diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 47bb24c2..034f3458 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -47,6 +47,8 @@ jobs: run: make lint-yaml - name: Lint prose run: make lint-prose + - name: Lint Python + run: make lint-python - name: Build run: make build diff --git a/.github/workflows/update-config-docs.yml b/.github/workflows/update-config-docs.yml new file mode 100644 index 00000000..11dbf6e9 --- /dev/null +++ b/.github/workflows/update-config-docs.yml @@ -0,0 +1,61 @@ +# This file is part of Dependency-Track. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# SPDX-License-Identifier: Apache-2.0 +# Copyright (c) OWASP Foundation. All Rights Reserved. +name: Update Config Documentation + +on: + workflow_dispatch: {} + +permissions: {} + +jobs: + generate-docs: + name: Generate Documentation + runs-on: ubuntu-latest + timeout-minutes: 5 + permissions: + contents: write + pull-requests: write + if: "${{ github.repository_owner == 'DependencyTrack' }}" + steps: + - name: Checkout Repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + - name: Checkout API Server Repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + repository: DependencyTrack/hyades-apiserver + path: hyades-apiserver + persist-credentials: false + - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + with: + enable-cache: false + - name: Generate API Server Documentation + run: >- + make generate-config-docs + APISERVER_PROPERTIES=hyades-apiserver/apiserver/src/main/resources/application.properties + - name: Create Pull Request + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 + with: + add-paths: "docs/reference/configuration/properties.md" + branch: update-config-docs + body: "Updates configuration documentation." + commit-message: Update config docs + delete-branch: true + labels: documentation + signoff: true + title: Update config docs diff --git a/.github/workflows/update-openapi-docs.yml b/.github/workflows/update-openapi-docs.yml new file mode 100644 index 00000000..8e826aa9 --- /dev/null +++ b/.github/workflows/update-openapi-docs.yml @@ -0,0 +1,61 @@ +# This file is part of Dependency-Track. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# SPDX-License-Identifier: Apache-2.0 +# Copyright (c) OWASP Foundation. All Rights Reserved. +name: Update OpenAPI Documentation + +on: + workflow_dispatch: {} + +permissions: {} + +jobs: + update-docs: + name: Update Documentation + runs-on: ubuntu-latest + timeout-minutes: 5 + permissions: + contents: write + pull-requests: write + if: "${{ github.repository_owner == 'DependencyTrack' }}" + steps: + - name: Checkout Repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + - name: Download OpenAPI Specs + env: + GH_TOKEN: "${{ github.token }}" + run: |- + gh run download --repo DependencyTrack/hyades-apiserver \ + --name openapi-spec \ + --dir /tmp/openapi-spec + - name: Update Spec Files + run: |- + cp /tmp/openapi-spec/v1/openapi.yaml \ + docs/reference/api/openapi-v1.yaml + cp /tmp/openapi-spec/v2/openapi.yaml \ + docs/reference/api/openapi-v2.yaml + - name: Create Pull Request + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 + with: + add-paths: "docs/reference/api/openapi-*.yaml" + branch: update-openapi-docs + body: "Updates OpenAPI documentation." + commit-message: Update OpenAPI docs + delete-branch: true + labels: documentation + signoff: true + title: Update OpenAPI docs diff --git a/.github/workflows/update-proto-docs.yml b/.github/workflows/update-proto-docs.yml new file mode 100644 index 00000000..68aa485f --- /dev/null +++ b/.github/workflows/update-proto-docs.yml @@ -0,0 +1,56 @@ +# This file is part of Dependency-Track. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# SPDX-License-Identifier: Apache-2.0 +# Copyright (c) OWASP Foundation. All Rights Reserved. +name: Update Protobuf Documentation + +on: + workflow_dispatch: {} + +permissions: {} + +jobs: + generate-docs: + name: Generate Documentation + runs-on: ubuntu-latest + timeout-minutes: 5 + permissions: + contents: write + pull-requests: write + if: "${{ github.repository_owner == 'DependencyTrack' }}" + steps: + - name: Checkout Repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + - name: Checkout API Server Repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + repository: DependencyTrack/hyades-apiserver + path: hyades-apiserver + persist-credentials: false + - name: Generate Proto Documentation + run: make generate-proto-docs APISERVER_DIR=hyades-apiserver + - name: Create Pull Request + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 + with: + add-paths: "docs/reference/schemas/*.md" + branch: update-proto-docs + body: "Updates Protobuf documentation." + commit-message: Update proto docs + delete-branch: true + labels: documentation + signoff: true + title: Update proto docs diff --git a/AGENTS.md b/AGENTS.md index d77bc6d7..b2937bd3 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -38,6 +38,7 @@ Run the relevant linter after modifying files: - **Markdown files** (`docs/**/*.md`, `context/**/*.md`): `make lint-markdown` - **Prose quality** (`docs/**/*.md`): `make lint-prose` - **YAML files** (`mkdocs.yml`, `.github/**/*.yml`, etc.): `make lint-yaml` +- **Python files** (`scripts/**/*.py`): `make lint-python` - **All at once**: `make lint` Fix all lint errors before considering work complete. @@ -49,6 +50,14 @@ Fix all lint errors before considering work complete. Always verify new or modified pages render correctly with `make build`. +### Generated documentation + +Some reference pages are generated from source repositories. Do not edit these files directly. + +- **Configuration properties** (`docs/reference/configuration/properties.md`): generated by `scripts/generate_config_docs.py` from `application.properties` in the API server repo. Regenerate with `make generate-config-docs APISERVER_PROPERTIES=`. +- **Protobuf schemas** (`docs/reference/schemas/{notification,policy}.md`): generated by `protoc-gen-doc` from proto definitions in the API server repo. Regenerate with `make generate-proto-docs APISERVER_DIR=`. +- **OpenAPI specs** (`docs/reference/api/openapi-*.yaml`): downloaded from API server CI artifacts via the `update-openapi-docs` workflow. + ## Writing conventions - Do not modify files in `existing-docs/`. diff --git a/Makefile b/Makefile index 0c2de1f2..31287595 100644 --- a/Makefile +++ b/Makefile @@ -23,7 +23,7 @@ clean: rm -rf site/ .PHONY: clean -lint: lint-markdown lint-yaml lint-prose +lint: lint-markdown lint-yaml lint-prose lint-python .PHONY: lint lint-markdown: @@ -41,6 +41,11 @@ lint-yaml: yamllint . .PHONY: lint-yaml +lint-python: + uvx ruff check scripts/ + uvx ruff format --check scripts/ +.PHONY: lint-python + lint-prose: docker run --rm \ -v "$(shell pwd)":/workdir \ @@ -54,6 +59,24 @@ lint-prose: docs/ .PHONY: lint-prose +generate-config-docs: + uv run scripts/generate_config_docs.py \ + --template scripts/templates/config-docs.md.j2 \ + --output docs/reference/configuration/properties.md \ + $(APISERVER_PROPERTIES) +.PHONY: generate-config-docs + +generate-proto-docs: + docker run -i --rm -u "$$(id -u):$$(id -g)" \ + -v "$$(pwd)/docs/reference/schemas:/out" \ + -v "$(APISERVER_DIR)/notification/api/src/main/proto/org/dependencytrack/notification/v1:/protos" \ + pseudomuto/protoc-gen-doc:1.5 --doc_opt=/out/notification.md.tmpl,notification.md + docker run -i --rm -u "$$(id -u):$$(id -g)" \ + -v "$$(pwd)/docs/reference/schemas:/out" \ + -v "$(APISERVER_DIR)/proto/src/main/proto/org/dependencytrack/policy/v1:/protos" \ + pseudomuto/protoc-gen-doc:1.5 --doc_opt=/out/policy.md.tmpl,policy.md +.PHONY: generate-proto-docs + serve: uv run mkdocs serve --livereload .PHONY: serve diff --git a/README.md b/README.md index 21e2357c..229e9b78 100644 --- a/README.md +++ b/README.md @@ -38,6 +38,17 @@ make lint # Run all linters make lint-markdown # Markdown (markdownlint) make lint-prose # Prose quality (Vale) make lint-yaml # YAML (yamllint) +make lint-python # Python (Ruff) ``` -Linters run in Docker. Fix all errors before submitting changes. +Linters run in Docker, except for Python which uses [Ruff](https://docs.astral.sh/ruff/) via `uvx`. Fix all errors before submitting changes. + +## Generated documentation + +Some reference pages are generated from upstream source repositories and should not be edited directly. GitHub Actions workflows are provided to automate regeneration. + +| Content | Source | Workflow | Local command | +|:--------|:-------|:---------|:--------------| +| Configuration properties | `application.properties` in [hyades-apiserver](https://github.com/DependencyTrack/hyades-apiserver) | `update-config-docs` | `make generate-config-docs APISERVER_PROPERTIES=` | +| Protobuf schemas | `.proto` files in [hyades-apiserver](https://github.com/DependencyTrack/hyades-apiserver) | `update-proto-docs` | `make generate-proto-docs APISERVER_DIR=` | +| OpenAPI specs | CI artifacts from [hyades-apiserver](https://github.com/DependencyTrack/hyades-apiserver) | `update-openapi-docs` | n/a | diff --git a/docs/reference/configuration/properties.md b/docs/reference/configuration/properties.md index ccf0cb57..af724dd8 100644 --- a/docs/reference/configuration/properties.md +++ b/docs/reference/configuration/properties.md @@ -1,7 +1,7 @@ # Configuration Properties @@ -30,2284 +30,2525 @@ Configuration properties may use the following types: ## CORS **`dt.cors.allow.credentials`** [¶](#dtcorsallowcredentials){ .headerlink } -: Controls the content of the `Access-Control-Allow-Credentials` response header.
Has no effect when [`dt.cors.enabled`](#dtcorsenabled) is `false`. - - - - -
Typeboolean
Defaulttrue
ENVDT_CORS_ALLOW_CREDENTIALS
+Controls the content of the `Access-Control-Allow-Credentials` response header.
Has no effect when [`dt.cors.enabled`](#dtcorsenabled) is `false`. + + + + + +
Typeboolean
Defaulttrue
ENVDT_CORS_ALLOW_CREDENTIALS
**`dt.cors.allow.headers`** [¶](#dtcorsallowheaders){ .headerlink } -: Controls the content of the `Access-Control-Allow-Headers` response header.
Has no effect when [`dt.cors.enabled`](#dtcorsenabled) is `false`. - - - - -
Typestring
DefaultOrigin,Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin,X-Api-Key,X-Total-Count,*
ENVDT_CORS_ALLOW_HEADERS
+Controls the content of the `Access-Control-Allow-Headers` response header.
Has no effect when [`dt.cors.enabled`](#dtcorsenabled) is `false`. + + + + + +
Typestring
DefaultOrigin,Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin,X-Api-Key,X-Total-Count,*
ENVDT_CORS_ALLOW_HEADERS
**`dt.cors.allow.methods`** [¶](#dtcorsallowmethods){ .headerlink } -: Controls the content of the `Access-Control-Allow-Methods` response header.
Has no effect when [`dt.cors.enabled`](#dtcorsenabled) is `false`. - - - - -
Typestring
DefaultGET,POST,PUT,PATCH,DELETE,OPTIONS
ENVDT_CORS_ALLOW_METHODS
+Controls the content of the `Access-Control-Allow-Methods` response header.
Has no effect when [`dt.cors.enabled`](#dtcorsenabled) is `false`. + + + + + +
Typestring
DefaultGET,POST,PUT,PATCH,DELETE,OPTIONS
ENVDT_CORS_ALLOW_METHODS
**`dt.cors.allow.origin`** [¶](#dtcorsalloworigin){ .headerlink } -: Controls the content of the `Access-Control-Allow-Origin` response header.
Has no effect when [`dt.cors.enabled`](#dtcorsenabled) is `false`. - - - - -
Typestring
Default*
ENVDT_CORS_ALLOW_ORIGIN
+Controls the content of the `Access-Control-Allow-Origin` response header.
Has no effect when [`dt.cors.enabled`](#dtcorsenabled) is `false`. + + + + + +
Typestring
Default*
ENVDT_CORS_ALLOW_ORIGIN
**`dt.cors.enabled`** [¶](#dtcorsenabled){ .headerlink } -: Defines whether [Cross Origin Resource Sharing](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) (CORS) headers shall be included in REST API responses. - - - - -
Typeboolean
Defaulttrue
ENVDT_CORS_ENABLED
+Defines whether [Cross Origin Resource Sharing](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) (CORS) headers shall be included in REST API responses. + + + + + +
Typeboolean
Defaulttrue
ENVDT_CORS_ENABLED
**`dt.cors.expose.headers`** [¶](#dtcorsexposeheaders){ .headerlink } -: Controls the content of the `Access-Control-Expose-Headers` response header.
Has no effect when [`dt.cors.enabled`](#dtcorsenabled) is `false`. - - - - -
Typestring
DefaultOrigin,Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin,X-Api-Key,X-Total-Count
ENVDT_CORS_EXPOSE_HEADERS
+Controls the content of the `Access-Control-Expose-Headers` response header.
Has no effect when [`dt.cors.enabled`](#dtcorsenabled) is `false`. + + + + + +
Typestring
DefaultOrigin,Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin,X-Api-Key,X-Total-Count
ENVDT_CORS_EXPOSE_HEADERS
**`dt.cors.max.age`** [¶](#dtcorsmaxage){ .headerlink } -: Controls the content of the `Access-Control-Max-Age` response header.
Has no effect when [`dt.cors.enabled`](#dtcorsenabled) is `false`. - - - - -
Typeinteger
Default3600
ENVDT_CORS_MAX_AGE
+Controls the content of the `Access-Control-Max-Age` response header.
Has no effect when [`dt.cors.enabled`](#dtcorsenabled) is `false`. + + + + + +
Typeinteger
Default3600
ENVDT_CORS_MAX_AGE
## Cache -**`dt.cache."package-metadata-resolver.cargo.responses".ttl-ms`** [¶](#dtcache"package-metadata-resolvercargoresponses"ttl-ms){ .headerlink } -: Defines the TTL in milliseconds for Cargo package metadata resolver response cache entries. - - - - - -
Typeinteger
Default7200000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_CARGO_RESPONSES__TTL_MS
- -**`dt.cache."package-metadata-resolver.composer.responses".ttl-ms`** [¶](#dtcache"package-metadata-resolvercomposerresponses"ttl-ms){ .headerlink } -: Defines the TTL in milliseconds for Composer package metadata resolver response cache entries. - - - - - -
Typeinteger
Default7200000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_COMPOSER_RESPONSES__TTL_MS
- -**`dt.cache."package-metadata-resolver.cpan.responses".ttl-ms`** [¶](#dtcache"package-metadata-resolvercpanresponses"ttl-ms){ .headerlink } -: Defines the TTL in milliseconds for CPAN package metadata resolver response cache entries. - - - - - -
Typeinteger
Default14400000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_CPAN_RESPONSES__TTL_MS
- -**`dt.cache."package-metadata-resolver.gem.responses".ttl-ms`** [¶](#dtcache"package-metadata-resolvergemresponses"ttl-ms){ .headerlink } -: Defines the TTL in milliseconds for RubyGems package metadata resolver response cache entries. - - - - - -
Typeinteger
Default7200000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_GEM_RESPONSES__TTL_MS
- -**`dt.cache."package-metadata-resolver.github.responses".ttl-ms`** [¶](#dtcache"package-metadata-resolvergithubresponses"ttl-ms){ .headerlink } -: Defines the TTL in milliseconds for GitHub package metadata resolver response cache entries. - - - - - -
Typeinteger
Default3600000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_GITHUB_RESPONSES__TTL_MS
- -**`dt.cache."package-metadata-resolver.gomodules.responses".ttl-ms`** [¶](#dtcache"package-metadata-resolvergomodulesresponses"ttl-ms){ .headerlink } -: Defines the TTL in milliseconds for Go Modules package metadata resolver response cache entries. - - - - - -
Typeinteger
Default14400000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_GOMODULES_RESPONSES__TTL_MS
- -**`dt.cache."package-metadata-resolver.hackage.responses".ttl-ms`** [¶](#dtcache"package-metadata-resolverhackageresponses"ttl-ms){ .headerlink } -: Defines the TTL in milliseconds for Hackage package metadata resolver response cache entries. - - - - - -
Typeinteger
Default14400000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_HACKAGE_RESPONSES__TTL_MS
- -**`dt.cache."package-metadata-resolver.hex.responses".ttl-ms`** [¶](#dtcache"package-metadata-resolverhexresponses"ttl-ms){ .headerlink } -: Defines the TTL in milliseconds for Hex package metadata resolver response cache entries. - - - - - -
Typeinteger
Default7200000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_HEX_RESPONSES__TTL_MS
- -**`dt.cache."package-metadata-resolver.maven.responses".ttl-ms`** [¶](#dtcache"package-metadata-resolvermavenresponses"ttl-ms){ .headerlink } -: Defines the TTL in milliseconds for Maven package metadata resolver response cache entries. - - - - - -
Typeinteger
Default14400000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_MAVEN_RESPONSES__TTL_MS
- -**`dt.cache."package-metadata-resolver.nixpkgs.responses".ttl-ms`** [¶](#dtcache"package-metadata-resolvernixpkgsresponses"ttl-ms){ .headerlink } -: Defines the TTL in milliseconds for Nixpkgs package metadata resolver response cache entries. - - - - - -
Typeinteger
Default14400000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_NIXPKGS_RESPONSES__TTL_MS
- -**`dt.cache."package-metadata-resolver.npm.responses".ttl-ms`** [¶](#dtcache"package-metadata-resolvernpmresponses"ttl-ms){ .headerlink } -: Defines the TTL in milliseconds for npm package metadata resolver response cache entries. - - - - - -
Typeinteger
Default3600000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_NPM_RESPONSES__TTL_MS
- -**`dt.cache."package-metadata-resolver.nuget.responses".ttl-ms`** [¶](#dtcache"package-metadata-resolvernugetresponses"ttl-ms){ .headerlink } -: Defines the TTL in milliseconds for NuGet package metadata resolver response cache entries. - - - - - -
Typeinteger
Default14400000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_NUGET_RESPONSES__TTL_MS
- -**`dt.cache."package-metadata-resolver.pypi.responses".ttl-ms`** [¶](#dtcache"package-metadata-resolverpypiresponses"ttl-ms){ .headerlink } -: Defines the TTL in milliseconds for PyPI package metadata resolver response cache entries. - - - - - -
Typeinteger
Default7200000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_PYPI_RESPONSES__TTL_MS
- -**`dt.cache."vuln-analyzer.oss-index.results".max-size`** [¶](#dtcache"vuln-analyzeross-indexresults"max-size){ .headerlink } -: Defines the maximum number of entries in the OSS Index result cache. - - - - - -
Typeinteger
Default30000
ENVDT_CACHE__VULN_ANALYZER_OSS_INDEX_RESULTS__MAX_SIZE
- -**`dt.cache."vuln-analyzer.oss-index.results".ttl-ms`** [¶](#dtcache"vuln-analyzeross-indexresults"ttl-ms){ .headerlink } -: Defines the TTL in milliseconds for OSS Index result cache entries. - - - - - -
Typeinteger
Default43200000
ENVDT_CACHE__VULN_ANALYZER_OSS_INDEX_RESULTS__TTL_MS
- -**`dt.cache."vuln-analyzer.snyk.results".max-size`** [¶](#dtcache"vuln-analyzersnykresults"max-size){ .headerlink } -: Defines the maximum number of entries in the Snyk result cache. - - - - - -
Typeinteger
Default30000
ENVDT_CACHE__VULN_ANALYZER_SNYK_RESULTS__MAX_SIZE
- -**`dt.cache."vuln-analyzer.snyk.results".ttl-ms`** [¶](#dtcache"vuln-analyzersnykresults"ttl-ms){ .headerlink } -: Defines the TTL in milliseconds for Snyk result cache entries. - - - - - -
Typeinteger
Default43200000
ENVDT_CACHE__VULN_ANALYZER_SNYK_RESULTS__TTL_MS
+**`dt.cache."package-metadata-resolver.cargo.responses".ttl-ms`** [¶](#dtcachepackage-metadata-resolvercargoresponsesttl-ms){ .headerlink } + +Defines the TTL in milliseconds for Cargo package metadata resolver response cache entries. + + + + + +
Typeinteger
Default7200000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_CARGO_RESPONSES__TTL_MS
+ +**`dt.cache."package-metadata-resolver.composer.responses".ttl-ms`** [¶](#dtcachepackage-metadata-resolvercomposerresponsesttl-ms){ .headerlink } + +Defines the TTL in milliseconds for Composer package metadata resolver response cache entries. + + + + + +
Typeinteger
Default7200000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_COMPOSER_RESPONSES__TTL_MS
+ +**`dt.cache."package-metadata-resolver.cpan.responses".ttl-ms`** [¶](#dtcachepackage-metadata-resolvercpanresponsesttl-ms){ .headerlink } + +Defines the TTL in milliseconds for CPAN package metadata resolver response cache entries. + + + + + +
Typeinteger
Default14400000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_CPAN_RESPONSES__TTL_MS
+ +**`dt.cache."package-metadata-resolver.gem.responses".ttl-ms`** [¶](#dtcachepackage-metadata-resolvergemresponsesttl-ms){ .headerlink } + +Defines the TTL in milliseconds for RubyGems package metadata resolver response cache entries. + + + + + +
Typeinteger
Default7200000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_GEM_RESPONSES__TTL_MS
+ +**`dt.cache."package-metadata-resolver.github.responses".ttl-ms`** [¶](#dtcachepackage-metadata-resolvergithubresponsesttl-ms){ .headerlink } + +Defines the TTL in milliseconds for GitHub package metadata resolver response cache entries. + + + + + +
Typeinteger
Default3600000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_GITHUB_RESPONSES__TTL_MS
+ +**`dt.cache."package-metadata-resolver.gomodules.responses".ttl-ms`** [¶](#dtcachepackage-metadata-resolvergomodulesresponsesttl-ms){ .headerlink } + +Defines the TTL in milliseconds for Go Modules package metadata resolver response cache entries. + + + + + +
Typeinteger
Default14400000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_GOMODULES_RESPONSES__TTL_MS
+ +**`dt.cache."package-metadata-resolver.hackage.responses".ttl-ms`** [¶](#dtcachepackage-metadata-resolverhackageresponsesttl-ms){ .headerlink } + +Defines the TTL in milliseconds for Hackage package metadata resolver response cache entries. + + + + + +
Typeinteger
Default14400000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_HACKAGE_RESPONSES__TTL_MS
+ +**`dt.cache."package-metadata-resolver.hex.responses".ttl-ms`** [¶](#dtcachepackage-metadata-resolverhexresponsesttl-ms){ .headerlink } + +Defines the TTL in milliseconds for Hex package metadata resolver response cache entries. + + + + + +
Typeinteger
Default7200000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_HEX_RESPONSES__TTL_MS
+ +**`dt.cache."package-metadata-resolver.maven.responses".ttl-ms`** [¶](#dtcachepackage-metadata-resolvermavenresponsesttl-ms){ .headerlink } + +Defines the TTL in milliseconds for Maven package metadata resolver response cache entries. + + + + + +
Typeinteger
Default14400000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_MAVEN_RESPONSES__TTL_MS
+ +**`dt.cache."package-metadata-resolver.nixpkgs.responses".ttl-ms`** [¶](#dtcachepackage-metadata-resolvernixpkgsresponsesttl-ms){ .headerlink } + +Defines the TTL in milliseconds for Nixpkgs package metadata resolver response cache entries. + + + + + +
Typeinteger
Default14400000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_NIXPKGS_RESPONSES__TTL_MS
+ +**`dt.cache."package-metadata-resolver.npm.responses".ttl-ms`** [¶](#dtcachepackage-metadata-resolvernpmresponsesttl-ms){ .headerlink } + +Defines the TTL in milliseconds for npm package metadata resolver response cache entries. + + + + + +
Typeinteger
Default3600000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_NPM_RESPONSES__TTL_MS
+ +**`dt.cache."package-metadata-resolver.nuget.responses".ttl-ms`** [¶](#dtcachepackage-metadata-resolvernugetresponsesttl-ms){ .headerlink } + +Defines the TTL in milliseconds for NuGet package metadata resolver response cache entries. + + + + + +
Typeinteger
Default14400000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_NUGET_RESPONSES__TTL_MS
+ +**`dt.cache."package-metadata-resolver.pypi.responses".ttl-ms`** [¶](#dtcachepackage-metadata-resolverpypiresponsesttl-ms){ .headerlink } + +Defines the TTL in milliseconds for PyPI package metadata resolver response cache entries. + + + + + +
Typeinteger
Default7200000
ENVDT_CACHE__PACKAGE_METADATA_RESOLVER_PYPI_RESPONSES__TTL_MS
+ +**`dt.cache."vuln-analyzer.oss-index.results".max-size`** [¶](#dtcachevuln-analyzeross-indexresultsmax-size){ .headerlink } + +Defines the maximum number of entries in the OSS Index result cache. + + + + + +
Typeinteger
Default30000
ENVDT_CACHE__VULN_ANALYZER_OSS_INDEX_RESULTS__MAX_SIZE
+ +**`dt.cache."vuln-analyzer.oss-index.results".ttl-ms`** [¶](#dtcachevuln-analyzeross-indexresultsttl-ms){ .headerlink } + +Defines the TTL in milliseconds for OSS Index result cache entries. + + + + + +
Typeinteger
Default43200000
ENVDT_CACHE__VULN_ANALYZER_OSS_INDEX_RESULTS__TTL_MS
+ +**`dt.cache."vuln-analyzer.snyk.results".max-size`** [¶](#dtcachevuln-analyzersnykresultsmax-size){ .headerlink } + +Defines the maximum number of entries in the Snyk result cache. + + + + + +
Typeinteger
Default30000
ENVDT_CACHE__VULN_ANALYZER_SNYK_RESULTS__MAX_SIZE
+ +**`dt.cache."vuln-analyzer.snyk.results".ttl-ms`** [¶](#dtcachevuln-analyzersnykresultsttl-ms){ .headerlink } + +Defines the TTL in milliseconds for Snyk result cache entries. + + + + + +
Typeinteger
Default43200000
ENVDT_CACHE__VULN_ANALYZER_SNYK_RESULTS__TTL_MS
**`dt.cache.provider`** * [¶](#dtcacheprovider){ .headerlink } -: Defines the cache provider to use. - - - - - -
Typeenum
Defaultdatabase
Valid Values[database]
ENVDT_CACHE_PROVIDER
+Defines the cache provider to use. + + + + + + +
Typeenum
Defaultdatabase
Valid Values[database]
ENVDT_CACHE_PROVIDER
**`dt.cache.provider.database.datasource.name`** [¶](#dtcacheproviderdatabasedatasourcename){ .headerlink } -: Defines the name of the data source to be used by the database cache provider. - - - - -
Typestring
Defaultdefault
ENVDT_CACHE_PROVIDER_DATABASE_DATASOURCE_NAME
+Defines the name of the data source to be used by the database cache provider. + + + + + +
Typestring
Defaultdefault
ENVDT_CACHE_PROVIDER_DATABASE_DATASOURCE_NAME
**`dt.cache.provider.database.maintenance.initial-delay-ms`** [¶](#dtcacheproviderdatabasemaintenanceinitial-delay-ms){ .headerlink } -: Defines the initial delay in milliseconds after which the database cache provider first performs its maintenance activities, e.g. entry expiration. - - - - -
Typeinteger
Default60000
ENVDT_CACHE_PROVIDER_DATABASE_MAINTENANCE_INITIAL_DELAY_MS
+Defines the initial delay in milliseconds after which the database cache provider first performs its maintenance activities, e.g. entry expiration. + + + + + +
Typeinteger
Default60000
ENVDT_CACHE_PROVIDER_DATABASE_MAINTENANCE_INITIAL_DELAY_MS
**`dt.cache.provider.database.maintenance.interval-ms`** [¶](#dtcacheproviderdatabasemaintenanceinterval-ms){ .headerlink } -: Defines the interval in milliseconds in which the database cache provider performs its maintenance activities, e.g. entry expiration. - - - - -
Typeinteger
Default300000
ENVDT_CACHE_PROVIDER_DATABASE_MAINTENANCE_INTERVAL_MS
+Defines the interval in milliseconds in which the database cache provider performs its maintenance activities, e.g. entry expiration. + + + + + +
Typeinteger
Default300000
ENVDT_CACHE_PROVIDER_DATABASE_MAINTENANCE_INTERVAL_MS
## Database **`dt.database.password`** [¶](#dtdatabasepassword){ .headerlink } -: Specifies the password to use when authenticating to the database. - !!! warning "Deprecated" - Since 5.7.0. Use [`dt.datasource.password`](#dtdatasourcepassword) instead. +Specifies the password to use when authenticating to the database. + + +!!! warning "Deprecated" + Since 5.7.0. Use [`dt.datasource.password`](#dtdatasourcepassword) instead. - - - - -
Typestring
Defaultdtrack
ENVDT_DATABASE_PASSWORD
+ + + + +
Typestring
Defaultdtrack
ENVDT_DATABASE_PASSWORD
**`dt.database.password.file`** [¶](#dtdatabasepasswordfile){ .headerlink } -: Specifies the file to load the database password from. If set, takes precedence over [`dt.database.password`](#dtdatabasepassword). - !!! warning "Deprecated" - Since 5.7.0. Use [`dt.datasource.password`](#dtdatasourcepassword)-file instead. +Specifies the file to load the database password from. If set, takes precedence over [`dt.database.password`](#dtdatabasepassword). - - - - - -
Typestring
Defaultnull
Example/var/run/secrets/database-password
ENVDT_DATABASE_PASSWORD_FILE
+ +!!! warning "Deprecated" + Since 5.7.0. Use [`dt.datasource.password`](#dtdatasourcepassword)-file instead. + + + + + + +
Typestring
Defaultnull
Example/var/run/secrets/database-password
ENVDT_DATABASE_PASSWORD_FILE
**`dt.database.pool.enabled`** [¶](#dtdatabasepoolenabled){ .headerlink } -: Specifies if the database connection pool is enabled. - !!! warning "Deprecated" - Since 5.7.0. Use [`dt.datasource.pool.enabled`](#dtdatasourcepoolenabled) instead. +Specifies if the database connection pool is enabled. + - - - - -
Typeboolean
Defaulttrue
ENVDT_DATABASE_POOL_ENABLED
+!!! warning "Deprecated" + Since 5.7.0. Use [`dt.datasource.pool.enabled`](#dtdatasourcepoolenabled) instead. + + + + + +
Typeboolean
Defaulttrue
ENVDT_DATABASE_POOL_ENABLED
**`dt.database.pool.idle.timeout`** [¶](#dtdatabasepoolidletimeout){ .headerlink } -: This property controls the maximum amount of time that a connection is allowed to sit idle in the pool. - !!! warning "Deprecated" - Since 5.7.0. Use [`dt.datasource.pool.idle-timeout-ms`](#dtdatasourcepoolidle-timeout-ms) instead. +This property controls the maximum amount of time that a connection is allowed to sit idle in the pool. + - - - - -
Typeinteger
Default300000
ENVDT_DATABASE_POOL_IDLE_TIMEOUT
+!!! warning "Deprecated" + Since 5.7.0. Use [`dt.datasource.pool.idle-timeout-ms`](#dtdatasourcepoolidle-timeout-ms) instead. + + + + + +
Typeinteger
Default300000
ENVDT_DATABASE_POOL_IDLE_TIMEOUT
**`dt.database.pool.max.lifetime`** [¶](#dtdatabasepoolmaxlifetime){ .headerlink } -: This property controls the maximum lifetime of a connection in the pool. An in-use connection will never be retired, only when it is closed will it then be removed. - !!! warning "Deprecated" - Since 5.7.0. Use [`dt.datasource.pool.max-lifetime-ms`](#dtdatasourcepoolmax-lifetime-ms) instead. +This property controls the maximum lifetime of a connection in the pool. An in-use connection will never be retired, only when it is closed will it then be removed. + - - - - -
Typeinteger
Default600000
ENVDT_DATABASE_POOL_MAX_LIFETIME
+!!! warning "Deprecated" + Since 5.7.0. Use [`dt.datasource.pool.max-lifetime-ms`](#dtdatasourcepoolmax-lifetime-ms) instead. + + + + + +
Typeinteger
Default600000
ENVDT_DATABASE_POOL_MAX_LIFETIME
**`dt.database.pool.max.size`** [¶](#dtdatabasepoolmaxsize){ .headerlink } -: This property controls the maximum size that the pool is allowed to reach, including both idle and in-use connections. - !!! warning "Deprecated" - Since 5.7.0. Use [`dt.datasource.pool.max-size`](#dtdatasourcepoolmax-size) instead. +This property controls the maximum size that the pool is allowed to reach, including both idle and in-use connections. + - - - - -
Typeinteger
Default30
ENVDT_DATABASE_POOL_MAX_SIZE
+!!! warning "Deprecated" + Since 5.7.0. Use [`dt.datasource.pool.max-size`](#dtdatasourcepoolmax-size) instead. + + + + + +
Typeinteger
Default30
ENVDT_DATABASE_POOL_MAX_SIZE
**`dt.database.pool.min.idle`** [¶](#dtdatabasepoolminidle){ .headerlink } -: This property controls the minimum number of idle connections in the pool. This value should be equal to or less than [`dt.database.pool.max.size`](#dtdatabasepoolmaxsize). Warning: If the value is less than [`dt.database.pool.max.size`](#dtdatabasepoolmaxsize), [`dt.database.pool.idle.timeout`](#dtdatabasepoolidletimeout) will have no effect. - !!! warning "Deprecated" - Since 5.7.0. Use [`dt.datasource.pool.min-idle`](#dtdatasourcepoolmin-idle) instead. +This property controls the minimum number of idle connections in the pool. This value should be equal to or less than [`dt.database.pool.max.size`](#dtdatabasepoolmaxsize). Warning: If the value is less than [`dt.database.pool.max.size`](#dtdatabasepoolmaxsize), [`dt.database.pool.idle.timeout`](#dtdatabasepoolidletimeout) will have no effect. + + +!!! warning "Deprecated" + Since 5.7.0. Use [`dt.datasource.pool.min-idle`](#dtdatasourcepoolmin-idle) instead. - - - - -
Typeinteger
Default15
ENVDT_DATABASE_POOL_MIN_IDLE
+ + + + +
Typeinteger
Default15
ENVDT_DATABASE_POOL_MIN_IDLE
**`dt.database.url`** [¶](#dtdatabaseurl){ .headerlink } -: Specifies the JDBC URL to use when connecting to the database. For best performance, set the `reWriteBatchedInserts` query parameter to `true`. - !!! warning "Deprecated" - Since 5.7.0. Use [`dt.datasource.url`](#dtdatasourceurl) instead. +Specifies the JDBC URL to use when connecting to the database. For best performance, set the `reWriteBatchedInserts` query parameter to `true`. + + +!!! warning "Deprecated" + Since 5.7.0. Use [`dt.datasource.url`](#dtdatasourceurl) instead. - - - - - -
Typestring
Defaultnull
Examplejdbc:postgresql://localhost:5432/dtrack?reWriteBatchedInserts=true
ENVDT_DATABASE_URL
+ + + + + +
Typestring
Defaultnull
Examplejdbc:postgresql://localhost:5432/dtrack?reWriteBatchedInserts=true
ENVDT_DATABASE_URL
**`dt.database.username`** [¶](#dtdatabaseusername){ .headerlink } -: Specifies the username to use when authenticating to the database. - !!! warning "Deprecated" - Since 5.7.0. Use [`dt.datasource.username`](#dtdatasourceusername) instead. +Specifies the username to use when authenticating to the database. - - - - -
Typestring
Defaultdtrack
ENVDT_DATABASE_USERNAME
+ +!!! warning "Deprecated" + Since 5.7.0. Use [`dt.datasource.username`](#dtdatasourceusername) instead. + + + + + +
Typestring
Defaultdtrack
ENVDT_DATABASE_USERNAME
**`dt.datasource.password`** [¶](#dtdatasourcepassword){ .headerlink } -: Defines the password to use for the default data source. - - - - -
Typestring
Default${dt.database.password}
ENVDT_DATASOURCE_PASSWORD
+Defines the password to use for the default data source. + + + + + +
Typestring
Default${dt.database.password}
ENVDT_DATASOURCE_PASSWORD
**`dt.datasource.password-file`** [¶](#dtdatasourcepassword-file){ .headerlink } -: Defines the location of the file to load the password for the default data source from. If set, takes precedence over [`dt.datasource.password`](#dtdatasourcepassword). - - - - -
Typestring
Default${dt.database.password.file}
ENVDT_DATASOURCE_PASSWORD_FILE
+Defines the location of the file to load the password for the default data source from. If set, takes precedence over [`dt.datasource.password`](#dtdatasourcepassword). + + + + + +
Typestring
Default${dt.database.password.file}
ENVDT_DATASOURCE_PASSWORD_FILE
**`dt.datasource.pool.enabled`** * [¶](#dtdatasourcepoolenabled){ .headerlink } -: Defines whether connection pooling is enabled for the default data source. - - - - -
Typeboolean
Default${dt.database.pool.enabled}
ENVDT_DATASOURCE_POOL_ENABLED
+Defines whether connection pooling is enabled for the default data source. + + + + + +
Typeboolean
Default${dt.database.pool.enabled}
ENVDT_DATASOURCE_POOL_ENABLED
**`dt.datasource.pool.idle-timeout-ms`** [¶](#dtdatasourcepoolidle-timeout-ms){ .headerlink } -: Defines the maximum time in milliseconds that a connection is allowed to sit idle in the pool. - - - - -
Typeinteger
Default${dt.database.pool.idle.timeout}
ENVDT_DATASOURCE_POOL_IDLE_TIMEOUT_MS
+Defines the maximum time in milliseconds that a connection is allowed to sit idle in the pool. + + + + + +
Typeinteger
Default${dt.database.pool.idle.timeout}
ENVDT_DATASOURCE_POOL_IDLE_TIMEOUT_MS
**`dt.datasource.pool.max-lifetime-ms`** [¶](#dtdatasourcepoolmax-lifetime-ms){ .headerlink } -: Defines the maximum time in milliseconds for which connections should be kept in the pool for the default data source. Required when [`dt.datasource.pool.enabled`](#dtdatasourcepoolenabled) is `true`. - - - - -
Typeinteger
Default${dt.database.pool.max.lifetime}
ENVDT_DATASOURCE_POOL_MAX_LIFETIME_MS
+Defines the maximum time in milliseconds for which connections should be kept in the pool for the default data source. Required when [`dt.datasource.pool.enabled`](#dtdatasourcepoolenabled) is `true`. + + + + + +
Typeinteger
Default${dt.database.pool.max.lifetime}
ENVDT_DATASOURCE_POOL_MAX_LIFETIME_MS
**`dt.datasource.pool.max-size`** [¶](#dtdatasourcepoolmax-size){ .headerlink } -: Defines the maximum size of the connection pool for the default data source. Required when [`dt.datasource.pool.enabled`](#dtdatasourcepoolenabled) is `true`. - - - - -
Typeinteger
Default${dt.database.pool.max.size}
ENVDT_DATASOURCE_POOL_MAX_SIZE
+Defines the maximum size of the connection pool for the default data source. Required when [`dt.datasource.pool.enabled`](#dtdatasourcepoolenabled) is `true`. + + + + + +
Typeinteger
Default${dt.database.pool.max.size}
ENVDT_DATASOURCE_POOL_MAX_SIZE
**`dt.datasource.pool.min-idle`** [¶](#dtdatasourcepoolmin-idle){ .headerlink } -: Defines the minimum number of idle connections in the pool for the default data source. Required when [`dt.datasource.pool.enabled`](#dtdatasourcepoolenabled) is `true`. - - - - -
Typeinteger
Default${dt.database.pool.min.idle}
ENVDT_DATASOURCE_POOL_MIN_IDLE
+Defines the minimum number of idle connections in the pool for the default data source. Required when [`dt.datasource.pool.enabled`](#dtdatasourcepoolenabled) is `true`. + + + + + +
Typeinteger
Default${dt.database.pool.min.idle}
ENVDT_DATASOURCE_POOL_MIN_IDLE
**`dt.datasource.url`** * [¶](#dtdatasourceurl){ .headerlink } -: Defines the JDBC URL to use for the default data source. - - - - - -
Typestring
Default${dt.database.url}
Examplejdbc:postgresql://localhost:5432/dtrack?reWriteBatchedInserts=true
ENVDT_DATASOURCE_URL
+Defines the JDBC URL to use for the default data source. + + + + + + +
Typestring
Default${dt.database.url}
Examplejdbc:postgresql://localhost:5432/dtrack?reWriteBatchedInserts=true
ENVDT_DATASOURCE_URL
**`dt.datasource.username`** [¶](#dtdatasourceusername){ .headerlink } -: Defines the username to use for the default data source. - - - - -
Typestring
Default${dt.database.username}
ENVDT_DATASOURCE_USERNAME
+Defines the username to use for the default data source. + + + + + +
Typestring
Default${dt.database.username}
ENVDT_DATASOURCE_USERNAME
**`dt.dex-engine.datasource.name`** [¶](#dtdex-enginedatasourcename){ .headerlink } -: Defines the name of the data source to be used by the durable execution engine. For larger deployments, it is recommended to use a separate, non-default data source. - - - - -
Typestring
Defaultdefault
ENVDT_DEX_ENGINE_DATASOURCE_NAME
+Defines the name of the data source to be used by the durable execution engine. For larger deployments, it is recommended to use a separate, non-default data source. + + + + + +
Typestring
Defaultdefault
ENVDT_DEX_ENGINE_DATASOURCE_NAME
**`dt.dex-engine.migration.datasource.name`** [¶](#dtdex-enginemigrationdatasourcename){ .headerlink } -: Defines the name of the data source to use for executing database migrations of the durable execution engine. - - - - -
Typestring
Defaultnull
ENVDT_DEX_ENGINE_MIGRATION_DATASOURCE_NAME
+Defines the name of the data source to use for executing database migrations of the durable execution engine. + + + + + +
Typestring
Defaultnull
ENVDT_DEX_ENGINE_MIGRATION_DATASOURCE_NAME
**`dt.init.tasks.datasource.close-after-use`** * [¶](#dtinittasksdatasourceclose-after-use){ .headerlink } -: Defines whether the data source used by init tasks should be closed after all tasks completed. This is useful when a non-default data source was configured, that is not used anywhere else. - - - - -
Typeboolean
Defaultfalse
ENVDT_INIT_TASKS_DATASOURCE_CLOSE_AFTER_USE
+Defines whether the data source used by init tasks should be closed after all tasks completed. This is useful when a non-default data source was configured, that is not used anywhere else. + + + + + +
Typeboolean
Defaultfalse
ENVDT_INIT_TASKS_DATASOURCE_CLOSE_AFTER_USE
**`dt.init.tasks.datasource.name`** * [¶](#dtinittasksdatasourcename){ .headerlink } -: Defines the name of the data source to be used by init tasks. - - - - -
Typestring
Defaultdefault
ENVDT_INIT_TASKS_DATASOURCE_NAME
+Defines the name of the data source to be used by init tasks. + + + + + +
Typestring
Defaultdefault
ENVDT_INIT_TASKS_DATASOURCE_NAME
## Development **`dt.dev.services.enabled`** [¶](#dtdevservicesenabled){ .headerlink } -: Whether dev services shall be enabled.

When enabled, Dependency-Track will automatically launch containers for:
  • Frontend
  • PostgreSQL
at startup, and configures itself to use them. They are disposed when Dependency-Track stops. The containers are exposed on randomized ports, which will be logged during startup.

Trying to enable dev services in a production build will prevent the application from starting.

Note that the containers launched by the API server can not currently be discovered and re-used by other Hyades services. This is a future enhancement tracked in . - - - - -
Typeboolean
Defaultfalse
ENVDT_DEV_SERVICES_ENABLED
+Whether dev services shall be enabled.

When enabled, Dependency-Track will automatically launch containers for:
  • Frontend
  • PostgreSQL
at startup, and configures itself to use them. They are disposed when Dependency-Track stops. The containers are exposed on randomized ports, which will be logged during startup.

Trying to enable dev services in a production build will prevent the application from starting.

Note that the containers launched by the API server can not currently be discovered and re-used by other Hyades services. This is a future enhancement tracked in . + + + + + +
Typeboolean
Defaultfalse
ENVDT_DEV_SERVICES_ENABLED
**`dt.dev.services.image.frontend`** [¶](#dtdevservicesimagefrontend){ .headerlink } -: The image to use for the frontend dev services container. - - - - -
Typestring
Defaultghcr.io/dependencytrack/hyades-frontend:snapshot
ENVDT_DEV_SERVICES_IMAGE_FRONTEND
+The image to use for the frontend dev services container. + + + + + +
Typestring
Defaultghcr.io/dependencytrack/hyades-frontend:snapshot
ENVDT_DEV_SERVICES_IMAGE_FRONTEND
**`dt.dev.services.image.postgres`** [¶](#dtdevservicesimagepostgres){ .headerlink } -: The image to use for the PostgreSQL dev services container. - - - - -
Typestring
Defaultpostgres:14-alpine
ENVDT_DEV_SERVICES_IMAGE_POSTGRES
+The image to use for the PostgreSQL dev services container. + + + + + +
Typestring
Defaultpostgres:14-alpine
ENVDT_DEV_SERVICES_IMAGE_POSTGRES
**`dt.dev.services.port.frontend`** [¶](#dtdevservicesportfrontend){ .headerlink } -: The port on which the frontend dev services container shall be exposed on the host. - - - - -
Typeinteger
Default8081
ENVDT_DEV_SERVICES_PORT_FRONTEND
+The port on which the frontend dev services container shall be exposed on the host. + + + + + +
Typeinteger
Default8081
ENVDT_DEV_SERVICES_PORT_FRONTEND
## Durable Execution **`dt.dex-engine.activity-task-heartbeat-buffer.flush-interval-ms`** [¶](#dtdex-engineactivity-task-heartbeat-bufferflush-interval-ms){ .headerlink } -: Defines the time in milliseconds between flushes of the activity task heartbeat buffer. - - - - -
Typeinteger
Default100
ENVDT_DEX_ENGINE_ACTIVITY_TASK_HEARTBEAT_BUFFER_FLUSH_INTERVAL_MS
+Defines the time in milliseconds between flushes of the activity task heartbeat buffer. + + + + + +
Typeinteger
Default100
ENVDT_DEX_ENGINE_ACTIVITY_TASK_HEARTBEAT_BUFFER_FLUSH_INTERVAL_MS
**`dt.dex-engine.activity-task-heartbeat-buffer.max-batch-size`** [¶](#dtdex-engineactivity-task-heartbeat-buffermax-batch-size){ .headerlink } -: Defines the maximum number of items of the activity task heartbeat buffer. - - - - -
Typeinteger
Default100
ENVDT_DEX_ENGINE_ACTIVITY_TASK_HEARTBEAT_BUFFER_MAX_BATCH_SIZE
+Defines the maximum number of items of the activity task heartbeat buffer. + + + + + +
Typeinteger
Default100
ENVDT_DEX_ENGINE_ACTIVITY_TASK_HEARTBEAT_BUFFER_MAX_BATCH_SIZE
**`dt.dex-engine.activity-task-scheduler.poll-interval-ms`** [¶](#dtdex-engineactivity-task-schedulerpoll-interval-ms){ .headerlink } -: Defines the interval in milliseconds in which the activity task scheduler polls for tasks to enqueue for execution. - - - - -
Typeinteger
Default100
ENVDT_DEX_ENGINE_ACTIVITY_TASK_SCHEDULER_POLL_INTERVAL_MS
+Defines the interval in milliseconds in which the activity task scheduler polls for tasks to enqueue for execution. + + + + + +
Typeinteger
Default100
ENVDT_DEX_ENGINE_ACTIVITY_TASK_SCHEDULER_POLL_INTERVAL_MS
**`dt.dex-engine.activity-worker.artifact-import.enabled`** [¶](#dtdex-engineactivity-workerartifact-importenabled){ .headerlink } -: Defines whether the artifact import activity worker should be enabled. - - - - -
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_ARTIFACT_IMPORT_ENABLED
+Defines whether the artifact import activity worker should be enabled. + + + + + +
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_ARTIFACT_IMPORT_ENABLED
**`dt.dex-engine.activity-worker.artifact-import.max-concurrency`** * [¶](#dtdex-engineactivity-workerartifact-importmax-concurrency){ .headerlink } -: Defines the maximum concurrency of the artifact import activity worker. - - - - -
Typeinteger
Default5
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_ARTIFACT_IMPORT_MAX_CONCURRENCY
+Defines the maximum concurrency of the artifact import activity worker. + + + + + +
Typeinteger
Default5
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_ARTIFACT_IMPORT_MAX_CONCURRENCY
**`dt.dex-engine.activity-worker.default.enabled`** [¶](#dtdex-engineactivity-workerdefaultenabled){ .headerlink } -: Defines whether the default activity worker should be enabled. - - - - -
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_DEFAULT_ENABLED
+Defines whether the default activity worker should be enabled. + + + + + +
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_DEFAULT_ENABLED
**`dt.dex-engine.activity-worker.default.max-concurrency`** * [¶](#dtdex-engineactivity-workerdefaultmax-concurrency){ .headerlink } -: Defines the maximum concurrency of the default activity worker. - - - - -
Typeinteger
Default25
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_DEFAULT_MAX_CONCURRENCY
+Defines the maximum concurrency of the default activity worker. + + + + + +
Typeinteger
Default25
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_DEFAULT_MAX_CONCURRENCY
**`dt.dex-engine.activity-worker.metrics-update.enabled`** [¶](#dtdex-engineactivity-workermetrics-updateenabled){ .headerlink } -: Defines whether the metrics update activity worker should be enabled. - - - - -
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_METRICS_UPDATE_ENABLED
+Defines whether the metrics update activity worker should be enabled. + + + + + +
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_METRICS_UPDATE_ENABLED
**`dt.dex-engine.activity-worker.metrics-update.max-concurrency`** * [¶](#dtdex-engineactivity-workermetrics-updatemax-concurrency){ .headerlink } -: Defines the maximum concurrency of the metrics update activity worker. - - - - -
Typeinteger
Default5
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_METRICS_UPDATE_MAX_CONCURRENCY
+Defines the maximum concurrency of the metrics update activity worker. + + + + + +
Typeinteger
Default5
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_METRICS_UPDATE_MAX_CONCURRENCY
**`dt.dex-engine.activity-worker.notification.enabled`** [¶](#dtdex-engineactivity-workernotificationenabled){ .headerlink } -: Defines whether the notification activity worker should be enabled. - - - - -
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_NOTIFICATION_ENABLED
+Defines whether the notification activity worker should be enabled. + + + + + +
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_NOTIFICATION_ENABLED
**`dt.dex-engine.activity-worker.notification.max-concurrency`** * [¶](#dtdex-engineactivity-workernotificationmax-concurrency){ .headerlink } -: Defines the maximum concurrency of the notification activity worker. - - - - -
Typeinteger
Default5
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_NOTIFICATION_MAX_CONCURRENCY
+Defines the maximum concurrency of the notification activity worker. + + + + + +
Typeinteger
Default5
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_NOTIFICATION_MAX_CONCURRENCY
**`dt.dex-engine.activity-worker.notification.poll-backoff.initial-delay-ms`** [¶](#dtdex-engineactivity-workernotificationpoll-backoffinitial-delay-ms){ .headerlink } -: Defines the initial poll backoff delay in milliseconds of the notification activity worker. - - - - -
Typeinteger
Default200
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_NOTIFICATION_POLL_BACKOFF_INITIAL_DELAY_MS
+Defines the initial poll backoff delay in milliseconds of the notification activity worker. + + + + + +
Typeinteger
Default200
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_NOTIFICATION_POLL_BACKOFF_INITIAL_DELAY_MS
**`dt.dex-engine.activity-worker.notification.poll-backoff.max-delay-ms`** [¶](#dtdex-engineactivity-workernotificationpoll-backoffmax-delay-ms){ .headerlink } -: Defines the max poll backoff delay in milliseconds of the notification activity worker. - - - - -
Typeinteger
Default10000
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_NOTIFICATION_POLL_BACKOFF_MAX_DELAY_MS
+Defines the max poll backoff delay in milliseconds of the notification activity worker. + + + + + +
Typeinteger
Default10000
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_NOTIFICATION_POLL_BACKOFF_MAX_DELAY_MS
**`dt.dex-engine.activity-worker.notification.poll-backoff.multiplier`** [¶](#dtdex-engineactivity-workernotificationpoll-backoffmultiplier){ .headerlink } -: Defines the poll backoff delay multiplier of the notification activity worker. - - - - -
Typedouble
Default2.0
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_NOTIFICATION_POLL_BACKOFF_MULTIPLIER
+Defines the poll backoff delay multiplier of the notification activity worker. + + + + + +
Typedouble
Default2.0
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_NOTIFICATION_POLL_BACKOFF_MULTIPLIER
**`dt.dex-engine.activity-worker.notification.poll-backoff.randomization-factor`** [¶](#dtdex-engineactivity-workernotificationpoll-backoffrandomization-factor){ .headerlink } -: Defines the poll backoff randomization factor of the notification activity worker. - - - - -
Typedouble
Default0.2
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_NOTIFICATION_POLL_BACKOFF_RANDOMIZATION_FACTOR
+Defines the poll backoff randomization factor of the notification activity worker. + + + + + +
Typedouble
Default0.2
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_NOTIFICATION_POLL_BACKOFF_RANDOMIZATION_FACTOR
**`dt.dex-engine.activity-worker.package-metadata-resolution.enabled`** [¶](#dtdex-engineactivity-workerpackage-metadata-resolutionenabled){ .headerlink } -: Defines whether the package metadata activity worker should be enabled. - - - - -
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_PACKAGE_METADATA_RESOLUTION_ENABLED
+Defines whether the package metadata activity worker should be enabled. + + + + + +
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_PACKAGE_METADATA_RESOLUTION_ENABLED
**`dt.dex-engine.activity-worker.package-metadata-resolution.max-concurrency`** * [¶](#dtdex-engineactivity-workerpackage-metadata-resolutionmax-concurrency){ .headerlink } -: Defines the maximum concurrency of the package metadata activity worker.

Note that a concurrency of N means that at most N PURLs batches will be resolved concurrently. Each batch performs HTTP requests against package registries. - - - - -
Typeinteger
Default3
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_PACKAGE_METADATA_RESOLUTION_MAX_CONCURRENCY
+Defines the maximum concurrency of the package metadata activity worker.

Note that a concurrency of N means that at most N PURLs batches will be resolved concurrently. Each batch performs HTTP requests against package registries. + + + + + +
Typeinteger
Default3
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_PACKAGE_METADATA_RESOLUTION_MAX_CONCURRENCY
**`dt.dex-engine.activity-worker.policy-evaluation.enabled`** [¶](#dtdex-engineactivity-workerpolicy-evaluationenabled){ .headerlink } -: Defines whether the policy evaluation activity worker should be enabled. - - - - -
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_POLICY_EVALUATION_ENABLED
+Defines whether the policy evaluation activity worker should be enabled. + + + + + +
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_POLICY_EVALUATION_ENABLED
**`dt.dex-engine.activity-worker.policy-evaluation.max-concurrency`** * [¶](#dtdex-engineactivity-workerpolicy-evaluationmax-concurrency){ .headerlink } -: Defines the maximum concurrency of the policy evaluation activity worker. - - - - -
Typeinteger
Default5
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_POLICY_EVALUATION_MAX_CONCURRENCY
+Defines the maximum concurrency of the policy evaluation activity worker. + + + + + +
Typeinteger
Default5
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_POLICY_EVALUATION_MAX_CONCURRENCY
**`dt.dex-engine.activity-worker.vuln-analysis-reconciliation.enabled`** [¶](#dtdex-engineactivity-workervuln-analysis-reconciliationenabled){ .headerlink } -: Defines whether the vulnerability analysis reconciliation activity worker should be enabled. - - - - -
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_VULN_ANALYSIS_RECONCILIATION_ENABLED
+Defines whether the vulnerability analysis reconciliation activity worker should be enabled. + + + + + +
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_VULN_ANALYSIS_RECONCILIATION_ENABLED
**`dt.dex-engine.activity-worker.vuln-analysis-reconciliation.max-concurrency`** * [¶](#dtdex-engineactivity-workervuln-analysis-reconciliationmax-concurrency){ .headerlink } -: Defines the maximum concurrency of the vulnerability analysis reconciliation activity worker. - - - - -
Typeinteger
Default5
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_VULN_ANALYSIS_RECONCILIATION_MAX_CONCURRENCY
+Defines the maximum concurrency of the vulnerability analysis reconciliation activity worker. + + + + + +
Typeinteger
Default5
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_VULN_ANALYSIS_RECONCILIATION_MAX_CONCURRENCY
**`dt.dex-engine.activity-worker.vuln-analysis.enabled`** [¶](#dtdex-engineactivity-workervuln-analysisenabled){ .headerlink } -: Defines whether the notification activity worker should be enabled. - - - - -
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_VULN_ANALYSIS_ENABLED
+Defines whether the notification activity worker should be enabled. + + + + + +
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_VULN_ANALYSIS_ENABLED
**`dt.dex-engine.activity-worker.vuln-analysis.max-concurrency`** * [¶](#dtdex-engineactivity-workervuln-analysismax-concurrency){ .headerlink } -: Defines the maximum concurrency of the notification activity worker. - - - - -
Typeinteger
Default10
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_VULN_ANALYSIS_MAX_CONCURRENCY
+Defines the maximum concurrency of the notification activity worker. + + + + + +
Typeinteger
Default10
ENVDT_DEX_ENGINE_ACTIVITY_WORKER_VULN_ANALYSIS_MAX_CONCURRENCY
**`dt.dex-engine.external-event-buffer.flush-interval-ms`** [¶](#dtdex-engineexternal-event-bufferflush-interval-ms){ .headerlink } -: Defines the time in milliseconds between flushes of the external event buffer. - - - - -
Typeinteger
Default100
ENVDT_DEX_ENGINE_EXTERNAL_EVENT_BUFFER_FLUSH_INTERVAL_MS
+Defines the time in milliseconds between flushes of the external event buffer. + + + + + +
Typeinteger
Default100
ENVDT_DEX_ENGINE_EXTERNAL_EVENT_BUFFER_FLUSH_INTERVAL_MS
**`dt.dex-engine.external-event-buffer.max-batch-size`** [¶](#dtdex-engineexternal-event-buffermax-batch-size){ .headerlink } -: Defines the maximum number of items of the external event buffer. - - - - -
Typeinteger
Default100
ENVDT_DEX_ENGINE_EXTERNAL_EVENT_BUFFER_MAX_BATCH_SIZE
+Defines the maximum number of items of the external event buffer. + + + + + +
Typeinteger
Default100
ENVDT_DEX_ENGINE_EXTERNAL_EVENT_BUFFER_MAX_BATCH_SIZE
**`dt.dex-engine.leader-election.enabled`** [¶](#dtdex-engineleader-electionenabled){ .headerlink } -: Whether leader election in the durable execution engine should be enabled.

Disabling leader election also disables the workflow task scheduler, activity task scheduler, and maintenance worker, as only the leader node is meant to handle those responsibilities. - - - - -
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_LEADER_ELECTION_ENABLED
+Whether leader election in the durable execution engine should be enabled.

Disabling leader election also disables the workflow task scheduler, activity task scheduler, and maintenance worker, as only the leader node is meant to handle those responsibilities. + + + + + +
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_LEADER_ELECTION_ENABLED
**`dt.dex-engine.leader-election.lease-check-interval-ms`** [¶](#dtdex-engineleader-electionlease-check-interval-ms){ .headerlink } -: Defines the interval in milliseconds in which leadership lease acquisition or extension is attempted.

Must be smaller than [`dt.dex-engine.leader-election.lease-duration-ms`](#dtdex-engineleader-electionlease-duration-ms) to avoid frequent leadership changes. - - - - -
Typeinteger
Default15000
ENVDT_DEX_ENGINE_LEADER_ELECTION_LEASE_CHECK_INTERVAL_MS
+Defines the interval in milliseconds in which leadership lease acquisition or extension is attempted.

Must be smaller than [`dt.dex-engine.leader-election.lease-duration-ms`](#dtdex-engineleader-electionlease-duration-ms) to avoid frequent leadership changes. + + + + + +
Typeinteger
Default15000
ENVDT_DEX_ENGINE_LEADER_ELECTION_LEASE_CHECK_INTERVAL_MS
**`dt.dex-engine.leader-election.lease-duration-ms`** [¶](#dtdex-engineleader-electionlease-duration-ms){ .headerlink } -: Defines the duration in milliseconds for which leadership leases are acquired. - - - - -
Typeinteger
Default30000
ENVDT_DEX_ENGINE_LEADER_ELECTION_LEASE_DURATION_MS
+Defines the duration in milliseconds for which leadership leases are acquired. + + + + + +
Typeinteger
Default30000
ENVDT_DEX_ENGINE_LEADER_ELECTION_LEASE_DURATION_MS
**`dt.dex-engine.maintenance.run-deletion-batch-size`** [¶](#dtdex-enginemaintenancerun-deletion-batch-size){ .headerlink } -: Defines the maximum number of completed workflow runs to delete during a single execution of the maintenance worker. Deletion of large volumes of runs in one pass can lead to I/O spikes and increased table bloat.

If retention is not able to keep up with the volumes of runs, consider increasing the interval of the maintenance worker first. - - - - -
Typeinteger
Default1000
ENVDT_DEX_ENGINE_MAINTENANCE_RUN_DELETION_BATCH_SIZE
+Defines the maximum number of completed workflow runs to delete during a single execution of the maintenance worker. Deletion of large volumes of runs in one pass can lead to I/O spikes and increased table bloat.

If retention is not able to keep up with the volumes of runs, consider increasing the interval of the maintenance worker first. + + + + + +
Typeinteger
Default1000
ENVDT_DEX_ENGINE_MAINTENANCE_RUN_DELETION_BATCH_SIZE
**`dt.dex-engine.maintenance.run-retention-duration`** [¶](#dtdex-enginemaintenancerun-retention-duration){ .headerlink } -: Defines the duration in ISO 8601 format after which completed workflow runs become eligible for deletion. - - - - -
Typeduration
DefaultP1D
ENVDT_DEX_ENGINE_MAINTENANCE_RUN_RETENTION_DURATION
+Defines the duration in ISO 8601 format after which completed workflow runs become eligible for deletion. + + + + + +
Typeduration
DefaultP1D
ENVDT_DEX_ENGINE_MAINTENANCE_RUN_RETENTION_DURATION
**`dt.dex-engine.maintenance.worker.initial-delay-ms`** [¶](#dtdex-enginemaintenanceworkerinitial-delay-ms){ .headerlink } -: Defines the initial delay in milliseconds after which the maintenance worker will execute for the first time.

Note that only the leader node in the cluster will actually perform maintenance work. For nodes that are not leaders, maintenance is a no-op. - - - - -
Typeinteger
Default60000
ENVDT_DEX_ENGINE_MAINTENANCE_WORKER_INITIAL_DELAY_MS
+Defines the initial delay in milliseconds after which the maintenance worker will execute for the first time.

Note that only the leader node in the cluster will actually perform maintenance work. For nodes that are not leaders, maintenance is a no-op. + + + + + +
Typeinteger
Default60000
ENVDT_DEX_ENGINE_MAINTENANCE_WORKER_INITIAL_DELAY_MS
**`dt.dex-engine.maintenance.worker.interval-ms`** [¶](#dtdex-enginemaintenanceworkerinterval-ms){ .headerlink } -: Defines the interval in milliseconds at which the maintenance worker will execute.

Note that only the leader node in the cluster will actually perform maintenance work. For nodes that are not leaders, maintenance is a no-op. - - - - -
Typeinteger
Default1800000
ENVDT_DEX_ENGINE_MAINTENANCE_WORKER_INTERVAL_MS
+Defines the interval in milliseconds at which the maintenance worker will execute.

Note that only the leader node in the cluster will actually perform maintenance work. For nodes that are not leaders, maintenance is a no-op. + + + + + +
Typeinteger
Default1800000
ENVDT_DEX_ENGINE_MAINTENANCE_WORKER_INTERVAL_MS
**`dt.dex-engine.metrics.collector.enabled`** [¶](#dtdex-enginemetricscollectorenabled){ .headerlink } -: Defines whether the metrics collector should be enabled.

The collector is responsible for collecting metrics from the database, such as the distribution of workflow run statuses, task queue capacities and depths, and more.

It is recommended to keep it enabled for monitoring purposes, but may be disabled in case it generates undesired load. - - - - -
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_METRICS_COLLECTOR_ENABLED
+Defines whether the metrics collector should be enabled.

The collector is responsible for collecting metrics from the database, such as the distribution of workflow run statuses, task queue capacities and depths, and more.

It is recommended to keep it enabled for monitoring purposes, but may be disabled in case it generates undesired load. + + + + + +
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_METRICS_COLLECTOR_ENABLED
**`dt.dex-engine.metrics.collector.initial-delay-ms`** [¶](#dtdex-enginemetricscollectorinitial-delay-ms){ .headerlink } -: Defines the initial delay in milliseconds after which the metrics collector will first run. - - - - -
Typeinteger
Default15000
ENVDT_DEX_ENGINE_METRICS_COLLECTOR_INITIAL_DELAY_MS
+Defines the initial delay in milliseconds after which the metrics collector will first run. + + + + + +
Typeinteger
Default15000
ENVDT_DEX_ENGINE_METRICS_COLLECTOR_INITIAL_DELAY_MS
**`dt.dex-engine.metrics.collector.interval-ms`** [¶](#dtdex-enginemetricscollectorinterval-ms){ .headerlink } -: Defines the interval in milliseconds in which the metrics collector runs. - - - - -
Typeinteger
Default30000
ENVDT_DEX_ENGINE_METRICS_COLLECTOR_INTERVAL_MS
+Defines the interval in milliseconds in which the metrics collector runs. + + + + + +
Typeinteger
Default30000
ENVDT_DEX_ENGINE_METRICS_COLLECTOR_INTERVAL_MS
**`dt.dex-engine.run-history-cache.evict-after-access-ms`** [¶](#dtdex-enginerun-history-cacheevict-after-access-ms){ .headerlink } -: Defines the time in milliseconds for which workflow run event histories are cached.

Histories are only cached for non-terminal runs, to improve performance of replay. Cached histories are automatically evicted when the corresponding run terminates. - - - - -
Typeinteger
Default300000
ENVDT_DEX_ENGINE_RUN_HISTORY_CACHE_EVICT_AFTER_ACCESS_MS
+Defines the time in milliseconds for which workflow run event histories are cached.

Histories are only cached for non-terminal runs, to improve performance of replay. Cached histories are automatically evicted when the corresponding run terminates. + + + + + +
Typeinteger
Default300000
ENVDT_DEX_ENGINE_RUN_HISTORY_CACHE_EVICT_AFTER_ACCESS_MS
**`dt.dex-engine.run-history-cache.max-size`** [¶](#dtdex-enginerun-history-cachemax-size){ .headerlink } -: Defines the maximum number of workflow runs for which histories may be cached. - - - - -
Typeinteger
Default1000
ENVDT_DEX_ENGINE_RUN_HISTORY_CACHE_MAX_SIZE
+Defines the maximum number of workflow runs for which histories may be cached. + + + + + +
Typeinteger
Default1000
ENVDT_DEX_ENGINE_RUN_HISTORY_CACHE_MAX_SIZE
**`dt.dex-engine.task-event-buffer.flush-interval-ms`** [¶](#dtdex-enginetask-event-bufferflush-interval-ms){ .headerlink } -: Defines the time in milliseconds between flushes of the task event buffer.

Increasing this interval may yield better throughput while reducing the database load, but also increases end-to-end latency of workflow and activity executions. - - - - -
Typeinteger
Default100
ENVDT_DEX_ENGINE_TASK_EVENT_BUFFER_FLUSH_INTERVAL_MS
+Defines the time in milliseconds between flushes of the task event buffer.

Increasing this interval may yield better throughput while reducing the database load, but also increases end-to-end latency of workflow and activity executions. + + + + + +
Typeinteger
Default100
ENVDT_DEX_ENGINE_TASK_EVENT_BUFFER_FLUSH_INTERVAL_MS
**`dt.dex-engine.task-event-buffer.max-batch-size`** [¶](#dtdex-enginetask-event-buffermax-batch-size){ .headerlink } -: Defines the maximum number of items that will be flushed at once.

Increasing this value may yield better throughput, at the expense of higher latency and potentially larger blast radius in case a task event causes failures during the flush.

Since flushes are atomic, a single event failing to be flushed impacts the entire batch. - - - - -
Typeinteger
Default100
ENVDT_DEX_ENGINE_TASK_EVENT_BUFFER_MAX_BATCH_SIZE
+Defines the maximum number of items that will be flushed at once.

Increasing this value may yield better throughput, at the expense of higher latency and potentially larger blast radius in case a task event causes failures during the flush.

Since flushes are atomic, a single event failing to be flushed impacts the entire batch. + + + + + +
Typeinteger
Default100
ENVDT_DEX_ENGINE_TASK_EVENT_BUFFER_MAX_BATCH_SIZE
**`dt.dex-engine.workers.enabled`** [¶](#dtdex-engineworkersenabled){ .headerlink } -: Whether all durable execution task workers should be enabled.

Acts as a global kill switch that takes precedence over individual worker settings. - - - - -
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_WORKERS_ENABLED
+Whether all durable execution task workers should be enabled.

Acts as a global kill switch that takes precedence over individual worker settings. + + + + + +
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_WORKERS_ENABLED
**`dt.dex-engine.workflow-task-scheduler.poll-interval-ms`** [¶](#dtdex-engineworkflow-task-schedulerpoll-interval-ms){ .headerlink } -: Defines the interval in milliseconds in which the workflow task scheduler polls for tasks to enqueue for execution. - - - - -
Typeinteger
Default100
ENVDT_DEX_ENGINE_WORKFLOW_TASK_SCHEDULER_POLL_INTERVAL_MS
+Defines the interval in milliseconds in which the workflow task scheduler polls for tasks to enqueue for execution. + + + + + +
Typeinteger
Default100
ENVDT_DEX_ENGINE_WORKFLOW_TASK_SCHEDULER_POLL_INTERVAL_MS
**`dt.dex-engine.workflow-worker.default.enabled`** [¶](#dtdex-engineworkflow-workerdefaultenabled){ .headerlink } -: Defines whether the default workflow worker should be enabled. - - - - -
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_WORKFLOW_WORKER_DEFAULT_ENABLED
+Defines whether the default workflow worker should be enabled. + + + + + +
Typeboolean
Defaulttrue
ENVDT_DEX_ENGINE_WORKFLOW_WORKER_DEFAULT_ENABLED
**`dt.dex-engine.workflow-worker.default.max-concurrency`** * [¶](#dtdex-engineworkflow-workerdefaultmax-concurrency){ .headerlink } -: Defines the maximum concurrency of the default workflow worker.

Note that workflow workers do not perform any I/O (although they may block while waiting for semaphores and buffer flushes), and are executed with virtual threads. This means that it's usually perfectly fine to have a high degree of concurrency, without risking excessive resource usage or I/O thrashing. - - - - -
Typeinteger
Default100
ENVDT_DEX_ENGINE_WORKFLOW_WORKER_DEFAULT_MAX_CONCURRENCY
+Defines the maximum concurrency of the default workflow worker.

Note that workflow workers do not perform any I/O (although they may block while waiting for semaphores and buffer flushes), and are executed with virtual threads. This means that it's usually perfectly fine to have a high degree of concurrency, without risking excessive resource usage or I/O thrashing. + + + + + +
Typeinteger
Default100
ENVDT_DEX_ENGINE_WORKFLOW_WORKER_DEFAULT_MAX_CONCURRENCY
## General **`dt.api.key.prefix`** [¶](#dtapikeyprefix){ .headerlink } -: Defines the prefix to be used for API keys. A maximum prefix length of 251 characters is supported. The prefix may also be left empty. - - - - -
Typestring
Defaultodt_
ENVDT_API_KEY_PREFIX
+Defines the prefix to be used for API keys. A maximum prefix length of 251 characters is supported. The prefix may also be left empty. + + + + + +
Typestring
Defaultodt_
ENVDT_API_KEY_PREFIX
**`dt.auth.session-timeout-ms`** [¶](#dtauthsession-timeout-ms){ .headerlink } -: Defines the user session timeout in milliseconds. - - - - -
Typeinteger
Default28800000
ENVDT_AUTH_SESSION_TIMEOUT_MS
+Defines the user session timeout in milliseconds. + + + + + +
Typeinteger
Default28800000
ENVDT_AUTH_SESSION_TIMEOUT_MS
**`dt.bcrypt.rounds`** * [¶](#dtbcryptrounds){ .headerlink } -: Specifies the number of bcrypt rounds to use when hashing a user's password. The higher the number the more secure the password, at the expense of hardware resources and additional time to generate the hash. - - - - -
Typeinteger
Default14
ENVDT_BCRYPT_ROUNDS
+Specifies the number of bcrypt rounds to use when hashing a user's password. The higher the number the more secure the password, at the expense of hardware resources and additional time to generate the hash. + + + + + +
Typeinteger
Default14
ENVDT_BCRYPT_ROUNDS
**`dt.config.log.values`** [¶](#dtconfiglogvalues){ .headerlink } -: Defines whether config value lookups should be logged.

Logging happens at DEBUG level. To make the logs visible, you must configure `dt.logging.level."io.smallrye.config"=DEBUG`.

Note that this will not mask or omit any secrets. **Do not use in production environments!** - - - - -
Typeboolean
Defaultfalse
ENVDT_CONFIG_LOG_VALUES
+Defines whether config value lookups should be logged.

Logging happens at DEBUG level. To make the logs visible, you must configure `dt.logging.level."io.smallrye.config"=DEBUG`.

Note that this will not mask or omit any secrets. **Do not use in production environments!** + + + + + +
Typeboolean
Defaultfalse
ENVDT_CONFIG_LOG_VALUES
**`dt.config.profile`** [¶](#dtconfigprofile){ .headerlink } -: Defines the configuration profile to apply.

For example, the `web` profile may be used to disable any background processing, effectively turning the node into a web-only instance. - - - - -
Typestring
Defaultnull
ENVDT_CONFIG_PROFILE
+Defines the configuration profile to apply.

For example, the `web` profile may be used to disable any background processing, effectively turning the node into a web-only instance. + + + + + +
Typestring
Defaultnull
ENVDT_CONFIG_PROFILE
**`dt.data.directory`** * [¶](#dtdatadirectory){ .headerlink } -: Defines the path to the data directory. This directory will hold logs, keys, and any database or index files along with application-specific files or directories. - - - - -
Typestring
Default${user.home}/.dependency-track
ENVDT_DATA_DIRECTORY
+Defines the path to the data directory. This directory will hold logs, keys, and any database or index files along with application-specific files or directories. + + + + + +
Typestring
Default${user.home}/.dependency-track
ENVDT_DATA_DIRECTORY
**`dt.init.and.exit`** [¶](#dtinitandexit){ .headerlink } -: Whether to only execute initialization tasks and exit. - - - - -
Typeboolean
Defaultfalse
ENVDT_INIT_AND_EXIT
+Whether to only execute initialization tasks and exit. + + + + + +
Typeboolean
Defaultfalse
ENVDT_INIT_AND_EXIT
**`dt.init.task.database.migration.enabled`** [¶](#dtinittaskdatabasemigrationenabled){ .headerlink } -: Whether to enable the database migration init task. Has no effect unless [`dt.init.tasks.enabled`](#dtinittasksenabled) is `true`. - - - - -
Typeboolean
Defaulttrue
ENVDT_INIT_TASK_DATABASE_MIGRATION_ENABLED
+Whether to enable the database migration init task. Has no effect unless [`dt.init.tasks.enabled`](#dtinittasksenabled) is `true`. + + + + + +
Typeboolean
Defaulttrue
ENVDT_INIT_TASK_DATABASE_MIGRATION_ENABLED
**`dt.init.task.database.partition.maintenance.enabled`** [¶](#dtinittaskdatabasepartitionmaintenanceenabled){ .headerlink } -: Whether to enable the database partition maintenance init task. Has no effect unless [`dt.init.tasks.enabled`](#dtinittasksenabled) is `true`. - - - - -
Typeboolean
Defaulttrue
ENVDT_INIT_TASK_DATABASE_PARTITION_MAINTENANCE_ENABLED
+Whether to enable the database partition maintenance init task. Has no effect unless [`dt.init.tasks.enabled`](#dtinittasksenabled) is `true`. + + + + + +
Typeboolean
Defaulttrue
ENVDT_INIT_TASK_DATABASE_PARTITION_MAINTENANCE_ENABLED
**`dt.init.task.database.seeding.enabled`** [¶](#dtinittaskdatabaseseedingenabled){ .headerlink } -: Whether to enable the database seeding init task. Seeding involves populating the database with default objects, such as permissions, users, licenses, etc. Has no effect unless [`dt.init.tasks.enabled`](#dtinittasksenabled) is `true`. - - - - -
Typeboolean
Defaulttrue
ENVDT_INIT_TASK_DATABASE_SEEDING_ENABLED
+Whether to enable the database seeding init task. Seeding involves populating the database with default objects, such as permissions, users, licenses, etc. Has no effect unless [`dt.init.tasks.enabled`](#dtinittasksenabled) is `true`. + + + + + +
Typeboolean
Defaulttrue
ENVDT_INIT_TASK_DATABASE_SEEDING_ENABLED
**`dt.init.task.dex.engine.database.migration.enabled`** [¶](#dtinittaskdexenginedatabasemigrationenabled){ .headerlink } -: Whether to enable the durable execution engine database migration init task. Has no effect unless [`dt.init.tasks.enabled`](#dtinittasksenabled) is `true`. - - - - -
Typeboolean
Defaulttrue
ENVDT_INIT_TASK_DEX_ENGINE_DATABASE_MIGRATION_ENABLED
+Whether to enable the durable execution engine database migration init task. Has no effect unless [`dt.init.tasks.enabled`](#dtinittasksenabled) is `true`. + + + + + +
Typeboolean
Defaulttrue
ENVDT_INIT_TASK_DEX_ENGINE_DATABASE_MIGRATION_ENABLED
**`dt.init.task.key.generation.enabled`** [¶](#dtinittaskkeygenerationenabled){ .headerlink } -: Whether to enable the key generation init task. Has no effect unless [`dt.init.tasks.enabled`](#dtinittasksenabled) is `true`. - - - - -
Typeboolean
Defaulttrue
ENVDT_INIT_TASK_KEY_GENERATION_ENABLED
+Whether to enable the key generation init task. Has no effect unless [`dt.init.tasks.enabled`](#dtinittasksenabled) is `true`. + + + + + +
Typeboolean
Defaulttrue
ENVDT_INIT_TASK_KEY_GENERATION_ENABLED
**`dt.init.tasks.enabled`** [¶](#dtinittasksenabled){ .headerlink } -: Whether to execute initialization tasks on startup. - - - - -
Typeboolean
Defaulttrue
ENVDT_INIT_TASKS_ENABLED
+Whether to execute initialization tasks on startup. + + + + + +
Typeboolean
Defaulttrue
ENVDT_INIT_TASKS_ENABLED
**`dt.telemetry.submission.enabled.default`** [¶](#dttelemetrysubmissionenableddefault){ .headerlink } -: Defines the default value for the telemetry submission enabled setting.

This is only used during initial database seeding. Once the setting exists in the database, it can be toggled via the REST API or the admin UI.

To opt out of telemetry before first startup, set this to `false`. - - - - -
Typeboolean
Defaulttrue
ENVDT_TELEMETRY_SUBMISSION_ENABLED_DEFAULT
+Defines the default value for the telemetry submission enabled setting.

This is only used during initial database seeding. Once the setting exists in the database, it can be toggled via the REST API or the admin UI.

To opt out of telemetry before first startup, set this to `false`. + + + + + +
Typeboolean
Defaulttrue
ENVDT_TELEMETRY_SUBMISSION_ENABLED_DEFAULT
**`dt.tmp.delay.bom.processed.notification`** [¶](#dttmpdelaybomprocessednotification){ .headerlink } -: Delays the BOM_PROCESSED notification until the vulnerability analysis associated with a given BOM upload is completed. The intention being that it is then "safe" to query the API for any identified vulnerabilities. This is specifically for cases where polling the /api/v1/bom/token/ endpoint is not feasible. THIS IS A TEMPORARY FUNCTIONALITY AND MAY BE REMOVED IN FUTURE RELEASES WITHOUT FURTHER NOTICE. - - - - -
Typeboolean
Defaultfalse
ENVDT_TMP_DELAY_BOM_PROCESSED_NOTIFICATION
+Delays the BOM_PROCESSED notification until the vulnerability analysis associated with a given BOM upload is completed. The intention being that it is then "safe" to query the API for any identified vulnerabilities. This is specifically for cases where polling the /api/v1/bom/token/ endpoint is not feasible. THIS IS A TEMPORARY FUNCTIONALITY AND MAY BE REMOVED IN FUTURE RELEASES WITHOUT FURTHER NOTICE. + + + + + +
Typeboolean
Defaultfalse
ENVDT_TMP_DELAY_BOM_PROCESSED_NOTIFICATION
**`dt.vulnerability.policy.bundle.auth.bearer.token`** [¶](#dtvulnerabilitypolicybundleauthbearertoken){ .headerlink } -: Defines the bearer token to be used for authentication against the service hosting the vulnerability policy bundle. - - - - -
Typestring
Defaultnull
ENVDT_VULNERABILITY_POLICY_BUNDLE_AUTH_BEARER_TOKEN
+Defines the bearer token to be used for authentication against the service hosting the vulnerability policy bundle. + + + + + +
Typestring
Defaultnull
ENVDT_VULNERABILITY_POLICY_BUNDLE_AUTH_BEARER_TOKEN
**`dt.vulnerability.policy.bundle.auth.password`** [¶](#dtvulnerabilitypolicybundleauthpassword){ .headerlink } -: Defines the password to be used for basic authentication against the service hosting the vulnerability policy bundle. - - - - -
Typestring
Defaultnull
ENVDT_VULNERABILITY_POLICY_BUNDLE_AUTH_PASSWORD
+Defines the password to be used for basic authentication against the service hosting the vulnerability policy bundle. + + + + + +
Typestring
Defaultnull
ENVDT_VULNERABILITY_POLICY_BUNDLE_AUTH_PASSWORD
**`dt.vulnerability.policy.bundle.auth.username`** [¶](#dtvulnerabilitypolicybundleauthusername){ .headerlink } -: Defines the username to be used for basic authentication against the service hosting the vulnerability policy bundle. - - - - -
Typestring
Defaultnull
ENVDT_VULNERABILITY_POLICY_BUNDLE_AUTH_USERNAME
+Defines the username to be used for basic authentication against the service hosting the vulnerability policy bundle. + + + + + +
Typestring
Defaultnull
ENVDT_VULNERABILITY_POLICY_BUNDLE_AUTH_USERNAME
**`dt.vulnerability.policy.bundle.url`** [¶](#dtvulnerabilitypolicybundleurl){ .headerlink } -: Defines where to fetch the vulnerability policy bundle from. - - - - - -
Typestring
Defaultnull
Examplehttps://example.com/bundles/bundle.zip
ENVDT_VULNERABILITY_POLICY_BUNDLE_URL
+Defines where to fetch the vulnerability policy bundle from. + + + + + + +
Typestring
Defaultnull
Examplehttps://example.com/bundles/bundle.zip
ENVDT_VULNERABILITY_POLICY_BUNDLE_URL
## HTTP **`dt.http.proxy.address`** [¶](#dthttpproxyaddress){ .headerlink } -: HTTP proxy address. If set, then [`dt.http.proxy.port`](#dthttpproxyport) must be set too. - - - - - -
Typestring
Defaultnull
Exampleproxy.example.com
ENVDT_HTTP_PROXY_ADDRESS
+HTTP proxy address. If set, then [`dt.http.proxy.port`](#dthttpproxyport) must be set too. + + + + + + +
Typestring
Defaultnull
Exampleproxy.example.com
ENVDT_HTTP_PROXY_ADDRESS
**`dt.http.proxy.password`** [¶](#dthttpproxypassword){ .headerlink } -: - - - - -
Typestring
Defaultnull
ENVDT_HTTP_PROXY_PASSWORD
+ + + + + + +
Typestring
Defaultnull
ENVDT_HTTP_PROXY_PASSWORD
**`dt.http.proxy.password.file`** [¶](#dthttpproxypasswordfile){ .headerlink } -: Specifies the file to load the HTTP proxy password from. If set, takes precedence over [`dt.http.proxy.password`](#dthttpproxypassword). - - - - - -
Typestring
Defaultnull
Example/var/run/secrets/http-proxy-password
ENVDT_HTTP_PROXY_PASSWORD_FILE
+Specifies the file to load the HTTP proxy password from. If set, takes precedence over [`dt.http.proxy.password`](#dthttpproxypassword). + + + + + + +
Typestring
Defaultnull
Example/var/run/secrets/http-proxy-password
ENVDT_HTTP_PROXY_PASSWORD_FILE
**`dt.http.proxy.port`** [¶](#dthttpproxyport){ .headerlink } -: - - - - - -
Typeinteger
Defaultnull
Example8888
ENVDT_HTTP_PROXY_PORT
+ + + + + + + +
Typeinteger
Defaultnull
Example8888
ENVDT_HTTP_PROXY_PORT
**`dt.http.proxy.username`** [¶](#dthttpproxyusername){ .headerlink } -: - - - - -
Typestring
Defaultnull
ENVDT_HTTP_PROXY_USERNAME
+ + + + + + +
Typestring
Defaultnull
ENVDT_HTTP_PROXY_USERNAME
**`dt.http.timeout.connection`** [¶](#dthttptimeoutconnection){ .headerlink } -: Defines the connection timeout in seconds for outbound HTTP connections. - - - - -
Typeinteger
Default30
ENVDT_HTTP_TIMEOUT_CONNECTION
+Defines the connection timeout in seconds for outbound HTTP connections. + + + + + +
Typeinteger
Default30
ENVDT_HTTP_TIMEOUT_CONNECTION
**`dt.http.timeout.pool`** [¶](#dthttptimeoutpool){ .headerlink } -: Defines the request timeout in seconds for outbound HTTP connections. - - - - -
Typeinteger
Default60
ENVDT_HTTP_TIMEOUT_POOL
+Defines the request timeout in seconds for outbound HTTP connections. + + + + + +
Typeinteger
Default60
ENVDT_HTTP_TIMEOUT_POOL
**`dt.http.timeout.socket`** [¶](#dthttptimeoutsocket){ .headerlink } -: Defines the socket / read timeout in seconds for outbound HTTP connections. - - - - -
Typeinteger
Default30
ENVDT_HTTP_TIMEOUT_SOCKET
+Defines the socket / read timeout in seconds for outbound HTTP connections. + + + + + +
Typeinteger
Default30
ENVDT_HTTP_TIMEOUT_SOCKET
**`dt.no.proxy`** [¶](#dtnoproxy){ .headerlink } -: - - - - - -
Typestring
Defaultnull
Examplelocalhost,127.0.0.1
ENVDT_NO_PROXY
+ + + + + + + +
Typestring
Defaultnull
Examplelocalhost,127.0.0.1
ENVDT_NO_PROXY
## LDAP **`dt.ldap.attribute.mail`** [¶](#dtldapattributemail){ .headerlink } -: Specifies the LDAP attribute used to store a users email address - - - - -
Typestring
Defaultmail
ENVDT_LDAP_ATTRIBUTE_MAIL
+Specifies the LDAP attribute used to store a users email address + + + + + +
Typestring
Defaultmail
ENVDT_LDAP_ATTRIBUTE_MAIL
**`dt.ldap.attribute.name`** [¶](#dtldapattributename){ .headerlink } -: Specifies the Attribute that identifies a users ID.

Example (Microsoft Active Directory):
  • userPrincipalName
Example (ApacheDS, Fedora 389 Directory, NetIQ/Novell eDirectory, etc):
  • uid
- - - - -
Typestring
DefaultuserPrincipalName
ENVDT_LDAP_ATTRIBUTE_NAME
+Specifies the Attribute that identifies a users ID.

Example (Microsoft Active Directory):
  • userPrincipalName
Example (ApacheDS, Fedora 389 Directory, NetIQ/Novell eDirectory, etc):
  • uid
+ + + + + +
Typestring
DefaultuserPrincipalName
ENVDT_LDAP_ATTRIBUTE_NAME
**`dt.ldap.auth.username.format`** [¶](#dtldapauthusernameformat){ .headerlink } -: Specifies if the username entered during login needs to be formatted prior to asserting credentials against the directory. For Active Directory, the userPrincipal attribute typically ends with the domain, whereas the samAccountName attribute and other directory server implementations do not. The %s variable will be substituted with the username asserted during login.

Example (Microsoft Active Directory):
  • %s@example.com
Example (ApacheDS, Fedora 389 Directory, NetIQ/Novell eDirectory, etc):
  • %s
- - - - - -
Typestring
Defaultnull
Example%s@example.com
ENVDT_LDAP_AUTH_USERNAME_FORMAT
+Specifies if the username entered during login needs to be formatted prior to asserting credentials against the directory. For Active Directory, the userPrincipal attribute typically ends with the domain, whereas the samAccountName attribute and other directory server implementations do not. The %s variable will be substituted with the username asserted during login.

Example (Microsoft Active Directory):
  • %s@example.com
Example (ApacheDS, Fedora 389 Directory, NetIQ/Novell eDirectory, etc):
  • %s
+ + + + + + +
Typestring
Defaultnull
Example%s@example.com
ENVDT_LDAP_AUTH_USERNAME_FORMAT
**`dt.ldap.basedn`** [¶](#dtldapbasedn){ .headerlink } -: Specifies the base DN that all queries should search from - - - - - -
Typestring
Defaultnull
Exampledc=example,dc=com
ENVDT_LDAP_BASEDN
+Specifies the base DN that all queries should search from + + + + + + +
Typestring
Defaultnull
Exampledc=example,dc=com
ENVDT_LDAP_BASEDN
**`dt.ldap.bind.password`** [¶](#dtldapbindpassword){ .headerlink } -: If anonymous access is not permitted, specify a password for the username used to bind. - - - - -
Typestring
Defaultnull
ENVDT_LDAP_BIND_PASSWORD
+If anonymous access is not permitted, specify a password for the username used to bind. + + + + + +
Typestring
Defaultnull
ENVDT_LDAP_BIND_PASSWORD
**`dt.ldap.bind.username`** [¶](#dtldapbindusername){ .headerlink } -: If anonymous access is not permitted, specify a username with limited access to the directory, just enough to perform searches. This should be the fully qualified DN of the user. - - - - -
Typestring
Defaultnull
ENVDT_LDAP_BIND_USERNAME
+If anonymous access is not permitted, specify a username with limited access to the directory, just enough to perform searches. This should be the fully qualified DN of the user. + + + + + +
Typestring
Defaultnull
ENVDT_LDAP_BIND_USERNAME
**`dt.ldap.enabled`** [¶](#dtldapenabled){ .headerlink } -: Defines if LDAP will be used for user authentication. If enabled, `dt.ldap.*` properties should be set accordingly. - - - - -
Typeboolean
Defaultfalse
ENVDT_LDAP_ENABLED
+Defines if LDAP will be used for user authentication. If enabled, `dt.ldap.*` properties should be set accordingly. + + + + + +
Typeboolean
Defaultfalse
ENVDT_LDAP_ENABLED
**`dt.ldap.groups.filter`** [¶](#dtldapgroupsfilter){ .headerlink } -: Specifies the LDAP search filter used to retrieve all groups from the directory.

Example (Microsoft Active Directory):
  • (&(objectClass=group)(objectCategory=Group))
Example (ApacheDS, Fedora 389 Directory, NetIQ/Novell eDirectory, etc):
  • (&(objectClass=groupOfUniqueNames))
- - - - -
Typestring
Default(&(objectClass=group)(objectCategory=Group))
ENVDT_LDAP_GROUPS_FILTER
+Specifies the LDAP search filter used to retrieve all groups from the directory.

Example (Microsoft Active Directory):
  • (&(objectClass=group)(objectCategory=Group))
Example (ApacheDS, Fedora 389 Directory, NetIQ/Novell eDirectory, etc):
  • (&(objectClass=groupOfUniqueNames))
+ + + + + +
Typestring
Default(&(objectClass=group)(objectCategory=Group))
ENVDT_LDAP_GROUPS_FILTER
**`dt.ldap.groups.search.filter`** [¶](#dtldapgroupssearchfilter){ .headerlink } -: Specifies the LDAP search filter used to search for groups by their name. The `{SEARCH_TERM}` variable will be substituted at runtime.

Example (Microsoft Active Directory):
  • (&(objectClass=group)(objectCategory=Group)(cn=*{SEARCH_TERM}*))
Example (ApacheDS, Fedora 389 Directory, NetIQ/Novell eDirectory, etc):
  • (&(objectClass=groupOfUniqueNames)(cn=*{SEARCH_TERM}*))
- - - - -
Typestring
Default(&(objectClass=group)(objectCategory=Group)(cn=*{SEARCH_TERM}*))
ENVDT_LDAP_GROUPS_SEARCH_FILTER
+Specifies the LDAP search filter used to search for groups by their name. The `{SEARCH_TERM}` variable will be substituted at runtime.

Example (Microsoft Active Directory):
  • (&(objectClass=group)(objectCategory=Group)(cn=*{SEARCH_TERM}*))
Example (ApacheDS, Fedora 389 Directory, NetIQ/Novell eDirectory, etc):
  • (&(objectClass=groupOfUniqueNames)(cn=*{SEARCH_TERM}*))
+ + + + + +
Typestring
Default(&(objectClass=group)(objectCategory=Group)(cn=*{SEARCH_TERM}*))
ENVDT_LDAP_GROUPS_SEARCH_FILTER
**`dt.ldap.security.auth`** [¶](#dtldapsecurityauth){ .headerlink } -: Specifies the LDAP security authentication level to use. Its value is one of the following strings: "none", "simple", "strong". If this property is empty or unspecified, the behaviour is determined by the service provider. - - - - - -
Typeenum
Defaultsimple
Valid Values[none, simple, strong]
ENVDT_LDAP_SECURITY_AUTH
+Specifies the LDAP security authentication level to use. Its value is one of the following strings: "none", "simple", "strong". If this property is empty or unspecified, the behaviour is determined by the service provider. + + + + + + +
Typeenum
Defaultsimple
Valid Values[none, simple, strong]
ENVDT_LDAP_SECURITY_AUTH
**`dt.ldap.server.url`** [¶](#dtldapserverurl){ .headerlink } -: Specifies the LDAP server URL.

Examples (Microsoft Active Directory):
  • ldap://ldap.example.com:3268
  • ldaps://ldap.example.com:3269
Examples (ApacheDS, Fedora 389 Directory, NetIQ/Novell eDirectory, etc):
  • ldap://ldap.example.com:389
  • ldaps://ldap.example.com:636
- - - - -
Typestring
Defaultnull
ENVDT_LDAP_SERVER_URL
+Specifies the LDAP server URL.

Examples (Microsoft Active Directory):
  • ldap://ldap.example.com:3268
  • ldaps://ldap.example.com:3269
Examples (ApacheDS, Fedora 389 Directory, NetIQ/Novell eDirectory, etc):
  • ldap://ldap.example.com:389
  • ldaps://ldap.example.com:636
+ + + + + +
Typestring
Defaultnull
ENVDT_LDAP_SERVER_URL
**`dt.ldap.team.synchronization`** [¶](#dtldapteamsynchronization){ .headerlink } -: This option will ensure that team memberships for LDAP users are dynamic and synchronized with membership of LDAP groups. When a team is mapped to an LDAP group, all local LDAP users will automatically be assigned to the team if they are a member of the group the team is mapped to. If the user is later removed from the LDAP group, they will also be removed from the team. This option provides the ability to dynamically control user permissions via an external directory. - - - - -
Typeboolean
Defaultfalse
ENVDT_LDAP_TEAM_SYNCHRONIZATION
+This option will ensure that team memberships for LDAP users are dynamic and synchronized with membership of LDAP groups. When a team is mapped to an LDAP group, all local LDAP users will automatically be assigned to the team if they are a member of the group the team is mapped to. If the user is later removed from the LDAP group, they will also be removed from the team. This option provides the ability to dynamically control user permissions via an external directory. + + + + + +
Typeboolean
Defaultfalse
ENVDT_LDAP_TEAM_SYNCHRONIZATION
**`dt.ldap.user.groups.filter`** [¶](#dtldapusergroupsfilter){ .headerlink } -: Specifies the LDAP search filter to use to query a user and retrieve a list of groups the user is a member of. The `{USER_DN}` variable will be substituted with the actual value of the users DN at runtime.

Example (Microsoft Active Directory):
  • (&(objectClass=group)(objectCategory=Group)(member={USER_DN}))
Example (Microsoft Active Directory - with nested group support):
  • (member:1.2.840.113556.1.4.1941:={USER_DN})
Example (ApacheDS, Fedora 389 Directory, NetIQ/Novell eDirectory, etc):
  • (&(objectClass=groupOfUniqueNames)(uniqueMember={USER_DN}))
- - - - -
Typestring
Default(member:1.2.840.113556.1.4.1941:={USER_DN})
ENVDT_LDAP_USER_GROUPS_FILTER
+Specifies the LDAP search filter to use to query a user and retrieve a list of groups the user is a member of. The `{USER_DN}` variable will be substituted with the actual value of the users DN at runtime.

Example (Microsoft Active Directory):
  • (&(objectClass=group)(objectCategory=Group)(member={USER_DN}))
Example (Microsoft Active Directory - with nested group support):
  • (member:1.2.840.113556.1.4.1941:={USER_DN})
Example (ApacheDS, Fedora 389 Directory, NetIQ/Novell eDirectory, etc):
  • (&(objectClass=groupOfUniqueNames)(uniqueMember={USER_DN}))
+ + + + + +
Typestring
Default(member:1.2.840.113556.1.4.1941:={USER_DN})
ENVDT_LDAP_USER_GROUPS_FILTER
**`dt.ldap.user.provisioning`** [¶](#dtldapuserprovisioning){ .headerlink } -: Specifies if mapped LDAP accounts are automatically created upon successful authentication. When a user logs in with valid credentials but an account has not been previously provisioned, an authentication failure will be returned. This allows admins to control specifically which ldap users can access the system and which users cannot. When this value is set to true, a local ldap user will be created and mapped to the ldap account automatically. This automatic provisioning only affects authentication, not authorization. - - - - -
Typeboolean
Defaultfalse
ENVDT_LDAP_USER_PROVISIONING
+Specifies if mapped LDAP accounts are automatically created upon successful authentication. When a user logs in with valid credentials but an account has not been previously provisioned, an authentication failure will be returned. This allows admins to control specifically which ldap users can access the system and which users cannot. When this value is set to true, a local ldap user will be created and mapped to the ldap account automatically. This automatic provisioning only affects authentication, not authorization. + + + + + +
Typeboolean
Defaultfalse
ENVDT_LDAP_USER_PROVISIONING
**`dt.ldap.users.search.filter`** [¶](#dtldapuserssearchfilter){ .headerlink } -: Specifies the LDAP search filter used to search for users by their name. The {SEARCH_TERM} variable will be substituted at runtime.

Example (Microsoft Active Directory):
  • (&(objectClass=group)(objectCategory=Group)(cn=*{SEARCH_TERM}*))
Example (ApacheDS, Fedora 389 Directory, NetIQ/Novell eDirectory, etc):
  • (&(objectClass=inetOrgPerson)(cn=*{SEARCH_TERM}*))
- - - - -
Typestring
Default(&(objectClass=user)(objectCategory=Person)(cn=*{SEARCH_TERM}*))
ENVDT_LDAP_USERS_SEARCH_FILTER
+Specifies the LDAP search filter used to search for users by their name. The {SEARCH_TERM} variable will be substituted at runtime.

Example (Microsoft Active Directory):
  • (&(objectClass=group)(objectCategory=Group)(cn=*{SEARCH_TERM}*))
Example (ApacheDS, Fedora 389 Directory, NetIQ/Novell eDirectory, etc):
  • (&(objectClass=inetOrgPerson)(cn=*{SEARCH_TERM}*))
+ + + + + +
Typestring
Default(&(objectClass=user)(objectCategory=Person)(cn=*{SEARCH_TERM}*))
ENVDT_LDAP_USERS_SEARCH_FILTER
## Notification **`dt.notification-publisher.console.enabled`** [¶](#dtnotification-publisherconsoleenabled){ .headerlink } -: Defines whether the console notification publisher is enabled. - - - - -
Typeboolean
Defaulttrue
ENVDT_NOTIFICATION_PUBLISHER_CONSOLE_ENABLED
+Defines whether the console notification publisher is enabled. + + + + + +
Typeboolean
Defaulttrue
ENVDT_NOTIFICATION_PUBLISHER_CONSOLE_ENABLED
**`dt.notification-publisher.email.allow-local-connections`** [¶](#dtnotification-publisheremailallow-local-connections){ .headerlink } -: Defines whether the email notification publisher is allowed to connect to local hosts. - - - - -
Typeboolean
Defaultfalse
ENVDT_NOTIFICATION_PUBLISHER_EMAIL_ALLOW_LOCAL_CONNECTIONS
+Defines whether the email notification publisher is allowed to connect to local hosts. + + + + + +
Typeboolean
Defaultfalse
ENVDT_NOTIFICATION_PUBLISHER_EMAIL_ALLOW_LOCAL_CONNECTIONS
**`dt.notification-publisher.email.enabled`** [¶](#dtnotification-publisheremailenabled){ .headerlink } -: Defines whether the email notification publisher is enabled. - - - - -
Typeboolean
Defaulttrue
ENVDT_NOTIFICATION_PUBLISHER_EMAIL_ENABLED
+Defines whether the email notification publisher is enabled. + + + + + +
Typeboolean
Defaulttrue
ENVDT_NOTIFICATION_PUBLISHER_EMAIL_ENABLED
**`dt.notification-publisher.jira.enabled`** [¶](#dtnotification-publisherjiraenabled){ .headerlink } -: Defines whether the Jira notification publisher is enabled. - - - - -
Typeboolean
Defaulttrue
ENVDT_NOTIFICATION_PUBLISHER_JIRA_ENABLED
+Defines whether the Jira notification publisher is enabled. + + + + + +
Typeboolean
Defaulttrue
ENVDT_NOTIFICATION_PUBLISHER_JIRA_ENABLED
**`dt.notification-publisher.kafka.allow-local-connections`** [¶](#dtnotification-publisherkafkaallow-local-connections){ .headerlink } -: Defines whether the Kafka notification publisher is allowed to connect to local hosts. - - - - -
Typeboolean
Defaultfalse
ENVDT_NOTIFICATION_PUBLISHER_KAFKA_ALLOW_LOCAL_CONNECTIONS
+Defines whether the Kafka notification publisher is allowed to connect to local hosts. + + + + + +
Typeboolean
Defaultfalse
ENVDT_NOTIFICATION_PUBLISHER_KAFKA_ALLOW_LOCAL_CONNECTIONS
**`dt.notification-publisher.kafka.enabled`** [¶](#dtnotification-publisherkafkaenabled){ .headerlink } -: Defines whether the Kafka notification publisher is enabled. - - - - -
Typeboolean
Defaulttrue
ENVDT_NOTIFICATION_PUBLISHER_KAFKA_ENABLED
+Defines whether the Kafka notification publisher is enabled. + + + + + +
Typeboolean
Defaulttrue
ENVDT_NOTIFICATION_PUBLISHER_KAFKA_ENABLED
**`dt.notification-publisher.mattermost.enabled`** [¶](#dtnotification-publishermattermostenabled){ .headerlink } -: Defines whether the Mattermost notification publisher is enabled. - - - - -
Typeboolean
Defaulttrue
ENVDT_NOTIFICATION_PUBLISHER_MATTERMOST_ENABLED
+Defines whether the Mattermost notification publisher is enabled. + + + + + +
Typeboolean
Defaulttrue
ENVDT_NOTIFICATION_PUBLISHER_MATTERMOST_ENABLED
**`dt.notification-publisher.msteams.enabled`** [¶](#dtnotification-publishermsteamsenabled){ .headerlink } -: Defines whether the Microsoft Teams notification publisher is enabled. - - - - -
Typeboolean
Defaulttrue
ENVDT_NOTIFICATION_PUBLISHER_MSTEAMS_ENABLED
+Defines whether the Microsoft Teams notification publisher is enabled. + + + + + +
Typeboolean
Defaulttrue
ENVDT_NOTIFICATION_PUBLISHER_MSTEAMS_ENABLED
**`dt.notification-publisher.slack.enabled`** [¶](#dtnotification-publisherslackenabled){ .headerlink } -: Defines whether the Slack notification publisher is enabled. - - - - -
Typeboolean
Defaulttrue
ENVDT_NOTIFICATION_PUBLISHER_SLACK_ENABLED
+Defines whether the Slack notification publisher is enabled. + + + + + +
Typeboolean
Defaulttrue
ENVDT_NOTIFICATION_PUBLISHER_SLACK_ENABLED
**`dt.notification-publisher.webex.enabled`** [¶](#dtnotification-publisherwebexenabled){ .headerlink } -: Defines whether the WebEx notification publisher is enabled. - - - - -
Typeboolean
Defaulttrue
ENVDT_NOTIFICATION_PUBLISHER_WEBEX_ENABLED
+Defines whether the WebEx notification publisher is enabled. + + + + + +
Typeboolean
Defaulttrue
ENVDT_NOTIFICATION_PUBLISHER_WEBEX_ENABLED
**`dt.notification-publisher.webhook.enabled`** [¶](#dtnotification-publisherwebhookenabled){ .headerlink } -: Defines whether the Webhook notification publisher is enabled. - - - - -
Typeboolean
Defaulttrue
ENVDT_NOTIFICATION_PUBLISHER_WEBHOOK_ENABLED
+Defines whether the Webhook notification publisher is enabled. + + + + + +
Typeboolean
Defaulttrue
ENVDT_NOTIFICATION_PUBLISHER_WEBHOOK_ENABLED
**`dt.notification.outbox-relay.batch-size`** * [¶](#dtnotificationoutbox-relaybatch-size){ .headerlink } -: Defines the number of notifications that the outbox relay will process in a batch. - - - - -
Typeinteger
Default100
ENVDT_NOTIFICATION_OUTBOX_RELAY_BATCH_SIZE
+Defines the number of notifications that the outbox relay will process in a batch. + + + + + +
Typeinteger
Default100
ENVDT_NOTIFICATION_OUTBOX_RELAY_BATCH_SIZE
**`dt.notification.outbox-relay.enabled`** * [¶](#dtnotificationoutbox-relayenabled){ .headerlink } -: Defines whether the notification outbox relay should be enabled. When disabled, notifications will still be emitted to the outbox table, but not be delivered. Should generally stay enabled, unless:
  • The relay has a critical issue that impacts the rest of the system
  • You run a multi-node cluster and want more granular control over which nodes run the relay
- - - - -
Typeboolean
Defaulttrue
ENVDT_NOTIFICATION_OUTBOX_RELAY_ENABLED
+Defines whether the notification outbox relay should be enabled. When disabled, notifications will still be emitted to the outbox table, but not be delivered. Should generally stay enabled, unless:
  • The relay has a critical issue that impacts the rest of the system
  • You run a multi-node cluster and want more granular control over which nodes run the relay
+ + + + + +
Typeboolean
Defaulttrue
ENVDT_NOTIFICATION_OUTBOX_RELAY_ENABLED
**`dt.notification.outbox-relay.large-notification-threshold-bytes`** * [¶](#dtnotificationoutbox-relaylarge-notification-threshold-bytes){ .headerlink } -: Defines the size in bytes at which notifications are considered "large".

Large notifications will be offloaded to file storage before being sent to the dex engine for publishing. - - - - -
Typeinteger
Default65536
ENVDT_NOTIFICATION_OUTBOX_RELAY_LARGE_NOTIFICATION_THRESHOLD_BYTES
+Defines the size in bytes at which notifications are considered "large".

Large notifications will be offloaded to file storage before being sent to the dex engine for publishing. + + + + + +
Typeinteger
Default65536
ENVDT_NOTIFICATION_OUTBOX_RELAY_LARGE_NOTIFICATION_THRESHOLD_BYTES
**`dt.notification.outbox-relay.poll-interval-ms`** * [¶](#dtnotificationoutbox-relaypoll-interval-ms){ .headerlink } -: Defines the interval in milliseconds in which the notification outbox relay will poll for records in the notification outbox table. Increasing this value will cause higher notification latencies, but incurs a lesser load on the database. - - - - -
Typeinteger
Default1000
ENVDT_NOTIFICATION_OUTBOX_RELAY_POLL_INTERVAL_MS
+Defines the interval in milliseconds in which the notification outbox relay will poll for records in the notification outbox table. Increasing this value will cause higher notification latencies, but incurs a lesser load on the database. + + + + + +
Typeinteger
Default1000
ENVDT_NOTIFICATION_OUTBOX_RELAY_POLL_INTERVAL_MS
## Observability **`dt.management.host`** [¶](#dtmanagementhost){ .headerlink } -: Defines the host for the management server, which exposes health and metrics endpoints independently of the main server. - - - - -
Typestring
Default0.0.0.0
ENVDT_MANAGEMENT_HOST
+Defines the host for the management server, which exposes health and metrics endpoints independently of the main server. + + + + + +
Typestring
Default0.0.0.0
ENVDT_MANAGEMENT_HOST
**`dt.management.port`** [¶](#dtmanagementport){ .headerlink } -: Defines the port for the management server, which exposes health and metrics endpoints independently of the main server. - - - - -
Typeinteger
Default9000
ENVDT_MANAGEMENT_PORT
+Defines the port for the management server, which exposes health and metrics endpoints independently of the main server. + + + + + +
Typeinteger
Default9000
ENVDT_MANAGEMENT_PORT
**`dt.metrics.auth.password`** [¶](#dtmetricsauthpassword){ .headerlink } -: Defines the password required to access metrics. Has no effect when [`dt.metrics.auth.username`](#dtmetricsauthusername) is not set. - - - - -
Typestring
Defaultnull
ENVDT_METRICS_AUTH_PASSWORD
+Defines the password required to access metrics. Has no effect when [`dt.metrics.auth.username`](#dtmetricsauthusername) is not set. + + + + + +
Typestring
Defaultnull
ENVDT_METRICS_AUTH_PASSWORD
**`dt.metrics.auth.username`** [¶](#dtmetricsauthusername){ .headerlink } -: Defines the username required to access metrics. Has no effect when [`dt.metrics.auth.password`](#dtmetricsauthpassword) is not set. - - - - -
Typestring
Defaultnull
ENVDT_METRICS_AUTH_USERNAME
+Defines the username required to access metrics. Has no effect when [`dt.metrics.auth.password`](#dtmetricsauthpassword) is not set. + + + + + +
Typestring
Defaultnull
ENVDT_METRICS_AUTH_USERNAME
**`dt.metrics.enabled`** [¶](#dtmetricsenabled){ .headerlink } -: Defines whether Prometheus metrics will be exposed. If enabled, metrics will be available via the /metrics endpoint of the management server. - - - - -
Typeboolean
Defaultfalse
ENVDT_METRICS_ENABLED
+Defines whether Prometheus metrics will be exposed. If enabled, metrics will be available via the /metrics endpoint of the management server. + + + + + +
Typeboolean
Defaultfalse
ENVDT_METRICS_ENABLED
## OpenID Connect **`dt.oidc.client.id`** [¶](#dtoidcclientid){ .headerlink } -: Defines the client ID to be used for OpenID Connect. The client ID should be the same as the one configured for the frontend, and will only be used to validate ID tokens. - - - - -
Typestring
Defaultnull
ENVDT_OIDC_CLIENT_ID
+Defines the client ID to be used for OpenID Connect. The client ID should be the same as the one configured for the frontend, and will only be used to validate ID tokens. + + + + + +
Typestring
Defaultnull
ENVDT_OIDC_CLIENT_ID
**`dt.oidc.enabled`** [¶](#dtoidcenabled){ .headerlink } -: Defines if OpenID Connect will be used for user authentication. If enabled, `dt.oidc.*` properties should be set accordingly. - - - - -
Typeboolean
Defaultfalse
ENVDT_OIDC_ENABLED
+Defines if OpenID Connect will be used for user authentication. If enabled, `dt.oidc.*` properties should be set accordingly. + + + + + +
Typeboolean
Defaultfalse
ENVDT_OIDC_ENABLED
**`dt.oidc.issuer`** [¶](#dtoidcissuer){ .headerlink } -: Defines the issuer URL to be used for OpenID Connect. This issuer MUST support provider configuration via the `/.well-known/openid-configuration` endpoint. See also:
  • https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
  • https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig
- - - - -
Typestring
Defaultnull
ENVDT_OIDC_ISSUER
+Defines the issuer URL to be used for OpenID Connect. This issuer MUST support provider configuration via the `/.well-known/openid-configuration` endpoint. See also:
  • https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
  • https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig
+ + + + + +
Typestring
Defaultnull
ENVDT_OIDC_ISSUER
**`dt.oidc.team.synchronization`** [¶](#dtoidcteamsynchronization){ .headerlink } -: This option will ensure that team memberships for OpenID Connect users are dynamic and synchronized with membership of OpenID Connect groups or assigned roles. When a team is mapped to an OpenID Connect group, all local OpenID Connect users will automatically be assigned to the team if they are a member of the group the team is mapped to. If the user is later removed from the OpenID Connect group, they will also be removed from the team. This option provides the ability to dynamically control user permissions via the identity provider. Note that team synchronization is only performed during user provisioning and after successful authentication. - - - - -
Typeboolean
Defaultfalse
ENVDT_OIDC_TEAM_SYNCHRONIZATION
+This option will ensure that team memberships for OpenID Connect users are dynamic and synchronized with membership of OpenID Connect groups or assigned roles. When a team is mapped to an OpenID Connect group, all local OpenID Connect users will automatically be assigned to the team if they are a member of the group the team is mapped to. If the user is later removed from the OpenID Connect group, they will also be removed from the team. This option provides the ability to dynamically control user permissions via the identity provider. Note that team synchronization is only performed during user provisioning and after successful authentication. + + + + + +
Typeboolean
Defaultfalse
ENVDT_OIDC_TEAM_SYNCHRONIZATION
**`dt.oidc.teams.claim`** [¶](#dtoidcteamsclaim){ .headerlink } -: Defines the name of the claim that contains group memberships or role assignments in the provider's userinfo endpoint. The claim must be an array of strings, or a comma-delimited string. Most public identity providers do not support group or role management. When using a customizable / on-demand hosted identity provider, name, content, and inclusion in the userinfo endpoint will most likely need to be configured. - - - - -
Typestring
Defaultgroups
ENVDT_OIDC_TEAMS_CLAIM
+Defines the name of the claim that contains group memberships or role assignments in the provider's userinfo endpoint. The claim must be an array of strings, or a comma-delimited string. Most public identity providers do not support group or role management. When using a customizable / on-demand hosted identity provider, name, content, and inclusion in the userinfo endpoint will most likely need to be configured. + + + + + +
Typestring
Defaultgroups
ENVDT_OIDC_TEAMS_CLAIM
**`dt.oidc.user.provisioning`** [¶](#dtoidcuserprovisioning){ .headerlink } -: Specifies if mapped OpenID Connect accounts are automatically created upon successful authentication. When a user logs in with a valid access token but an account has not been previously provisioned, an authentication failure will be returned. This allows admins to control specifically which OpenID Connect users can access the system and which users cannot. When this value is set to true, a local OpenID Connect user will be created and mapped to the OpenID Connect account automatically. This automatic provisioning only affects authentication, not authorization. - - - - -
Typeboolean
Defaultfalse
ENVDT_OIDC_USER_PROVISIONING
+Specifies if mapped OpenID Connect accounts are automatically created upon successful authentication. When a user logs in with a valid access token but an account has not been previously provisioned, an authentication failure will be returned. This allows admins to control specifically which OpenID Connect users can access the system and which users cannot. When this value is set to true, a local OpenID Connect user will be created and mapped to the OpenID Connect account automatically. This automatic provisioning only affects authentication, not authorization. + + + + + +
Typeboolean
Defaultfalse
ENVDT_OIDC_USER_PROVISIONING
**`dt.oidc.username.claim`** [¶](#dtoidcusernameclaim){ .headerlink } -: Defines the name of the claim that contains the username in the provider's userinfo endpoint. Common claims are `name`, `username`, `preferred_username` or `nickname`. See also:
  • https://openid.net/specs/openid-connect-core-1_0.html#UserInfoResponse
- - - - -
Typestring
Defaultname
ENVDT_OIDC_USERNAME_CLAIM
+Defines the name of the claim that contains the username in the provider's userinfo endpoint. Common claims are `name`, `username`, `preferred_username` or `nickname`. See also:
  • https://openid.net/specs/openid-connect-core-1_0.html#UserInfoResponse
+ + + + + +
Typestring
Defaultname
ENVDT_OIDC_USERNAME_CLAIM
## Secrets **`dt.secret-management.cache.enabled`** * [¶](#dtsecret-managementcacheenabled){ .headerlink } -: Defines whether secret caching should be enabled. - - - - -
Typeboolean
Defaultfalse
ENVDT_SECRET_MANAGEMENT_CACHE_ENABLED
+Defines whether secret caching should be enabled. + + + + + +
Typeboolean
Defaultfalse
ENVDT_SECRET_MANAGEMENT_CACHE_ENABLED
**`dt.secret-management.cache.expire-after-write-ms`** [¶](#dtsecret-managementcacheexpire-after-write-ms){ .headerlink } -: Defines the duration in milliseconds for which secrets should be cached. - - - - -
Typeinteger
Default60000
ENVDT_SECRET_MANAGEMENT_CACHE_EXPIRE_AFTER_WRITE_MS
+Defines the duration in milliseconds for which secrets should be cached. + + + + + +
Typeinteger
Default60000
ENVDT_SECRET_MANAGEMENT_CACHE_EXPIRE_AFTER_WRITE_MS
**`dt.secret-management.cache.max-size`** [¶](#dtsecret-managementcachemax-size){ .headerlink } -: Defines the maximum number of secrets to keep in the cache. - - - - -
Typeinteger
Default100
ENVDT_SECRET_MANAGEMENT_CACHE_MAX_SIZE
+Defines the maximum number of secrets to keep in the cache. + + + + + +
Typeinteger
Default100
ENVDT_SECRET_MANAGEMENT_CACHE_MAX_SIZE
**`dt.secret-management.database.datasource.name`** [¶](#dtsecret-managementdatabasedatasourcename){ .headerlink } -: Defines the name of the data source to be used by the database secret manager.

Required when [`dt.secret-management.provider`](#dtsecret-managementprovider) is `database`. - - - - -
Typestring
Defaultdefault
ENVDT_SECRET_MANAGEMENT_DATABASE_DATASOURCE_NAME
+Defines the name of the data source to be used by the database secret manager.

Required when [`dt.secret-management.provider`](#dtsecret-managementprovider) is `database`. + + + + + +
Typestring
Defaultdefault
ENVDT_SECRET_MANAGEMENT_DATABASE_DATASOURCE_NAME
**`dt.secret-management.database.kek`** [¶](#dtsecret-managementdatabasekek){ .headerlink } -: Defines a base64-encoded AES-256 key (32 bytes) to use as the key encryption key (KEK) for the database secret manager.

A secure key may be generated using OpenSSL like this: `openssl rand -base64 32`

When set, takes precedence over [`dt.secret-management.database.kek`](#dtsecret-managementdatabasekek)-keyset.path. Unlike the keyset file approach, this option does not support KEK rotation.

Must be the same for all nodes in the cluster. When different keys are detected, the application will fail to start. - - - - -
Typestring
Defaultnull
ENVDT_SECRET_MANAGEMENT_DATABASE_KEK
+Defines a base64-encoded AES-256 key (32 bytes) to use as the key encryption key (KEK) for the database secret manager.

A secure key may be generated using OpenSSL like this: `openssl rand -base64 32`

When set, takes precedence over [`dt.secret-management.database.kek`](#dtsecret-managementdatabasekek)-keyset.path. Unlike the keyset file approach, this option does not support KEK rotation.

Must be the same for all nodes in the cluster. When different keys are detected, the application will fail to start. + + + + + +
Typestring
Defaultnull
ENVDT_SECRET_MANAGEMENT_DATABASE_KEK
**`dt.secret-management.database.kek-keyset.create-if-missing`** [¶](#dtsecret-managementdatabasekek-keysetcreate-if-missing){ .headerlink } -: Defines whether a key encryption keyset should be created if it doesn't already exist. - - - - -
Typeboolean
Defaulttrue
ENVDT_SECRET_MANAGEMENT_DATABASE_KEK_KEYSET_CREATE_IF_MISSING
+Defines whether a key encryption keyset should be created if it doesn't already exist. + + + + + +
Typeboolean
Defaulttrue
ENVDT_SECRET_MANAGEMENT_DATABASE_KEK_KEYSET_CREATE_IF_MISSING
**`dt.secret-management.database.kek-keyset.path`** [¶](#dtsecret-managementdatabasekek-keysetpath){ .headerlink } -: Defines the path to the key encryption keyset to use for the database secret manager.

Must point to the same file for all nodes in the cluster, e.g. using a shared volume or mounted k8s secret. When different keysets are detected, the application will fail to start. - - - - -
Typestring
Default${dt.data.directory}/keys/secret-management-kek.json
ENVDT_SECRET_MANAGEMENT_DATABASE_KEK_KEYSET_PATH
+Defines the path to the key encryption keyset to use for the database secret manager.

Must point to the same file for all nodes in the cluster, e.g. using a shared volume or mounted k8s secret. When different keysets are detected, the application will fail to start. + + + + + +
Typestring
Default${dt.data.directory}/keys/secret-management-kek.json
ENVDT_SECRET_MANAGEMENT_DATABASE_KEK_KEYSET_PATH
**`dt.secret-management.provider`** * [¶](#dtsecret-managementprovider){ .headerlink } -: Defines the secret management type to use. - - - - - -
Typeenum
Defaultdatabase
Valid Values[database, env]
ENVDT_SECRET_MANAGEMENT_PROVIDER
+Defines the secret management type to use. + + + + + + +
Typeenum
Defaultdatabase
Valid Values[database, env]
ENVDT_SECRET_MANAGEMENT_PROVIDER
## Storage **`dt.file-storage.local.compression.level`** [¶](#dtfile-storagelocalcompressionlevel){ .headerlink } -: Defines the zstd compression level to use for local file storage. - - - - - -
Typeinteger
Default5
Valid Values[-7..22]
ENVDT_FILE_STORAGE_LOCAL_COMPRESSION_LEVEL
+Defines the zstd compression level to use for local file storage. + + + + + + +
Typeinteger
Default5
Valid Values[-7..22]
ENVDT_FILE_STORAGE_LOCAL_COMPRESSION_LEVEL
**`dt.file-storage.local.directory`** [¶](#dtfile-storagelocaldirectory){ .headerlink } -: Defines the local directory where files shall be stored. - - - - -
Typestring
Default${dt.data.directory}/storage
ENVDT_FILE_STORAGE_LOCAL_DIRECTORY
+Defines the local directory where files shall be stored. + + + + + +
Typestring
Default${dt.data.directory}/storage
ENVDT_FILE_STORAGE_LOCAL_DIRECTORY
**`dt.file-storage.provider`** [¶](#dtfile-storageprovider){ .headerlink } -: Defines the file storage provider to use. - - - - - -
Typeenum
Defaultlocal
Valid Values[local, memory, s3]
ENVDT_FILE_STORAGE_PROVIDER
+Defines the file storage provider to use. + + + + + + +
Typeenum
Defaultlocal
Valid Values[local, memory, s3]
ENVDT_FILE_STORAGE_PROVIDER
**`dt.file-storage.s3.access.key`** [¶](#dtfile-storages3accesskey){ .headerlink } -: Defines the S3 access key / username. - - - - -
Typestring
Defaultnull
ENVDT_FILE_STORAGE_S3_ACCESS_KEY
+Defines the S3 access key / username. + + + + + +
Typestring
Defaultnull
ENVDT_FILE_STORAGE_S3_ACCESS_KEY
**`dt.file-storage.s3.bucket`** [¶](#dtfile-storages3bucket){ .headerlink } -: Defines the name of the S3 bucket. The existence of the bucket will be verified during startup. - - - - -
Typestring
Defaultnull
ENVDT_FILE_STORAGE_S3_BUCKET
+Defines the name of the S3 bucket. The existence of the bucket will be verified during startup. + + + + + +
Typestring
Defaultnull
ENVDT_FILE_STORAGE_S3_BUCKET
**`dt.file-storage.s3.compression.level`** [¶](#dtfile-storages3compressionlevel){ .headerlink } -: Defines the zstd compression level to use for S3 file storage. - - - - - -
Typeinteger
Default5
Valid Values[-7..22]
ENVDT_FILE_STORAGE_S3_COMPRESSION_LEVEL
+Defines the zstd compression level to use for S3 file storage. + + + + + + +
Typeinteger
Default5
Valid Values[-7..22]
ENVDT_FILE_STORAGE_S3_COMPRESSION_LEVEL
**`dt.file-storage.s3.connect-timeout-ms`** [¶](#dtfile-storages3connect-timeout-ms){ .headerlink } -: Defines the HTTP connect timeout for S3 requests in milliseconds. - - - - -
Typeinteger
Defaultnull
ENVDT_FILE_STORAGE_S3_CONNECT_TIMEOUT_MS
+Defines the HTTP connect timeout for S3 requests in milliseconds. + + + + + +
Typeinteger
Defaultnull
ENVDT_FILE_STORAGE_S3_CONNECT_TIMEOUT_MS
**`dt.file-storage.s3.endpoint`** [¶](#dtfile-storages3endpoint){ .headerlink } -: Defines the S3 endpoint URL. - - - - -
Typestring
Defaultnull
ENVDT_FILE_STORAGE_S3_ENDPOINT
+Defines the S3 endpoint URL. + + + + + +
Typestring
Defaultnull
ENVDT_FILE_STORAGE_S3_ENDPOINT
**`dt.file-storage.s3.read-timeout-ms`** [¶](#dtfile-storages3read-timeout-ms){ .headerlink } -: Defines the HTTP read timeout for S3 requests in milliseconds. - - - - -
Typeinteger
Defaultnull
ENVDT_FILE_STORAGE_S3_READ_TIMEOUT_MS
+Defines the HTTP read timeout for S3 requests in milliseconds. + + + + + +
Typeinteger
Defaultnull
ENVDT_FILE_STORAGE_S3_READ_TIMEOUT_MS
**`dt.file-storage.s3.region`** [¶](#dtfile-storages3region){ .headerlink } -: Defines the region of the S3 bucket. - - - - -
Typestring
Defaultnull
ENVDT_FILE_STORAGE_S3_REGION
+Defines the region of the S3 bucket. + + + + + +
Typestring
Defaultnull
ENVDT_FILE_STORAGE_S3_REGION
**`dt.file-storage.s3.secret.key`** [¶](#dtfile-storages3secretkey){ .headerlink } -: Defines the S3 secret key / password. - - - - -
Typestring
Defaultnull
ENVDT_FILE_STORAGE_S3_SECRET_KEY
+Defines the S3 secret key / password. + + + + + +
Typestring
Defaultnull
ENVDT_FILE_STORAGE_S3_SECRET_KEY
**`dt.file-storage.s3.write-timeout-ms`** [¶](#dtfile-storages3write-timeout-ms){ .headerlink } -: Defines the HTTP write timeout for S3 requests in milliseconds. - - - - -
Typeinteger
Defaultnull
ENVDT_FILE_STORAGE_S3_WRITE_TIMEOUT_MS
+Defines the HTTP write timeout for S3 requests in milliseconds. + + + + + +
Typeinteger
Defaultnull
ENVDT_FILE_STORAGE_S3_WRITE_TIMEOUT_MS
## Task Execution **`dt.worker.thread.multiplier`** * [¶](#dtworkerthreadmultiplier){ .headerlink } -: Defines a multiplier that is used to calculate the number of threads used by the event subsystem. This property is only used when [`dt.worker.threads`](#dtworkerthreads) is set to 0. A machine with 4 cores and a multiplier of 4, will use (at most) 16 worker threads. - - - - -
Typeinteger
Default4
ENVDT_WORKER_THREAD_MULTIPLIER
+Defines a multiplier that is used to calculate the number of threads used by the event subsystem. This property is only used when [`dt.worker.threads`](#dtworkerthreads) is set to 0. A machine with 4 cores and a multiplier of 4, will use (at most) 16 worker threads. + + + + + +
Typeinteger
Default4
ENVDT_WORKER_THREAD_MULTIPLIER
**`dt.worker.threads`** * [¶](#dtworkerthreads){ .headerlink } -: Defines the number of worker threads that the event subsystem will consume. Events occur asynchronously and are processed by the Event subsystem. This value should be large enough to handle most production situations without introducing much delay, yet small enough not to pose additional load on an already resource-constrained server. A value of 0 will instruct Alpine to allocate 1 thread per CPU core. This can further be tweaked using the [`dt.worker.thread.multiplier`](#dtworkerthreadmultiplier) property. - - - - -
Typeinteger
Default0
ENVDT_WORKER_THREADS
+Defines the number of worker threads that the event subsystem will consume. Events occur asynchronously and are processed by the Event subsystem. This value should be large enough to handle most production situations without introducing much delay, yet small enough not to pose additional load on an already resource-constrained server. A value of 0 will instruct Alpine to allocate 1 thread per CPU core. This can further be tweaked using the [`dt.worker.thread.multiplier`](#dtworkerthreadmultiplier) property. + + + + + +
Typeinteger
Default0
ENVDT_WORKER_THREADS
## Task Scheduling **`dt.task-scheduler.enabled`** [¶](#dttask-schedulerenabled){ .headerlink } -: Defines whether the task scheduler should be enabled.

May be disabled on specific nodes in the cluster to limit the amount of background processing they're doing. Can help with dedicating nodes to only serve web traffic. - - - - - -
Typeboolean
Defaulttrue
ENVDT_TASK_SCHEDULER_ENABLED
-**`dt.task.csaf.document.import.cron`** * [¶](#dttaskcsafdocumentimportcron){ .headerlink } -: Cron expression of the CSAF mirroring task. +Defines whether the task scheduler should be enabled.

May be disabled on specific nodes in the cluster to limit the amount of background processing they're doing. Can help with dedicating nodes to only serve web traffic. - - - - -
Typecron
Default0 5 * * *
ENVDT_TASK_CSAF_DOCUMENT_IMPORT_CRON
+ + + + +
Typeboolean
Defaulttrue
ENVDT_TASK_SCHEDULER_ENABLED
**`dt.task.defect.dojo.upload.cron`** * [¶](#dttaskdefectdojouploadcron){ .headerlink } -: Cron expression of the DefectDojo upload task. - - - - -
Typecron
Default0 2 * * *
ENVDT_TASK_DEFECT_DOJO_UPLOAD_CRON
+Cron expression of the DefectDojo upload task. + + + + + +
Typecron
Default0 2 * * *
ENVDT_TASK_DEFECT_DOJO_UPLOAD_CRON
**`dt.task.epss.mirror.cron`** * [¶](#dttaskepssmirrorcron){ .headerlink } -: Cron expression of the EPSS mirroring task. - - - - -
Typecron
Default0 1 * * *
ENVDT_TASK_EPSS_MIRROR_CRON
+Cron expression of the EPSS mirroring task. + + + + + +
Typecron
Default0 1 * * *
ENVDT_TASK_EPSS_MIRROR_CRON
**`dt.task.epss.mirror.lock.max.duration`** * [¶](#dttaskepssmirrorlockmaxduration){ .headerlink } -: Maximum duration in ISO 8601 format for which the EPSS mirror task will hold a lock.

The duration should be long enough to cover the task's execution duration. - - - - -
Typeduration
DefaultPT15M
ENVDT_TASK_EPSS_MIRROR_LOCK_MAX_DURATION
+Maximum duration in ISO 8601 format for which the EPSS mirror task will hold a lock.

The duration should be long enough to cover the task's execution duration. + + + + + +
Typeduration
DefaultPT15M
ENVDT_TASK_EPSS_MIRROR_LOCK_MAX_DURATION
**`dt.task.epss.mirror.lock.min.duration`** * [¶](#dttaskepssmirrorlockminduration){ .headerlink } -: Minimum duration in ISO 8601 format for which the EPSS mirror task will hold a lock.

The duration should be long enough to cover eventual clock skew across API server instances. - - - - -
Typeduration
DefaultPT1M
ENVDT_TASK_EPSS_MIRROR_LOCK_MIN_DURATION
+Minimum duration in ISO 8601 format for which the EPSS mirror task will hold a lock.

The duration should be long enough to cover eventual clock skew across API server instances. + + + + + +
Typeduration
DefaultPT1M
ENVDT_TASK_EPSS_MIRROR_LOCK_MIN_DURATION
**`dt.task.expired-session-cleanup.cron`** * [¶](#dttaskexpired-session-cleanupcron){ .headerlink } -: Cron expression of the expired session cleanup task. - - - - -
Typecron
Default0 * * * *
ENVDT_TASK_EXPIRED_SESSION_CLEANUP_CRON
+Cron expression of the expired session cleanup task. + + + + + +
Typecron
Default0 * * * *
ENVDT_TASK_EXPIRED_SESSION_CLEANUP_CRON
**`dt.task.fortify.ssc.upload.cron`** * [¶](#dttaskfortifysscuploadcron){ .headerlink } -: Cron expression of the Fortify SSC upload task. - - - - -
Typecron
Default0 2 * * *
ENVDT_TASK_FORTIFY_SSC_UPLOAD_CRON
+Cron expression of the Fortify SSC upload task. + + + + + +
Typecron
Default0 2 * * *
ENVDT_TASK_FORTIFY_SSC_UPLOAD_CRON
**`dt.task.git.hub.advisory.mirror.cron`** * [¶](#dttaskgithubadvisorymirrorcron){ .headerlink } -: Cron expression of the vulnerability GitHub Advisories mirroring task. - - - - -
Typecron
Default0 2 * * *
ENVDT_TASK_GIT_HUB_ADVISORY_MIRROR_CRON
+Cron expression of the vulnerability GitHub Advisories mirroring task. + + + + + +
Typecron
Default0 2 * * *
ENVDT_TASK_GIT_HUB_ADVISORY_MIRROR_CRON
**`dt.task.internal.component.identification.cron`** * [¶](#dttaskinternalcomponentidentificationcron){ .headerlink } -: Cron expression of the internal component identification task. - - - - -
Typecron
Default25 */6 * * *
ENVDT_TASK_INTERNAL_COMPONENT_IDENTIFICATION_CRON
+Cron expression of the internal component identification task. + + + + + +
Typecron
Default25 */6 * * *
ENVDT_TASK_INTERNAL_COMPONENT_IDENTIFICATION_CRON
**`dt.task.internal.component.identification.lock.max.duration`** * [¶](#dttaskinternalcomponentidentificationlockmaxduration){ .headerlink } -: Maximum duration in ISO 8601 format for which the internal component identification task will hold a lock.

The duration should be long enough to cover the task's execution duration. - - - - -
Typeduration
DefaultPT15M
ENVDT_TASK_INTERNAL_COMPONENT_IDENTIFICATION_LOCK_MAX_DURATION
+Maximum duration in ISO 8601 format for which the internal component identification task will hold a lock.

The duration should be long enough to cover the task's execution duration. + + + + + +
Typeduration
DefaultPT15M
ENVDT_TASK_INTERNAL_COMPONENT_IDENTIFICATION_LOCK_MAX_DURATION
**`dt.task.internal.component.identification.lock.min.duration`** * [¶](#dttaskinternalcomponentidentificationlockminduration){ .headerlink } -: Minimum duration in ISO 8601 format for which the internal component identification task will hold a lock.

The duration should be long enough to cover eventual clock skew across API server instances. - - - - -
Typeduration
DefaultPT90S
ENVDT_TASK_INTERNAL_COMPONENT_IDENTIFICATION_LOCK_MIN_DURATION
+Minimum duration in ISO 8601 format for which the internal component identification task will hold a lock.

The duration should be long enough to cover eventual clock skew across API server instances. + + + + + +
Typeduration
DefaultPT90S
ENVDT_TASK_INTERNAL_COMPONENT_IDENTIFICATION_LOCK_MIN_DURATION
**`dt.task.kenna.security.upload.cron`** * [¶](#dttaskkennasecurityuploadcron){ .headerlink } -: Cron expression of the Kenna Security upload task. - - - - -
Typecron
Default0 2 * * *
ENVDT_TASK_KENNA_SECURITY_UPLOAD_CRON
+Cron expression of the Kenna Security upload task. + + + + + +
Typecron
Default0 2 * * *
ENVDT_TASK_KENNA_SECURITY_UPLOAD_CRON
**`dt.task.ldap.sync.cron`** * [¶](#dttaskldapsynccron){ .headerlink } -: Cron expression of the LDAP synchronization task. - - - - -
Typecron
Default0 */6 * * *
ENVDT_TASK_LDAP_SYNC_CRON
+Cron expression of the LDAP synchronization task. + + + + + +
Typecron
Default0 */6 * * *
ENVDT_TASK_LDAP_SYNC_CRON
**`dt.task.ldap.sync.lock.max.duration`** * [¶](#dttaskldapsynclockmaxduration){ .headerlink } -: Maximum duration in ISO 8601 format for which the LDAP synchronization task will hold a lock.

The duration should be long enough to cover the task's execution duration. - - - - -
Typeduration
DefaultPT15M
ENVDT_TASK_LDAP_SYNC_LOCK_MAX_DURATION
+Maximum duration in ISO 8601 format for which the LDAP synchronization task will hold a lock.

The duration should be long enough to cover the task's execution duration. + + + + + +
Typeduration
DefaultPT15M
ENVDT_TASK_LDAP_SYNC_LOCK_MAX_DURATION
**`dt.task.ldap.sync.lock.min.duration`** * [¶](#dttaskldapsynclockminduration){ .headerlink } -: Minimum duration in ISO 8601 format for which the LDAP synchronization task will hold a lock.

The duration should be long enough to cover eventual clock skew across API server instances. - - - - -
Typeduration
DefaultPT90S
ENVDT_TASK_LDAP_SYNC_LOCK_MIN_DURATION
+Minimum duration in ISO 8601 format for which the LDAP synchronization task will hold a lock.

The duration should be long enough to cover eventual clock skew across API server instances. + + + + + +
Typeduration
DefaultPT90S
ENVDT_TASK_LDAP_SYNC_LOCK_MIN_DURATION
**`dt.task.metrics.maintenance.cron`** * [¶](#dttaskmetricsmaintenancecron){ .headerlink } -: Cron expression of the metrics maintenance task.

The task creates new partitions for the day for the following tables And deletes records older than the configured metrics retention duration from the following tables:
  • DEPENDENCYMETRICS
  • PROJECTMETRICS
- - - - -
Typecron
Default1 * * * *
ENVDT_TASK_METRICS_MAINTENANCE_CRON
+Cron expression of the metrics maintenance task.

The task creates new partitions for the day for the following tables And deletes records older than the configured metrics retention duration from the following tables:
  • DEPENDENCYMETRICS
  • PROJECTMETRICS
+ + + + + +
Typecron
Default1 * * * *
ENVDT_TASK_METRICS_MAINTENANCE_CRON
**`dt.task.metrics.maintenance.lock.max.duration`** * [¶](#dttaskmetricsmaintenancelockmaxduration){ .headerlink } -: Maximum duration in ISO 8601 format for which the metrics maintenance task will hold a lock.

The duration should be long enough to cover the task's execution duration. - - - - -
Typeduration
DefaultPT15M
ENVDT_TASK_METRICS_MAINTENANCE_LOCK_MAX_DURATION
+Maximum duration in ISO 8601 format for which the metrics maintenance task will hold a lock.

The duration should be long enough to cover the task's execution duration. + + + + + +
Typeduration
DefaultPT15M
ENVDT_TASK_METRICS_MAINTENANCE_LOCK_MAX_DURATION
**`dt.task.metrics.maintenance.lock.min.duration`** * [¶](#dttaskmetricsmaintenancelockminduration){ .headerlink } -: Minimum duration in ISO 8601 format for which the metrics maintenance task will hold a lock.

The duration should be long enough to cover eventual clock skew across API server instances. - - - - -
Typeduration
DefaultPT1M
ENVDT_TASK_METRICS_MAINTENANCE_LOCK_MIN_DURATION
+Minimum duration in ISO 8601 format for which the metrics maintenance task will hold a lock.

The duration should be long enough to cover eventual clock skew across API server instances. + + + + + +
Typeduration
DefaultPT1M
ENVDT_TASK_METRICS_MAINTENANCE_LOCK_MIN_DURATION
**`dt.task.nist.mirror.cron`** * [¶](#dttasknistmirrorcron){ .headerlink } -: Cron expression of the NIST / NVD mirroring task. - - - - -
Typecron
Default0 4 * * *
ENVDT_TASK_NIST_MIRROR_CRON
+Cron expression of the NIST / NVD mirroring task. + + + + + +
Typecron
Default0 4 * * *
ENVDT_TASK_NIST_MIRROR_CRON
**`dt.task.osv.mirror.cron`** * [¶](#dttaskosvmirrorcron){ .headerlink } -: Cron expression of the OSV mirroring task. - - - - -
Typecron
Default0 3 * * *
ENVDT_TASK_OSV_MIRROR_CRON
+Cron expression of the OSV mirroring task. + + + + + +
Typecron
Default0 3 * * *
ENVDT_TASK_OSV_MIRROR_CRON
**`dt.task.package-metadata-resolution.cron`** * [¶](#dttaskpackage-metadata-resolutioncron){ .headerlink } -: Cron expression of the package metadata resolution task.

Note that package metadata resolution is also triggered by other actions, such as BOM uploads. The scheduled execution is mostly relevant for deployments that may sit idle for a long time. - - - - -
Typecron
Default0 1 * * *
ENVDT_TASK_PACKAGE_METADATA_RESOLUTION_CRON
+Cron expression of the package metadata resolution task.

Note that package metadata resolution is also triggered by other actions, such as BOM uploads. The scheduled execution is mostly relevant for deployments that may sit idle for a long time. + + + + + +
Typecron
Default0 1 * * *
ENVDT_TASK_PACKAGE_METADATA_RESOLUTION_CRON
**`dt.task.package.metadata.maintenance.cron`** * [¶](#dttaskpackagemetadatamaintenancecron){ .headerlink } -: Cron expression of the package metadata maintenance task.

The task deletes orphaned records from the `PACKAGE_ARTIFACT_METADATA` and `PACKAGE_METADATA` tables. - - - - -
Typecron
Default0 */12 * * *
ENVDT_TASK_PACKAGE_METADATA_MAINTENANCE_CRON
+Cron expression of the package metadata maintenance task.

The task deletes orphaned records from the `PACKAGE_ARTIFACT_METADATA` and `PACKAGE_METADATA` tables. + + + + + +
Typecron
Default0 */12 * * *
ENVDT_TASK_PACKAGE_METADATA_MAINTENANCE_CRON
**`dt.task.package.metadata.maintenance.lock.max.duration`** * [¶](#dttaskpackagemetadatamaintenancelockmaxduration){ .headerlink } -: Maximum duration in ISO 8601 format for which the package metadata maintenance task will hold a lock.

The duration should be long enough to cover the task's execution duration. - - - - -
Typeduration
DefaultPT15M
ENVDT_TASK_PACKAGE_METADATA_MAINTENANCE_LOCK_MAX_DURATION
+Maximum duration in ISO 8601 format for which the package metadata maintenance task will hold a lock.

The duration should be long enough to cover the task's execution duration. + + + + + +
Typeduration
DefaultPT15M
ENVDT_TASK_PACKAGE_METADATA_MAINTENANCE_LOCK_MAX_DURATION
**`dt.task.package.metadata.maintenance.lock.min.duration`** * [¶](#dttaskpackagemetadatamaintenancelockminduration){ .headerlink } -: Minimum duration in ISO 8601 format for which the package metadata maintenance task will hold a lock.

The duration should be long enough to cover eventual clock skew across API server instances. - - - - -
Typeduration
DefaultPT1M
ENVDT_TASK_PACKAGE_METADATA_MAINTENANCE_LOCK_MIN_DURATION
+Minimum duration in ISO 8601 format for which the package metadata maintenance task will hold a lock.

The duration should be long enough to cover eventual clock skew across API server instances. + + + + + +
Typeduration
DefaultPT1M
ENVDT_TASK_PACKAGE_METADATA_MAINTENANCE_LOCK_MIN_DURATION
**`dt.task.portfolio-metrics-update.cron`** * [¶](#dttaskportfolio-metrics-updatecron){ .headerlink } -: Cron expression of the portfolio metrics update task. - - - - -
Typecron
Default10 * * * *
ENVDT_TASK_PORTFOLIO_METRICS_UPDATE_CRON
+Cron expression of the portfolio metrics update task. + + + + + +
Typecron
Default10 * * * *
ENVDT_TASK_PORTFOLIO_METRICS_UPDATE_CRON
**`dt.task.project.maintenance.cron`** * [¶](#dttaskprojectmaintenancecron){ .headerlink } -: Cron expression of the project maintenance task.

The task deletes inactive projects based on retention policy. - - - - -
Typecron
Default0 */4 * * *
ENVDT_TASK_PROJECT_MAINTENANCE_CRON
+Cron expression of the project maintenance task.

The task deletes inactive projects based on retention policy. + + + + + +
Typecron
Default0 */4 * * *
ENVDT_TASK_PROJECT_MAINTENANCE_CRON
**`dt.task.project.maintenance.lock.max.duration`** * [¶](#dttaskprojectmaintenancelockmaxduration){ .headerlink } -: Maximum duration in ISO 8601 format for which the project maintenance task will hold a lock.

The duration should be long enough to cover the task's execution duration. - - - - -
Typeduration
DefaultPT15M
ENVDT_TASK_PROJECT_MAINTENANCE_LOCK_MAX_DURATION
+Maximum duration in ISO 8601 format for which the project maintenance task will hold a lock.

The duration should be long enough to cover the task's execution duration. + + + + + +
Typeduration
DefaultPT15M
ENVDT_TASK_PROJECT_MAINTENANCE_LOCK_MAX_DURATION
**`dt.task.project.maintenance.lock.min.duration`** * [¶](#dttaskprojectmaintenancelockminduration){ .headerlink } -: Minimum duration in ISO 8601 format for which the project maintenance task will hold a lock.

The duration should be long enough to cover eventual clock skew across API server instances. - - - - -
Typeduration
DefaultPT1M
ENVDT_TASK_PROJECT_MAINTENANCE_LOCK_MIN_DURATION
+Minimum duration in ISO 8601 format for which the project maintenance task will hold a lock.

The duration should be long enough to cover eventual clock skew across API server instances. + + + + + +
Typeduration
DefaultPT1M
ENVDT_TASK_PROJECT_MAINTENANCE_LOCK_MIN_DURATION
**`dt.task.scheduled-notification-dispatch.cron`** * [¶](#dttaskscheduled-notification-dispatchcron){ .headerlink } -: Cron expression for polling scheduled notification rules that are due for dispatch. - - - - -
Typecron
Default* * * * *
ENVDT_TASK_SCHEDULED_NOTIFICATION_DISPATCH_CRON
+Cron expression for polling scheduled notification rules that are due for dispatch. + + + + + +
Typecron
Default* * * * *
ENVDT_TASK_SCHEDULED_NOTIFICATION_DISPATCH_CRON
**`dt.task.tag.maintenance.cron`** * [¶](#dttasktagmaintenancecron){ .headerlink } -: Cron expression of the tag maintenance task.

The task deletes orphaned tags that are not used anymore. - - - - -
Typecron
Default0 */12 * * *
ENVDT_TASK_TAG_MAINTENANCE_CRON
+Cron expression of the tag maintenance task.

The task deletes orphaned tags that are not used anymore. + + + + + +
Typecron
Default0 */12 * * *
ENVDT_TASK_TAG_MAINTENANCE_CRON
**`dt.task.tag.maintenance.lock.max.duration`** * [¶](#dttasktagmaintenancelockmaxduration){ .headerlink } -: Maximum duration in ISO 8601 format for which the tag maintenance task will hold a lock.

The duration should be long enough to cover the task's execution duration. - - - - -
Typeduration
DefaultPT15M
ENVDT_TASK_TAG_MAINTENANCE_LOCK_MAX_DURATION
+Maximum duration in ISO 8601 format for which the tag maintenance task will hold a lock.

The duration should be long enough to cover the task's execution duration. + + + + + +
Typeduration
DefaultPT15M
ENVDT_TASK_TAG_MAINTENANCE_LOCK_MAX_DURATION
**`dt.task.tag.maintenance.lock.min.duration`** * [¶](#dttasktagmaintenancelockminduration){ .headerlink } -: Minimum duration in ISO 8601 format for which the tag maintenance task will hold a lock.

The duration should be long enough to cover eventual clock skew across API server instances. - - - - -
Typeduration
DefaultPT1M
ENVDT_TASK_TAG_MAINTENANCE_LOCK_MIN_DURATION
+Minimum duration in ISO 8601 format for which the tag maintenance task will hold a lock.

The duration should be long enough to cover eventual clock skew across API server instances. + + + + + +
Typeduration
DefaultPT1M
ENVDT_TASK_TAG_MAINTENANCE_LOCK_MIN_DURATION
**`dt.task.telemetry-submission.cron`** * [¶](#dttasktelemetry-submissioncron){ .headerlink } -: Cron expression of the telemetry submission task.

The task enforces a 24-hour minimum interval between submissions, so the cron expression controls how often the task checks whether a submission is due. - - - - -
Typecron
Default0 */1 * * *
ENVDT_TASK_TELEMETRY_SUBMISSION_CRON
+Cron expression of the telemetry submission task.

The task enforces a 24-hour minimum interval between submissions, so the cron expression controls how often the task checks whether a submission is due. + + + + + +
Typecron
Default0 */1 * * *
ENVDT_TASK_TELEMETRY_SUBMISSION_CRON
**`dt.task.vulnerability-policy-bundle-sync.cron`** * [¶](#dttaskvulnerability-policy-bundle-synccron){ .headerlink } -: Cron expression of the vulnerability policy bundle synchronization task.

Has no effect unless [`dt.vulnerability.policy.bundle.url`](#dtvulnerabilitypolicybundleurl) is also configured. - - - - -
Typecron
Default*/15 * * * *
ENVDT_TASK_VULNERABILITY_POLICY_BUNDLE_SYNC_CRON
+Cron expression of the vulnerability policy bundle synchronization task.

Has no effect unless [`dt.vulnerability.policy.bundle.url`](#dtvulnerabilitypolicybundleurl) is also configured. + + + + + +
Typecron
Default*/15 * * * *
ENVDT_TASK_VULNERABILITY_POLICY_BUNDLE_SYNC_CRON
**`dt.task.vulnerability.analysis.cron`** * [¶](#dttaskvulnerabilityanalysiscron){ .headerlink } -: Cron expression of the portfolio vulnerability analysis task. - - - - -
Typecron
Default0 6 * * *
ENVDT_TASK_VULNERABILITY_ANALYSIS_CRON
+Cron expression of the portfolio vulnerability analysis task. + + + + + +
Typecron
Default0 6 * * *
ENVDT_TASK_VULNERABILITY_ANALYSIS_CRON
**`dt.task.vulnerability.analysis.lock.max.duration`** * [¶](#dttaskvulnerabilityanalysislockmaxduration){ .headerlink } -: Maximum duration in ISO 8601 format for which the portfolio vulnerability analysis task will hold a lock.

The duration should be long enough to cover the task's execution duration. - - - - -
Typeduration
DefaultPT15M
ENVDT_TASK_VULNERABILITY_ANALYSIS_LOCK_MAX_DURATION
+Maximum duration in ISO 8601 format for which the portfolio vulnerability analysis task will hold a lock.

The duration should be long enough to cover the task's execution duration. + + + + + +
Typeduration
DefaultPT15M
ENVDT_TASK_VULNERABILITY_ANALYSIS_LOCK_MAX_DURATION
**`dt.task.vulnerability.analysis.lock.min.duration`** * [¶](#dttaskvulnerabilityanalysislockminduration){ .headerlink } -: Minimum duration in ISO 8601 format for which the portfolio vulnerability analysis task will hold a lock.

The duration should be long enough to cover eventual clock skew across API server instances. - - - - -
Typeduration
DefaultPT90S
ENVDT_TASK_VULNERABILITY_ANALYSIS_LOCK_MIN_DURATION
+Minimum duration in ISO 8601 format for which the portfolio vulnerability analysis task will hold a lock.

The duration should be long enough to cover eventual clock skew across API server instances. + + + + + +
Typeduration
DefaultPT90S
ENVDT_TASK_VULNERABILITY_ANALYSIS_LOCK_MIN_DURATION
**`dt.task.vulnerability.database.maintenance.cron`** * [¶](#dttaskvulnerabilitydatabasemaintenancecron){ .headerlink } -: Cron expression of the vulnerability database maintenance task.

The task deletes orphaned records from the `VULNERABLESOFTWARE` table. - - - - -
Typecron
Default0 0 * * *
ENVDT_TASK_VULNERABILITY_DATABASE_MAINTENANCE_CRON
+Cron expression of the vulnerability database maintenance task.

The task deletes orphaned records from the `VULNERABLESOFTWARE` table. + + + + + +
Typecron
Default0 0 * * *
ENVDT_TASK_VULNERABILITY_DATABASE_MAINTENANCE_CRON
**`dt.task.vulnerability.database.maintenance.lock.max.duration`** * [¶](#dttaskvulnerabilitydatabasemaintenancelockmaxduration){ .headerlink } -: Maximum duration in ISO 8601 format for which the vulnerability database maintenance task will hold a lock.

The duration should be long enough to cover the task's execution duration. - - - - -
Typeduration
DefaultPT15M
ENVDT_TASK_VULNERABILITY_DATABASE_MAINTENANCE_LOCK_MAX_DURATION
+Maximum duration in ISO 8601 format for which the vulnerability database maintenance task will hold a lock.

The duration should be long enough to cover the task's execution duration. + + + + + +
Typeduration
DefaultPT15M
ENVDT_TASK_VULNERABILITY_DATABASE_MAINTENANCE_LOCK_MAX_DURATION
**`dt.task.vulnerability.database.maintenance.lock.min.duration`** * [¶](#dttaskvulnerabilitydatabasemaintenancelockminduration){ .headerlink } -: Minimum duration in ISO 8601 format for which the vulnerability database maintenance task will hold a lock.

The duration should be long enough to cover eventual clock skew across API server instances. - - - - -
Typeduration
DefaultPT1M
ENVDT_TASK_VULNERABILITY_DATABASE_MAINTENANCE_LOCK_MIN_DURATION
+Minimum duration in ISO 8601 format for which the vulnerability database maintenance task will hold a lock.

The duration should be long enough to cover eventual clock skew across API server instances. + + + + + +
Typeduration
DefaultPT1M
ENVDT_TASK_VULNERABILITY_DATABASE_MAINTENANCE_LOCK_MIN_DURATION
**`dt.task.vulnerability.metrics.update.cron`** * [¶](#dttaskvulnerabilitymetricsupdatecron){ .headerlink } -: Cron expression of the vulnerability metrics update task. - - - - -
Typecron
Default40 * * * *
ENVDT_TASK_VULNERABILITY_METRICS_UPDATE_CRON
+Cron expression of the vulnerability metrics update task. + + + + + +
Typecron
Default40 * * * *
ENVDT_TASK_VULNERABILITY_METRICS_UPDATE_CRON
**`dt.task.vulnerability.metrics.update.lock.max.duration`** * [¶](#dttaskvulnerabilitymetricsupdatelockmaxduration){ .headerlink } -: Maximum duration in ISO 8601 format for which the vulnerability metrics update task will hold a lock.

The duration should be long enough to cover the task's execution duration. - - - - -
Typeduration
DefaultPT15M
ENVDT_TASK_VULNERABILITY_METRICS_UPDATE_LOCK_MAX_DURATION
+Maximum duration in ISO 8601 format for which the vulnerability metrics update task will hold a lock.

The duration should be long enough to cover the task's execution duration. + + + + + +
Typeduration
DefaultPT15M
ENVDT_TASK_VULNERABILITY_METRICS_UPDATE_LOCK_MAX_DURATION
**`dt.task.vulnerability.metrics.update.lock.min.duration`** * [¶](#dttaskvulnerabilitymetricsupdatelockminduration){ .headerlink } -: Minimum duration in ISO 8601 format for which the vulnerability metrics update task will hold a lock.

The duration should be long enough to cover eventual clock skew across API server instances. - - - - -
Typeduration
DefaultPT90S
ENVDT_TASK_VULNERABILITY_METRICS_UPDATE_LOCK_MIN_DURATION
+Minimum duration in ISO 8601 format for which the vulnerability metrics update task will hold a lock.

The duration should be long enough to cover eventual clock skew across API server instances. + + + + + +
Typeduration
DefaultPT90S
ENVDT_TASK_VULNERABILITY_METRICS_UPDATE_LOCK_MIN_DURATION
**`dt.task.workflow.maintenance.cron`** * [¶](#dttaskworkflowmaintenancecron){ .headerlink } -: Cron expression of the workflow maintenance task.

The task:
  • Transitions workflow steps from PENDING to TIMED_OUT state
  • Transitions workflow steps from TIMED_OUT to FAILED state
  • Transitions children of FAILED steps to CANCELLED state
  • Deletes finished workflows according to the configured retention duration
- - - - -
Typecron
Default*/15 * * * *
ENVDT_TASK_WORKFLOW_MAINTENANCE_CRON
+Cron expression of the workflow maintenance task.

The task:
  • Transitions workflow steps from PENDING to TIMED_OUT state
  • Transitions workflow steps from TIMED_OUT to FAILED state
  • Transitions children of FAILED steps to CANCELLED state
  • Deletes finished workflows according to the configured retention duration
+ + + + + +
Typecron
Default*/15 * * * *
ENVDT_TASK_WORKFLOW_MAINTENANCE_CRON
**`dt.task.workflow.maintenance.lock.max.duration`** * [¶](#dttaskworkflowmaintenancelockmaxduration){ .headerlink } -: Maximum duration in ISO 8601 format for which the workflow maintenance task will hold a lock.

The duration should be long enough to cover the task's execution duration. - - - - -
Typeduration
DefaultPT5M
ENVDT_TASK_WORKFLOW_MAINTENANCE_LOCK_MAX_DURATION
+Maximum duration in ISO 8601 format for which the workflow maintenance task will hold a lock.

The duration should be long enough to cover the task's execution duration. + + + + + +
Typeduration
DefaultPT5M
ENVDT_TASK_WORKFLOW_MAINTENANCE_LOCK_MAX_DURATION
**`dt.task.workflow.maintenance.lock.min.duration`** * [¶](#dttaskworkflowmaintenancelockminduration){ .headerlink } -: Minimum duration in ISO 8601 format for which the workflow maintenance task will hold a lock.

The duration should be long enough to cover eventual clock skew across API server instances. - - - - -
Typeduration
DefaultPT1M
ENVDT_TASK_WORKFLOW_MAINTENANCE_LOCK_MIN_DURATION
+Minimum duration in ISO 8601 format for which the workflow maintenance task will hold a lock.

The duration should be long enough to cover eventual clock skew across API server instances. + + + + + +
Typeduration
DefaultPT1M
ENVDT_TASK_WORKFLOW_MAINTENANCE_LOCK_MIN_DURATION
## Vulnerability Analysis **`dt.vuln-analyzer.internal.datasource.name`** [¶](#dtvuln-analyzerinternaldatasourcename){ .headerlink } -: Defines the name of the data source to be used by the internal vulnerability analyzer.

The internal analyzer performs no database writes, so this data source *could* point to a read replica if needed. - - - - -
Typestring
Defaultdefault
ENVDT_VULN_ANALYZER_INTERNAL_DATASOURCE_NAME
+Defines the name of the data source to be used by the internal vulnerability analyzer.

The internal analyzer performs no database writes, so this data source *could* point to a read replica if needed. + + + + + +
Typestring
Defaultdefault
ENVDT_VULN_ANALYZER_INTERNAL_DATASOURCE_NAME
**`dt.vuln-analyzer.internal.enabled`** [¶](#dtvuln-analyzerinternalenabled){ .headerlink } -: Defines whether the internal vulnerability analyzer is enabled. - - - - -
Typeboolean
Defaulttrue
ENVDT_VULN_ANALYZER_INTERNAL_ENABLED
+Defines whether the internal vulnerability analyzer is enabled. + + + + + +
Typeboolean
Defaulttrue
ENVDT_VULN_ANALYZER_INTERNAL_ENABLED
**`dt.vuln-analyzer.oss-index.allow-local-connections`** [¶](#dtvuln-analyzeross-indexallow-local-connections){ .headerlink } -: Defines whether the OSS Index vulnerability analyzer is allowed to connect to local hosts. - - - - -
Typeboolean
Defaultfalse
ENVDT_VULN_ANALYZER_OSS_INDEX_ALLOW_LOCAL_CONNECTIONS
+Defines whether the OSS Index vulnerability analyzer is allowed to connect to local hosts. + + + + + +
Typeboolean
Defaultfalse
ENVDT_VULN_ANALYZER_OSS_INDEX_ALLOW_LOCAL_CONNECTIONS
**`dt.vuln-analyzer.oss-index.enabled`** [¶](#dtvuln-analyzeross-indexenabled){ .headerlink } -: Defines whether the OSS Index vulnerability analyzer is enabled. - - - - -
Typeboolean
Defaulttrue
ENVDT_VULN_ANALYZER_OSS_INDEX_ENABLED
+Defines whether the OSS Index vulnerability analyzer is enabled. + + + + + +
Typeboolean
Defaulttrue
ENVDT_VULN_ANALYZER_OSS_INDEX_ENABLED
**`dt.vuln-analyzer.snyk.api-version`** [¶](#dtvuln-analyzersnykapi-version){ .headerlink } -: Defines the Snyk REST API version to use.

Should only be changed if the default version is discontinued by Snyk and an upgrade of Dependency-Track is not immediately possible. - - - - -
Typestring
Default2025-11-05
ENVDT_VULN_ANALYZER_SNYK_API_VERSION
+Defines the Snyk REST API version to use.

Should only be changed if the default version is discontinued by Snyk and an upgrade of Dependency-Track is not immediately possible. + + + + + +
Typestring
Default2025-11-05
ENVDT_VULN_ANALYZER_SNYK_API_VERSION
**`dt.vuln-analyzer.snyk.enabled`** [¶](#dtvuln-analyzersnykenabled){ .headerlink } -: Defines whether the Snyk vulnerability analyzer is enabled. - - - - -
Typeboolean
Defaulttrue
ENVDT_VULN_ANALYZER_SNYK_ENABLED
+Defines whether the Snyk vulnerability analyzer is enabled. + + + + + +
Typeboolean
Defaulttrue
ENVDT_VULN_ANALYZER_SNYK_ENABLED
diff --git a/docs/reference/schemas/notification.md.tmpl b/docs/reference/schemas/notification.md.tmpl new file mode 100644 index 00000000..42e4ff5b --- /dev/null +++ b/docs/reference/schemas/notification.md.tmpl @@ -0,0 +1,89 @@ +{{ range .Files }} +{{ range .Messages }} +{{ if eq .LongName "Notification" }} + + + +## {{ .LongName }} + +{{ .Description }} + +{{ if .HasFields }} +| Field | Type | Description | +| :---- | :--- | :---------- | +{{ range .Fields -}} +| `{{ .Name }}` | {{ if and (ne .LongType "int64") (ne .LongType "int32") (ne .LongType "float") (ne .LongType "bytes") (ne .LongType "double") (ne .LongType "google.protobuf.Empty") (ne .LongType "string") (ne .LongType "bool") (ne .LongType "google.protobuf.Timestamp") (ne .LongType "google.protobuf.Any")}}[`{{ .LongType }}{{ if eq .Label "repeated" }}[]{{ end }}`](#{{ .FullType | anchor }}){{ else }}`{{ .LongType }}{{ if eq .Label "repeated" }}[]{{ end }}`{{ end }} | {{ .Description | replace "\n\n" "

" | replace "\n" " "}} | - | +{{ end }} +{{ end }} + +{{ end }} +{{ end }} +{{ end }} + +## Subjects + +{{ range .Files }} +{{ range .Messages }} +{{ if hasSuffix "Subject" .LongName }} + + + +### {{ .LongName }} + +{{ .Description }} + +{{ if .HasFields }} +| Field | Type | Description | +| :---- | :--- | :---------- | +{{ range .Fields -}} +| `{{ .Name }}` | {{ if and (ne .LongType "int64") (ne .LongType "int32") (ne .LongType "float") (ne .LongType "bytes") (ne .LongType "double") (ne .LongType "google.protobuf.Empty") (ne .LongType "string") (ne .LongType "bool") (ne .LongType "google.protobuf.Timestamp")}}[`{{ .LongType }}{{ if eq .Label "repeated" }}[]{{ end }}`](#{{ .FullType | anchor }}){{ else }}`{{ .LongType }}{{ if eq .Label "repeated" }}[]{{ end }}`{{ end }} | {{.Description | replace "\n\n" "

" | replace "\n" " "}} | - | +{{ end }} +{{ end }} + +{{ end }} +{{ end }} +{{ end }} + +## Messages + +{{ range .Files }} +{{ range .Messages }} +{{ if not (or (eq .LongName "Notification") (hasSuffix "Subject" .LongName)) }} + + + +### {{ .LongName }} + +{{ .Description }} + +{{ if .HasFields }} +| Field | Type | Description | +| :---- | :--- | :---------- | +{{ range .Fields -}} +| `{{ .Name }}` | {{ if and (ne .LongType "int64") (ne .LongType "int32") (ne .LongType "float") (ne .LongType "bytes") (ne .LongType "double") (ne .LongType "google.protobuf.Empty") (ne .LongType "string") (ne .LongType "bool") (ne .LongType "google.protobuf.Timestamp")}}[`{{ .LongType }}{{ if eq .Label "repeated" }}[]{{ end }}`](#{{ .FullType | anchor }}){{ else }}`{{ .LongType }}{{ if eq .Label "repeated" }}[]{{ end }}`{{end}} | {{.Description | replace "\n\n" "

" | replace "\n" " "}} | - | +{{ end }} +{{ end }} + +{{ end }} +{{ end }} +{{ end }} + +## Enums + +{{ range .Files }} +{{ range .Enums }} + + + +### {{ .LongName }} + +{{ .Description }} + +| Name | Description | +| :--- | :---------- | +{{ range .Values -}} +| `{{ .Name }}` | {{ .Description }} | +{{ end }} + +{{ end }} +{{ end }} \ No newline at end of file diff --git a/docs/reference/schemas/policy.md.tmpl b/docs/reference/schemas/policy.md.tmpl new file mode 100644 index 00000000..a10d27e4 --- /dev/null +++ b/docs/reference/schemas/policy.md.tmpl @@ -0,0 +1,43 @@ +## Messages + +{{ range .Files }} +{{ range .Messages }} + + + +### {{ .LongName }} + +{{ .Description }} + +{{ if .HasFields }} +| Field | Type | Description | +| :---- | :--- | :---------- | +{{ range .Fields -}} +| `{{ .Name }}` | {{ if and (ne .LongType "int64") (ne .LongType "int32") (ne .LongType "float") (ne .LongType "bytes") (ne .LongType "double") (ne .LongType "google.protobuf.Empty") (ne .LongType "string") (ne .LongType "bool") (ne .LongType "google.protobuf.Timestamp")}}[`{{ .LongType }}{{ if eq .Label "repeated" }}[]{{ end }}`](#{{ .FullType | anchor }}){{ else }}`{{ .LongType }}{{ if eq .Label "repeated" }}[]{{ end }}`{{end}} | {{.Description | replace "\n\n" "

" | replace "\n" " "}} | - | +{{ end }} +{{ end }} + +{{ end }} +{{ end }} + +{{ range .Files }} +{{ if .HasEnums }} +## Enums + +{{ range .Enums }} + + + +### {{ .LongName }} + +{{ .Description }} + +| Name | Description | +| :--- | :---------- | +{{ range .Values -}} +| `{{ .Name }}` | {{ .Description }} | +{{ end }} + +{{ end }} +{{ end }} +{{ end }} \ No newline at end of file diff --git a/pyproject.toml b/pyproject.toml index 2c2499c4..4c5b62bf 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -3,6 +3,7 @@ name = "dependency-track-docs" version = "0.0.0" requires-python = ">=3.14" dependencies = [ + "jinja2>=3.1.0", "mike==2.2.0", "mkdocs-awesome-pages-plugin==2.10.1", "mkdocs-material[imaging]==9.6.14", diff --git a/scripts/generate_config_docs.py b/scripts/generate_config_docs.py new file mode 100644 index 00000000..a834b458 --- /dev/null +++ b/scripts/generate_config_docs.py @@ -0,0 +1,279 @@ +#!/usr/bin/env python3 + +# This file is part of Dependency-Track. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# SPDX-License-Identifier: Apache-2.0 +# Copyright (c) OWASP Foundation. All Rights Reserved. + +"""Generate configuration documentation from application.properties files.""" + +import argparse +import re +import sys +from collections import defaultdict +from pathlib import Path + +from jinja2 import Environment, FileSystemLoader + + +def parse_properties(path, include_hidden=False): + """Parse an application.properties file and extract config property metadata.""" + lines = Path(path).read_text().splitlines() + properties = [] + current = _new_property() + + line_index = 0 + while line_index < len(lines): + line = lines[line_index].strip() + + if not line: + if current != _new_property(): + print( + f"\033[33m[!] Detected empty line, discarding incomplete" + f" property: {current}\033[0m", + file=sys.stderr, + ) + current = _new_property() + line_index += 1 + continue + + if re.match(r"^#[\s\w]", line): + line = line[1:].strip() + if re.match(r"^@type:\s", line): + current["type"] = line.split(":", 1)[1].strip().lower() + elif re.match(r"^@category:\s", line): + current["category"] = line.split(":", 1)[1].strip() + elif re.match(r"^@default:\s", line): + current["default_value"] = line.split(":", 1)[1].strip() + elif re.match(r"^@example:\s", line): + current["example"] = line.split(":", 1)[1].strip() + elif re.match(r"^@valid-values:\s", line): + current["valid_values"] = line.split(":", 1)[1].strip() + elif re.match(r"^@hidden\s*$", line): + current["hidden"] = True + elif re.match(r"^@required\s*$", line): + current["required"] = True + elif re.match(r"^@deprecated:\s", line): + current["deprecated"] = line.split(":", 1)[1].strip() + elif re.match(r"^[\w.\-]+=", line): + # Commented-out property definition. + line_index = _finalize_property( + line, lines, line_index, current, properties, include_hidden + ) + current = _new_property() + else: + if current["description"] is None: + current["description"] = line + " " + else: + current["description"] += line + " " + elif "=" in line: + line_index = _finalize_property( + line, lines, line_index, current, properties, include_hidden + ) + current = _new_property() + + line_index += 1 + + return properties + + +def _new_property(): + return { + "name": None, + "default_value": None, + "type": None, + "valid_values": None, + "description": None, + "example": None, + "category": None, + "required": False, + "deprecated": None, + "hidden": False, + } + + +def _finalize_property(line, lines, line_index, current, properties, include_hidden): + """Parse name=value from line, handle multi-line defaults, add to properties.""" + parts = line.split("=", 1) + current["name"] = parts[0].strip() + default_value = parts[1].strip() if len(parts) > 1 else "" + + # Handle multi-line defaults (trailing backslash). + if default_value.endswith("\\"): + default_value = default_value.rstrip("\\") + next_index = line_index + 1 + while next_index < len(lines): + next_line = lines[next_index] + # Continuation lines are either comment-prefixed or whitespace-prefixed. + if re.match(r"^#\s+", next_line): + continuation = re.sub(r"^#", "", next_line).strip() + elif re.match(r"^\s+", next_line): + continuation = next_line.strip() + else: + break + default_value += continuation + if not default_value.endswith("\\"): + break + default_value = default_value.rstrip("\\") + next_index += 1 + line_index = next_index + + # Skip profile-specific properties. + if current["name"].startswith("%"): + print( + f"\033[33m[!] Skipping profile-specific property {current['name']}\033[0m", + file=sys.stderr, + ) + return line_index + + if not current["default_value"]: + current["default_value"] = default_value + elif default_value: + print( + f"\033[33m[!] {current['name']} has both a default value" + f" ({default_value}) and a @default annotation" + f" ({current['default_value']})\033[0m", + file=sys.stderr, + ) + + if not current["hidden"] or include_hidden: + properties.append(current) + + return line_index + + +def _anchor(name): + return name.replace(".", "").replace('"', "").lower() + + +def _env(name): + return name.replace(".", "_").replace("-", "_").replace('"', "_").upper() + + +def _validate_default(prop): + """Validate that the default value matches the declared type.""" + default = prop["default_value"] + prop_type = prop["type"] + if not default or not prop_type or re.match(r"^\$\{[\w.]+}$", default): + return + try: + if prop_type == "boolean" and default not in ("true", "false"): + raise ValueError(f"{default} is not a valid boolean value") + elif prop_type == "double": + float(default) + elif prop_type == "integer": + int(default) + elif prop_type == "duration": + if not re.match(r"^P", default, re.IGNORECASE): + raise ValueError(f"{default} is not a valid ISO 8601 duration") + except (ValueError, TypeError) as e: + print( + f"\033[33m[!] Definition of property {prop['name']} appears to be" + f" invalid: {e}\033[0m", + file=sys.stderr, + ) + + +def post_process(properties): + """Apply cross-referencing, validation, and env/anchor computation.""" + anchors_by_name = {p["name"]: _anchor(p["name"]) for p in properties} + + for prop in properties: + _validate_default(prop) + + if not prop["default_value"] or not prop["default_value"].strip(): + prop["default_value"] = "null" + + if prop["type"] == "enum" and not prop.get("valid_values"): + print( + f"\033[33m[!] Property {prop['name']} is of type enum, but" + f" does not define any valid values\033[0m", + file=sys.stderr, + ) + + # Cross-reference property names in description and deprecated fields. + for field in ("description", "deprecated"): + if prop.get(field): + for ref_name, ref_anchor in anchors_by_name.items(): + prop[field] = re.sub( + r"\b" + re.escape(ref_name) + r"\b", + f"[`{ref_name}`](#{ref_anchor})", + prop[field], + ) + + if prop["description"] is None: + prop["description"] = "" + + prop["env"] = _env(prop["name"]) + prop["anchor"] = _anchor(prop["name"]) + + # Group by category, sorted. + by_category = defaultdict(list) + for prop in properties: + category = prop["category"] or "Other" + by_category[category].append(prop) + + sorted_categories = dict(sorted(by_category.items())) + for props in sorted_categories.values(): + props.sort(key=lambda p: p["name"]) + + return sorted_categories + + +def render(properties_by_category, template_path, args): + """Render properties using Jinja2 template.""" + template_dir = str(Path(template_path).parent) + template_name = Path(template_path).name + + env = Environment( + loader=FileSystemLoader(template_dir), + keep_trailing_newline=True, + trim_blocks=False, + lstrip_blocks=False, + ) + template = env.get_template(template_name) + + return template.render( + properties_by_category=properties_by_category, + generate_command=" ".join(args), + ) + + +def main(): + parser = argparse.ArgumentParser( + description="Generate configuration documentation from application.properties" + ) + parser.add_argument("properties_file", help="Path to application.properties") + parser.add_argument( + "-t", "--template", required=True, help="Path to Jinja2 template" + ) + parser.add_argument("-o", "--output", help="Output file path (default: stdout)") + parser.add_argument( + "--include-hidden", action="store_true", help="Include hidden properties" + ) + args = parser.parse_args() + + properties = parse_properties(args.properties_file, args.include_hidden) + properties_by_category = post_process(properties) + output = render(properties_by_category, args.template, sys.argv[1:]) + + if args.output: + Path(args.output).write_text(output) + else: + print(output, end="") + + +if __name__ == "__main__": + main() diff --git a/scripts/templates/config-docs.md.j2 b/scripts/templates/config-docs.md.j2 new file mode 100644 index 00000000..f07be436 --- /dev/null +++ b/scripts/templates/config-docs.md.j2 @@ -0,0 +1,55 @@ + + +# Configuration Properties + +## Glossary + +### Required Properties + +Properties marked with * are required. A required property must never be unset. + +### Property Types + +Configuration properties may use the following types: + +| Type | Description | +|:-----|:------------| +| `boolean` | `true` or `false` | +| `cron` | A [cron expression](https://en.wikipedia.org/wiki/Cron#Cron_expression) (e.g. `0 0 * * *`) | +| `double` | A decimal number (e.g. `3.14`) | +| `duration` | An [ISO 8601 duration](https://en.wikipedia.org/wiki/ISO_8601#Durations) (e.g. `PT30S`, `PT5M`, `PT1H`) | +| `enum` | One of a fixed set of values, refer to *Valid Values* | +| `integer` | A whole number (e.g. `42`) | +| `string` | A text value | + +{% for category, properties in properties_by_category.items() %} +## {{ category }} + +{% for property in properties -%} +**`{{ property.name }}`**{% if property.required %} *{% endif %} [¶](#{{ property.anchor }}){ .headerlink } + +{{ property.description }} + +{% if property.deprecated %} +!!! warning "Deprecated" + {{ property.deprecated }} + +{% endif -%} + + + +{% if property.valid_values -%} + +{% endif -%} +{% if property.example -%} + +{% endif -%} + +
Type{{ property.type }}
Default{{ property.default_value }}
Valid Values{{ property.valid_values }}
Example{{ property.example }}
ENV{{ property.env }}
+ +{% endfor %} +{% endfor %} \ No newline at end of file diff --git a/uv.lock b/uv.lock index 88404009..b346b05e 100644 --- a/uv.lock +++ b/uv.lock @@ -224,6 +224,7 @@ name = "dependency-track-docs" version = "0.0.0" source = { virtual = "." } dependencies = [ + { name = "jinja2" }, { name = "mike" }, { name = "mkdocs-awesome-pages-plugin" }, { name = "mkdocs-material", extra = ["imaging"] }, @@ -233,6 +234,7 @@ dependencies = [ [package.metadata] requires-dist = [ + { name = "jinja2", specifier = ">=3.1.0" }, { name = "mike", specifier = "==2.2.0" }, { name = "mkdocs-awesome-pages-plugin", specifier = "==2.10.1" }, { name = "mkdocs-material", extras = ["imaging"], specifier = "==9.6.14" },