Browse Source

Passage en version 1.10.6

dist/ubuntu/bionic/staging pkg/staging/ubuntu-bionic/1.10.6-1
wpetit 1 month ago
parent
commit
715f0019eb
4 changed files with 910 additions and 448 deletions
  1. +897
    -437
      conf/hydra.yml
  2. +1
    -1
      debian/control
  3. +1
    -1
      debian/rules
  4. +11
    -9
      script/install.sh

+ 897
- 437
conf/hydra.yml View File

@ -1,100 +1,34 @@
## ORY Hydra Configuration
#
## log ##
#
# Configures the logger
#
log:
## level ##
#
# Sets the log level.
#
# Default value: info
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export LOG_LEVEL=<value>
# - Windows Command Line (CMD):
# > set LOG_LEVEL=<value>
#
level: info
## format ##
#
# Sets the log format.
#
# Default value: text
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export LOG_FORMAT=<value>
# - Windows Command Line (CMD):
# > set LOG_FORMAT=<value>
#
format: text
## serve ##
#
# Controls the configuration for the http(s) daemon(s).
#
serve:
## public ##
#
# Controls the public daemon serving public API endpoints like /oauth2/auth, /oauth2/token, /.well-known/jwks.json
## admin ##
#
public:
## port ##
#
# Default value: 4444
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_PUBLIC_PORT=<value>
# - Windows Command Line (CMD):
# > set SERVE_PUBLIC_PORT=<value>
#
port: 4444
admin:
## host ##
#
# The interface or unix socket ORY Hydra should listen and handle public API requests on. Use the prefix "unix:" to specify a path to a unix socket. Leave empty to listen on all interfaces.
# The interface or unix socket ORY Hydra should listen and handle administrative API requests on. Use the prefix "unix:" to specify a path to a unix socket. Leave empty to listen on all interfaces.
#
# Examples:
# - localhost
#
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_PUBLIC_HOST=<value>
# $ export SERVE_ADMIN_HOST=<value>
# - Windows Command Line (CMD):
# > set SERVE_PUBLIC_HOST=<value>
# > set SERVE_ADMIN_HOST=<value>
#
host: ""
host: localhost
## cors ##
#
# Configures Cross Origin Resource Sharing for public endpoints.
#
cors:
## enabled ##
#
# Sets whether CORS is enabled.
#
# Default value: false
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_PUBLIC_CORS_ENABLED=<value>
# - Windows Command Line (CMD):
# > set SERVE_PUBLIC_CORS_ENABLED=<value>
#
enabled: false
## allowed_origins ##
#
# A list of origins a cross-domain request can be executed from. If the special * value is present in the list, all origins will be allowed. An origin may contain a wildcard (*) to replace 0 or more characters (i.e.: http://*.domain.com). Only one wildcard can be used per origin.
@ -105,15 +39,17 @@ serve:
# - - https://example.com
# - https://*.example.com
# - https://*.foo.example.com
#
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_PUBLIC_CORS_ALLOWED_ORIGINS=<value>
# $ export SERVE_ADMIN_CORS_ALLOWED_ORIGINS=<value>
# - Windows Command Line (CMD):
# > set SERVE_PUBLIC_CORS_ALLOWED_ORIGINS=<value>
# > set SERVE_ADMIN_CORS_ALLOWED_ORIGINS=<value>
#
allowed_origins:
- "*"
- https://example.com
- https://*.example.com
- https://*.foo.example.com
## allowed_methods ##
#
@ -123,16 +59,12 @@ serve:
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_PUBLIC_CORS_ALLOWED_METHODS=<value>
# $ export SERVE_ADMIN_CORS_ALLOWED_METHODS=<value>
# - Windows Command Line (CMD):
# > set SERVE_PUBLIC_CORS_ALLOWED_METHODS=<value>
# > set SERVE_ADMIN_CORS_ALLOWED_METHODS=<value>
#
allowed_methods:
- TRACE
- GET
- HEAD
- GET
- HEAD
- POST
## allowed_headers ##
#
@ -142,14 +74,12 @@ serve:
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_PUBLIC_CORS_ALLOWED_HEADERS=<value>
# $ export SERVE_ADMIN_CORS_ALLOWED_HEADERS=<value>
# - Windows Command Line (CMD):
# > set SERVE_PUBLIC_CORS_ALLOWED_HEADERS=<value>
# > set SERVE_ADMIN_CORS_ALLOWED_HEADERS=<value>
#
allowed_headers:
- ea
- exercitation consectetur
- exercitation
- ''
## exposed_headers ##
#
@ -159,12 +89,12 @@ serve:
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_PUBLIC_CORS_EXPOSED_HEADERS=<value>
# $ export SERVE_ADMIN_CORS_EXPOSED_HEADERS=<value>
# - Windows Command Line (CMD):
# > set SERVE_PUBLIC_CORS_EXPOSED_HEADERS=<value>
# > set SERVE_ADMIN_CORS_EXPOSED_HEADERS=<value>
#
exposed_headers:
- Excepteur adipisicing
- ''
## allow_credentials ##
#
@ -174,9 +104,9 @@ serve:
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_PUBLIC_CORS_ALLOW_CREDENTIALS=<value>
# $ export SERVE_ADMIN_CORS_ALLOW_CREDENTIALS=<value>
# - Windows Command Line (CMD):
# > set SERVE_PUBLIC_CORS_ALLOW_CREDENTIALS=<value>
# > set SERVE_ADMIN_CORS_ALLOW_CREDENTIALS=<value>
#
allow_credentials: false
@ -188,9 +118,9 @@ serve:
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_PUBLIC_CORS_OPTIONS_PASSTHROUGH=<value>
# $ export SERVE_ADMIN_CORS_OPTIONS_PASSTHROUGH=<value>
# - Windows Command Line (CMD):
# > set SERVE_PUBLIC_CORS_OPTIONS_PASSTHROUGH=<value>
# > set SERVE_ADMIN_CORS_OPTIONS_PASSTHROUGH=<value>
#
options_passthrough: false
@ -198,13 +128,15 @@ serve:
#
# Sets how long (in seconds) the results of a preflight request can be cached. If set to 0, every request is preceded by a preflight request.
#
# Minimum value: 0
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_PUBLIC_CORS_MAX_AGE=<value>
# $ export SERVE_ADMIN_CORS_MAX_AGE=<value>
# - Windows Command Line (CMD):
# > set SERVE_PUBLIC_CORS_MAX_AGE=<value>
# > set SERVE_ADMIN_CORS_MAX_AGE=<value>
#
max_age: 77402945
max_age: 0
## debug ##
#
@ -214,18 +146,78 @@ serve:
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_PUBLIC_CORS_DEBUG=<value>
# $ export SERVE_ADMIN_CORS_DEBUG=<value>
# - Windows Command Line (CMD):
# > set SERVE_PUBLIC_CORS_DEBUG=<value>
# > set SERVE_ADMIN_CORS_DEBUG=<value>
#
debug: false
## enabled ##
#
# Sets whether CORS is enabled.
#
# Default value: false
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_ADMIN_CORS_ENABLED=<value>
# - Windows Command Line (CMD):
# > set SERVE_ADMIN_CORS_ENABLED=<value>
#
enabled: false
## socket ##
#
# Sets the permissions of the unix socket
#
socket:
## group ##
#
# Group of unix socket. If empty, the group will be the primary group of the user running hydra.
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_ADMIN_SOCKET_GROUP=<value>
# - Windows Command Line (CMD):
# > set SERVE_ADMIN_SOCKET_GROUP=<value>
#
group: ''
## mode ##
#
# Mode of unix socket in numeric form
#
# Default value: 493
#
# Minimum value: 0
#
# Maximum value: 511
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_ADMIN_SOCKET_MODE=<value>
# - Windows Command Line (CMD):
# > set SERVE_ADMIN_SOCKET_MODE=<value>
#
mode: 0
## owner ##
#
# Owner of unix socket. If empty, the owner will be the user running hydra.
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_ADMIN_SOCKET_OWNER=<value>
# - Windows Command Line (CMD):
# > set SERVE_ADMIN_SOCKET_OWNER=<value>
#
owner: ''
## access_log ##
#
# Access Log configuration for public server.
# Access Log configuration for admin server.
#
access_log:
## disable_for_health ##
#
# Disable access log for health endpoints.
@ -234,16 +226,62 @@ serve:
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_PUBLIC_ACCESS_LOG_DISABLE_FOR_HEALTH=<value>
# $ export SERVE_ADMIN_ACCESS_LOG_DISABLE_FOR_HEALTH=<value>
# - Windows Command Line (CMD):
# > set SERVE_PUBLIC_ACCESS_LOG_DISABLE_FOR_HEALTH=<value>
# > set SERVE_ADMIN_ACCESS_LOG_DISABLE_FOR_HEALTH=<value>
#
disable_for_health: true
disable_for_health: false
## tls ##
#
tls:
## cert ##
#
cert:
## path ##
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_ADMIN_TLS_CERT_PATH=<value>
# - Windows Command Line (CMD):
# > set SERVE_ADMIN_TLS_CERT_PATH=<value>
#
path: /etc/ssl/certs/ssl-cert-snakeoil.pem
## allow_termination_from ##
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_ADMIN_TLS_ALLOW_TERMINATION_FROM=<value>
# - Windows Command Line (CMD):
# > set SERVE_ADMIN_TLS_ALLOW_TERMINATION_FROM=<value>
#
allow_termination_from:
- 127.0.0.1/32
## enabled ##
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_ADMIN_TLS_ENABLED=<value>
# - Windows Command Line (CMD):
# > set SERVE_ADMIN_TLS_ENABLED=<value>
#
enabled: false
## key ##
#
key:
## path ##
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_ADMIN_TLS_KEY_PATH=<value>
# - Windows Command Line (CMD):
# > set SERVE_ADMIN_TLS_KEY_PATH=<value>
#
path: /etc/ssl/private/ssl-cert-snakeoil.key
## admin ##
#
admin:
## port ##
#
# Default value: 4445
@ -254,20 +292,112 @@ serve:
# - Windows Command Line (CMD):
# > set SERVE_ADMIN_PORT=<value>
#
port: 4445
port: 1
## tls ##
#
# Configures HTTPS (HTTP over TLS). If configured, the server automatically supports HTTP/2.
#
tls:
## cert ##
#
# Configures the public certificate (pem encoded).
#
cert:
## path ##
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_TLS_CERT_PATH=<value>
# - Windows Command Line (CMD):
# > set SERVE_TLS_CERT_PATH=<value>
#
path: /etc/ssl/certs/ssl-cert-snakeoil.pem
## allow_termination_from ##
#
# Whitelist one or multiple CIDR address ranges and allow them to terminate TLS connections. Be aware that the X-Forwarded-Proto header must be set and must never be modifiable by anyone but your proxy / gateway / load balancer. Supports ipv4 and ipv6. Hydra serves http instead of https when this option is set.
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_TLS_ALLOW_TERMINATION_FROM=<value>
# - Windows Command Line (CMD):
# > set SERVE_TLS_ALLOW_TERMINATION_FROM=<value>
#
allow_termination_from:
- 127.0.0.1/32
## key ##
#
# Configures the private key (pem encoded).
#
key:
## path ##
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_TLS_KEY_PATH=<value>
# - Windows Command Line (CMD):
# > set SERVE_TLS_KEY_PATH=<value>
#
path: /etc/ssl/private/ssl-cert-snakeoil.key
## cookies ##
#
cookies:
## same_site_legacy_workaround ##
#
# Some older browser versions don’t work with SameSite=None. This option enables the workaround defined in https://web.dev/samesite-cookie-recipes/ which essentially stores a second cookie without SameSite as a fallback.
#
# Default value: false
#
# Examples:
# - true
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_COOKIES_SAME_SITE_LEGACY_WORKAROUND=<value>
# - Windows Command Line (CMD):
# > set SERVE_COOKIES_SAME_SITE_LEGACY_WORKAROUND=<value>
#
same_site_legacy_workaround: true
## same_site_mode ##
#
# Specify the SameSite mode that cookies should be sent with.
#
# Default value: None
#
# One of:
# - Strict
# - Lax
# - None
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_COOKIES_SAME_SITE_MODE=<value>
# - Windows Command Line (CMD):
# > set SERVE_COOKIES_SAME_SITE_MODE=<value>
#
same_site_mode: Strict
## public ##
#
# Controls the public daemon serving public API endpoints like /oauth2/auth, /oauth2/token, /.well-known/jwks.json
#
public:
## host ##
#
# The interface or unix socket ORY Hydra should listen and handle administrative API requests on. Use the prefix "unix:" to specify a path to a unix socket. Leave empty to listen on all interfaces.
# The interface or unix socket ORY Hydra should listen and handle public API requests on. Use the prefix "unix:" to specify a path to a unix socket. Leave empty to listen on all interfaces.
#
# Examples:
# - localhost
#
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_ADMIN_HOST=<value>
# $ export SERVE_PUBLIC_HOST=<value>
# - Windows Command Line (CMD):
# > set SERVE_ADMIN_HOST=<value>
# > set SERVE_PUBLIC_HOST=<value>
#
host: localhost
@ -276,21 +406,6 @@ serve:
# Configures Cross Origin Resource Sharing for public endpoints.
#
cors:
## enabled ##
#
# Sets whether CORS is enabled.
#
# Default value: false
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_ADMIN_CORS_ENABLED=<value>
# - Windows Command Line (CMD):
# > set SERVE_ADMIN_CORS_ENABLED=<value>
#
enabled: false
## allowed_origins ##
#
# A list of origins a cross-domain request can be executed from. If the special * value is present in the list, all origins will be allowed. An origin may contain a wildcard (*) to replace 0 or more characters (i.e.: http://*.domain.com). Only one wildcard can be used per origin.
@ -301,15 +416,17 @@ serve:
# - - https://example.com
# - https://*.example.com
# - https://*.foo.example.com
#
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_ADMIN_CORS_ALLOWED_ORIGINS=<value>
# $ export SERVE_PUBLIC_CORS_ALLOWED_ORIGINS=<value>
# - Windows Command Line (CMD):
# > set SERVE_ADMIN_CORS_ALLOWED_ORIGINS=<value>
# > set SERVE_PUBLIC_CORS_ALLOWED_ORIGINS=<value>
#
allowed_origins:
- "*"
- https://example.com
- https://*.example.com
- https://*.foo.example.com
## allowed_methods ##
#
@ -319,16 +436,12 @@ serve:
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_ADMIN_CORS_ALLOWED_METHODS=<value>
# $ export SERVE_PUBLIC_CORS_ALLOWED_METHODS=<value>
# - Windows Command Line (CMD):
# > set SERVE_ADMIN_CORS_ALLOWED_METHODS=<value>
# > set SERVE_PUBLIC_CORS_ALLOWED_METHODS=<value>
#
allowed_methods:
- POST
- PUT
- DELETE
- TRACE
- PUT
## allowed_headers ##
#
@ -338,13 +451,12 @@ serve:
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_ADMIN_CORS_ALLOWED_HEADERS=<value>
# $ export SERVE_PUBLIC_CORS_ALLOWED_HEADERS=<value>
# - Windows Command Line (CMD):
# > set SERVE_ADMIN_CORS_ALLOWED_HEADERS=<value>
# > set SERVE_PUBLIC_CORS_ALLOWED_HEADERS=<value>
#
allowed_headers:
# - in ex mollit
# - mollit velit ad
- ''
## exposed_headers ##
#
@ -354,14 +466,12 @@ serve:
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_ADMIN_CORS_EXPOSED_HEADERS=<value>
# $ export SERVE_PUBLIC_CORS_EXPOSED_HEADERS=<value>
# - Windows Command Line (CMD):
# > set SERVE_ADMIN_CORS_EXPOSED_HEADERS=<value>
# > set SERVE_PUBLIC_CORS_EXPOSED_HEADERS=<value>
#
exposed_headers:
# - consectetur sed commodo cupidatat
# - consequat anim id
# - aute dolor ipsum irure
- ''
## allow_credentials ##
#
@ -371,9 +481,9 @@ serve:
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_ADMIN_CORS_ALLOW_CREDENTIALS=<value>
# $ export SERVE_PUBLIC_CORS_ALLOW_CREDENTIALS=<value>
# - Windows Command Line (CMD):
# > set SERVE_ADMIN_CORS_ALLOW_CREDENTIALS=<value>
# > set SERVE_PUBLIC_CORS_ALLOW_CREDENTIALS=<value>
#
allow_credentials: false
@ -385,23 +495,25 @@ serve:
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_ADMIN_CORS_OPTIONS_PASSTHROUGH=<value>
# $ export SERVE_PUBLIC_CORS_OPTIONS_PASSTHROUGH=<value>
# - Windows Command Line (CMD):
# > set SERVE_ADMIN_CORS_OPTIONS_PASSTHROUGH=<value>
# > set SERVE_PUBLIC_CORS_OPTIONS_PASSTHROUGH=<value>
#
options_passthrough: true
options_passthrough: false
## max_age ##
#
# Sets how long (in seconds) the results of a preflight request can be cached. If set to 0, every request is preceded by a preflight request.
#
# Minimum value: 0
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_ADMIN_CORS_MAX_AGE=<value>
# $ export SERVE_PUBLIC_CORS_MAX_AGE=<value>
# - Windows Command Line (CMD):
# > set SERVE_ADMIN_CORS_MAX_AGE=<value>
# > set SERVE_PUBLIC_CORS_MAX_AGE=<value>
#
max_age: 6684720
max_age: 0
## debug ##
#
@ -411,119 +523,151 @@ serve:
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_ADMIN_CORS_DEBUG=<value>
# $ export SERVE_PUBLIC_CORS_DEBUG=<value>
# - Windows Command Line (CMD):
# > set SERVE_ADMIN_CORS_DEBUG=<value>
# > set SERVE_PUBLIC_CORS_DEBUG=<value>
#
debug: false
## access_log ##
#
# Access Log configuration for admin server.
#
access_log:
## disable_for_health ##
## enabled ##
#
# Disable access log for health endpoints.
# Sets whether CORS is enabled.
#
# Default value: false
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_ADMIN_ACCESS_LOG_DISABLE_FOR_HEALTH=<value>
# $ export SERVE_PUBLIC_CORS_ENABLED=<value>
# - Windows Command Line (CMD):
# > set SERVE_ADMIN_ACCESS_LOG_DISABLE_FOR_HEALTH=<value>
# > set SERVE_PUBLIC_CORS_ENABLED=<value>
#
disable_for_health: false
enabled: false
## tls ##
#
# Configures HTTPS (HTTP over TLS). If configured, the server automatically supports HTTP/2.
#
tls:
## key ##
## socket ##
#
# Configures the private key (pem encoded).
# Sets the permissions of the unix socket
#
key:
## path ##
socket:
## group ##
#
# Group of unix socket. If empty, the group will be the primary group of the user running hydra.
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_TLS_KEY_PATH=<value>
# $ export SERVE_PUBLIC_SOCKET_GROUP=<value>
# - Windows Command Line (CMD):
# > set SERVE_TLS_KEY_PATH=<value>
# > set SERVE_PUBLIC_SOCKET_GROUP=<value>
#
# path: /path/to/file.pem
group: ''
## cert ##
#
# Configures the private key (pem encoded).
#
cert:
## base64 ##
## mode ##
#
# Mode of unix socket in numeric form
#
# Default value: 493
#
# Minimum value: 0
#
# Maximum value: 511
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_TLS_CERT_BASE64=<value>
# $ export SERVE_PUBLIC_SOCKET_MODE=<value>
# - Windows Command Line (CMD):
# > set SERVE_TLS_CERT_BASE64=<value>
# > set SERVE_PUBLIC_SOCKET_MODE=<value>
#
# base64: b3J5IGh5ZHJhIGlzIGF3ZXNvbWUK
mode: 0
## allow_termination_from ##
#
# Whitelist one or multiple CIDR address ranges and allow them to terminate TLS connections. Be aware that the X-Forwarded-Proto header must be set and must never be modifiable by anyone but your proxy / gateway / load balancer. Supports ipv4 and ipv6. Hydra serves http instead of https when this option is set.
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_TLS_ALLOW_TERMINATION_FROM=<value>
# - Windows Command Line (CMD):
# > set SERVE_TLS_ALLOW_TERMINATION_FROM=<value>
#
allow_termination_from:
- 127.0.0.1/32
- 127.0.0.1/32
- 127.0.0.1/32
## owner ##
#
# Owner of unix socket. If empty, the owner will be the user running hydra.
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_PUBLIC_SOCKET_OWNER=<value>
# - Windows Command Line (CMD):
# > set SERVE_PUBLIC_SOCKET_OWNER=<value>
#
owner: ''
## cookies ##
#
cookies:
## same_site_mode ##
## access_log ##
#
# Specify the SameSite mode that cookies should be sent with.
# Access Log configuration for public server.
#
# Default value: None
access_log:
## disable_for_health ##
#
# Disable access log for health endpoints.
#
# Default value: false
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_PUBLIC_ACCESS_LOG_DISABLE_FOR_HEALTH=<value>
# - Windows Command Line (CMD):
# > set SERVE_PUBLIC_ACCESS_LOG_DISABLE_FOR_HEALTH=<value>
#
disable_for_health: false
## tls ##
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_COOKIES_SAME_SITE_MODE=<value>
# - Windows Command Line (CMD):
# > set SERVE_COOKIES_SAME_SITE_MODE=<value>
# Configures HTTPS (HTTP over TLS). If configured, the server automatically supports HTTP/2.
#
same_site_mode: None
tls:
## cert ##
#
# Configures the public certificate (pem encoded).
#
cert:
## path ##
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_PUBLIC_TLS_CERT_PATH=<value>
# - Windows Command Line (CMD):
# > set SERVE_PUBLIC_TLS_CERT_PATH=<value>
#
path: /etc/ssl/certs/ssl-cert-snakeoil.pem
## same_site_legacy_workaround ##
#
# Some older browser versions don’t work with SameSite=None. This option enables the workaround defined in https://web.dev/samesite-cookie-recipes/ which essentially stores a second cookie without SameSite as a fallback.
## allow_termination_from ##
#
# Whitelist one or multiple CIDR address ranges and allow them to terminate TLS connections. Be aware that the X-Forwarded-Proto header must be set and must never be modifiable by anyone but your proxy / gateway / load balancer. Supports ipv4 and ipv6. Hydra serves http instead of https when this option is set.
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_PUBLIC_TLS_ALLOW_TERMINATION_FROM=<value>
# - Windows Command Line (CMD):
# > set SERVE_PUBLIC_TLS_ALLOW_TERMINATION_FROM=<value>
#
allow_termination_from:
- 127.0.0.1/32
## key ##
#
# Configures the private key (pem encoded).
#
key:
## path ##
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_PUBLIC_TLS_KEY_PATH=<value>
# - Windows Command Line (CMD):
# > set SERVE_PUBLIC_TLS_KEY_PATH=<value>
#
path: /etc/ssl/private/ssl-cert-snakeoil.key
## port ##
#
# Default value: false
# Default value: 4444
#
# Examples:
# - true
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SERVE_COOKIES_SAME_SITE_LEGACY_WORKAROUND=<value>
# $ export SERVE_PUBLIC_PORT=<value>
# - Windows Command Line (CMD):
# > set SERVE_COOKIES_SAME_SITE_LEGACY_WORKAROUND=<value>
# > set SERVE_PUBLIC_PORT=<value>
#
same_site_legacy_workaround: true
port: 1
## dsn ##
#
@ -535,49 +679,55 @@ serve:
# - Windows Command Line (CMD):
# > set DSN=<value>
#
dsn: memory
dsn: 'memory'
## webfinger ##
#
# Configures ./well-known/ settings.
#
webfinger:
## jwks ##
## oidc_discovery ##
#
# Configures the /.well-known/jwks.json endpoint.
# Configures OpenID Connect Discovery (/.well-known/openid-configuration).
#
jwks:
## broadcast_keys ##
oidc_discovery:
## token_url ##
#
# Overwrites the OAuth2 Token URL
#
# Examples:
# - https://my-service.com/oauth2/token
#
# A list of JSON Web Keys that should be exposed at that endpoint. This is usually the public key for verifying OpenID Connect ID Tokens. However, you might want to add additional keys here as well.
# Set this value using environment variables on
# - Linux/macOS:
# $ export WEBFINGER_OIDC_DISCOVERY_TOKEN_URL=<value>
# - Windows Command Line (CMD):
# > set WEBFINGER_OIDC_DISCOVERY_TOKEN_URL=<value>
#
# Default value: hydra.openid.id-token
token_url: https://my-service.com/oauth2/token
## auth_url ##
#
# Overwrites the OAuth2 Auth URL
#
# Examples:
# - hydra.jwt.access-token
#
# - https://my-service.com/oauth2/auth
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export WEBFINGER_JWKS_BROADCAST_KEYS=<value>
# $ export WEBFINGER_OIDC_DISCOVERY_AUTH_URL=<value>
# - Windows Command Line (CMD):
# > set WEBFINGER_JWKS_BROADCAST_KEYS=<value>
# > set WEBFINGER_OIDC_DISCOVERY_AUTH_URL=<value>
#
broadcast_keys:
- hydra.jwt.access-token
auth_url: https://my-service.com/oauth2/auth
## oidc_discovery ##
#
# Configures OpenID Connect Discovery (/.well-known/openid-configuration).
#
oidc_discovery:
## client_registration_url ##
#
# Sets the OpenID Connect Dynamic Client Registration Endpoint
#
# Examples:
# - https://my-service.com/clients
#
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export WEBFINGER_OIDC_DISCOVERY_CLIENT_REGISTRATION_URL=<value>
@ -593,7 +743,7 @@ webfinger:
# Examples:
# - - email
# - username
#
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export WEBFINGER_OIDC_DISCOVERY_SUPPORTED_CLAIMS=<value>
@ -612,7 +762,7 @@ webfinger:
# - - email
# - whatever
# - read.photos
#
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export WEBFINGER_OIDC_DISCOVERY_SUPPORTED_SCOPE=<value>
@ -630,7 +780,7 @@ webfinger:
#
# Examples:
# - https://example.org/my-custom-userinfo-endpoint
#
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export WEBFINGER_OIDC_DISCOVERY_USERINFO_URL=<value>
@ -639,61 +789,54 @@ webfinger:
#
userinfo_url: https://example.org/my-custom-userinfo-endpoint
## oidc ##
#
# Configures OpenID Connect features.
#
oidc:
## subject_identifiers ##
#
# Configures the Subject Identifier algorithm. For more information please head over to the documentation: https://www.ory.sh/docs/hydra/advanced#subject-identifier-algorithms
#
# Examples:
# - enabled:
# - public
# - pairwise
# pairwise:
# salt: some-random-salt
#
subject_identifiers:
## enabled ##
## jwks_url ##
#
# A list of algorithms to enable.
# Overwrites the JWKS URL
#
# Examples:
# - https://my-service.com/.well-known/jwks.json
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export OIDC_SUBJECT_IDENTIFIERS_ENABLED=<value>
# $ export WEBFINGER_OIDC_DISCOVERY_JWKS_URL=<value>
# - Windows Command Line (CMD):
# > set OIDC_SUBJECT_IDENTIFIERS_ENABLED=<value>
# > set WEBFINGER_OIDC_DISCOVERY_JWKS_URL=<value>
#
enabled:
- public
- pairwise
jwks_url: https://my-service.com/.well-known/jwks.json
## pairwise ##
## jwks ##
#
# Configures the /.well-known/jwks.json endpoint.
#
jwks:
## broadcast_keys ##
#
# Configures the pairwise algorithm.
# A list of JSON Web Keys that should be exposed at that endpoint. This is usually the public key for verifying OpenID Connect ID Tokens. However, you might want to add additional keys here as well.
#
pairwise:
## salt ##
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT=<value>
# - Windows Command Line (CMD):
# > set OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT=<value>
#
salt: some-random-salt
# Default value: hydra.openid.id-token
#
# Examples:
# - hydra.jwt.access-token
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export WEBFINGER_JWKS_BROADCAST_KEYS=<value>
# - Windows Command Line (CMD):
# > set WEBFINGER_JWKS_BROADCAST_KEYS=<value>
#
broadcast_keys:
- hydra.jwt.access-token
## oidc ##
#
# Configures OpenID Connect features.
#
oidc:
## dynamic_client_registration ##
#
# Configures OpenID Connect Dynamic Client Registration (exposed as admin endpoints /clients/...).
#
dynamic_client_registration:
## default_scope ##
#
# The OpenID Connect Dynamic Client Registration specification has no concept of whitelisting OAuth 2.0 Scope. If you want to expose Dynamic Client Registration, you should set the default scope enabled for newly registered clients. Keep in mind that users can overwrite this default by setting the "scope" key in the registration payload, effectively disabling the concept of whitelisted scopes.
@ -702,7 +845,7 @@ oidc:
# - - openid
# - offline
# - offline_access
#
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export OIDC_DYNAMIC_CLIENT_REGISTRATION_DEFAULT_SCOPE=<value>
@ -714,51 +857,57 @@ oidc:
- offline
- offline_access
## urls ##
#
urls:
## self ##
## subject_identifiers ##
#
self:
## issuer ##
# Configures the Subject Identifier algorithm. For more information please head over to the documentation: https://www.ory.sh/docs/hydra/advanced#subject-identifier-algorithms
#
# Examples:
# - supported_types:
# - public
# - pairwise
# pairwise:
# salt: some-random-salt
#
subject_identifiers:
## supported_types ##
#
# This value will be used as the "issuer" in access and ID tokens. It must be specified and using HTTPS protocol, unless --dangerous-force-http is set. This should typically be equal to the public value.
# A list of algorithms to enable.
#
# Examples:
# - https://localhost:4444/
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export URLS_SELF_ISSUER=<value>
# $ export OIDC_SUBJECT_IDENTIFIERS_SUPPORTED_TYPES=<value>
# - Windows Command Line (CMD):
# > set URLS_SELF_ISSUER=<value>
# > set OIDC_SUBJECT_IDENTIFIERS_SUPPORTED_TYPES=<value>
#
issuer: https://localhost:4444/
supported_types:
- public
- pairwise
## public ##
#
# This is the base location of the public endpoints of your ORY Hydra installation. This should typically be equal to the issuer value. If left unspecified, it falls back to the issuer value.
## pairwise ##
#
# Examples:
# - https://localhost:4444/
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export URLS_SELF_PUBLIC=<value>
# - Windows Command Line (CMD):
# > set URLS_SELF_PUBLIC=<value>
# Configures the pairwise algorithm.
#
public: https://localhost:4444/
pairwise:
## salt ##
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT=<value>
# - Windows Command Line (CMD):
# > set OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT=<value>
#
salt: some-random-salt
## urls ##
#
urls:
## login ##
#
# Sets the login endpoint of the User Login & Consent flow. Defaults to an internal fallback URL.
# Sets the login endpoint of the User Login & Consent flow. Defaults to an internal fallback URL showing an error.
#
# Examples:
# - https://my-login.app/login
#
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export URLS_LOGIN=<value>
@ -769,11 +918,11 @@ urls:
## consent ##
#
# Sets the consent endpoint of the User Login & Consent flow. Defaults to an internal fallback URL.
# Sets the consent endpoint of the User Login & Consent flow. Defaults to an internal fallback URL showing an error.
#
# Examples:
# - https://my-consent.app/consent
#
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export URLS_CONSENT=<value>
@ -784,11 +933,11 @@ urls:
## logout ##
#
# Sets the logout endpoint. Defaults to an internal fallback URL.
# Sets the logout endpoint. Defaults to an internal fallback URL showing an error.
#
# Examples:
# - https://my-logout.app/logout
#
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export URLS_LOGOUT=<value>
@ -799,11 +948,11 @@ urls:
## error ##
#
# Sets the error endpoint. The error ui will be shown when an OAuth2 error occurs that which can not be sent back to the client. Defaults to an internal fallback URL.
# Sets the error endpoint. The error ui will be shown when an OAuth2 error occurs that which can not be sent back to the client. Defaults to an internal fallback URL showing an error.
#
# Examples:
# - https://my-error.app/error
#
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export URLS_ERROR=<value>
@ -818,7 +967,7 @@ urls:
#
# Examples:
# - https://my-example.app/logout-successful
#
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export URLS_POST_LOGOUT_REDIRECT=<value>
@ -827,28 +976,52 @@ urls:
#
post_logout_redirect: https://my-example.app/logout-successful
## self ##
#
self:
## public ##
#
# This is the base location of the public endpoints of your ORY Hydra installation. This should typically be equal to the issuer value. If left unspecified, it falls back to the issuer value.
#
# Examples:
# - https://localhost:4444/
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export URLS_SELF_PUBLIC=<value>
# - Windows Command Line (CMD):
# > set URLS_SELF_PUBLIC=<value>
#
public: https://localhost:4444/
## issuer ##
#
# This value will be used as the "issuer" in access and ID tokens. It must be specified and using HTTPS protocol, unless --dangerous-force-http is set. This should typically be equal to the public value.
#
# Examples:
# - https://localhost:4444/
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export URLS_SELF_ISSUER=<value>
# - Windows Command Line (CMD):
# > set URLS_SELF_ISSUER=<value>
#
issuer: https://localhost:4444/
## strategies ##
#
strategies:
## scope ##
#
# Defines how scopes are matched. For more details have a look at https://github.com/ory/fosite#scopes
#
# Default value: wildcard
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export STRATEGIES_SCOPE=<value>
# - Windows Command Line (CMD):
# > set STRATEGIES_SCOPE=<value>
#
scope: exact
## access_token ##
#
# Defines access token type. jwt is a bad idea, see https://www.ory.sh/docs/hydra/advanced#json-web-tokens
#
# Default value: opaque
#
# One of:
# - opaque
# - jwt
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export STRATEGIES_ACCESS_TOKEN=<value>
@ -857,26 +1030,30 @@ strategies:
#
access_token: opaque
## ttl ##
#
# Configures time to live.
#
ttl:
## login_consent_request ##
## scope ##
#
# Configures how long a user login and consent flow may take.
# Defines how scopes are matched. For more details have a look at https://github.com/ory/fosite#scopes
#
# Default value: 1h
# Default value: wildcard
#
# One of:
# - exact
# - wildcard
# - DEPRECATED_HIERARCHICAL_SCOPE_STRATEGY
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export TTL_LOGIN_CONSENT_REQUEST=<value>
# $ export STRATEGIES_SCOPE=<value>
# - Windows Command Line (CMD):
# > set TTL_LOGIN_CONSENT_REQUEST=<value>
# > set STRATEGIES_SCOPE=<value>
#
login_consent_request: 1h
scope: exact
## ttl ##
#
# Configures time to live.
#
ttl:
## access_token ##
#
# Configures how long access tokens are valid.
@ -905,92 +1082,175 @@ ttl:
#
refresh_token: 1h
## id_token ##
## id_token ##
#
# Configures how long id tokens are valid.
#
# Default value: 1h
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export TTL_ID_TOKEN=<value>
# - Windows Command Line (CMD):
# > set TTL_ID_TOKEN=<value>
#
id_token: 1h
## auth_code ##
#
# Configures how long auth codes are valid.
#
# Default value: 10m
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export TTL_AUTH_CODE=<value>
# - Windows Command Line (CMD):
# > set TTL_AUTH_CODE=<value>
#
auth_code: 1h
## login_consent_request ##
#
# Configures how long a user login and consent flow may take.
#
# Default value: 30m
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export TTL_LOGIN_CONSENT_REQUEST=<value>
# - Windows Command Line (CMD):
# > set TTL_LOGIN_CONSENT_REQUEST=<value>
#
login_consent_request: 1h
## oauth2 ##
#
oauth2:
## session ##
#
session:
## Encrypt OAuth2 Session ##
#
# If set to true (default) ORY Hydra encrypt OAuth2 and OpenID Connect session data using AES-GCM and the system secret before persisting it in the database.
#
# Default value: true
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export OAUTH2_SESSION_ENCRYPT_AT_REST=<value>
# - Windows Command Line (CMD):
# > set OAUTH2_SESSION_ENCRYPT_AT_REST=<value>
#
encrypt_at_rest: false
## include_legacy_error_fields ##
#
# Configures how long id tokens are valid.
# Set this to true if you want to include the `error_hint` and `error_debug` legacy fields in error responses. We recommend to set this to `false` unless you have clients using these fields.
#
# Default value: 1h
# Default value: false
#
# Examples:
# - true
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export TTL_ID_TOKEN=<value>
# $ export OAUTH2_INCLUDE_LEGACY_ERROR_FIELDS=<value>
# - Windows Command Line (CMD):
# > set TTL_ID_TOKEN=<value>
# > set OAUTH2_INCLUDE_LEGACY_ERROR_FIELDS=<value>
#
id_token: 1h
include_legacy_error_fields: true
## auth_code ##
## exclude_not_before_claim ##
#
# Configures how long auth codes are valid.
# Set to true if you want to exclude claim `nbf (not before)` part of access token.
#
# Default value: 10m
# Default value: false
#
# Examples:
# - true
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export TTL_AUTH_CODE=<value>
# $ export OAUTH2_EXCLUDE_NOT_BEFORE_CLAIM=<value>
# - Windows Command Line (CMD):
# > set TTL_AUTH_CODE=<value>
# > set OAUTH2_EXCLUDE_NOT_BEFORE_CLAIM=<value>
#
auth_code: 1h
exclude_not_before_claim: true
## oauth2 ##
#
oauth2:
## expose_internal_errors ##
#
# Set this to true if you want to share error debugging information with your OAuth 2.0 clients. Keep in mind that debug information is very valuable when dealing with errors, but might also expose database error codes and similar errors.
## allowed_top_level_claims ##
#
# Default value: false
# A list of custom claims which are allowed to be added top level to the Access Token. They cannot override reserved claims.
#
# Examples:
# - true
#
# - - username
# - email
# - user_uuid
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export OAUTH2_EXPOSE_INTERNAL_ERRORS=<value>
# $ export OAUTH2_ALLOWED_TOP_LEVEL_CLAIMS=<value>
# - Windows Command Line (CMD):
# > set OAUTH2_EXPOSE_INTERNAL_ERRORS=<value>
# > set OAUTH2_ALLOWED_TOP_LEVEL_CLAIMS=<value>
#
expose_internal_errors: true
allowed_top_level_claims:
- username
- email
- user_uuid
## hashers ##
#
# Configures hashing algorithms. Supports only BCrypt at the moment.
#
hashers:
## bcrypt ##
#
# Configures the BCrypt hashing algorithm used for hashing Client Secrets.
#
bcrypt:
## cost ##
#
# Sets the BCrypt cost. The higher the value, the more CPU time is being used to generate hashes.
#
# Default value: 10
#
# Minimum value: 4
#
# Maximum value: 31
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export OAUTH2_HASHERS_BCRYPT_COST=<value>
# - Windows Command Line (CMD):
# > set OAUTH2_HASHERS_BCRYPT_COST=<value>
#
cost: 40935632
cost: 4
## pkce ##
#
pkce:
## enforced_for_public_clients ##
#
# Sets whether PKCE should be enforced for public clients.
#
# Examples:
# - true
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export OAUTH2_PKCE_ENFORCED_FOR_PUBLIC_CLIENTS=<value>
# - Windows Command Line (CMD):
# > set OAUTH2_PKCE_ENFORCED_FOR_PUBLIC_CLIENTS=<value>
#
enforced_for_public_clients: true
## enforced ##
#
# Sets whether PKCE should be enforced for all clients.
#
# Examples:
# - true
#
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export OAUTH2_PKCE_ENFORCED=<value>
@ -999,48 +1259,82 @@ oauth2:
#
enforced: true
## client_credentials ##
#
client_credentials:
## default_grant_allowed_scope ##
#
# Defines how scopes are added if the request doesn't contains any scope
#
# Examples:
# - false
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export OAUTH2_CLIENT_CREDENTIALS_DEFAULT_GRANT_ALLOWED_SCOPE=<value>
# - Windows Command Line (CMD):
# > set OAUTH2_CLIENT_CREDENTIALS_DEFAULT_GRANT_ALLOWED_SCOPE=<value>
#
default_grant_allowed_scope: false
## expose_internal_errors ##
#
# Set this to true if you want to share error debugging information with your OAuth 2.0 clients. Keep in mind that debug information is very valuable when dealing with errors, but might also expose database error codes and similar errors.
#
# Default value: false
#
# Examples:
# - true
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export OAUTH2_EXPOSE_INTERNAL_ERRORS=<value>
# - Windows Command Line (CMD):
# > set OAUTH2_EXPOSE_INTERNAL_ERRORS=<value>
#
expose_internal_errors: true
## secrets ##
#
# The secrets section configures secrets used for encryption and signing of several systems. All secrets can be rotated, for more information on this topic go to: https://www.ory.sh/docs/hydra/advanced#rotation-of-hmac-token-signing-and-database-and-cookie-encryption-keys
#
secrets:
## system ##
## cookie ##
#
# The system secret must be at least 16 characters long. If none is provided, one will be generated. They key is used to encrypt sensitive data using AES-GCM (256 bit) and validate HMAC signatures. The first item in the list is used for signing and encryption. The whole list is used for verifying signatures and decryption.
# A secret that is used to encrypt cookie sessions. Defaults to secrets.system. It is recommended to use a separate secret in production. The first item in the list is used for signing and encryption. The whole list is used for verifying signatures and decryption.
#
# Examples:
# - - this-is-the-primary-secret
# - this-is-an-old-secret
# - this-is-another-old-secret
#
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SECRETS_SYSTEM=<value>
# $ export SECRETS_COOKIE=<value>
# - Windows Command Line (CMD):
# > set SECRETS_SYSTEM=<value>
# > set SECRETS_COOKIE=<value>
#
system:
cookie:
- this-is-the-primary-secret
- this-is-an-old-secret
- this-is-another-old-secret
## cookie ##
## system ##
#
# A secret that is used to encrypt cookie sessions. Defaults to secrets.system. It is recommended to use a separate secret in production. The first item in the list is used for signing and encryption. The whole list is used for verifying signatures and decryption.
# The system secret must be at least 16 characters long. If none is provided, one will be generated. They key is used to encrypt sensitive data using AES-GCM (256 bit) and validate HMAC signatures. The first item in the list is used for signing and encryption. The whole list is used for verifying signatures and decryption.
#
# Examples:
# - - this-is-the-primary-secret
# - this-is-an-old-secret
# - this-is-another-old-secret
#
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export SECRETS_COOKIE=<value>
# $ export SECRETS_SYSTEM=<value>
# - Windows Command Line (CMD):
# > set SECRETS_COOKIE=<value>
# > set SECRETS_SYSTEM=<value>
#
cookie:
system:
- this-is-the-primary-secret
- this-is-an-old-secret
- this-is-another-old-secret
@ -1049,9 +1343,13 @@ secrets:
#
# Enables profiling if set. For more details on profiling, head over to: https://blog.golang.org/profiling-go-programs
#
# One of:
# - cpu
# - mem
#
# Examples:
# - cpu
#
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export PROFILING=<value>
@ -1065,29 +1363,13 @@ profiling: cpu
# ORY Hydra supports distributed tracing.
#
tracing:
## provider ##
#
# Set this to the tracing backend you wish to use. Currently supports jaeger. If omitted or empty, tracing will be disabled.
#
# Examples:
# - jaeger
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export TRACING_PROVIDER=<value>
# - Windows Command Line (CMD):
# > set TRACING_PROVIDER=<value>
#
provider: jaeger
## service_name ##
#
# Specifies the service name to use on the tracer.
#
# Examples:
# - ORY Hydra
#
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export TRACING_SERVICE_NAME=<value>
@ -1099,35 +1381,38 @@ tracing:
## providers ##
#
providers:
## jaeger ##
## zipkin ##
#
# Configures the jaeger tracing backend.
# Configures the zipkin tracing backend.
#
jaeger:
## local_agent_address ##
# Examples:
# - server_url: http://localhost:9411/api/v2/spans
#
zipkin:
## server_url ##
#
# The address of the jaeger-agent where spans should be sent to.
# The address of Zipkin server where spans should be sent to.
#
# Examples:
# - 127.0.0.1:6831
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export TRACING_PROVIDERS_JAEGER_LOCAL_AGENT_ADDRESS=<value>
# $ export TRACING_PROVIDERS_ZIPKIN_SERVER_URL=<value>
# - Windows Command Line (CMD):
# > set TRACING_PROVIDERS_JAEGER_LOCAL_AGENT_ADDRESS=<value>
# > set TRACING_PROVIDERS_ZIPKIN_SERVER_URL=<value>
#
local_agent_address: 127.0.0.1:6831
server_url: http://localhost:9411/api/v2/spans
## jaeger ##
#
# Configures the jaeger tracing backend.
#
jaeger:
## propagation ##
#
# The tracing header format
#
# Examples:
# - jaeger
#
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export TRACING_PROVIDERS_JAEGER_PROPAGATION=<value>
@ -1136,15 +1421,28 @@ tracing:
#
propagation: jaeger
## max_tag_value_length ##
#
# The value passed to the max tag value length that has been configured.
#
# Minimum value: 0
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export TRACING_PROVIDERS_JAEGER_MAX_TAG_VALUE_LENGTH=<value>
# - Windows Command Line (CMD):
# > set TRACING_PROVIDERS_JAEGER_MAX_TAG_VALUE_LENGTH=<value>
#
max_tag_value_length: 0
## sampling ##
#
# Examples:
# - type: const
# value: 1
# server_url: http://localhost:5778/sampling
#
#
sampling:
## type ##
#
# Set this value using environment variables on
@ -1174,3 +1472,165 @@ tracing:
# > set TRACING_PROVIDERS_JAEGER_SAMPLING_SERVER_URL=<value>
#
server_url: http://localhost:5778/sampling
## local_agent_address ##
#
# The address of the jaeger-agent where spans should be sent to.
#
# Examples:
# - 127.0.0.1:6831
#
# Set this value using environment variables on
# - Linux/macOS:
# $ export TRACING_PROVIDERS_JAEGER_LOCAL_AGENT_ADDRESS=<value>
# - Windows Command Line (CMD):
# > set TRACING_PROVIDERS_JAEGER_LOCAL_AGENT_ADDRESS=<value>
#
local_agent_address: 127.0.0.1:6831
## provider ##
#
# Set this to the tracing backend you wish to use. Supports Jaeger, Zipkin DataDog, Elastic APM and Instana. If omitted or empty, tracing will be disabled. Use environment variables to configure DataDog (see https://docs.datadoghq.com/tracing/setup/go/#configuration).
#
# One of:
# - jaeger
# - zipkin