| log: |
| stdout: true |
| level: {{ default .Env.LOG_LEVEL "info" }} |
| |
| persistence: |
| numHistoryShards: {{ default .Env.NUM_HISTORY_SHARDS "4" }} |
| defaultStore: default |
| {{- $es := default .Env.ENABLE_ES "false" | lower -}} |
| {{- if eq $es "true" }} |
| visibilityStore: es-visibility |
| {{- else }} |
| visibilityStore: visibility |
| {{- end }} |
| datastores: |
| {{- $db := default .Env.DB "postgres" | lower -}} |
| {{- $db := replace $db "postgresql" "postgres" 1 }} |
| default: |
| sql: |
| pluginName: "{{ $db }}" |
| databaseName: "{{ default .Env.DBNAME "temporal" }}" |
| connectAddr: |
| "{{ default .Env.POSTGRES_SEEDS "" }}:{{ default .Env.DB_PORT "5432" }}" |
| connectProtocol: "tcp" |
| user: "{{ default .Env.POSTGRES_USER "" }}" |
| password: "{{ default .Env.POSTGRES_PWD "" }}" |
| maxConns: {{ default .Env.SQL_MAX_CONNS "20" }} |
| maxIdleConns: {{ default .Env.SQL_MAX_IDLE_CONNS "20" }} |
| maxConnLifetime: {{ default .Env.SQL_MAX_CONN_TIME "1h" }} |
| tls: |
| enabled: {{ default .Env.SQL_TLS_ENABLED "false" }} |
| caFile: {{ default .Env.SQL_CA "" }} |
| certFile: {{ default .Env.SQL_CERT "" }} |
| keyFile: {{ default .Env.SQL_CERT_KEY "" }} |
| enableHostVerification: {{ default .Env.SQL_HOST_VERIFICATION "false" }} |
| serverName: {{ default .Env.SQL_HOST_NAME "" }} |
| visibility: |
| {{ $visibility_seeds_default := default .Env.POSTGRES_SEEDS "" }} |
| {{ $visibility_seeds := default .Env.VISIBILITY_POSTGRES_SEEDS $visibility_seeds_default }} |
| {{ $visibility_port_default := default .Env.DB_PORT "5432" }} |
| {{ $visibility_port := default .Env.VISIBILITY_DB_PORT $visibility_port_default }} |
| {{ $visibility_user_default := default .Env.POSTGRES_USER "" }} |
| {{ $visibility_user := default .Env.VISIBILITY_POSTGRES_USER $visibility_user_default }} |
| {{ $visibility_pwd_default := default .Env.POSTGRES_PWD "" }} |
| {{ $visibility_pwd := default .Env.VISIBILITY_POSTGRES_PWD $visibility_pwd_default }} |
| sql: |
| pluginName: "{{ $db }}" |
| databaseName: "{{ default .Env.VISIBILITY_DBNAME "temporal_visibility" }}" |
| connectAddr: "{{ $visibility_seeds }}:{{ $visibility_port }}" |
| connectProtocol: "tcp" |
| user: "{{ $visibility_user }}" |
| password: "{{ $visibility_pwd }}" |
| maxConns: {{ default .Env.SQL_VIS_MAX_CONNS "10" }} |
| maxIdleConns: {{ default .Env.SQL_VIS_MAX_IDLE_CONNS "10" }} |
| maxConnLifetime: {{ default .Env.SQL_VIS_MAX_CONN_TIME "1h" }} |
| tls: |
| enabled: {{ default .Env.SQL_TLS_ENABLED "false" }} |
| caFile: {{ default .Env.SQL_CA "" }} |
| certFile: {{ default .Env.SQL_CERT "" }} |
| keyFile: {{ default .Env.SQL_CERT_KEY "" }} |
| enableHostVerification: {{ default .Env.SQL_HOST_VERIFICATION "false" }} |
| serverName: {{ default .Env.SQL_HOST_NAME "" }} |
| {{- if eq $es "true" }} |
| es-visibility: |
| elasticsearch: |
| version: {{ default .Env.ES_VERSION "" }} |
| url: |
| scheme: {{ default .Env.ES_SCHEME "http" }} |
| host: "{{ default .Env.ES_SEEDS "" }}:{{ default .Env.ES_PORT "9200" }}" |
| username: "{{ default .Env.ES_USER "" }}" |
| password: "{{ default .Env.ES_PWD "" }}" |
| indices: |
| visibility: "{{ default .Env.ES_VIS_INDEX "temporal_visibility_v1_dev" }}" |
| {{- $es_sec_vis_index := default .Env.ES_SEC_VIS_INDEX "" -}} |
| {{- if ne $es_sec_vis_index "" }} |
| secondary_visibility: "{{ $es_sec_vis_index }}" |
| {{- end }} |
| {{- end }} |
| |
| global: |
| membership: |
| maxJoinDuration: 30s |
| broadcastAddress: "{{ default .Env.TEMPORAL_BROADCAST_ADDRESS "" }}" |
| pprof: |
| port: {{ default .Env.PPROF_PORT "0" }} |
| tls: |
| refreshInterval: {{ default .Env.TEMPORAL_TLS_REFRESH_INTERVAL "0s" }} |
| expirationChecks: |
| warningWindow: {{ default .Env.TEMPORAL_TLS_EXPIRATION_CHECKS_WARNING_WINDOW "0s" }} |
| errorWindow: {{ default .Env.TEMPORAL_TLS_EXPIRATION_CHECKS_ERROR_WINDOW "0s" }} |
| checkInterval: {{ default .Env.TEMPORAL_TLS_EXPIRATION_CHECKS_CHECK_INTERVAL "0s" }} |
| internode: |
| # This server section configures the TLS certificate that internal temporal |
| # cluster nodes (history, matching, and internal-frontend) present to other |
| # clients within the Temporal Cluster. |
| server: |
| requireClientAuth: {{ default .Env.TEMPORAL_TLS_REQUIRE_CLIENT_AUTH "false" }} |
| |
| certFile: {{ default .Env.TEMPORAL_TLS_SERVER_CERT "" }} |
| keyFile: {{ default .Env.TEMPORAL_TLS_SERVER_KEY "" }} |
| {{- if .Env.TEMPORAL_TLS_SERVER_CA_CERT }} |
| clientCaFiles: |
| - {{ default .Env.TEMPORAL_TLS_SERVER_CA_CERT "" }} |
| {{- end }} |
| |
| certData: {{ default .Env.TEMPORAL_TLS_SERVER_CERT_DATA "" }} |
| keyData: {{ default .Env.TEMPORAL_TLS_SERVER_KEY_DATA "" }} |
| {{- if .Env.TEMPORAL_TLS_SERVER_CA_CERT_DATA }} |
| clientCaData: |
| - {{ default .Env.TEMPORAL_TLS_SERVER_CA_CERT_DATA "" }} |
| {{- end }} |
| |
| # This client section is used to configure the TLS clients within |
| # the Temporal Cluster that connect to an Internode (history, matching, or |
| # internal-frontend) |
| client: |
| serverName: {{ default .Env.TEMPORAL_TLS_INTERNODE_SERVER_NAME "" }} |
| disableHostVerification: |
| {{ default .Env.TEMPORAL_TLS_INTERNODE_DISABLE_HOST_VERIFICATION "false"}} |
| {{- if .Env.TEMPORAL_TLS_SERVER_CA_CERT }} |
| rootCaFiles: |
| - {{ default .Env.TEMPORAL_TLS_SERVER_CA_CERT "" }} |
| {{- end }} |
| {{- if .Env.TEMPORAL_TLS_SERVER_CA_CERT_DATA }} |
| rootCaData: |
| - {{ default .Env.TEMPORAL_TLS_SERVER_CA_CERT_DATA "" }} |
| {{- end }} |
| frontend: |
| # This server section configures the TLS certificate that the Frontend |
| # server presents to external clients. |
| server: |
| requireClientAuth: {{ default .Env.TEMPORAL_TLS_REQUIRE_CLIENT_AUTH "false" }} |
| certFile: {{ default .Env.TEMPORAL_TLS_FRONTEND_CERT "" }} |
| keyFile: {{ default .Env.TEMPORAL_TLS_FRONTEND_KEY "" }} |
| {{- if .Env.TEMPORAL_TLS_CLIENT1_CA_CERT }} |
| clientCaFiles: |
| - {{ default .Env.TEMPORAL_TLS_CLIENT1_CA_CERT "" }} |
| - {{ default .Env.TEMPORAL_TLS_CLIENT2_CA_CERT "" }} |
| {{- end }} |
| |
| certData: {{ default .Env.TEMPORAL_TLS_FRONTEND_CERT_DATA "" }} |
| keyData: {{ default .Env.TEMPORAL_TLS_FRONTEND_KEY_DATA "" }} |
| {{- if .Env.TEMPORAL_TLS_CLIENT1_CA_CERT_DATA }} |
| clientCaData: |
| - {{ default .Env.TEMPORAL_TLS_CLIENT1_CA_CERT_DATA "" }} |
| - {{ default .Env.TEMPORAL_TLS_CLIENT2_CA_CERT_DATA "" }} |
| {{- end }} |
| |
| # This client section is used to configure the TLS clients within |
| # the Temporal Cluster (specifically the Worker role) that connect to the Frontend |
| # service |
| client: |
| serverName: {{ default .Env.TEMPORAL_TLS_FRONTEND_SERVER_NAME "" }} |
| disableHostVerification: |
| {{ default .Env.TEMPORAL_TLS_FRONTEND_DISABLE_HOST_VERIFICATION "false"}} |
| {{- if .Env.TEMPORAL_TLS_SERVER_CA_CERT }} |
| rootCaFiles: |
| - {{ default .Env.TEMPORAL_TLS_SERVER_CA_CERT "" }} |
| {{- end }} |
| {{- if .Env.TEMPORAL_TLS_SERVER_CA_CERT_DATA }} |
| rootCaData: |
| - {{ default .Env.TEMPORAL_TLS_SERVER_CA_CERT_DATA "" }} |
| {{- end }} |
| {{- if .Env.STATSD_ENDPOINT }} |
| metrics: |
| statsd: |
| hostPort: {{ .Env.STATSD_ENDPOINT }} |
| prefix: "temporal" |
| {{- else if .Env.PROMETHEUS_ENDPOINT }} |
| metrics: |
| prometheus: |
| timerType: {{ default .Env.PROMETHEUS_TIMER_TYPE "histogram" }} |
| listenAddress: "{{ .Env.PROMETHEUS_ENDPOINT }}" |
| {{- end }} |
| authorization: |
| jwtKeyProvider: |
| keySourceURIs: |
| {{- if .Env.TEMPORAL_JWT_KEY_SOURCE1 }} |
| - {{ default .Env.TEMPORAL_JWT_KEY_SOURCE1 "" }} |
| {{- end }} |
| {{- if .Env.TEMPORAL_JWT_KEY_SOURCE2 }} |
| - {{ default .Env.TEMPORAL_JWT_KEY_SOURCE2 "" }} |
| {{- end }} |
| refreshInterval: {{ default .Env.TEMPORAL_JWT_KEY_REFRESH "1m" }} |
| permissionsClaimName: {{ default .Env.TEMPORAL_JWT_PERMISSIONS_CLAIM "permissions" }} |
| authorizer: {{ default .Env.TEMPORAL_AUTH_AUTHORIZER "" }} |
| claimMapper: {{ default .Env.TEMPORAL_AUTH_CLAIM_MAPPER "" }} |
| |
| {{- $temporalGrpcPort := default .Env.FRONTEND_GRPC_PORT "7233" }} |
| services: |
| frontend: |
| rpc: |
| grpcPort: {{ $temporalGrpcPort }} |
| membershipPort: {{ default .Env.FRONTEND_MEMBERSHIP_PORT "6933" }} |
| bindOnIP: {{ default .Env.BIND_ON_IP "127.0.0.1" }} |
| httpPort: {{ default .Env.FRONTEND_HTTP_PORT "7243" }} |
| |
| {{- if .Env.USE_INTERNAL_FRONTEND }} |
| internal-frontend: |
| rpc: |
| grpcPort: {{ default .Env.INTERNAL_FRONTEND_GRPC_PORT "7236" }} |
| membershipPort: {{ default .Env.INTERNAL_FRONTEND_MEMBERSHIP_PORT "6936" }} |
| bindOnIP: {{ default .Env.BIND_ON_IP "127.0.0.1" }} |
| {{- end }} |
| |
| matching: |
| rpc: |
| grpcPort: {{ default .Env.MATCHING_GRPC_PORT "7235" }} |
| membershipPort: {{ default .Env.MATCHING_MEMBERSHIP_PORT "6935" }} |
| bindOnIP: {{ default .Env.BIND_ON_IP "127.0.0.1" }} |
| |
| history: |
| rpc: |
| grpcPort: {{ default .Env.HISTORY_GRPC_PORT "7234" }} |
| membershipPort: {{ default .Env.HISTORY_MEMBERSHIP_PORT "6934" }} |
| bindOnIP: {{ default .Env.BIND_ON_IP "127.0.0.1" }} |
| |
| worker: |
| rpc: |
| grpcPort: {{ default .Env.WORKER_GRPC_PORT "7239" }} |
| membershipPort: {{ default .Env.WORKER_MEMBERSHIP_PORT "6939" }} |
| bindOnIP: {{ default .Env.BIND_ON_IP "127.0.0.1" }} |
| |
| clusterMetadata: |
| enableGlobalNamespace: false |
| failoverVersionIncrement: 10 |
| masterClusterName: "active" |
| currentClusterName: "active" |
| clusterInformation: |
| active: |
| enabled: true |
| initialFailoverVersion: 1 |
| rpcName: "frontend" |
| rpcAddress: {{ (print "127.0.0.1:" $temporalGrpcPort) }} |
| |
| dcRedirectionPolicy: |
| policy: "noop" |
| |
| {{- if eq .Env.ENABLE_GCS_ARCHIVAL "true" }} |
| archival: |
| history: |
| state: "enabled" |
| enableRead: true |
| provider: |
| gstorage: |
| credentialsPath: "" # Google Defualt Auth |
| visibility: |
| state: "enabled" |
| enableRead: true |
| provider: |
| gstorage: |
| credentialsPath: "" # Google Defualt Auth |
| |
| namespaceDefaults: |
| archival: |
| history: |
| state: "enabled" |
| URI: "gs://{{ default .Env.GCS_ARCHIVAL_ROOTPATH "temporal-archival"}}/default/history" |
| visibility: |
| state: "enabled" |
| URI: "gs://{{ default .Env.GCS_ARCHIVAL_ROOTPATH "temporal-archival"}}/default/visibility" |
| {{- end}} |
| |
| {{- if or (.Env.USE_INTERNAL_FRONTEND) (and (not .Env.TEMPORAL_AUTH_AUTHORIZER) (not .Env.TEMPORAL_AUTH_CLAIM_MAPPER)) }} |
| {{/* publicClient is not needed with internal frontend, or if not using authorizer + claim mapper */}} |
| {{- else }} |
| {{ $publicIp := default .Env.BIND_ON_IP "127.0.0.1" -}} |
| {{- $defaultPublicHostPost := (print $publicIp ":" $temporalGrpcPort) -}} |
| publicClient: |
| hostPort: "{{ default .Env.PUBLIC_FRONTEND_ADDRESS $defaultPublicHostPost }}" |
| {{- end }} |
| |
| dynamicConfigClient: |
| filepath: "{{ default .Env.DYNAMIC_CONFIG_FILE_PATH "/etc/temporal/config/dynamicconfig/docker.yaml" }}" |
| pollInterval: "60s" |
