# ∞Proxy configuration file

Type: object
No Additional Properties

##

Type: string
Must match regular expression: `^\./.*\.schema\.json$`

Must be at least `1` characters long

Must be at most `64` characters long

##

#### Asynchronous job solver

Type: object

Configuration of asynchronous job solver

No Additional Properties

##

Type: boolean

Enable or disable asynchronous job handling

##

Type: integer

Maximum cpu count that the solver is allowed to dedicate for workers

Value must be greater or equal to `1` and lesser or equal to `64`

##

Type: integer

Maximum memory that the solver is allowed to dedicate for workers. See administration manual to check memory requirements per job types.

Value must be greater or equal to `1024` and lesser or equal to `65536`

##

Type: enum (of string) Default: "system"

Allows to choose which OpenGL implementation should be used. `none` : will not load OpenGL support, making some export jobs unprocessable. `system` : will use OpenGL implementation provided by the OS. `mesa` : will use Mesa3D LLVM software renderer (only available on Windows)

#### Must be one of:

- "none"
- "system"
- "mesa"

##

Type: array of enum (of string) Default: []

List of supported async job types. If the list is empty assums all job types are acceptable.

Must contain a minimum of `0` items

All items must be unique

No Additional Items

#### Each item of this array must be:

Type: enum (of string)

`export2draster`: 2D raster image export.<br/>`export2dvecto`: 2D vectorial image export.<br/>`export3d`: 3D or BOM export.

#### Must be one of:

- "export2draster"
- "export2dvecto"
- "export3d"

##

Type: boolean Default: false

enables rfDebug for doc river

##

Type: object
No Additional Properties

##

∞Directory api key, if null m2m bearer will be used

## One of

Type: null

If null http.*_key authentication methods will be disabled.

Type: string

Api key secret used to protect api endpoints, this secret will be used as http Basic authentication with 'infinite' login. It will be preferred over OAuth2 method if both are specified.

Must be at least `1` characters long

##

Type: string

url to the directory, preferably a backend vhost

Must match regular expression: `^https?:\/\/[^@\/A-Z]+?(:[1-9][0-9]{0,4})(\/.*)?\/directory$`

Must be at most `1024` characters long

##

Type: object

Host and port of elasticsearch node http interface. The node should be fully dedicated to this proxy. It is preferable to host the node on the same server as proxy service.

No Additional Properties

##

Type: string Default: ""

Elasticsearch connection login, could be empty if xpack.security is disabled.

Must be at least `0` characters long

##

Type: string Default: ""

Elasticsearch connection password, could be empty if xpack.security is disabled.

Must be at least `0` characters long

##

Type: string

url to the local elasticsearch cluster

Must match regular expression: `^http:\/\/[^@\/]+?(:[1-9][0-9]{0,4})(\/.*)?$`

Must be at most `1024` characters long

##

#### Http client global configuration

Type: object

http configuration

No Additional Properties

##

Default: false

## One of

Type: object
No Additional Properties

##

Type: string

file path to client PEM certificate

Must be at least `1` characters long

##

Type: string

file path to client PEM private key

Must be at least `1` characters long

##

Type: string

private key password if any

Type: object
No Additional Properties

##

Type: string

file path to client P12 certificate

Must be at least `1` characters long

##

Type: string

private key password if any

Type: enum (of boolean)

Disable use of certificate

#### Must be one of:

- false

##

Default: false

## One of

Type: string

Enforce use of provided http proxy for http calls

Must match regular expression: `^https?:\/\/.*$`

Must be at most `1024` characters long

Type: enum (of boolean)

Disable use of any http proxy for http calls

#### Must be one of:

- false

Type: enum (of boolean)

Enforce use of the automatic http proxy configuration from the system for http calls

#### Must be one of:

- true

##

Type: boolean Default: true

Set this value to false to disable ssl peer verification

##

#### Log configuration

Type: object
No Additional Properties

##

Type: array of string Default: []

rfDebug output that should be omitted

All items must be unique

No Additional Items

#### Each item of this array must be:

Type: string

Must be at least `1` characters long

##

Type: boolean Default: false

`loglevel` should be used instead. Enables DEBUG log level. This SHOULD NOT BE MAINTAINED IN PRODUCTION as it will log sensitive data and have a negative impact on overall performances.

##

Default: ""

## One of

Type: string

change default log location. If relative, will be resolved relative to configuration or job file.

Must be at least `1` characters long

Type: string

use default log location

Must be at least `0` characters long

Must be at most `0` characters long

Type: null

disable file logging

##

Type: boolean Default: true

enable log output to console

##

Type: enum (of string) Default: "INFO"

Specifies log level. `INFO` > `DEBUG` > `TRACE`. A log level lower than `INFO` SHOULD NOT BE MAINTAINED IN PRODUCTION as it will log sensitive data and have a negative impact on overall performances.

#### Must be one of:

- "INFO"
- "DEBUG"
- "TRACE"

##

#### Loki http log handler configuration

## One of

Type: null
Type: object

Configuration for Grafana Loki http push log handler

No Additional Properties

##

#### Http client override configuration

Type: object

http configuration for calls to calls to loki endpoint

No Additional Properties

##

Default: null

## One of

Type: null

Use global configuration

Type: object
No Additional Properties

##

Type: string

file path to client PEM certificate

Must be at least `1` characters long

##

Type: string

file path to client PEM private key

Must be at least `1` characters long

##

Type: string

private key password if any

Type: object
No Additional Properties

##

Type: string

file path to client P12 certificate

Must be at least `1` characters long

##

Type: string

private key password if any

Type: enum (of boolean)

Disable use of certificate

#### Must be one of:

- false

##

Default: null

## One of

Type: null

Use global configuration

Type: string

Enforce use of provided http proxy for http calls

Must match regular expression: `^https?:\/\/.*$`

Must be at most `1024` characters long

Type: enum (of boolean)

Disable use of any http proxy for http calls

#### Must be one of:

- false

Type: enum (of boolean)

Enforce use of the automatic http proxy configuration from the system for http calls

#### Must be one of:

- true

##

Default: null

## One of

Type: null

Use global configuration

Type: boolean

Set this value to false to disable ssl peer verification

##

Type: object

optional labels that will be added to loki streams

##

## Pattern Property

All properties whose name matches the following regular expression must respect the following conditions

Property name regular expression: `^(?!log$).*$`
Type: string

Must be at least `1` characters long

Must be at most `64` characters long

##

Additional Properties of any type are allowed.

Type: object

##

Type: string or null Default: null

loki connection login

##

Type: integer Default: 4096

maximum size in bytes of log message send to loki, if log entry is longer it will be truncated. If zero full message will not be truncated.

Value must be greater or equal to `0`

##

Type: string or null Default: null

loki connection password

##

Type: string

an url that should point to an endpoint compatible with POST /loki/api/v1/push, body will be gziped json, this endpoint is expected to return 200 or 204 on success. Url should not contains credentials.

Must match regular expression: `^https?:\/\/[^@\/]+?(\/.*)$`

Must be at most `1024` characters long

##

Type: integer Default: 64

Maximum log file size

Value must be greater or equal to `16` and lesser or equal to `1024`

##

Type: integer Default: 64

Number of backup log to keep, if -1 all logs will be kept

Value must be greater or equal to `-1` and lesser or equal to `512`

##

Type: enum (of string) Default: "weekly"

Enable time base log rotation

#### Must be one of:

- "disabled"
- "daily"
- "weekly"
- "monthly"

##

Type: object
No Additional Properties

##

#### OpenID connect common settings

Type: object

common OpenID connect settings

No Additional Properties

##

Type: string

OpenID Provider configuration url (https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest)

Must match regular expression: `^https:\/\/([^\/]*?)\/.*$`

Must be at most `1024` characters long

##

#### Http client override configuration

Type: object

http configuration for calls to calls to the OpenID server

No Additional Properties

##

Default: null

## One of

Type: null

Use global configuration

Type: object
No Additional Properties

##

Type: string

file path to client PEM certificate

Must be at least `1` characters long

##

Type: string

file path to client PEM private key

Must be at least `1` characters long

##

Type: string

private key password if any

Type: object
No Additional Properties

##

Type: string

file path to client P12 certificate

Must be at least `1` characters long

##

Type: string

private key password if any

Type: enum (of boolean)

Disable use of certificate

#### Must be one of:

- false

##

Default: null

## One of

Type: null

Use global configuration

Type: string

Enforce use of provided http proxy for http calls

Must match regular expression: `^https?:\/\/.*$`

Must be at most `1024` characters long

Type: enum (of boolean)

Disable use of any http proxy for http calls

#### Must be one of:

- false

Type: enum (of boolean)

Enforce use of the automatic http proxy configuration from the system for http calls

#### Must be one of:

- true

##

Default: null

## One of

Type: null

Use global configuration

Type: boolean

Set this value to false to disable ssl peer verification

##

## One of

Type: null

No OAuth2 configuration for machine to machine communication, http.m2m_bearer will be disabled and api key will be used.

#### OpenID Connect M2M settings

Type: object

Configure OAuth2 machine to machine identification using OpenID Connect client credentials flow. See http.m2m_bearer authentication method. Those settings will be used to acquire a token and to validate received tokens.

No Additional Properties

##

Type: object

specifies additional query parameters that should be added to oidc endpoint calls

No Additional Properties

##

Type: object

additional query parameters for token_endpoint

No Additional Properties

##

## Pattern Property

All properties whose name matches the following regular expression must respect the following conditions

Property name regular expression: `^(?!scope$).*$`
Type: string

##

Type: string Default: ""

Additional scope string that will be passed to the OpenID server on the token call to obtain and access_token. infinite.* scopes will be added automatically.

Must match regular expression: `^(()|([\x21\x23-\x5B\x5d-\x7e]+)( [\x21\x23-\x5B\x5d-\x7e]+)*)$`

Must be at least `0` characters long

Must be at most `1024` characters long

##

Type: array of enum (of string)

List of algorithm that will be allowed for JWT (idtoken and accesstoken) delivered by the OpenID server

All items must be unique

No Additional Items

#### Each item of this array must be:

Type: enum (of string)

#### Must be one of:

- "RS256"
- "RS384"
- "RS512"

##

Type: string

OpenID application id

Must be at least `1` characters long

##

Type: string

OpenID application secret

Must be at least `1` characters long

##

Default: null

## One of

Type: null

audience (aud) value is assumed to contain client_id.

Type: const

disable aud field validation. Not recommanded but could be usefull when dealing with a weird oidc server.

Specific value: `false`
Type: string

value that should be contained in access tokens aud field.

Must be at least `1` characters long

Type: array of string

list of potential aud field values. At least one should be equal to access tokens aud field.

Must contain a minimum of `1` items

Must contain a maximum of `16` items

No Additional Items

#### Each item of this array must be:

Type: string

value that should be contained in access tokens aud field.

Must be at least `1` characters long

##

Default: null

## One of

Type: null

Authorized party (azp) value is assumed to contain client_id

Type: const

disable azp field validation. Not recommanded but could be usefull when dealing with a weird oidc server.

Specific value: `false`
Type: array of string

list of accepted azp values, at least one should be contained in access tokens azp field

Must contain a minimum of `1` items

Must contain a maximum of `32` items

All items must be unique

No Additional Items

#### Each item of this array must be:

Type: string

Must be at least `1` characters long

##

Default: null

## One of

Type: null

issuer (iss) value will be retrieved from configuration endpoint.

Type: const

disable iss field validation. Not recommanded but could be usefull when dealing with a weird oidc server.

Specific value: `false`
Type: string

value that should be contained in access tokens iss field.

Must be at least `1` characters long

Type: array of string

list of potential iss field values. At least one should be equal to access tokens iss field.

Must contain a minimum of `1` items

Must contain a maximum of `16` items

No Additional Items

#### Each item of this array must be:

Type: string

value that should be contained in access tokens iss field.

Must be at least `1` characters long

##

#### OpenID Connect user identification ∞Proxy settings

Type: object
No Additional Properties

##

Type: array of enum (of string)

List of algorithm that will be allowed for JWT (idtoken and accesstoken) delivered by the OpenID server

All items must be unique

No Additional Items

#### Each item of this array must be:

Type: enum (of string)

#### Must be one of:

- "RS256"
- "RS384"
- "RS512"

##

Default: null

## One of

Type: null

audience (aud) value is assumed to contain client_id.

Type: const

disable aud field validation. Not recommanded but could be usefull when dealing with a weird oidc server.

Specific value: `false`
Type: string

value that should be contained in access tokens aud field.

Must be at least `1` characters long

Type: array of string

list of potential aud field values. At least one should be equal to access tokens aud field.

Must contain a minimum of `1` items

Must contain a maximum of `16` items

No Additional Items

#### Each item of this array must be:

Type: string

value that should be contained in access tokens aud field.

Must be at least `1` characters long

##

Default: null

## One of

Type: null

Authorized party (azp) value is assumed to contain client_id

Type: const

disable azp field validation. Not recommanded but could be usefull when dealing with a weird oidc server.

Specific value: `false`
Type: array of string

list of accepted azp values, at least one should be contained in access tokens azp field

Must contain a minimum of `1` items

Must contain a maximum of `32` items

All items must be unique

No Additional Items

#### Each item of this array must be:

Type: string

Must be at least `1` characters long

##

Default: null

## One of

Type: null

issuer (iss) value will be retrieved from configuration endpoint.

Type: const

disable iss field validation. Not recommanded but could be usefull when dealing with a weird oidc server.

Specific value: `false`
Type: string

value that should be contained in access tokens iss field.

Must be at least `1` characters long

Type: array of string

list of potential iss field values. At least one should be equal to access tokens iss field.

Must contain a minimum of `1` items

Must contain a maximum of `16` items

No Additional Items

#### Each item of this array must be:

Type: string

value that should be contained in access tokens iss field.

Must be at least `1` characters long

##

Type: boolean

Enable use of accesstoken (OpendID server should also return a refreshtoken) delivered by OpenID server to protect ∞Directory and ∞Proxy api calls from client applications (http.session_bearer security scheme). If disabled, tokens delivered by the Directory will be used.

##

#### PostgreSQL configuration

Type: object
No Additional Properties

##

Type: integer Default: 15

maximum wait duration per host while trying to establish a connection. Value is in secondes.

Value must be greater or equal to `2`

##

Type: string

target database name

Must be at least `1` characters long

##

Type: array of object

list of host, allowing to specify primary and replicat servers. Connection attempt will respect list order, to distribute read-only load on hot standby servers, put them first in the list.

Must contain a minimum of `1` items

Must contain a maximum of `8` items

No Additional Items

#### Each item of this array must be:

Type: object
No Additional Properties

##

Type: string

hostname or ip

Must be at least `1` characters long

##

Type: integer

tcp port

Value must be greater or equal to `1` and lesser or equal to `65535`

##

Type: string

PostgreSQL database connection login, could be empty if using SSPI or GSS authentication.

Must be at least `0` characters long

##

Type: string

PostgreSQL database connection password, could be empty if using SSPI or GSS authentication.

Must be at least `0` characters long

##

Type: object
No Additional Properties

##

Default: false

## One of

Type: object
No Additional Properties

##

Type: string

file path to client PEM certificate

Must be at least `1` characters long

##

Type: string

file path to client PEM private key

Must be at least `1` characters long

##

Type: string

private key password if any

Type: object
No Additional Properties

##

Type: string

file path to client P12 certificate

Must be at least `1` characters long

##

Type: string

private key password if any

Type: enum (of boolean)

Disable use of certificate

#### Must be one of:

- false

##

Type: boolean

should we use ssl connection

##

Type: string Default: ""

file path to rootCA.crt that will be used to verify server certificat, if empty default libpq cert location will be used

##

Type: boolean Default: true

if disabled, server certificat will not be validated

##

Type: object
No Additional Properties

##

## One of

Type: null

If null http.*_key authentication methods will be disabled.

Type: string

Api key secret used to protect api endpoints, this secret will be used as http Basic authentication with 'infinite' login. It will be preferred over OAuth2 method if both are specified.

Must be at least `1` characters long

##

Default: null

## One of

Type: null

#### Proxy VHost

Type: object

optional proxy api vhost for backend usage (used by proxy service and directory), if specified this vhost will not accept client security schemes. This vhost should be accessible by all directory instances.

No Additional Properties

##

Allows to restrict security flows accepted on this vhost

## One of

Type: null

Accept all security schemes

Type: array of enum (of string)

List of security flows accepted by the ∞Proxy.

Must contain a minimum of `1` items

No Additional Items

#### Each item of this array must be:

Type: enum (of string)

#### Must be one of:

- "app.admin"
- "app.client"
- "back.admin"
- "back.connector"
- "back.infinite"

##

Allows to restrict security schemes accepted on this vhost

## One of

Type: null

Accept all security schemes

Type: array of enum (of string)

List of security schemes accepted by the ∞Proxy.

Must contain a minimum of `1` items

No Additional Items

#### Each item of this array must be:

Type: enum (of string)

#### Must be one of:

- "http.m2m_bearer"
- "http.proxy_key"
- "http.session_bearer"
- "infinitebearer.data_session"
- "infiniteprivate"

##

Type: string
Must match regular expression: `^https?:\/\/[^@\/A-Z]+?(:[1-9][0-9]{0,4})(\/.*)?\/proxy$`

Must be at most `1024` characters long

##

Type: integer

bind port for proxy api http implementation

Value must be greater or equal to `1` and lesser or equal to `65535`

##

Type: boolean Default: false

If true, authorization and vhost check will be disabled for /api/getversion endpoint. This is useful to run healthcheck of containers behind a load balancer were load balancer will use internal IP or hostname.

##

Type: boolean Default: true

enables log of received http requests

##

#### Host search order

Type: array of enum (of string)

Define which headers should be used to determine host and port used by the client.Unfortunately 2 sets of headers ('Forwarded' and 'X-Forwarded-*') exist for reverse proxy. So depending on your infrastructure you might need to change evaluation order. Evaluation will stop on the first header found. If no headers were found the 'Host' header will be used. Sometimes exotic configuration (like AWS) may preserve the Host header, add X-forwarded-port and discard X-forwarded-Host, in this case, the policy host-with-x-forwarded-port may be used.

All items must be unique

No Additional Items

#### Each item of this array must be:

Type: enum (of string)

#### Must be one of:

- "forwarded"
- "x-forwarded-*"
- "host-with-x-forwarded-port"

##

Type: boolean Default: true

enables log of received http requests

##

Type: integer

how long (in secondes) a bearer is kept in cache

Value must be greater or equal to `0` and lesser or equal to `500`

##

Type: boolean Default: false

specify if proxy api http implementation should listen on any addresses, if false only loopback will be bound

##

#### Proxy VHost

Type: object

main proxy vhost always used by client. If a backendvhost security schemes is defined, implicit restrictions will be applied to this vhost. Should use HTTPS !

No Additional Properties

##

Allows to restrict security flows accepted on this vhost

## One of

Type: null

Accept all security schemes

Type: array of enum (of string)

List of security flows accepted by the ∞Proxy.

Must contain a minimum of `1` items

No Additional Items

#### Each item of this array must be:

Type: enum (of string)

#### Must be one of:

- "app.admin"
- "app.client"
- "back.admin"
- "back.connector"
- "back.infinite"

##

Allows to restrict security schemes accepted on this vhost

## One of

Type: null

Accept all security schemes

Type: array of enum (of string)

List of security schemes accepted by the ∞Proxy.

Must contain a minimum of `1` items

No Additional Items

#### Each item of this array must be:

Type: enum (of string)

#### Must be one of:

- "http.m2m_bearer"
- "http.proxy_key"
- "http.session_bearer"
- "infinitebearer.data_session"
- "infiniteprivate"

##

Type: string
Must match regular expression: `^https?:\/\/[^@\/A-Z]+?(:[1-9][0-9]{0,4})(\/.*)?\/proxy$`

Must be at most `1024` characters long

##

Type: object

Defines replication restriction, allowing to retrieve only a subset of builds available on the Directory

No Additional Properties

##

Type: array of string

To be replicated a build should not have a tag from this list (if the list is not empty).

Must contain a minimum of `0` items

All items must be unique

No Additional Items

#### Each item of this array must be:

Type: string

tag definition, because tags are also used as scopes limit them to scopes acceptable chars minus ':' and ';'. See https://www.rfc-editor.org/rfc/rfc6749#section-3.3.

Must match regular expression: `^[\x21\x23-\x39\x3c-\x5B\x5d-\x7e]+$`

Must be at least `1` characters long

Must be at most `64` characters long

##

Type: array of string

To be replicated a build should have at least one tag from this list (if the list is not empty).

Must contain a minimum of `0` items

All items must be unique

No Additional Items

#### Each item of this array must be:

Type: string

tag definition, because tags are also used as scopes limit them to scopes acceptable chars minus ':' and ';'. See https://www.rfc-editor.org/rfc/rfc6749#section-3.3.

Must match regular expression: `^[\x21\x23-\x39\x3c-\x5B\x5d-\x7e]+$`

Must be at least `1` characters long

Must be at most `64` characters long

##

Type: string

working folder were ∞Proxy data are stored. If relative, will be resolved relative to job file.