Merge branch '5724-blob-signature-ttl' commit '6fc44a6' refs #5724

[arvados.git] / services / api / config / application.default.yml

diff --git a/services/api/config/application.default.yml b/services/api/config/application.default.yml
index 006ac55e470ee17e8ec42027984d453def0673f0..d3d3e22cc7f53212936e41da30a101fb3c65c97e 100644 (file)
--- a/services/api/config/application.default.yml
+++ b/services/api/config/application.default.yml
@@ -220,9 +220,23 @@ common:
   # a site secret. It should be at least 50 characters.
   blob_signing_key: ~
 
-  # Amount of time (in seconds) for which a blob permission signature
-  # remains valid.  Default: 2 weeks (1209600 seconds)
-  blob_signing_ttl: 1209600
+  # Lifetime (in seconds) of blob permission signatures generated by
+  # the API server. This determines how long a client can take (after
+  # retrieving a collection record) to retrieve the collection data
+  # from Keep. If the client needs more time than that (assuming the
+  # collection still has the same content and the relevant user/token
+  # still has permission) the client can retrieve the collection again
+  # to get fresh signatures.
+  #
+  # Datamanager considers an unreferenced block older than this to be
+  # eligible for garbage collection. Therefore, it should never be
+  # smaller than the corresponding value used by any local keepstore
+  # service (see keepstore -blob-signing-ttl flag). This rule prevents
+  # datamanager from trying to garbage-collect recently written blocks
+  # while clients are still holding valid signatures.
+  #
+  # The default is 2 weeks.
+  blob_signature_ttl: 1209600
 
   # Allow clients to create collections by providing a manifest with
   # unsigned data blob locators. IMPORTANT: This effectively disables