Skip to content

config.md

Latest commit

 

History

History
463 lines (427 loc) · 13.3 KB

config.md

File metadata and controls

463 lines (427 loc) · 13.3 KB
Raw

Topaz configuration

The main configuration for Topaz can be divided in 3 main sections:

  1. Common configuration
  2. Auth configuration - optional
  3. Topaz File Decision Logger configuration - optional

Topaz configuration environment variables

If you use topaz CLI to generate your configuration file by default the $XDG_CONFIG_HOME and $XDG_DATA_HOME values to path the various locations.

You can use topaz config info environment to discover the resulting directory locations.

topaz config info environment

{
  "home": "/Users/gertd",
  "xdg_config_home": "/Users/gertd/.config",
  "xdg_data_home": "/Users/gertd/.local/share"
}

NOTE: The topazd service uses the spf13/viper library, which allows all configuration parameters to be passed to the topazd service as environment variables. Configurations files generated by the topaz CLI will by default use the TOPAZ_ prefix.

NOTE: The TOPAZ_DIR environment variable used as the root location in older versions of Topaz is no longer supported!

Default directory locations

  • TOPAZ_CFG_DIR - default $XDG_CONFIG_HOME/topaz/cfg - the directory from where topaz will load the configuration file.

  • TOPAZ_CERTS_DIR - default $XDG_CONFIG_HOME/topaz/certs - the directory where topaz will load/generate the certs.

  • TOPAZ_DB_DIR - default $XDG_DATA_HOME/topaz/db - the directory where the topazd will store the directory DB files.

  • TOPAZ_DECISIONS_DIR - default $XDG_DATA_HOME/topaz/decisions - the directory where decision files files will be stored.

Discover locations used using topaz config info

The topaz CLI can be used to discover the environmental settings, for example:

topaz config info
{
  "environment": {
    "home": "/Users/gertd",
    "xdg_config_home": "/Users/gertd/.config",
    "xdg_data_home": "/Users/gertd/.local/share"
  },
  "config": {
    "topaz_cfg_dir": "/Users/gertd/.config/topaz/cfg",
    "topaz_certs_dir": "/Users/gertd/.local/share/topaz/certs",
    "topaz_db_dir": "/Users/gertd/.local/share/topaz/db",
    "topaz_tmpl_dir": "/Users/gertd/.local/share/topaz/tmpl",
    "topaz_dir": "/Users/gertd/.config/topaz"
  },
  "runtime": {
    "active_configuration_name": "gdrive-v33",
    "active_configuration_file": "/Users/gertd/.config/topaz/cfg/gdrive-v33.yaml",
    "running_configuration_name": "test-dlog",
    "running_configuration_file": "/Users/gertd/.config/topaz/cfg/test-dlog.yaml",
    "running_container_name": "topaz-test-dlog",
    "topaz_json": "/Users/gertd/.config/topaz/topaz.json"
  },
  "default": {
    "container_registry": "ghcr.io/aserto-dev",
    "container_image": "topaz",
    "container_tag": "0.33.14",
    "container_platform": "linux/arm64",
    "topaz_no_check": false,
    "topaz_no_color": false
  },
  "directory": {
    "topaz_directory_svc": "localhost:9292",
    "topaz_directory_key": "",
    "topaz_directory_token": "",
    "topaz_insecure": false
  },
  "authorizer": {
    "topaz_authorizer_svc": "localhost:8282",
    "topaz_authorizer_key": "",
    "topaz_authorizer_token": "",
    "topaz_insecure": false
  }
}

Creating a new configuration

You can create a new configuration using the topaz CLI and use it as a template.

topaz config new --name my-topaz --resource ghcr.io/aserto-policies/policy-rebac:latest --policy rebac --stdout

The resulting config file looks like this:

# yaml-language-server: $schema=https://topaz.sh/schema/config.json
---
# config schema version
version: 2

# logger settings.
logging:
  prod: true
  log_level: info
  grpc_log_level: info

# edge directory configuration.
directory:
  db_path: '${TOPAZ_DB_DIR}/my-topaz.db'
  request_timeout: 5s # set as default, 5 secs.

# remote directory is used to resolve the identity for the authorizer.
remote_directory:
  address: "0.0.0.0:9292" # set as default, it should be the same as the reader as we resolve the identity from the local directory service.
  insecure: true
  no_tls: false
  no_proxy: false
  api_key: ""
  token: ""
  client_cert_path: ""
  client_key_path: ""
  ca_cert_path: ""
  headers:

# default jwt validation configuration
jwt:
  acceptable_time_skew_seconds: 5 # set as default, 5 secs

# authentication configuration
auth:
  keys:
    # - "<API key>"
    # - "<Password>"
  options:
    default:
      enable_api_key: false
      enable_anonymous: true
    overrides:
      paths:
        - /aserto.authorizer.v2.Authorizer/Info
        - /grpc.reflection.v1.ServerReflection/ServerReflectionInfo
        - /grpc.reflection.v1alpha.ServerReflection/ServerReflectionInfo
      override:
        enable_api_key: false
        enable_anonymous: true

api:
  health:
    listen_address: "0.0.0.0:9494"

  metrics:
    listen_address: "0.0.0.0:9696"
    zpages: true

  services:
    console:
      grpc:
        listen_address: "0.0.0.0:8081"
        fqdn: ""
        certs:
          tls_key_path: '${TOPAZ_CERTS_DIR}/grpc.key'
          tls_cert_path: '${TOPAZ_CERTS_DIR}/grpc.crt'
          tls_ca_cert_path: '${TOPAZ_CERTS_DIR}/grpc-ca.crt'
      gateway:
        listen_address: "0.0.0.0:8080"
        fqdn: ""
        allowed_headers:
        - "Authorization"
        - "Content-Type"
        - "If-Match"
        - "If-None-Match"
        - "Depth"
        allowed_methods:
        - "GET"
        - "POST"
        - "HEAD"
        - "DELETE"
        - "PUT"
        - "PATCH"
        - "PROFIND"
        - "MKCOL"
        - "COPY"
        - "MOVE"
        allowed_origins:
        - http://localhost
        - http://localhost:*
        - https://localhost
        - https://localhost:*
        - https://0.0.0.0:*
        certs:
          tls_key_path: '${TOPAZ_CERTS_DIR}/gateway.key'
          tls_cert_path: '${TOPAZ_CERTS_DIR}/gateway.crt'
          tls_ca_cert_path: '${TOPAZ_CERTS_DIR}/gateway-ca.crt'
        http: false
        read_timeout: 2s
        read_header_timeout: 2s
        write_timeout: 2s
        idle_timeout: 30s

    model:
      grpc:
        listen_address: "0.0.0.0:9292"
        fqdn: ""
        certs:
          tls_key_path: '${TOPAZ_CERTS_DIR}/grpc.key'
          tls_cert_path: '${TOPAZ_CERTS_DIR}/grpc.crt'
          tls_ca_cert_path: '${TOPAZ_CERTS_DIR}/grpc-ca.crt'
      gateway:
        listen_address: "0.0.0.0:9393"
        fqdn: ""
        allowed_headers:
        - "Authorization"
        - "Content-Type"
        - "If-Match"
        - "If-None-Match"
        - "Depth"
        allowed_methods:
        - "GET"
        - "POST"
        - "HEAD"
        - "DELETE"
        - "PUT"
        - "PATCH"
        - "PROFIND"
        - "MKCOL"
        - "COPY"
        - "MOVE"
        allowed_origins:
        - http://localhost
        - http://localhost:*
        - https://localhost
        - https://localhost:*
        certs:
          tls_key_path: '${TOPAZ_CERTS_DIR}/gateway.key'
          tls_cert_path: '${TOPAZ_CERTS_DIR}/gateway.crt'
          tls_ca_cert_path: '${TOPAZ_CERTS_DIR}/gateway-ca.crt'
        http: false
        read_timeout: 2s
        read_header_timeout: 2s
        write_timeout: 2s
        idle_timeout: 30s

    reader:
      needs:
        - model
      grpc:
        listen_address: "0.0.0.0:9292"
        fqdn: ""
        certs:
          tls_key_path: '${TOPAZ_CERTS_DIR}/grpc.key'
          tls_cert_path: '${TOPAZ_CERTS_DIR}/grpc.crt'
          tls_ca_cert_path: '${TOPAZ_CERTS_DIR}/grpc-ca.crt'
      gateway:
        listen_address: "0.0.0.0:9393"
        fqdn: ""
        allowed_headers:
        - "Authorization"
        - "Content-Type"
        - "If-Match"
        - "If-None-Match"
        - "Depth"
        allowed_methods:
        - "GET"
        - "POST"
        - "HEAD"
        - "DELETE"
        - "PUT"
        - "PATCH"
        - "PROFIND"
        - "MKCOL"
        - "COPY"
        - "MOVE"
        allowed_origins:
        - http://localhost
        - http://localhost:*
        - https://localhost
        - https://localhost:*
        - https://0.0.0.0:*
        certs:
          tls_key_path: '${TOPAZ_CERTS_DIR}/gateway.key'
          tls_cert_path: '${TOPAZ_CERTS_DIR}/gateway.crt'
          tls_ca_cert_path: '${TOPAZ_CERTS_DIR}/gateway-ca.crt'
        http: false
        read_timeout: 2s # default 2 seconds
        read_header_timeout: 2s
        write_timeout: 2s
        idle_timeout: 30s # default 30 seconds

    writer:
      needs:
        - model
      grpc:
        listen_address: "0.0.0.0:9292"
        fqdn: ""
        certs:
          tls_key_path: '${TOPAZ_CERTS_DIR}/grpc.key'
          tls_cert_path: '${TOPAZ_CERTS_DIR}/grpc.crt'
          tls_ca_cert_path: '${TOPAZ_CERTS_DIR}/grpc-ca.crt'
      gateway:
        listen_address: "0.0.0.0:9393"
        fqdn: ""
        allowed_headers:
        - "Authorization"
        - "Content-Type"
        - "If-Match"
        - "If-None-Match"
        - "Depth"
        allowed_methods:
        - "GET"
        - "POST"
        - "HEAD"
        - "DELETE"
        - "PUT"
        - "PATCH"
        - "PROFIND"
        - "MKCOL"
        - "COPY"
        - "MOVE"
        allowed_origins:
        - http://localhost
        - http://localhost:*
        - https://localhost
        - https://localhost:*
        certs:
          tls_key_path: '${TOPAZ_CERTS_DIR}/gateway.key'
          tls_cert_path: '${TOPAZ_CERTS_DIR}/gateway.crt'
          tls_ca_cert_path: '${TOPAZ_CERTS_DIR}/gateway-ca.crt'
        http: false
        read_timeout: 2s
        read_header_timeout: 2s
        write_timeout: 2s
        idle_timeout: 30s

    exporter:
      grpc:
        listen_address: "0.0.0.0:9292"
        fqdn: ""
        certs:
          tls_key_path: '${TOPAZ_CERTS_DIR}/grpc.key'
          tls_cert_path: '${TOPAZ_CERTS_DIR}/grpc.crt'
          tls_ca_cert_path: '${TOPAZ_CERTS_DIR}/grpc-ca.crt'

    importer:
      needs:
        - model
      grpc:
        listen_address: "0.0.0.0:9292"
        fqdn: ""
        certs:
          tls_key_path: '${TOPAZ_CERTS_DIR}/grpc.key'
          tls_cert_path: '${TOPAZ_CERTS_DIR}/grpc.crt'
          tls_ca_cert_path: '${TOPAZ_CERTS_DIR}/grpc-ca.crt'

    authorizer:
      needs:
        - reader
      grpc:
        connection_timeout_seconds: 2
        listen_address: "0.0.0.0:8282"
        fqdn: ""
        certs:
          tls_key_path: '${TOPAZ_CERTS_DIR}/grpc.key'
          tls_cert_path: '${TOPAZ_CERTS_DIR}/grpc.crt'
          tls_ca_cert_path: '${TOPAZ_CERTS_DIR}/grpc-ca.crt'
      gateway:
        listen_address: "0.0.0.0:8383"
        fqdn: ""
        allowed_headers:
        - "Authorization"
        - "Content-Type"
        - "If-Match"
        - "If-None-Match"
        - "Depth"
        allowed_methods:
        - "GET"
        - "POST"
        - "HEAD"
        - "DELETE"
        - "PUT"
        - "PATCH"
        - "PROFIND"
        - "MKCOL"
        - "COPY"
        - "MOVE"
        allowed_origins:
        - http://localhost
        - http://localhost:*
        - https://localhost
        - https://localhost:*
        - https://0.0.0.0:*
        certs:
          tls_key_path: '${TOPAZ_CERTS_DIR}/gateway.key'
          tls_cert_path: '${TOPAZ_CERTS_DIR}/gateway.crt'
          tls_ca_cert_path: '${TOPAZ_CERTS_DIR}/gateway-ca.crt'
        http: false
        read_timeout: 2s
        read_header_timeout: 2s
        write_timeout: 2s
        idle_timeout: 30s

opa:
  instance_id: "-"
  graceful_shutdown_period_seconds: 2
  # max_plugin_wait_time_seconds: 30 set as default
  local_bundles:
    paths: []
    skip_verification: true
  config:
    services:
      policy-registry:
        url: "https://ghcr.io"
        type: "oci"
        credentials:
          bearer:
            scheme: "Bearer"
            token: "${GIT_TOKEN}"
        response_header_timeout_seconds: 15
    bundles:
      rebac:
        service: policy-registry
        resource: "ghcr.io/aserto-policies/policy-rebac:latest"
        persist: false
        config:
          polling:
            min_delay_seconds: 60
            max_delay_seconds: 120
    decision_logs:
      console: false
    plugins:
      # topaz file decision logger plugin configuration
      topaz_file_decision_logger:
        enabled: false
        logger:
          filename: '${TOPAZ_DECISIONS_DIR}/my-topaz.json'
          max_size: 100
          max_age: 0
          max_backups: 0
          local_time: false
          compress: false
        policy_info:
          policy_name: 'rebac'
          registry_service: 'ghcr.io'
          registry_image: 'aserto-policies/policy-rebac'
          registry_tag: 'latest'
          digest: ''
          
      # aserto edge directory sync plugin configuration
      aserto_edge:
        enabled: false
        addr: ""                    # gRPC directory service address.
        apikey: ""                  # directory API key.
        timeout: 5                  # gRPC connection timeout in seconds.
        sync_interval: 1            # sync run interval in minutes.
        insecure: true              # when using TLS connections, skip verification of the server certificate.
        page_size: 0                # deprecated: no longer used.
        client_cert_path: ""        # when using mTLS connections, ClientCertPath is the path of the client's certificate file.
        client_key_path: ""         # when using mTLS connections, ClientKeyPath is the path of the client's private key file.
        no_tls: false               # disable TLS and use a plaintext connection.
        no_proxy: false             # bypasses any configured HTTP proxy.
        headers:                    # additional headers to include in requests to the service.