Configuration

The following configuration file formats are supported:

• Files ending in .cue - parsed as CUE
• Files ending in .json - parsed as JSON
• Files ending in .yaml or .yml - parsed as YAML

If no config file is specified, the server will attempt to load one in the current working directory named syn-cp.[cue|json|yaml|yml]

Multiple config files can be supplied with the -c or --config flag. They are merged using the merge-patch strategy in-order with the right-most file taking precedence.

Base configuration

Key	Type	Required	Description
server	Server	No	Control Plane HTTP(S) server options.
kms	KMS	No	KMS options for encrypting secrets.
data_sources	Data Sources	No	External database connections.
authentication	Authentication	No	Controls how users authenticate to Control Plane.
authorization	Authorization	No	Controls authorization defaults, roles, and policies.
logging	Logging	No	Controls log levels and logging destinations.
metrics	Metrics	No	Controls scrape interval, scraper type, and detail level
data_dir	string	No	Location of data directory, defaults to ./data in current working directory.

Server

Key	Type	Required	Description
url	string	No	URL where Control Plane server will be accessed, defaults to http://localhost:8080 or https://localhost:8443 if TLS is enabled.
http_addr	string	No	HTTP interface:port to listen on, defaults to :8080 which listens on all interfaces port 8080. When tls is set, this will 301 redirect to server.url.
https_addr	string	No	HTTPS interface:port to listen on, defaults to :8443 which listens on all interfaces port 8443. tls must be set for this to take effect.
tls	TLS Server	No	Server TLS configuration
extra_headers	map	No	Extra headers to add to each response, map key is the header name and value is the header value. Available since 1.4.1

Example (YAML):

server:
  url: 'https://cp.demo.nats.io'
  tls:
    cert_file: '/etc/syn-cp/cert.pem'
    key_file: '/etc/syn-cp/key.pem'
  extra_headers:
    Strict-Transport-Security: 'max-age=31536000; includeSubDomains; preload'
    X-Frame-Options: 'DENY'

KMS

KMS config

Key	Type	Required	Description
key_url	string	No	Supports KMS key URLs documented here, as well as: file:///path/to/file - read the secrets keeper URL from a file env://ENV_VAR_NAME - read the secrets keeper URL from an Environment Variable Default is to generate a local encryption key at <data_dir>/encryption/enc.key.
rotated_key_urls	[]string	No	List of keys that should be rotated to key_url. Same URL format as key_url.

Data sources

External data sources

Key	Type	Required	Description
postgres	Postgres	No	Connect to an external PostgreSQL database.
prometheus	Prometheus	No	Connect to an external Prometheus.

Postgres

Key	Type	Required	Description
dsn	string	Yes	Data Source Name, example - postgres://localhost:5432/mydb - all supported options.
max_open_conns	int	No	Maximum number of open PostgreSQL connections from this app instance. Unset preserves the Go sql.DB default.
max_idle_conns	int	No	Maximum number of idle PostgreSQL connections retained by this app instance. Unset preserves the Go sql.DB default.

Prometheus

Key	Type	Required	Description
url	string	Yes	Prometheus URL, example - https://user:pass@localhost.
tls	TLS Client	No	TLS Client options.
basic_auth	map	No	Basic auth credentials, map format is: username: string password: string
bearer_token	string	No	Bearer token.

TLS common

Key	Type	Required	Description
min_version	enum	No	TLS1.0, TLS1.1, TLS1.2 (default), or TLS1.3.

TLS server

Supports all options from TLS Common, plus:

Key	Type	Required	Description
cert_file	string	Yes	Path to PEM-encoded x509 server certificate.
key_file	string	Yes	Path to PEM-encoded x509 server private key.
ca_file	string	No	Path to PEM-encoded x509 CA certificate. When supplied, client certificates will be validated against this CA.
client_auth_type	enum	No	Client certificate authentication type, valid options are: NoClientCert - do not require client certs (default when ca_file is not set) RequireAndVerifyClientCert - require and validate client certs (default when ca_file is set)

TLS client

Supports all options from TLS Common, plus:

Key	Type	Required	Description
cert_file	string	No	Path to PEM-encoded x509 client certificate.
key_file	string	No	Path to PEM-encoded x509 client private key.
ca_file	string	No	Path to PEM-encoded x509 CA certificate. When supplied, the server certificate will be validated against this CA certificate.
insecure_skip_verify	boolean	No	Skip verifying server certificate, defaults to false.