X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/fc3b155fb7ad82cf97cdb81a02a9cfaebe4389ff..95000b5d6bb4264533a1770346342c8fd3dbe61a:/services/api/config/application.default.yml diff --git a/services/api/config/application.default.yml b/services/api/config/application.default.yml index 40c9ef6dfc..2f32556733 100644 --- a/services/api/config/application.default.yml +++ b/services/api/config/application.default.yml @@ -1,3 +1,7 @@ +# Copyright (C) The Arvados Authors. All rights reserved. +# +# SPDX-License-Identifier: AGPL-3.0 + # Do not use this file for site configuration. Create application.yml # instead (see application.yml.example). # @@ -27,6 +31,11 @@ common: # generate permission signatures for Keep locators. It must be # identical to the permission key given to Keep. IMPORTANT: This is # a site secret. It should be at least 50 characters. + # + # Modifying blob_signing_key will invalidate all existing + # signatures, which can cause programs to fail (e.g., arv-put, + # arv-get, and Crunch jobs). To avoid errors, rotate keys only when + # no such processes are running. blob_signing_key: ~ # These settings are provided by your OAuth2 provider (e.g., @@ -41,30 +50,28 @@ common: # to log in. workbench_address: false - # The ARVADOS_WEBSOCKETS environment variable determines whether to - # serve http, websockets, or both. - # - # If ARVADOS_WEBSOCKETS="true", http and websockets are both served - # from the same process. - # - # If ARVADOS_WEBSOCKETS="ws-only", only websockets is served. + # Client-facing URI for websocket service. Nginx should be + # configured to proxy this URI to arvados-ws; see + # http://doc.arvados.org/install/install-ws.html # - # If ARVADOS_WEBSOCKETS="false" or not set at all, only http is - # served. In this case, you should have a separate process serving - # websockets, and the address of that service should be given here - # as websocket_address. + # If websocket_address is false (which is the default), no websocket + # server will be advertised to clients. This configuration is not + # supported. # - # If websocket_address is false (which is the default), the - # discovery document will tell clients to use the current server as - # the websocket service, or (if the current server does not have - # websockets enabled) not to use websockets at all. - # - # Example: Clients will connect to the specified endpoint. - #websocket_address: wss://127.0.0.1:3333/websocket - # Default: Clients will connect to this server if it's running - # websockets, otherwise none at all. + # Example: + #websocket_address: wss://ws.zzzzz.arvadosapi.com/websocket websocket_address: false + # Maximum number of websocket connections allowed + websocket_max_connections: 500 + + # Maximum number of events a single connection can be backlogged + websocket_max_notify_backlog: 1000 + + # Maximum number of subscriptions a single websocket connection can have + # active. + websocket_max_filters: 10 + # Git repositories must be readable by api server, or you won't be # able to submit crunch jobs. To pass the test suites, put a clone # of the arvados tree in {git_repositories_dir}/arvados.git or @@ -155,19 +162,31 @@ common: # still has permission) the client can retrieve the collection again # to get fresh signatures. # - # Datamanager considers an unreferenced block older than this to be - # eligible for garbage collection. Therefore, it should never be - # smaller than the corresponding value used by any local keepstore - # service (see keepstore -blob-signature-ttl flag). This rule - # prevents datamanager from trying to garbage-collect recently - # written blocks while clients are still holding valid signatures. + # This must be exactly equal to the -blob-signature-ttl flag used by + # keepstore servers. Otherwise, reading data blocks and saving + # collections will fail with HTTP 403 permission errors. + # + # Modifying blob_signature_ttl invalidates existing signatures; see + # blob_signing_key note above. # # The default is 2 weeks. blob_signature_ttl: 1209600 - # Default lifetime for ephemeral collections: 2 weeks. + # Default lifetime for ephemeral collections: 2 weeks. This must not + # be less than blob_signature_ttl. default_trash_lifetime: 1209600 + # Interval (seconds) between trash sweeps. During a trash sweep, + # collections are marked as trash if their trash_at time has + # arrived, and deleted if their delete_at time has arrived. + trash_sweep_interval: 60 + + # Maximum characters of (JSON-encoded) query parameters to include + # in each request log entry. When params exceed this size, they will + # be JSON-encoded, truncated to this size, and logged as + # params_truncated. + max_request_log_params_size: 2000 + # Maximum size (in bytes) allowed for a single API request. This # limit is published in the discovery document for use by clients. # Note: You must separately configure the upstream web server or @@ -180,12 +199,10 @@ common: # normally be returned in a single response). # Note 1: This setting never reduces the number of returned rows to # zero, no matter how big the first data row is. - # Note 2: Currently, this only limits the - # arvados.v1.collections.list API (GET /arvados/v1/collections), and - # only takes the size of manifest_text into account. Other fields - # (e.g., "properties" hashes) are not counted against this limit - # when returning collections, and the limit is not applied at all - # for other data types. + # Note 2: Currently, this is only checked against a specific set of + # columns that tend to get large (collections.manifest_text, + # containers.mounts, workflows.definition). Other fields (e.g., + # "properties" hashes) are not counted against this limit. max_index_database_read: 134217728 # Maximum number of items to return when responding to a APIs that @@ -199,6 +216,30 @@ common: # stderr logs from the logs table. clean_job_log_rows_after: <%= 30.days %> + # When you run the db:delete_old_container_logs task, it will find + # containers that have been finished for at least this many seconds, + # and delete their stdout, stderr, arv-mount, crunch-run, and + # crunchstat logs from the logs table. + clean_container_log_rows_after: <%= 30.days %> + + # Time to keep audit logs, in seconds. (An audit log is a row added + # to the "logs" table in the PostgreSQL database each time an + # Arvados object is created, modified, or deleted.) + # + # Currently, websocket event notifications rely on audit logs, so + # this should not be set lower than 600 (5 minutes). + max_audit_log_age: 1209600 + + # Maximum number of log rows to delete in a single SQL transaction. + # + # If max_audit_log_delete_batch is 0, log entries will never be + # deleted by Arvados. Cleanup can be done by an external process + # without affecting any Arvados system processes, as long as very + # recent (<5 minutes old) logs are not deleted. + # + # 100000 is a reasonable batch size for most sites. + max_audit_log_delete_batch: 0 + # The maximum number of compute nodes that can be in use simultaneously # If this limit is reduced, any existing nodes with slot number >= new limit # will not be counted against the new limit. In other words, the new limit @@ -228,6 +269,21 @@ common: # silenced by throttling are not counted against this total. crunch_limit_log_bytes_per_job: 67108864 + crunch_log_partial_line_throttle_period: 5 + + # Attributes to suppress in events and audit logs. Notably, + # specifying ["manifest_text"] here typically makes the database + # smaller and faster. + # + # Warning: Using any non-empty value here can have undesirable side + # effects for any client or component that relies on event logs. + # Use at your own risk. + unlogged_attributes: [] + + # API methods to disable. Disabled methods are not listed in the + # discovery document, and respond 404 to all requests. + # Example: ["jobs.create", "pipeline_instances.create"] + disable_api_methods: [] ### ### Crunch, DNS & compute node management @@ -236,6 +292,17 @@ common: # Docker image to be used when none found in runtime_constraints of a job default_docker_image_for_jobs: false + # List of supported Docker Registry image formats that compute nodes + # are able to use. `arv keep docker` will error out if a user tries + # to store an image with an unsupported format. Use an empty array + # to skip the compatibility check (and display a warning message to + # that effect). + # + # Example for sites running docker < 1.10: ["v1"] + # Example for sites running docker >= 1.10: ["v2"] + # Example for disabling check: [] + docker_image_formats: ["v2"] + # :none or :slurm_immediate crunch_job_wrapper: :none @@ -294,6 +361,27 @@ common: assign_node_hostname: compute%d + ### + ### Job and container reuse logic. + ### + + # Include details about job reuse decisions in the server log. This + # causes additional database queries to run, so it should not be + # enabled unless you expect to examine the resulting logs for + # troubleshooting purposes. + log_reuse_decisions: false + + # Control job reuse behavior when two completed jobs match the + # search criteria and have different outputs. + # + # If true, in case of a conflict, reuse the earliest job (this is + # similar to container reuse behavior). + # + # If false, in case of a conflict, do not reuse any completed job, + # but do reuse an already-running job if available (this is the + # original job reuse behavior, and is still the default). + reuse_job_if_outputs_differ: false + ### ### Remaining assorted configuration options. ### @@ -338,6 +426,25 @@ common: # "git log". source_version: false + # Enable asynchronous permission graph rebuild. Must run + # script/permission-updater.rb as a separate process. When the permission + # cache is invalidated, the background process will update the permission + # graph cache. This feature is experimental! + async_permissions_update: false + + # Default value for container_count_max for container requests. This is the + # number of times Arvados will create a new container to satisfy a container + # request. If a container is cancelled it will retry a new container if + # container_count < container_count_max on any container requests associated + # with the cancelled container. + container_count_max: 3 + + # Default value for keep_cache_ram of a container's runtime_constraints. + container_default_keep_cache_ram: 268435456 + + # Token to be included in all healthcheck requests. Disabled by default. + # Server expects request header of the format "Authorization: Bearer xxx" + ManagementToken: false development: force_ssl: false @@ -349,7 +456,6 @@ development: action_mailer.perform_deliveries: false active_support.deprecation: :log action_dispatch.best_standards_support: :builtin - active_record.mass_assignment_sanitizer: :strict active_record.auto_explain_threshold_in_seconds: 0.5 assets.compress: false assets.debug: true @@ -359,7 +465,7 @@ production: cache_classes: true consider_all_requests_local: false action_controller.perform_caching: true - serve_static_assets: false + serve_static_files: false assets.compress: true assets.compile: false assets.digest: true @@ -367,7 +473,7 @@ production: test: force_ssl: false cache_classes: true - serve_static_assets: true + serve_static_files: true static_cache_control: public, max-age=3600 whiny_nils: true consider_all_requests_local: true @@ -376,7 +482,6 @@ test: action_controller.allow_forgery_protection: false action_mailer.delivery_method: :test active_support.deprecation: :stderr - active_record.mass_assignment_sanitizer: :strict uuid_prefix: zzzzz sso_app_id: arvados-server sso_app_secret: <%= rand(2**512).to_s(36) %> @@ -387,3 +492,6 @@ test: workbench_address: https://localhost:3001/ git_repositories_dir: <%= Rails.root.join 'tmp', 'git', 'test' %> git_internal_dir: <%= Rails.root.join 'tmp', 'internal.git' %> + websocket_address: "wss://0.0.0.0:<%= ENV['ARVADOS_TEST_WSS_PORT'] %>/websocket" + trash_sweep_interval: -1 + docker_image_formats: ["v1"]