conductor

conductor.example.yaml (3923B)

---

 # conductor.example.yaml - server configuration
 #
 # Copy to conductor.yaml and edit. Every value here is a default, so an empty
 # file is a valid configuration: sqlite on disk, local object storage and
 # built-in user accounts.
 #
 # Any value can also be set from the environment, which takes precedence over
 # this file. See ENV_MAP in src/lib/config.js for the full list.
 #
 # Relative paths resolve against the directory holding this file.
 
 server:
   host: 0.0.0.0
   port: 8080
   # Absolute URL this conductor is reachable at. Workers are handed callback
   # URLs derived from it, so it must be correct behind a reverse proxy.
   public_url: http://127.0.0.1:8080
 
 database:
   # Leave url unset for sqlite. Otherwise the scheme picks the dialect:
   #   mysql://user:pass@host:3306/conductor
   #   postgres://user:pass@host:5432/conductor
   # The matching driver package must be installed: mysql2 or pg.
   url: null
   path: ./data/conductor.db
   connection_limit: 10
 
 storage:
   # Used when no s3 bucket is configured below.
   path: ./data/storage
   # Setting a bucket switches artifacts and finished logs to object storage.
   # endpoint, bucket, access_key_id and secret_access_key are all required
   # together. Garage and MinIO need force_path_style; AWS S3 does not.
   s3:
     endpoint: null
     region: us-east-1
     bucket: null
     access_key_id: null
     secret_access_key: null
     force_path_style: true
 
 auth:
   # Signs built-in session tokens. Generated per boot when unset, which logs
   # everyone out on restart, so set it in production.
   session_secret: null
   session_ttl: 43200
   # Setting a discovery url switches authentication to OIDC. Built-in
   # accounts are used when it is unset. Everything else about the provider,
   # including its issuer and every endpoint, is read from this document.
   oidc:
     discovery_url: null
     # The client this conductor is registered as. The redirect uri to
     # register is <server.public_url>/oidc/callback.
     client_id: null
     # Only for a confidential client; leave unset for a public one.
     client_secret: null
     scopes: openid profile email
     admin_role: conductor-admin
   # Created on first boot, only while the users table is empty, and only
   # without OIDC. With no password set, one is generated and logged once.
   bootstrap_admin:
     username: admin
     password: null
 
 secrets:
   # 32 bytes as 64 hex characters or base64, for example:
   #   openssl rand -hex 32
   # Without it, project variables and trigger secrets are stored in the clear
   # and marked as such, so they can be re-sealed later.
   encryption_key: null
 
 git:
   mirror_path: ./data/mirrors
   fetch_interval: 60
   timeout: 300
 
 log:
   spool_path: ./data/logs
   max_size: 67108864
 
 # How long build output is kept. A project may override any of these from
 # its settings page; zero means keep forever.
 #
 # Artifacts follow two rules and survive if either wants them: the last
 # artifact_keep_jobs jobs are kept whatever their age, and anything younger
 # than artifact_keep_days is kept however many jobs have followed. The most
 # recent successful job is always kept, so a project that has gone quiet
 # still has something to download. A task that sets artifacts.expire in the
 # pipeline overrides all of it with an exact deadline.
 #
 # Logs go by age alone. They are the reason this exists: written for every
 # task, read for almost none, and otherwise never removed.
 retention:
   artifact_keep_jobs: 10
   artifact_keep_days: 30
   log_keep_days: 14
   # Seconds between sweeps, and how much one sweep will delete, so a first
   # pass over a long backlog cannot monopolise the database or the bucket.
   sweep_interval: 3600
   batch: 500
 
 scheduler:
   # A claimed task whose worker stops reporting for this long is treated as
   # lost, then retried or failed. Must exceed reap_interval.
   heartbeat_timeout: 120
   reap_interval: 30
   default_task_timeout: 3600
   max_attempts: 3