gateway.conf

ditto {
  mapping-strategy.implementation = "org.eclipse.ditto.services.gateway.util.GatewayMappingStrategies"
  cluster-downing.role = "gateway"

  gateway {
    http {
      # InetAddress.getLocalHost.getHostAddress is used if empty
      hostname = ""
      hostname = ${?HOSTNAME}
      hostname = ${?BIND_HOSTNAME}
      port = 8080
      port = ${?HTTP_PORT}
      port = ${?PORT}

      schema-versions = [1, 2]
      # override schema-versions via system properties, e.g.: -Dditto.gateway.http.schema-versions.0=1 -Dditto.gateway.http.schema-versions.1=2

      # Creator of props of HTTP request actors. Must implement HttpRequestActorPropsFactory.
      actor-props-factory = "org.eclipse.ditto.services.gateway.endpoints.actors.DefaultHttpRequestActorPropsFactory"

      forcehttps = false
      forcehttps = ${?FORCE_HTTPS}

      redirect-to-https = false
      redirect-to-https = ${?REDIRECT_TO_HTTPS}
      redirect-to-https-blacklist-pattern = "/cr.*|/api.*|/ws.*|/status.*|/overall.*"

      enablecors = false
      enablecors = ${?ENABLE_CORS}

      request-timeout = 60s # default: 20 s
      request-timeout = ${?REQUEST_TIMEOUT}
    }

    websocket {
      # the max queue size of how many inflight Commands a single Websocket client can have
      subscriber.backpressure-queue-size = 100
      subscriber.backpressure-queue-size = ${?WS_SUBSCRIBER_BACKPRESSURE}

      # the max buffer size of how many outstanding CommandResponses and Events a single Websocket client can have
      # additionally CommandResponses and Events are dropped if this size is reached
      publisher.backpressure-buffer-size = 200
      publisher.backpressure-buffer-size = ${?WS_PUBLISHER_BACKPRESSURE}

      # How often to update websocket session counter
      session-counter-scrape-interval = 30s

      throttling {
        # Interval at which the websocket is rate-limited. Disable rate limit with a value of zero.
        interval = 1s
        interval = ${?GATEWAY_WEBSOCKET_THROTTLING_INTERVAL}

        # The maximum number of messages the websocket is allowed to receive within the configured
        # throttling interval e.g. 100 msgs/s. Disable throttling with a value of zero.
        limit = 100
        limit = ${?GATEWAY_WEBSOCKET_THROTTLING_LIMIT}
      }
    }

    message {
      default-timeout = 10s
      max-timeout = 1m
    }

    claim-message {
      default-timeout = 1m
      max-timeout = 10m
    }

    dns {
      # DNS server to use for looking up services
      address = none
      address = ${?DNS_SERVER} # may be overridden with this environment variable
    }

    authentication {
      # configures HTTP for different authentication mechanisms: IM3, JWT (e.g. Google), ...
      http {
        # proxy config
        proxy {
          enabled = false
          enabled = ${?AUTH_HTTP_PROXY_ENABLED}

          hostname = ${?AUTH_HTTP_PROXY_HOST}
          port = ${?AUTH_HTTP_PROXY_PORT}
          username = ${?AUTH_HTTP_PROXY_USERNAME}
          password = ${?AUTH_HTTP_PROXY_PASSWORD}
        }
      }

      oauth {
        # map <subject-issuer, issuer> of all supported OpenID Connect authorization servers
        openid-connect-issuers = {
          # auth0 = "https://<your-domain>.<region>.auth0.com/"
          google = "https://accounts.google.com"
        }
      }

      dummy {
        # enable/disable dummy authentication (for dev purposes)
        enabled = false
        enabled = ${?ENABLE_DUMMY_AUTH}
      }

      devops {
        securestatus = true
        securestatus = ${?DEVOPS_SECURE_STATUS}

        // default password
        password = "foobar"
        // override default password by secret file if host environment is file-based
        password = ${?secrets.devops_password.value}
        // override all other sources by environment variable
        password = ${?DEVOPS_PASSWORD}

        // default password
        statusPassword = "status"
        // override default password by secret file if host environment is file-based
        statusPassword = ${?secrets.status_password.value}
        // override all other sources by environment variable
        statusPassword = ${?STATUS_PASSWORD}
      }
    }

    health-check {
      enabled = true
      enabled = ${?HEALTH_CHECK_ENABLED} # may be overridden with this environment variable
      interval = 60s
      service.timeout = 10s
      service.timeout = ${?HEALTH_CHECK_SERVICE_TIMEOUT} # may be overridden with this environment variable

      cluster-roles = {
        enabled = true
        enabled = ${?HEALTH_CHECK_ROLES_ENABLED} # may be overridden with this environment variable

        expected = [
          "policies",
          "things",
          "things-search",
          "gateway",
          "connectivity",
          "concierge"
        ]
      }
    }

    public-health {
      cache-timeout = 20s
      cache-timeout = ${?GATEWAY_STATUS_HEALTH_EXTERNAL_TIMEOUT}
    }

    cache {
      publickeys {
        maxentries = 32
        expiry = 60m
        maximum-size = ${ditto.gateway.cache.publickeys.maxentries}
        expire-after-write = ${ditto.gateway.cache.publickeys.expiry}
      }
    }

    statistics {

      // how long to wait for messages from other cluster members
      ask-timeout = 5s

      // how often to update hot entities count for the public
      update-interval = 30s
      update-interval = ${?STATISTICS_UPDATE_INTERVAL}

      // minimum pause between computations of statistics details
      details-expire-after = 5s
      details-expire-after = ${?STATISTICS_DETAILS_EXPIRE_AFTER}

      // CAUTION: no shard name should be a part of another shard name, because statistics-actor identifies
      // messages from shard regions by checking whether the sender's actor path contains the shard name.
      // This restriction does not apply to cluster role names; it is okay for example to have both the role "things"
      // and the role "things-search".
      shards: [
        {
          region: "thing"
          role: "things"
          root: "/user/thingsRoot"
        },
        {
          region: "policy"
          role: "policies"
          root: "/user/policiesRoot"
        },
        {
          region: "search-updater",
          role: "things-search",
          root: "/user/thingsSearchRoot/searchUpdaterRoot"
        }
      ]
    }
  }
}

// read docker secrets in /run/secrets if a "filebased" host environment is chosen
secrets {
  devops_password {
    name = "devops_password"
    name = ${?DEVOPS_PASSWORD_NAME}
    // value = ... // read from /run/secret/<name>
  }

  status_password {
    name = "status_password"
    name = ${?STATUS_PASSWORD_NAME}
    // value = ... // read from /run/secret/<name>
  }
}

akka {
  actor {
    deployment {
      /gatewayRoot/proxy {
        router = round-robin-pool
        # nr-of-instances = 5
        resizer {
          lower-bound = 5
          upper-bound = 100
          messages-per-resize = 50
        }
      }
    }
  }

  cluster {
    sharding {
      role = "gateway"
    }

    roles = [
      "gateway",
      "thing-event-aware",
      "live-signal-aware"
    ]
  }

  http {

    server {
      server-header = "" # default: akka-http/${akka.http.version}
      request-timeout = ${ditto.gateway.http.request-timeout}
      idle-timeout = 610s # default: 60s
      idle-timeout = ${?IDLE_TIMEOUT}
      max-connections = 4096 # default: 1024
      backlog = 100 # default: 100
      raw-request-uri-header = on # default: off

      parsing {
        max-uri-length = 8k # default: 2k
        # Default maximum content length which should not be exceeded by incoming request entities.
        # is handled + checked additionally by Ditto code - just in order to prevent the "worst case" where the backend
        # has to read a lot of data it won't process anyway, set a reasonable limit:
        max-content-length = 1m # default: 8m
        illegal-header-warnings = off # default: on
        error-logging-verbosity = simple # default: full

        # Sets the strictness mode for parsing request target URIs.
        # The following values are defined:
        #
        # `strict`: RFC3986-compliant URIs are required,
        #     a 400 response is triggered on violations
        #
        # `relaxed`: all visible 7-Bit ASCII chars are allowed
        #
        uri-parsing-mode = relaxed
      }

      websocket {
        # could be also "pong" for unidirectional keepalives
        periodic-keep-alive-mode = ping # default: ping

        # Interval for sending periodic keep-alives
        periodic-keep-alive-max-idle = 30s # default: infinite
      }

      termination-deadline-exceeded-response {
        # Status code of the "terminating" response to be automatically sent to pending requests once the termination deadline is exceeded.
        # default: 503
        status = 502 # Bad Gateway
      }
    }

    host-connection-pool {
      # The maximum number of open requests accepted into the pool across all
      # materializations of any of its client flows.
      # Protects against (accidentally) overloading a single pool with too many client flow materializations.
      # Note that with N concurrent materializations the max number of open request in the pool
      # will never exceed N * max-connections * pipelining-limit.
      # Must be a power of 2 and > 0!
      max-open-requests = 1024 # default: 32

      # The time after which an idle connection pool (without pending requests)
      # will automatically terminate itself. Set to `infinite` to completely disable idle timeouts.
      idle-timeout = 60s # default: 30s
    }
  }

  management.health-checks.readiness-checks {
    gateway-http-readiness = "org.eclipse.ditto.services.gateway.health.GatewayHttpReadinessCheck"
  }
}

authentication-dispatcher {
  type = Dispatcher
  executor = "thread-pool-executor"
  thread-pool-executor {
    # minimum number of threads to cap factor-based core number to
    core-pool-size-min = 4
    # No of core threads ... ceil(available processors * factor)
    core-pool-size-factor = 2.0
    # maximum number of threads to cap factor-based number to
    core-pool-size-max = 8
  }
  throughput = 100
}