{ "$schema": "http://json-schema.org/draft-04/schema#", "type": "object", "additionalProperties": false, "properties": { "version": { "description": "Current version of YML notation.", "type": [ "number", "string" ], "pattern": "^(\\d+)\\.(\\d+)\\.(\\d+)$" }, "profile": { "type": "string" }, "profile_version": { "description": "Current version of a dedicated profile", "type": [ "number", "string" ], "pattern": "^[A-Za-z0-9\\.\\-_]+$" }, "sowa_version": { "description": "The parameter value indicates the minimum distribution version for correct interaction with the application part.", "type": [ "number", "string" ], "pattern": "^[A-Za-z0-9\\.\\-]+$" }, "is_outgoing": { "description": "The parameter value indicates that requests are going TO untrusted network (default - false).", "type": "boolean" }, "system": { "type": "object", "additionalProperties": false, "properties": { "wrk_count": { "description": "Default 1 for container and openshift, auto - for others", "type": [ "number", "string" ], "pattern": "^(auto)|(\\d)+$" }, "conn_count": { "description": "Specifies needed connection count(not limit). Default 4096", "type": "integer" }, "worker_shutdown_timeout": { "description": "Specifies a time limit for NGINX’s attempts to gracefully let worker processes terminate. Once the timeout has expired, NGINX will actively try to close the connections necessary for the processes to terminate.", "type": [ "number", "string" ], "pattern": "^(([0-9]+(ms){0,1})|([0-9]+[smhdwMy]{1}))$" }, "optional": { "type": "object", "additionalProperties": false, "properties": { "http2_recv_buffer_size": { "description": "Specifies the size of the per worker input buffer", "type": [ "number", "string" ], "pattern": "^([0-9]+[kKmMG]{1})$" }, "wrk_user": { "type": "string" }, "default_type": { "type": "string" }, "log_level": { "type": "string", "enum": [ "debug", "info", "notice", "warn", "error", "crit", "alert", "off" ] }, "log_type": { "description": "Specifies logging mode for sowa-nginx. Default mode - file.", "type": "object", "additionalProperties": false, "properties": { "kafka": { "type": "array", "items": { "type": "object", "additionalProperties": false, "properties": { "group": { "description": "Specifies which group of logs will use current settings.", "type": "array", "items": { "type": [ "number", "string" ], "enum": [ "system", "error", "access" ] } }, "id": { "description": "Specifies client.id.", "type": [ "number", "string" ] }, "broker": { "description": "Initial list of brokers as a host:port separated by comma.", "type": [ "number", "string" ] }, "topic": { "description": "Specifies topic name.", "type": [ "number", "string" ], "pattern": "^\\S*$" }, "protocol": { "description": "Specifies connection protocol. Plaintext by default.", "type": [ "number", "string" ], "enum": [ "plaintext", "ssl" ] }, "certificate": { "description": "Specifies ssl.certificate.location", "type": [ "number", "string" ] }, "ca": { "description": "Specifies ssl.ca.location.", "type": [ "number", "string" ] }, "key": { "description": "Specifies ssl.key.location.", "type": [ "number", "string" ] }, "ciphers": { "description": "Specifies ssl.cipher.suites. Same as default ssl ciphers.", "type": [ "number", "string" ] }, "compression_codec": { "description": "Compression codec to use for compressing message sets.", "type": [ "number", "string" ], "enum": [ "none", "gzip", "snappy", "lz4", "zstd" ] }, "compression_level": { "description": "Compression level parameter for algorithm selected by configuration property compression.codec. Higher values will result in better compression at the cost of more CPU usage.", "type": "integer", "minimum": -1, "maximum": 12 }, "log_level": { "description": "Logging level (syslog(3) levels).", "type": [ "number", "string" ] }, "debug": { "description": "A comma-separated list of debug contexts to enable.", "type": [ "number", "string" ] }, "max_messages": { "description": "Maximum number of messages batched in one MessageSet.", "type": "integer", "minimum": 1, "maximum": 1000000 }, "pattern_file": { "description": "Template file with custom log structure.", "type": [ "number", "string" ] }, "escape": { "description": "Defines if you need to escape variables used in pattern file.", "type": "boolean" } }, "required": [ "broker", "topic" ], "allOf": [ { "if": { "type": "object", "required": [ "protocol" ], "properties": { "protocol": { "const": "ssl" } } }, "then": { "required": [ "certificate" ] } }, { "if": { "type": "object", "required": [ "protocol" ], "properties": { "protocol": { "const": "ssl" } } }, "then": { "required": [ "ca" ] } }, { "if": { "type": "object", "required": [ "protocol" ], "properties": { "protocol": { "const": "ssl" } } }, "then": { "required": [ "key" ] } }, { "if": { "type": "object", "required": [ "protocol" ], "properties": { "protocol": { "const": "ssl" } } }, "else": { "not": { "required": [ "ciphers" ] } } } ] } }, "syslog": { "type": "array", "items": { "type": "object", "additionalProperties": false, "properties": { "group": { "description": "Specifies which group of logs will use current settings.", "type": "array", "items": { "type": [ "number", "string" ], "enum": [ "system", "error", "access" ] } }, "log_host": { "description": "Specifies host for remote logging to syslog.", "type": [ "number", "string" ] }, "log_port": { "description": "Specifies port for remote logging to syslog. Default port - 514.", "type": [ "number", "string" ] } } } }, "file": { "type": "array", "items": { "type": "object", "additionalProperties": false, "properties": { "group": { "description": "Specifies which group of logs will use current settings.", "type": "array", "items": { "type": [ "number", "string" ], "enum": [ "system", "error", "access" ] } } } } }, "security": { "type": "object", "additionalProperties": false, "properties": { "enabled": { "description": "Enables logging security security events (XSD, JSON, WSDL and other validators). False by default.", "type": "boolean" }, "threads_count": { "description": "Specifies count of threads for thread pool, used for sending security events to syslog. Default is 16", "type": "integer" }, "hostname": { "description": "Specifies hostname to dispaly in syslog event. Default is current hostname.", "type": [ "number", "string" ] }, "appname": { "description": "Specifies application name to dispaly in syslog event. Default is \"sowa-security\".", "type": [ "number", "string" ] }, "facility": { "description": "Specifies facility for syslog event. Default is USER.", "type": [ "number", "string" ], "enum": [ "KERN", "USER", "MAIL", "DAEMON", "AUTH", "SYSLOG", "LPR", "NEWS", "UUCP", "CRON", "AUTHPRIV", "FTP", "NTP", "AUDIT", "ALERT", "CLOCK", "LOCAL0", "LOCAL1", "LOCAL2", "LOCAL3", "LOCAL4", "LOCAL5", "LOCAL6", "LOCAL7" ] }, "severity": { "description": "Specifies severity for syslog event. Default is INFORMATIONAL.", "type": [ "number", "string" ], "enum": [ "EMERGENCY", "ALERT", "CRITICAL", "ERROR", "WARNING", "NOTICE", "INFORMATIONAL", "DEBUG" ] }, "target_host": { "description": "Specifies host to send syslog event. Default is \"127.0.0.1\"", "type": [ "number", "string" ] }, "target_port": { "description": "Specifies port to send syslog event. Default is 514.", "type": "integer", "minimum": 0, "maximum": 65535 }, "protocol": { "description": "Specifies used protocol to send syslog event. Default is UDP.", "type": [ "number", "string" ], "enum": [ "UDP", "TCP" ] }, "msg_format": { "description": "Specifies message format to send syslog event. Default is RFC_3164", "type": [ "number", "string" ], "enum": [ "RFC_3164", "RFC_5424", "RFC_5425" ] } } } } }, "resolver": { "description": "dns resolver", "type": "object", "additionalProperties": false, "properties": { "host": { "description": "one or more IP or domain addresses of DNS servers (when specifying several addresses, the space character must be used as a delimiter)", "type": [ "number", "string" ] }, "valid": { "description": "parameter to the resolver directive, you can tell SOWA to ignore the TTL and re‑resolve names at a specified frequency instead.", "type": [ "number", "string" ], "pattern": "^([0-9]+[smhdwMy]{1})$" }, "resolver_timeout": { "description": "resolver_timeout sec", "type": [ "number", "string" ], "pattern": "^([0-9]+[smhdwMy]{1})$" } }, "required": [ "host", "valid" ] }, "pcre_jit": { "description": "Enable jit for pcre. Default on.", "type": "boolean" }, "log_format": { "description": "Specifies log format for access logging.", "type": "array", "items": { "type": "object", "additionalProperties": false, "properties": { "name": { "description": "Specifies format name.", "type": [ "number", "string" ] }, "format": { "description": "Specifies log format in nginx terms.", "type": [ "number", "string" ] }, "escape": { "type": [ "number", "string" ], "enum": [ "default", "json", "none" ] } } } }, "map_hash_bucket_size": { "description": "Specifies map_hash_bucket_size", "type": [ "number", "string" ], "pattern": "^([0-9]+)$" }, "map_hash_max_size": { "description": "Specifies map_hash_max_size", "type": [ "number", "string" ], "pattern": "^([0-9]+)$" }, "server_names_hash_max_size": { "description": "Specifies server_names_hash_max_size", "type": [ "number", "string" ], "pattern": "^([0-9]+)$" }, "server_names_hash_bucket_size": { "description": "Specifies server_names_hash_bucket_size", "type": [ "number", "string" ], "pattern": "^([0-9]+)$" }, "variables_hash_max_size": { "description": "Specifies variables_hash_max_size", "type": [ "number", "string" ], "pattern": "^([0-9]+)$" }, "variables_hash_bucket_size": { "description": "Specifies variables_hash_bucket_size", "type": [ "number", "string" ], "pattern": "^([0-9]+)$" }, "types_hash_bucket_size": { "description": "Specifies types_hash_bucket_size", "type": [ "number", "string" ], "pattern": "^([0-9]+)$" }, "types_hash_max_size": { "description": "Specifies types_hash_max_size", "type": [ "number", "string" ], "pattern": "^([0-9]+)$" }, "jvm_options": { "description": "Additional JVM options for specified profile. For example - '-XX:+HeapDumpOnOutOfMemoryError'", "type": "array", "items": { "type": [ "number", "string" ] } }, "jvm": { "description": "JVM options. The exact meaning and semantics of these values preserved, except the GCType(which is enum of GCollectors)", "type": "object", "additionalProperties": false, "properties": { "Xmx": { "type": "string", "pattern": "^([0-9]+[kKmMG]{1})$" }, "Xms": { "type": "string", "pattern": "^([0-9]+[kKmMG]{1})$" }, "MaxGCPauseMillis": { "type": "integer" }, "ParallelGCThreads": { "type": "integer" }, "ConcGCThreads": { "type": "integer" }, "InitiatingHeapOccupancyPercent": { "type": "integer" }, "GCType": { "description": "Garbage collector to use. Default is UseG1GC", "type": "string", "enum": [ "UseG1GC", "UseSerialGC", "UseParallelGC", "UseParNewGC" ] }, "UseStringDeduplication": { "type": "boolean" }, "UseCompressedStrings": { "type": "boolean" }, "OptimizeStringConcat": { "type": "boolean" }, "UseLWPSynchronization": { "type": "boolean" }, "AggressiveOpts": { "type": "boolean" }, "UseAES": { "type": "boolean" }, "UseAESIntrinsics": { "type": "boolean" } } }, "ip_blacklist": { "type": "object", "additionalProperties": false, "properties": { "enabled": { "description": "Enabling dynamic ip blacklist", "type": "boolean" }, "optional": { "type": "object", "additionalProperties": false, "properties": { "size": { "description": "Specify IP blacklist size, size is how many IP addresses could be stored in the blacklist. The default value is \"1024\".", "type": "integer" }, "timeout": { "description": "Specify IP blacklist entries timeout in seconds. Entries in the 'timeout' period is blocked. The default value is \"60\".", "type": "integer" }, "log": { "description": "Enable error log or not. The default value is \"off\".", "type": "string", "enum": [ "on", "off" ] }, "mode": { "description": "Specifies the blacklist mode. When \"local\" specified, blacklist will be stored inside nginx. Otherwise in the external system specified by \"syscmd\". The default value is \"local\".", "type": "string", "enum": [ "sys", "local" ] }, "syscmd": { "description": "When \"sys\" mode specified, you must specify external script, which will store ip address in external system (for e.g. Iptables)", "type": "string" } } } } }, "session_max_size": { "type": "integer" }, "session_cache": { "description": "specifies cache size for ssl session. The default value evaluates automatically.", "type": "object", "additionalProperties": false, "properties": { "type": { "type": "string", "enum": [ "off", "none", "builtin", "shared" ] }, "name": { "type": "string" }, "size": { "type": [ "number", "string" ], "pattern": "^([0-9]+[kKmM]{1})|([0-9]+)$" } }, "required": [ "type" ] }, "service_status": { "description": "This directive enables profile_status service. Default value is \"on\".", "type": "string", "enum": [ "on", "off" ] }, "underscores_in_headers": { "description": "If value is \"True\" then allow use headers with underscores. Otherwise this headers will be handled by \"ignore_invalid_headers\" directive. The default value is \"false\"", "type": "boolean" }, "ignore_invalid_headers": { "description": "Controls whether header fields with invalid names should be ignored. Default is \"True\".", "type": "boolean" }, "autostart": { "description": "If \"True\" profile will try to start on boot and in runtime automatically if not stopped properly. The default value is \"True\".", "type": "boolean" }, "strict_hostname_check": { "description": "If enabled, hostnames not from whitelist will be blocked.", "type": "boolean" }, "hostname_error_code": { "description": "Error code to return if service hostanme check is failed.", "type": "integer" }, "extended_status_zone": { "description": "Define shared memory zone using for extended stats gathering(chains, security, SimpleRateLimiter)", "type": "object", "additionalProperties": false, "properties": { "enabled": { "type": [ "number", "string" ], "enum": [ "on", "off" ] }, "space": { "description": "Defines the size of object storage. Default 10m", "type": [ "number", "string" ], "pattern": "^([0-9]+[kKmM]{1})$" }, "entries": { "description": "Defines the count of simultaneously stored objects. Default 32000", "type": "integer" } }, "required": [ "enabled" ] }, "shared_task_executors": { "type": "array", "items": { "type": "object", "additionalProperties": false, "properties": { "name": { "type": [ "number", "string" ] }, "executor_type": { "type": [ "number", "string" ], "enum": [ "FIXED", "FORKJOIN", "CACHED", "SCHEDULED", "SINGLE", "SINGLE_SCHEDULED" ] }, "params": { "type": "object", "additionalProperties": true, "properties": { "pool_size": { "type": "integer" }, "parallelism": { "type": "integer" } }, "allOf": [ { "if": { "type": "object", "required": [ "_type" ], "properties": { "_type": { "const": "SCHEDULED" } } }, "else": { "not": { "required": [ "pool_size" ] } } }, { "if": { "type": "object", "required": [ "_type" ], "properties": { "_type": { "const": "FIXED" } } }, "else": { "not": { "required": [ "pool_size" ] } } }, { "if": { "type": "object", "required": [ "_type" ], "properties": { "_type": { "const": "FORKJOIN" } } }, "else": { "not": { "required": [ "parallelism" ] } } } ] }, "shutdown_strategy": { "type": [ "number", "string" ], "enum": [ "IMMEDIATELY", "GRACEFULLY" ] }, "shutdown_timeout": { "type": [ "number", "string" ], "pattern": "^(([0-9]+(ms){0,1})|([0-9]+[smhdwMy]{1}))$" } }, "allOf": [ { "if": { "type": "object", "required": [ "shutdown_strategy" ], "properties": { "shutdown_strategy": { "const": "GRACEFULLY" } } }, "then": { "required": [ "shutdown_timeout" ] } } ] } }, "shared_ldap_connections": { "type": "array", "items": { "type": "object", "additionalProperties": false, "properties": { "name": { "type": [ "number", "string" ] }, "connection": {} } } }, "thread_pools": { "type": "array", "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "description": "Defines thread pool unique id.", "type": [ "number", "string" ] }, "threads_num": { "description": "Defines the number of threads in the pool.", "type": "integer" }, "max_queue": { "description": "Limits the number of tasks allowed to be waiting in the queue. By default, up to 65536 tasks can wait in the queue.", "type": "integer" } }, "required": [ "id", "threads_num" ] } }, "async_io": { "type": "object", "additionalProperties": false, "properties": { "directio_threshold": { "description": "Enables the use of the O_DIRECT flag (FreeBSD, Linux), the F_NOCACHE flag (macOS), or the directio() function (Solaris), when reading files that are larger than or equal to the specified size.", "type": [ "number", "string" ], "pattern": "^([0-9]+[kKmM]{1})|([0-9]+)$" }, "thread_pool_id": { "description": "Defines thread pool to use by id. If the thread_pool_id is omitted, the pool with the name default is used.", "type": [ "number", "string" ] }, "write": { "description": "Specifies whether async_io is used for writing files.", "type": "boolean" } }, "required": [ "directio_threshold" ] }, "maps": { "type": "array", "items": { "description": "Creates a new variable 'dst_var' whose value depends on values of one or more of the source variables specified in the 'src_var'.", "type": "object", "additionalProperties": false, "properties": { "src_var": { "description": "Specifies a string with one or more of source variables, e.g. \"$var1:$var2\"", "type": [ "number", "string" ] }, "dst_var": { "description": "Specifies a variable to store result value.", "type": [ "number", "string" ] }, "mapping": { "type": "array", "items": { "type": "object", "additionalProperties": false, "properties": { "src_val": { "type": [ "number", "string" ] }, "dst_val": { "type": [ "number", "string" ] } }, "required": [ "src_val", "dst_val" ] } }, "default": { "description": "Specifies a default value of the 'res_var'. If not specified then it is empty string.", "type": [ "number", "string" ] }, "volatile": { "description": "Indicates that the variable is not cacheable.", "type": "boolean" }, "hostnames": { "description": "Indicates that source values can be hostnames with a prefix or suffix mask.", "type": "boolean" } }, "required": [ "src_var", "dst_var", "mapping" ] } }, "serve_static_file": { "type": "array", "items": { "description": "relative path from custom resources directory", "type": [ "number", "string" ] } }, "proxy_temp_tree": { "description": "Specifies proxy tmp directory structure. Not actual when use http_version - 2.0", "type": [ "number", "string" ], "pattern": "^(\\d*( \\d*){0,1}( \\d*){0,1})$" }, "body_temp_tree": { "description": "Specifies body tmp directory structure", "type": [ "number", "string" ], "pattern": "^(\\d*( \\d*){0,1}( \\d*){0,1})$" }, "storages": { "type": "array", "items": { "type": "object", "additionalProperties": false, "properties": { "name": { "description": "Defines the name of storage.", "type": "string" }, "space": { "description": "Defines the size of object storage. Default 10m", "type": [ "number", "string" ], "pattern": "^([0-9]+[kKmM]{1})$" }, "entries": { "description": "Defines the count of simultaneously stored objects. Default 8096", "type": "integer" }, "remove_time": { "description": "Defines the time of storing objects. Default dont remove at all", "type": [ "number", "string" ], "pattern": "^([0-9]+[mMsS]{1})$" } }, "required": [ "name" ] } }, "init_handlers": { "description": "Specifies a list of init handlers.", "type": "array", "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "description": "Specifies id for init handler", "type": [ "number", "string" ] }, "name": { "description": "Specifies a handler", "type": [ "number", "string" ], "enum": [ "HealthCheck", "LdapSearch" ] }, "instances": { "description": "Specifies count of handler instances. Single - one handler per profile. Auto - count of nginx workers. Default - single", "type": [ "number", "string" ], "enum": [ "single", "auto" ] }, "params": { "description": "Specifies extra parameters for the actions.", "type": "object", "additionalProperties": true } }, "required": [ "id", "name", "params" ] } }, "transformations_debug": { "description": "Enables transformation debug logs. False by default.", "type": "boolean" }, "get_load": { "type": "object", "additionalProperties": false, "properties": { "enabled": { "description": "Enables or disables putting server load statistics to variables ($stat_cpu_usage, $stat_memory_usage).", "type": "boolean" }, "interval": { "description": "Stats loading interval in seconds.", "type": "integer" } } }, "vault": { "type": "object", "additionalProperties": false, "properties": { "enabled": { "type": "boolean" }, "runtime_update": { "description": "Update secrets received from vault during runtime operations.", "type": "boolean" }, "auto_update": { "description": "Update secrets in background.", "type": "boolean" }, "auto_update_expire_delta": { "description": "Expire delta for auto update in seconds. 2678400 by default.", "type": "integer" }, "auto_update_type": { "type": [ "number", "string" ], "enum": [ "expire", "always" ] }, "url": { "type": [ "number", "string" ] }, "ssl": { "type": "object", "additionalProperties": false, "properties": { "enabled": { "description": "Enables ssl connection to vault with client certificates. Enabled by default.", "type": "boolean" }, "certificate": { "type": [ "number", "string" ] }, "certificate_key": { "type": [ "number", "string" ] }, "ca": { "type": [ "number", "string" ] } }, "allOf": [ { "if": { "type": "object", "required": [ "certificate_key" ], "properties": { "certificate_key": { "pattern": ".+" } } }, "then": { "required": [ "certificate" ] } }, { "if": { "type": "object", "required": [ "certificate" ], "properties": { "certificate": { "pattern": ".+" } } }, "then": { "required": [ "certificate_key" ] } }, { "if": { "type": "object", "required": [ "enabled" ], "properties": { "enabled": { "const": false } } }, "then": { "required": [] }, "else": { "required": [ "ca" ] } } ] }, "storages": { "type": "array", "items": { "type": "object", "additionalProperties": false, "properties": { "url": { "type": [ "number", "string" ] }, "ssl": { "type": "object", "additionalProperties": false, "properties": { "enabled": { "description": "Enables ssl connection to vault with client certificates. Enabled by default.", "type": "boolean" }, "certificate": { "type": [ "number", "string" ] }, "certificate_key": { "type": [ "number", "string" ] }, "ca": { "type": [ "number", "string" ] } }, "allOf": [ { "if": { "type": "object", "required": [ "certificate_key" ], "properties": { "certificate_key": { "pattern": ".+" } } }, "then": { "required": [ "certificate" ] } }, { "if": { "type": "object", "required": [ "certificate" ], "properties": { "certificate": { "pattern": ".+" } } }, "then": { "required": [ "certificate_key" ] } }, { "if": { "type": "object", "required": [ "enabled" ], "properties": { "enabled": { "const": false } } }, "then": { "required": [] }, "else": { "required": [ "ca" ] } } ] }, "path": { "description": "Specifies storage name to lookup secrets (\"/DEV/SOWA/CF/KV/\" for example).", "type": [ "number", "string" ] }, "approle_role_id_file": { "description": "Specifies path to file with approle role id", "type": [ "number", "string" ] }, "approle_wrapped_token_file": { "description": "Specifies path to file with wrapped token which contains secret id", "type": [ "number", "string" ] }, "approle_wrapped_token_field": { "description": "Specifies which field to use while unwrapping secret. \"secret_id\" by default.", "type": [ "number", "string" ] }, "approle_namespace": { "description": "Specifies approle namespace", "type": [ "number", "string" ] }, "secrets": { "type": "array", "items": { "type": "object", "additionalProperties": false, "properties": { "type": { "description": "Secret type, KV-secrets as default if not specified.", "type": [ "number", "string" ], "enum": [ "sberca", "kv" ] }, "base64_decode": { "description": "Decode secret form base64. False by default.", "type": "boolean" }, "name": { "type": [ "number", "string" ] }, "alias": { "type": [ "number", "string" ] }, "key": { "type": [ "number", "string" ] }, "certificate_alias": { "type": [ "number", "string" ] }, "key_alias": { "type": [ "number", "string" ] }, "ca_alias": { "type": [ "number", "string" ] }, "format": { "type": [ "number", "string" ], "enum": [ "pem", "pem_bundle", "jks" ] }, "email": { "type": [ "number", "string" ] }, "common_name": { "type": [ "number", "string" ] }, "alt_names": { "type": [ "number", "string" ] }, "other_sans": { "type": "array", "items": { "type": [ "number", "string" ] } }, "ip_sans": { "type": "array", "items": { "type": [ "number", "string" ] } }, "uri_sans": { "type": "array", "items": { "type": [ "number", "string" ] } }, "exclude_cn_from_sans": { "type": "boolean" } }, "required": [ "name" ], "allOf": [ { "if": { "type": "object", "required": [ "type" ], "properties": { "type": { "const": "kv" } } }, "then": { "required": [ "alias" ] } }, { "if": { "type": "object", "required": [ "type" ], "properties": { "type": {} } }, "else": { "required": [ "alias" ] } }, { "if": { "type": "object", "required": [ "type" ], "properties": { "type": { "const": "kv" } } }, "then": { "required": [ "key" ] } }, { "if": { "type": "object", "required": [ "type" ], "properties": { "type": {} } }, "else": { "required": [ "key" ] } }, { "if": { "type": "object", "required": [ "type" ], "properties": { "type": { "const": "sberca" } } }, "then": { "required": [ "certificate_alias" ] } }, { "if": { "type": "object", "required": [ "type" ], "properties": { "type": { "const": "sberca" } } }, "then": { "required": [ "common_name" ] } }, { "if": { "type": "object", "required": [ "type" ], "properties": { "type": { "const": "sberca" } } }, "else": { "not": { "required": [ "format" ] } } }, { "if": { "type": "object", "required": [ "type" ], "properties": { "type": { "const": "sberca" } } }, "else": { "not": { "required": [ "email" ] } } }, { "if": { "type": "object", "required": [ "type" ], "properties": { "type": { "const": "sberca" } } }, "else": { "not": { "required": [ "alt_names" ] } } }, { "if": { "type": "object", "required": [ "type" ], "properties": { "type": { "const": "sberca" } } }, "else": { "not": { "required": [ "other_sans" ] } } }, { "if": { "type": "object", "required": [ "type" ], "properties": { "type": { "const": "sberca" } } }, "else": { "not": { "required": [ "ip_sans" ] } } }, { "if": { "type": "object", "required": [ "type" ], "properties": { "type": { "const": "sberca" } } }, "else": { "not": { "required": [ "uri_sans" ] } } }, { "if": { "type": "object", "required": [ "type" ], "properties": { "type": { "const": "sberca" } } }, "else": { "not": { "required": [ "exclude_cn_from_sans" ] } } } ] } } }, "required": [ "path", "secrets" ], "allOf": [ { "if": { "type": "object", "required": [ "approle_role_id_file" ], "properties": { "approle_role_id_file": { "pattern": ".+" } } }, "then": { "required": [ "approle_role_id_file" ] } }, { "if": { "type": "object", "required": [ "approle_role_id_file" ], "properties": { "approle_role_id_file": { "pattern": ".+" } } }, "then": { "required": [ "approle_wrapped_token_file" ] } }, { "if": { "type": "object", "required": [ "approle_role_id_file" ], "properties": { "approle_role_id_file": { "pattern": ".+" } } }, "then": { "required": [ "approle_namespace" ] } }, { "if": { "type": "object", "required": [ "approle_wrapped_token_file" ], "properties": { "approle_wrapped_token_file": { "pattern": ".+" } } }, "else": { "not": { "required": [ "approle_wrapped_token_field" ] } } } ] } } }, "required": [ "storages" ] }, "healthcheck_dynamic": { "type": "object", "additionalProperties": false, "properties": { "initial_state_param_file": { "type": [ "number", "string" ], "pattern": "^(?!\\/)(?!\\.\\.\\/)(?:(?!\\/\\.\\.\\/).)+?(? Set mode for decode state for upstreams with passive health-check. When exclude, listen ports binded to service which has an upstream group with passive HC, will be exluded from automatic stop/start listening. When ignore, state of upstream group with passive hc always up When inlude, state of upstream group with passive hc always calculated and used. By default - exclude", "type": [ "number", "string" ], "enum": [ "exclude", "ignore", "include" ] }, "not_binded_mode": { "type": "array", "uniqueItems": true, "items": { "description": "Additionaly close up listening ports on service which not binded to upstream groups - status - profile status service, \"non_upstream\", services which not has http upstream groups", "type": [ "number", "string" ], "enum": [ "status", "non_upstream" ] } }, "custom_binds": { "description": "Allow to manual specify ports - upstream groups for autoclose listen. Used, when service binded to some port not have upstream group (e.g. service_http_kafka_proxy)", "type": "array", "items": { "type": "object", "additionalProperties": false, "properties": { "port": { "description": "Port for autoclose", "type": "integer", "minimum": 0, "maximum": 65535 }, "service_id": { "description": "id of service which upstream group will be used", "type": [ "number", "string" ] }, "service_type": { "description": "type of service which upstream group will be used", "type": [ "number", "string" ], "enum": [ "service_main_proxy", "service_http_proxy", "service_web_socket_proxy" ] }, "upstream_id": { "description": "id of upstream group", "type": [ "number", "string" ] } } } }, "skip_ports": { "description": "Ports defined in this section will not be closed ever by autoclose listen mechanism", "type": "array", "items": { "type": "integer", "minimum": 0, "maximum": 65535 } } }, "required": [ "check_type" ], "allOf": [ { "if": { "type": "object", "required": [ "check_type" ], "properties": { "check_type": { "const": "no_live_upstream" } } }, "else": { "not": { "required": [ "drain_is_up" ] } } }, { "if": { "type": "object", "required": [ "check_type" ], "properties": { "check_type": { "const": "no_live_upstream" } } }, "else": { "not": { "required": [ "passive_hc_mode" ] } } }, { "if": { "type": "object", "required": [ "check_type" ], "properties": { "check_type": { "const": "no_live_upstream" } } }, "else": { "not": { "required": [ "not_binded_mode" ] } } }, { "if": { "type": "object", "required": [ "check_type" ], "properties": { "check_type": { "const": "no_live_upstream" } } }, "else": { "not": { "required": [ "custom_binds" ] } } } ] } } }, "required": [ "condition" ] }, "opentelemetry": { "description": "Common parameters of opentelemetry tracing", "type": "object", "additionalProperties": false, "properties": { "exporter": { "description": "Define connection param to OTLP/GRPC agent", "type": "object", "additionalProperties": false, "properties": { "endpoint": { "description": "the address of OTLP/gRPC endpoint that will accept telemetry data.", "type": [ "number", "string" ] }, "interval": { "description": "the maximum interval between two exports, by default is 5 seconds.", "type": [ "number", "string" ], "pattern": "^(([0-9]+(ms){0,1})|([0-9]+[smhdwMy]{1}))$" }, "batch_size": { "description": "the maximum number of spans to be sent in one batch per worker, by default is 512", "type": "integer" }, "batch_count": { "description": "the number of pending batches per worker, spans exceeding the limit are dropped, by default is 4", "type": "integer" } }, "required": [ "endpoint" ] }, "service_name": { "description": "Sets the “service.name” attribute of the OTel resource, by default profile_name.sowa", "type": [ "number", "string" ] }, "chains_tracing": { "type": "object", "additionalProperties": false, "properties": { "enabled": { "description": "Allow tracing in chains", "type": "boolean" }, "disableAllChainsByDefault": { "description": "Disable all chains tracing by default. In flag set to true", "type": "boolean" } } }, "tracing": { "description": "Defines parameters of Opentelemetry Tracing", "type": "object", "additionalProperties": false, "properties": { "mode": { "description": "Enable or disable tracing at this level", "type": "object", "additionalProperties": false, "properties": { "enabled": { "description": "When on - tracing enabled, off - tracing disabled, var_based - if var specified in \"var\" parameter return \"on\", then enabled, else disabled", "type": [ "number", "string" ], "enum": [ "on", "off", "var_based" ] }, "var": { "description": "name of var which will be used, when enabled == var_based. Must return \"on\" or \"off\".", "type": [ "number", "string" ] } }, "allOf": [ { "if": { "type": "object", "required": [ "enabled" ], "properties": { "enabled": { "const": "var_based" } } }, "then": { "required": [ "var" ] } } ] }, "trace_context": { "description": "Specifies how to propagate traceparent/tracestate headers. Default - ignore", "type": [ "number", "string" ], "enum": [ "extract", "inject", "propagate", "ignore" ] }, "span_name": { "description": "Defines the name of span. By default - name of location, can be contain variables", "type": [ "number", "string" ] }, "span_attr": { "type": "array", "items": { "type": "object", "additionalProperties": false, "properties": { "name": { "description": "name of attribute", "type": [ "number", "string" ] }, "value": { "description": "value of attribute, can contain variables", "type": [ "number", "string" ] } } } } } } }, "required": [ "exporter" ], "allOf": [ { "if": { "type": "object", "required": [ "" ], "properties": { "": { "properties": { "system": { "type": "object", "required": [ "system" ], "properties": { "system": {}, "optional": { "type": "object", "required": [ "opentelemetry" ], "properties": { "opentelemetry": { "pattern": ".+" } } } } } } } } }, "else": { "not": { "required": [ "tracing" ] } } } ] }, "client_body_buffer_size": { "description": "Sets buffer size for reading client request body. Default By default, buffer size is equal to two memory pages. For x86 it is usually 8K.", "type": [ "number", "string" ], "pattern": "^([0-9]+[kKmM]{1})|([0-9]+)$" }, "client_body_in_file_only": { "description": "Determines whether nginx should save the entire client request body into a file. By default is off.", "type": "string", "enum": [ "on", "off", "clean" ] }, "client_body_in_single_buffer": { "description": "Determines whether nginx should save the entire client request body in a single buffer. By default is off.", "type": "string", "enum": [ "on", "off" ] }, "client_header_buffer_size": { "description": "Sets buffer size for reading client request header. By default is 1k.", "type": [ "number", "string" ], "pattern": "^([0-9]+[kKmM]{1})|([0-9]+)$" }, "large_client_header_buffers": { "description": "Sets the maximum number and size of buffers used for reading large client request header. By default the number is 4, the size is 4k.", "type": "object", "additionalProperties": false, "properties": { "number": { "type": "integer" }, "size": { "type": [ "number", "string" ], "pattern": "^([0-9]+[kKmM]{1})|([0-9]+)$" } }, "required": [ "number", "size" ] }, "output_buffers": { "description": "Sets the number and size of the buffers used for reading a response from a disk. By default the number is 2, the size is 32k.", "type": "object", "additionalProperties": false, "properties": { "number": { "type": "integer" }, "size": { "type": [ "number", "string" ], "pattern": "^([0-9]+[kKmM]{1})|([0-9]+)$" } }, "required": [ "number", "size" ] }, "subrequest_output_buffer_size": { "description": "Sets the size of the buffer used for storing the response body of a subrequest. By default, the buffer size is equal to one memory page.", "type": [ "number", "string" ], "pattern": "^([0-9]+[kKmM]{1})|([0-9]+)$" }, "proxy_buffer_size": { "description": "Sets the size of the buffer used for reading the first part of the response received from the proxied server. By default, the buffer size is equal to one memory page.", "type": [ "number", "string" ], "pattern": "^([0-9]+[kKmM]{1})|([0-9]+)$" }, "proxy_buffering": { "description": "Enables or disables buffering of responses from the proxied server. By default is on.", "type": "string", "enum": [ "on", "off" ] }, "proxy_buffers": { "description": "Sets the number and size of the buffers used for reading a response from the proxied server, for a single connection. By default the number is 8, the size is equal to one memory page.", "type": "object", "additionalProperties": false, "properties": { "number": { "type": "integer" }, "size": { "type": [ "number", "string" ], "pattern": "^([0-9]+[kKmM]{1})|([0-9]+)$" } }, "required": [ "number", "size" ] }, "proxy_busy_buffers_size": { "description": "When buffering of responses from the proxied server is enabled, limits the total size of buffers that can be busy sending a response to the client while the response is not yet fully read. By default, size is limited by the size of two buffers set by the proxy_buffer_size and proxy_buffers directives.", "type": [ "number", "string" ], "pattern": "^([0-9]+[kKmM]{1})|([0-9]+)$" }, "proxy_request_buffering": { "description": "Enables or disables buffering of a client request body. By default is on.", "type": "string", "enum": [ "on", "off" ] }, "proxy_max_temp_file_size": { "description": "When buffering of responses from the proxied server is enabled, and the whole response does not fit into the buffers set by the proxy_buffer_size and proxy_buffers directives, a part of the response can be saved to a temporary file. This directive sets the maximum size of the temporary file. The size of data written to the temporary file at a time is set by the proxy_temp_file_write_size directive. The zero value disables buffering of responses to temporary files.", "type": [ "number", "string" ], "pattern": "^([0-9]+[kKmM]{1})|([0-9]+)$" }, "proxy_temp_file_write_size": { "description": "Limits the size of data written to a temporary file at a time, when buffering of responses from the proxied server to temporary files is enabled. By default, size is limited by two buffers set by the proxy_buffer_size and proxy_buffers directives. The maximum size of a temporary file is set by the proxy_max_temp_file_size directive.", "type": [ "number", "string" ], "pattern": "^([0-9]+[kKmM]{1})|([0-9]+)$" }, "proxy_max_downstream_presend_inmemory_size": { "description": "When used body filters such Modsecurity or Response size body filter, we always read all upstream data before sending client. Setting this parameter adjust maximum data in memory size, if 0 specified limit is not setted", "type": [ "number", "string" ], "pattern": "^([0-9]+[kKmM]{1})|([0-9]+)$" }, "worker_clean_cache_on_fail": { "description": "Whether to clean worker chache file on failure exit. Default is true (clean).", "type": "boolean" }, "worker_cpu_affinity": { "description": "Binds worker processes to the sets of CPUs. Each CPU set is represented by a bitmask of allowed CPUs. There should be a separate set defined for each of the worker processes. By default, worker processes are not bound to any specific CPUs. Default auto", "type": [ "number", "string" ], "pattern": "^(auto(?:\\s+[01]+)*|[01]+(?:\\s+[01]+)*)$" }, "allocator_type": { "description": "Choice SOWA allocator", "type": "string", "enum": [ "std", "mimalloc", "jemalloc" ] }, "allocator_env": { "description": "Environment setting for allocator", "type": "array", "items": { "type": [ "number", "string" ], "pattern": "^(MALLOC_CONF|MIMALLOC_\\w*)=[\"']?[^\"';\\s]+[\"']?$" } } }, "allOf": [ { "if": { "type": "object", "required": [ "jvm" ], "properties": { "jvm": {} } }, "then": { "not": { "required": [ "jvm_options" ] } } }, { "if": { "type": "object", "required": [ "jvm_options" ], "properties": { "jvm_options": {} } }, "then": { "not": { "required": [ "jvm" ] } } }, { "if": { "type": "object", "required": [ "strict_hostname_check" ], "properties": { "strict_hostname_check": { "pattern": ".+" } } }, "else": { "not": { "required": [ "hostname_error_code" ] } } }, { "if": { "type": "object", "required": [ ".." ], "properties": { "..": { "type": "object", "required": [ "listen" ], "properties": { "listen": { "pattern": ".+" } } } } }, "else": { "not": { "required": [ "healthcheck_dynamic" ] } } }, { "if": { "type": "object", "required": [ "http_version" ], "properties": { "http_version": {} } }, "then": { "not": { "required": [ "proxy_buffering" ] } } }, { "if": { "type": "object", "required": [ "http_version" ], "properties": { "http_version": {} } }, "then": { "not": { "required": [ "proxy_buffers" ] } } }, { "if": { "type": "object", "required": [ "http_version" ], "properties": { "http_version": {} } }, "then": { "not": { "required": [ "proxy_busy_buffers_size" ] } } }, { "if": { "type": "object", "required": [ "http_version" ], "properties": { "http_version": {} } }, "then": { "not": { "required": [ "proxy_request_buffering" ] } } }, { "if": { "type": "object", "required": [ "http_version" ], "properties": { "http_version": {} } }, "then": { "not": { "required": [ "proxy_max_temp_file_size" ] } } }, { "if": { "type": "object", "required": [ "http_version" ], "properties": { "http_version": {} } }, "then": { "not": { "required": [ "proxy_temp_file_write_size" ] } } }, { "if": { "type": "object", "required": [ "http_version" ], "properties": { "http_version": {} } }, "then": { "not": { "required": [ "proxy_max_downstream_presend_inmemory_size" ] } } }, { "if": { "type": "object", "required": [ "_type" ], "properties": { "_type": { "pattern": ".+" } } }, "else": { "not": { "required": [ "allocator_env" ] } } } ] } } }, "service": { "type": "object", "additionalProperties": false, "properties": { "service_http_proxy": { "type": "array", "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "description": "Specifies the unique id for the service.", "type": [ "number", "string" ], "pattern": "^[^.\\/\\\\()]+$" }, "name": { "description": "Human readable Service identifier printed in log messages", "type": [ "number", "string" ] }, "profile_version": { "description": "Specifies profile version of this service", "type": [ "number", "string" ] }, "description": { "type": [ "number", "string" ] }, "listen": { "type": "array", "items": { "type": "object", "additionalProperties": false, "properties": { "address": { "description": "specifies ip/hostname on which the socket will listen.", "type": [ "number", "string" ] }, "port": { "description": "specifies port on which the socket will listen", "type": "integer", "minimum": 0, "maximum": 65535 }, "allow_http2": { "description": "Allow to accept http2 connection. Default - false", "type": "boolean" }, "proxy_protocol": { "description": "Accept proxy protocol. Http requests will not be handler with this flag. Default - false", "type": "boolean" }, "http2_only": { "description": "Allow to pass only http2 protocol connection. Default - off", "type": "string", "enum": [ "on", "off" ] }, "ssl": { "type": "object", "additionalProperties": false, "properties": { "sspi": { "description": "Enables GOST TLS mode. Default id false.", "type": "boolean" }, "client_verify_local_crl_only": { "description": "GOST mode. Specifies whether to check the certificate status locally (otherwise check online). Default is \"off\" (online check).", "type": "string", "enum": [ "on", "off" ] }, "buffer_size": { "description": "GOST mode. Specifies payload length in TLS record (min 1024, max 16384). Default is 16384 bytes.", "type": [ "number", "string" ], "pattern": "^([0-9]+[kK]{1})|([0-9]+)$" }, "certificate": { "description": "specifies name of the certificate wich will be used. Certificate must be placed in \"resource\" directory.", "type": [ "number", "string" ], "pattern": "^(?!\\/)(?!\\.\\.\\/)(?:(?!\\/\\.\\.\\/).)+?(?,