conductor

CI task system
git clone git://git.finwo.net/app/conductor
Log | Files | Refs | README | LICENSE

conductor.example.yaml (4389B)

      1 # conductor.example.yaml - server configuration
      2 #
      3 # Copy to conductor.yaml and edit. Every value here is a default, so an empty
      4 # file is a valid configuration: sqlite on disk, local object storage and
      5 # built-in user accounts.
      6 #
      7 # Any value can also be set from the environment, which takes precedence over
      8 # this file. See ENV_MAP in src/lib/config.js for the full list.
      9 #
     10 # Relative paths resolve against the directory holding this file.
     11 
     12 server:
     13   host: 0.0.0.0
     14   port: 8080
     15   # Absolute URL this conductor is reachable at. Workers are handed callback
     16   # URLs derived from it, so it must be correct behind a reverse proxy.
     17   public_url: http://127.0.0.1:8080
     18 
     19 database:
     20   # Leave url unset for sqlite. Otherwise the scheme picks the dialect:
     21   #   mysql://user:pass@host:3306/conductor
     22   #   postgres://user:pass@host:5432/conductor
     23   # The matching driver package must be installed: mysql2 or pg.
     24   url: null
     25   path: ./data/conductor.db
     26   connection_limit: 10
     27 
     28 storage:
     29   # Used when no s3 bucket is configured below.
     30   path: ./data/storage
     31   # Setting a bucket switches artifacts and finished logs to object storage.
     32   # endpoint, bucket, access_key_id and secret_access_key are all required
     33   # together. Garage and MinIO need force_path_style; AWS S3 does not.
     34   s3:
     35     endpoint: null
     36     region: us-east-1
     37     bucket: null
     38     access_key_id: null
     39     secret_access_key: null
     40     force_path_style: true
     41 
     42 auth:
     43   # Signs built-in session tokens. Generated per boot when unset, which logs
     44   # everyone out on restart, so set it in production.
     45   session_secret: null
     46   access_ttl: 900
     47   refresh_ttl: 2592000
     48   # False expires a session refresh_ttl after signing in rather than after
     49   # last use.
     50   refresh_sliding: true
     51   # The built-in login provider. Derived from oidc.discovery_url when unset;
     52   # setting it true uses the built-in one even with a provider configured.
     53   local:
     54     enabled: null
     55     # Where the app may be sent back to, when it is not served from
     56     # server.public_url. Comma separated absolute URLs, compared by origin.
     57     # "*" allows any, which is for local testing only.
     58     redirect_uris: null
     59   # Setting a discovery url switches authentication to the provider. Built-in
     60   # accounts are used when it is unset. Everything else about the provider,
     61   # including its issuer and every endpoint, is read from this document.
     62   oidc:
     63     discovery_url: null
     64     # The client this conductor is registered as. Register it as a public
     65     # client with PKCE, and the app's origin as a redirect uri.
     66     client_id: null
     67     scopes: openid profile email
     68     admin_role: conductor-admin
     69   # Created on first boot, only while the users table is empty, and only
     70   # without OIDC. With no password set, one is generated and logged once.
     71   bootstrap_admin:
     72     username: admin
     73     password: null
     74 
     75 secrets:
     76   # 32 bytes as 64 hex characters or base64, for example:
     77   #   openssl rand -hex 32
     78   # Without it, project variables and trigger secrets are stored in the clear
     79   # and marked as such, so they can be re-sealed later.
     80   encryption_key: null
     81 
     82 git:
     83   mirror_path: ./data/mirrors
     84   fetch_interval: 60
     85   timeout: 300
     86 
     87 log:
     88   spool_path: ./data/logs
     89   max_size: 67108864
     90 
     91 # How long build output is kept. A project may override any of these from
     92 # its settings page; zero means keep forever.
     93 #
     94 # Artifacts follow two rules and survive if either wants them: the last
     95 # artifact_keep_jobs jobs are kept whatever their age, and anything younger
     96 # than artifact_keep_days is kept however many jobs have followed. The most
     97 # recent successful job is always kept, so a project that has gone quiet
     98 # still has something to download. A task that sets artifacts.expire in the
     99 # pipeline overrides all of it with an exact deadline.
    100 #
    101 # Logs go by age alone. They are the reason this exists: written for every
    102 # task, read for almost none, and otherwise never removed.
    103 retention:
    104   artifact_keep_jobs: 10
    105   artifact_keep_days: 30
    106   log_keep_days: 14
    107   # Seconds between sweeps, and how much one sweep will delete, so a first
    108   # pass over a long backlog cannot monopolise the database or the bucket.
    109   sweep_interval: 3600
    110   batch: 500
    111 
    112 scheduler:
    113   # A claimed task whose worker stops reporting for this long is treated as
    114   # lost, then retried or failed. Must exceed reap_interval.
    115   heartbeat_timeout: 120
    116   reap_interval: 30
    117   default_task_timeout: 3600
    118   max_attempts: 1