mirror of
https://github.com/versity/versitygw.git
synced 2026-09-23 08:24:17 +00:00
144 lines
4.6 KiB
Plaintext
144 lines
4.6 KiB
Plaintext
##########################################
|
|
# VersityGW standalone IAM configuration #
|
|
##########################################
|
|
|
|
# Copy this file to /etc/versitygw.d/ and rename it to a unique service name.
|
|
# For example, /etc/versitygw.d/iam.conf is started with:
|
|
# systemctl start versitygw@iam
|
|
# systemctl enable versitygw@iam
|
|
|
|
##############################
|
|
# VersityGW Required Options #
|
|
##############################
|
|
|
|
# Run the standalone IAM API server.
|
|
VGW_BACKEND=iam
|
|
|
|
# The IAM API needs one storage backend. Set VGW_IAM_DIR for local file-backed
|
|
# storage, or configure VGW_IAM_VAULT_ENDPOINT_URL and its authentication
|
|
# options below for HashiCorp Vault storage.
|
|
VGW_IAM_DIR=/var/lib/versitygw/iam
|
|
|
|
# The access and secret options specify the root account credentials. The root
|
|
# account has full authorization to IAM API requests after authentication.
|
|
ROOT_ACCESS_KEY_ID=
|
|
ROOT_SECRET_ACCESS_KEY=
|
|
|
|
############################
|
|
# VersityGW Global Options #
|
|
############################
|
|
|
|
# The IAM API listener address. It accepts the same comma-separated TCP or
|
|
# UNIX-socket addresses as the gateway, for example :7076 or /run/vgw/iam.sock.
|
|
#VGW_PORT=:7076
|
|
|
|
# TLS certificate and private key for the IAM API listener.
|
|
#VGW_CERT=
|
|
#VGW_KEY=
|
|
|
|
# Maximum concurrent connections and in-flight requests.
|
|
#VGW_MAX_CONNECTIONS=250000
|
|
#VGW_MAX_REQUESTS=100000
|
|
|
|
# Region returned by IAM responses. Defaults to us-east-1.
|
|
#VGW_REGION=us-east-1
|
|
|
|
# Silence request logging to stdout.
|
|
#VGW_QUIET=false
|
|
|
|
# Enable HTTP keep-alive connections.
|
|
#VGW_KEEP_ALIVE=false
|
|
|
|
# File-mode permissions for file-backed UNIX sockets, as an octal integer.
|
|
#VGW_SOCKET_PERM=
|
|
|
|
# Configure this when a browser-based WebUI on another origin accesses IAM.
|
|
#VGW_CORS_ALLOW_ORIGIN=
|
|
|
|
# Override the S3 gateway URLs offered by the WebUI. Specify one or more
|
|
# comma-separated URLs, for example http://localhost:7070 or
|
|
# https://s3.example.com.
|
|
#VGW_WEBUI_GATEWAYS=
|
|
|
|
#################
|
|
# Vault Storage #
|
|
#################
|
|
|
|
# Use Vault instead of VGW_IAM_DIR by setting the Vault endpoint and suitable
|
|
# credentials.
|
|
|
|
# Vault server URL for IAM storage.
|
|
#VGW_IAM_VAULT_ENDPOINT_URL=
|
|
|
|
# Fallback Vault namespace for both AppRole authentication and KV v2 storage.
|
|
# The more-specific authentication and storage namespace options override it.
|
|
#VGW_IAM_VAULT_NAMESPACE=
|
|
|
|
# KV v2 path prefix used to store IAM users. Defaults to iam.
|
|
#VGW_IAM_VAULT_SECRET_STORAGE_PATH=iam
|
|
|
|
# Vault namespace for the KV v2 IAM storage path. Overrides VGW_IAM_VAULT_NAMESPACE.
|
|
#VGW_IAM_VAULT_SECRET_STORAGE_NAMESPACE=
|
|
|
|
# Vault authentication method mount path. Defaults to approle.
|
|
#VGW_IAM_VAULT_AUTH_METHOD=approle
|
|
|
|
# Vault namespace used for AppRole login. Overrides VGW_IAM_VAULT_NAMESPACE.
|
|
#VGW_IAM_VAULT_AUTH_NAMESPACE=
|
|
|
|
# Vault KV v2 secrets engine mount path. Defaults to kv-v2.
|
|
#VGW_IAM_VAULT_MOUNT_PATH=kv-v2
|
|
|
|
# Vault root token for authentication. Do not set this with the AppRole ID or
|
|
# secret options below.
|
|
#VGW_IAM_VAULT_ROOT_TOKEN=
|
|
|
|
# Vault AppRole role ID for authentication. Set with VGW_IAM_VAULT_ROLE_SECRET
|
|
# instead of VGW_IAM_VAULT_ROOT_TOKEN.
|
|
#VGW_IAM_VAULT_ROLE_ID=
|
|
|
|
# Vault AppRole secret ID for authentication. Set with VGW_IAM_VAULT_ROLE_ID
|
|
# instead of VGW_IAM_VAULT_ROOT_TOKEN.
|
|
#VGW_IAM_VAULT_ROLE_SECRET=
|
|
|
|
# PEM-encoded Vault server TLS certificate used to verify the Vault server.
|
|
#VGW_IAM_VAULT_SERVER_CERT=
|
|
|
|
# PEM-encoded client TLS certificate presented to Vault.
|
|
#VGW_IAM_VAULT_CLIENT_CERT=
|
|
|
|
# PEM-encoded private key for VGW_IAM_VAULT_CLIENT_CERT.
|
|
#VGW_IAM_VAULT_CLIENT_CERT_KEY=
|
|
|
|
############################
|
|
# Private IAM API Listener #
|
|
############################
|
|
|
|
# This private endpoint serves the VersityGW protocol used by S3 gateway
|
|
# instances to communicate directly with the standalone IAM service.
|
|
|
|
# Private endpoint listen addresses. Set one or more comma-separated UNIX
|
|
# socket paths, or TCP addresses such as :7077 or 127.0.0.1:7077. TCP listeners
|
|
# require the three mTLS settings below; UNIX sockets do not.
|
|
#VGW_IAM_PRIVATE_PORTS=
|
|
|
|
# TLS server certificate for TCP private endpoint listeners.
|
|
#VGW_IAM_PRIVATE_CERT=
|
|
|
|
# TLS private key for VGW_IAM_PRIVATE_CERT.
|
|
#VGW_IAM_PRIVATE_CERT_KEY=
|
|
|
|
# PEM-encoded CA bundle used to verify the S3 gateway's client certificate on
|
|
# TCP private endpoint listeners.
|
|
#VGW_IAM_PRIVATE_CLIENT_CA=
|
|
|
|
# Octal permissions for file-backed UNIX private sockets, for example 0660.
|
|
# This does not affect TCP or Linux abstract-namespace sockets.
|
|
#VGW_IAM_PRIVATE_SOCKET_PERM=
|
|
|
|
#################
|
|
# OIDC Settings #
|
|
#################
|
|
|
|
# Reject OIDC provider creation without an explicit certificate thumbprint.
|
|
#VGW_IAM_DISABLE_OIDC_THUMBPRINT_AUTOFETCH=false |