config.yaml

# Copyright AGNTCY Contributors (https://github.com/agntcy)
# SPDX-License-Identifier: Apache-2.0

# Configuration for the tracing
tracing:
  # The logging level. Available options:
  #  - trace
  #  - debug
  #  - info
  #  - warn
  #  - error
  # Default: info
  log_level: debug

  # Display the thread name in the logs.
  # Default: true
  display_thread_names: true

  # Display the thread ID in the logs.
  # Default: false
  display_thread_ids: true

  opentelemetry:
    # Enables OpenTelemetry integration.
    # Default: false
    enabled: true

    # Service name used for the tracing.
    # Default: slim-data-plane
    service_name: "slim-data-plane"

    # Service version used for the tracing.
    # Default: v0.1.0
    service_version: "v0.1.0"

runtime:
  # The number of cores to use for the runtime.
  # Default: 0 (use all available cores)
  n_cores: 0

  # The name of the thread(s) that will run the runtime.
  # Default: "slim"
  thread_name: "slim-data-plane"

  # The timeout for the runtime to wait for the tasks to finish before shutting down.
  # Default: 10s
  drain_timeout: 10s

# Configuration for the services
services:
  # Configuration for the slim service.
  # This is the main service that will handle the incoming requests.
  slim/0:
    # dataplane API configuration
    dataplane:
      # GRPC Server configuration
      servers:
        # The endpoint to listen on.
        # No default, this must be specified.
        - endpoint: "0.0.0.0:46357"

          # Transport protocol is inferred from the endpoint scheme:
          #   ws://, wss://  → websocket (TLS when wss)
          #   http://, https://, bare host:port, unix://  → grpc

          # Authentication configuration
          auth:
            # Basic authentication configuration. One of the following:
            basic:
              # The username for the basic authentication.
              # No default, this must be specified.
              username: "username"

              # The password for the basic authentication.
              # No default, this must be specified.
              password: "password"
            jwt:
              # Claims for the JWT token. audience and issuer will be used for validation.
              claims:
                # The audience for the JWT token.
                audience: "slim"
                # The issuer of the JWT token.
                issuer: "slim"
                # The subject of the JWT token.
                subject: "slim"
                # Additional custom claims can be added here.
                custom_claims:
                  custom_key: "custom_value"
              # The duration for which the JWT token is valid. Ignored for server-side validation.
              duration: 1h
              # Key configuration for the JWT token.
              key:
                # Decoding configuration for the JWT token.
                decoding:
                  # The algorithm used for decoding the JWT token.
                  algorithm: "ES256"
                  # The PEM encoded public key used for decoding the JWT token.
                  # The alternative is to use a file with the public key.
                  # pem: |
                  #   -----BEGIN PUBLIC KEY-----
                  #   MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE3AOXRAbY5xP09w79HcbI6Fwz3jHE
                  #   UukerJKoy4HHeI7YjEu/WXSm69C7ve8IdyLgFnX+KRUkWfj0R2wTRU4VYQ==
                  #   -----END PUBLIC KEY-----
                  # file: "testdata/jwt/ecdsa-public.pem"
                  pem: |
                    -----BEGIN PUBLIC KEY-----
                    MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE3AOXRAbY5xP09w79HcbI6Fwz3jHE
                    UukerJKoy4HHeI7YjEu/WXSm69C7ve8IdyLgFnX+KRUkWfj0R2wTRU4VYQ==
                    -----END PUBLIC KEY-----

          # TLS configuration
          tls:
            # Whether to enable TLS.
            # Default: true
            insecure: false

            # Enforce client authentication using mTLS, and use
            # this CA certificate to verify the client certificate.
            # client_ca_file:
            # client_ca_pem:

            # Path to the CA certificate file.
            # If not specified, it will use the system CA certs pool.
            # This is used to verify the client certificate in case of mTLS
            ca_file: "testdata/ca.crt"

            # PEM encoded CA certificate.
            # If not specified, it will use the system CA certs pool.
            # This is used to verify the client certificate in case of mTLS
            # ca_pem: ""

            # The path to the certificate file, if TLS is enabled.
            # No default, this (or alternatively cert_pem) must be specified.
            cert_file: "testdata/server.crt"

            # The path to the key file, if TLS is enabled.
            # No default, this (or alternatively key_pem) must be specified.
            key_file: "testdata/server.key"

            # The certificate in PEM format, if TLS is enabled.
            # No default, this (or alternatively cert_file) must be specified.
            # cert_pem: ""

            # The key in PEM format, if TLS is enabled.
            # No default, this (or alternatively key_file) must be specified.
            # key_pem: ""

            # Whether to include the system CA certs pool.
            # Default: false
            include_system_ca_certs_pool: false

            # TLS Version. Available options:
            # - tls1.2
            # - tls1.3
            # Default: tls1.3
            tls_version: "tls1.3"

            # The certificate reload interval. If set, the server will reload the certificate
            # every time the interval is reached.
            # reload_interval: 10s

          # Whether to enable HTTP/2 only.
          # Default: true
          http2_only: true

          # Maximum size (in MiB) of messages accepted by the server.
          # Default: It will default from the underlying transport.
          # max_recv_msg_size: 4

          # Max concurrent streams per connection.
          # Default: 100
          # max_concurrent_streams: 100

          # Max header list size.
          # Default: 16KiB
          # max_header_list_size: 8192

          # The read buffer size for the server.
          # This is currently not used
          # read_buffer_size: 4KiB

          # The write buffer size for the server.
          # This is currently not used
          # write_buffer_size: 4KiB

          # Keepalive configuration
          keepalive:
            # Sets the time after which an idle connection is closed.
            # Default: 3600s
            max_connection_idle: 7200s

            # Sets the maximum amount of time a connection may exist before it will be closed.
            # Default: 7200s
            max_connection_age: 14400s

            # Additional time given after MaxConnectionAge before closing the connection.
            # Default: 300s
            max_connection_age_grace: 300s

            # Set the frequency of the keepalive ping.
            # Default: 12ß0s
            time: 120s

            # Sets the amount of time the server waits for a keepalive ping ack.
            # Default: 20s
            timeout: 20s

            # Authenticator configuration.
            # This is not currently implemented, but its purpose is to specify an
            # authenticator that can authenticate the messages before they are processed.
            # authenticator: ""

      # GRPC Clients configuration.
      clients:
        # The endpoint to connect to.
        # No default, this must be specified.
        - endpoint: "1.2.3.4:54321"

          # Transport protocol is inferred from the endpoint scheme:
          #   ws://, wss://  → websocket (TLS when wss)
          #   http://, https://, bare host:port, unix://  → grpc

          # Optional websocket auth query parameter key.
          # Used only when endpoint scheme is ws:// or wss://.
          # websocket_auth_query_param: token

          # Authentication configuration
          auth:
            # Basic authentication configuration
            basic:
              # The username for the basic authentication.
              # No default, this must be specified.
              username: "username"

              # The password for the basic authentication.
              # No default, this must be specified.
              password: "password"

          # Origin configuration
          # Default: none
          # origin: localhost

          # Compression configuration.
          # Default: none
          # compression: none

          # Rate limit configuration. The format is "<limit>/<duration>", with the duration expressed in seconds.
          # Default: none
          # rate_limit: 20/60 (20 requests every 60 seconds)

          # Keepalive parameters
          keepalive:
            # Sets the TCP keepalive interval
            # Default: 10s
            tcp_keepalive: 60s

            # Sets the http 2 keepalive interval
            # Default: 60s
            http2_keepalive: 60s

            # The timeout duration for the keepalive
            # Default: 10s
            timeout: 10s

            # Whether to permit keepalive without an active stream
            # Default: false
            permit_without_stream: false

          # The timeout for the connection with the server
          # Default is None
          connection_timeout: 10s

          # The timeout for each request
          # Default is None
          request_timeout: 10s

          # The buffer size
          # Default is None
          buffer_size: 4096

          # Additional headers to send with the request
          # Default is None
          headers:
            x-header: value

          # authentication configuration.
          # not used yet
          # auth:

          # TLS configuration
          tls:
            # Whether to enable TLS.
            # Default: false
            insecure: true

            # Whether to skip the server name verification.
            # Default: false
            insecure_skip_verify: false

            # Path to the CA certificate file.
            # If not specified, it will use the system CA certs pool.
            ca_file: "testdata/ca.crt"

            # PEM encoded CA certificate.
            # If not specified, it will use the system CA certs pool.
            # ca_pem: ""

            # The path to the certificate file, if TLS is enabled.
            # No default, this (or alternatively cert_pem) must be specified.
            # Specifying this effectively enable mTLS.
            # cert_file: "testdata/client.crt"

            # The path to the key file, if TLS is enabled.
            # No default, this (or alternatively key_pem) must be specified.
            # Specifying this effectively enable mTLS.
            # key_file: "testdata/client.key"

            # The certificate in PEM format, if TLS is enabled.
            # No default, this (or alternatively cert_file) must be specified.
            # Specifying this effectively enable mTLS.
            # cert_pem: ""

            # The key in PEM format, if TLS is enabled.
            # No default, this (or alternatively key_file) must be specified.
            # Specifying this effectively enable mTLS.
            # key_pem: ""

            # TLS Version. Available options:
            # - tls1.2
            # - tls1.3
            # Default: tls1.3
            tls_version: "tls1.3"

            # The certificate reload interval. If set, the client will reload the certificate
            # every time the interval is reached.
            # reload_interval: 10s

    # controller API configuration
    controller:
      # GRPC Server configuration
      servers:
        # The endpoint to listen on.
        # No default, this must be specified.
        - endpoint: "0.0.0.0:46358"

          # Authentication configuration
          auth:
            # Basic authentication configuration
            basic:
              # The username for the basic authentication.
              # No default, this must be specified.
              username: "username"

              # The password for the basic authentication.
              # No default, this must be specified.
              password: "password"
            jwt:
              # Claims for the JWT token.
              claims:
                # The audience for the JWT token.
                audience: "slim"
                # The issuer of the JWT token.
                issuer: "slim"
                # The subject of the JWT token.
                subject: "slim"
                # Additional custom claims can be added here.
                custom_claims:
                  custom_key: "custom_value"
              # The duration for which the JWT token is valid.
              duration: 1h
              # Key configuration for the JWT token.
              key:
                # Decoding configuration for the JWT token.
                encoding:
                  # The algorithm used for decoding the JWT token.
                  algorithm: "ES256"
                  # The PEM encoded public key used for decoding the JWT token.
                  # The alternative is to use a file with the public key.
                  # pem: |
                  #   -----BEGIN PRIVATE KEY-----
                  #   ...
                  #   -----END PRIVATE KEY-----
                  # file: "testdata/jwt/ecdsa-public.pem"
                  pem: |
                    -----BEGIN PRIVATE KEY-----
                    ...
                    -----END PRIVATE KEY-----

          # TLS configuration
          tls:
            # Whether to enable TLS.
            # Default: true
            insecure: false

            # Enforce client authentication using mTLS, and use
            # this CA certificate to verify the client certificate.
            # client_ca_file:
            # client_ca_pem:

            # Path to the CA certificate file.
            # If not specified, it will use the system CA certs pool.
            # This is used to verify the client certificate in case of mTLS
            ca_file: "testdata/ca.crt"

            # PEM encoded CA certificate.
            # If not specified, it will use the system CA certs pool.
            # This is used to verify the client certificate in case of mTLS
            # ca_pem: ""

            # The path to the certificate file, if TLS is enabled.
            # No default, this (or alternatively cert_pem) must be specified.
            cert_file: "testdata/server.crt"

            # The path to the key file, if TLS is enabled.
            # No default, this (or alternatively key_pem) must be specified.
            key_file: "testdata/server.key"

            # The certificate in PEM format, if TLS is enabled.
            # No default, this (or alternatively cert_file) must be specified.
            # cert_pem: ""

            # The key in PEM format, if TLS is enabled.
            # No default, this (or alternatively key_file) must be specified.
            # key_pem: ""

            # Whether to include the system CA certs pool.
            # Default: false
            include_system_ca_certs_pool: false

            # TLS Version. Available options:
            # - tls1.2
            # - tls1.3
            # Default: tls1.3
            tls_version: "tls1.3"

            # The certificate reload interval. If set, the server will reload the certificate
            # every time the interval is reached.
            # reload_interval: 10s

          # Whether to enable HTTP/2 only.
          # Default: true
          http2_only: true

          # Maximum size (in MiB) of messages accepted by the server.
          # Default: It will default from the underlying transport.
          # max_recv_msg_size: 4

          # Max concurrent streams per connection.
          # Default: 100
          # max_concurrent_streams: 100

          # Max header list size.
          # Default: 16KiB
          # max_header_list_size: 8192

          # The read buffer size for the server.
          # This is currently not used
          # read_buffer_size: 4KiB

          # The write buffer size for the server.
          # This is currently not used
          # write_buffer_size: 4KiB

          # Keepalive configuration
          keepalive:
            # Sets the time after which an idle connection is closed.
            # Default: 3600s
            max_connection_idle: 7200s

            # Sets the maximum amount of time a connection may exist before it will be closed.
            # Default: 7200s
            max_connection_age: 14400s

            # Additional time given after MaxConnectionAge before closing the connection.
            # Default: 300s
            max_connection_age_grace: 300s

            # Set the frequency of the keepalive ping.
            # Default: 12ß0s
            time: 120s

            # Sets the amount of time the server waits for a keepalive ping ack.
            # Default: 20s
            timeout: 20s

            # Authenticator configuration.
            # This is not currently implemented, but its purpose is to specify an
            # authenticator that can authenticate the messages before they are processed.
            # authenticator: ""

      # GRPC Client configuration.
      clients:
        # The endpoint to connect to.
        # No default, this must be specified.
        - endpoint: "1.2.3.4:54321"

          # Authentication configuration
          auth:
            # Basic authentication configuration
            basic:
              # The username for the basic authentication.
              # No default, this must be specified.
              username: "username"

              # The password for the basic authentication.
              # No default, this must be specified.
              password: "password"

          # Origin configuration
          # Default: none
          # origin: localhost

          # Compression configuration.
          # Default: none
          # compression: none

          # Rate limit configuration. The format is "<limit>/<duration>", with the duration expressed in seconds.
          # Default: none
          # rate_limit: 20/60 (20 requests every 60 seconds)

          # Keepalive parameters
          keepalive:
            # Sets the TCP keepalive interval
            # Default: 10s
            tcp_keepalive: 60s

            # Sets the http 2 keepalive interval
            # Default: 60s
            http2_keepalive: 60s

            # The timeout duration for the keepalive
            # Default: 10s
            timeout: 10s

            # Whether to permit keepalive without an active stream
            # Default: false
            permit_without_stream: false

          # The timeout for the connection with the server
          # Default is None
          connection_timeout: 10s

          # The timeout for each request
          # Default is None
          request_timeout: 10s

          # The buffer size
          # Default is None
          buffer_size: 4096

          # Additional headers to send with the request
          # Default is None
          headers:
            x-header: value

          # authentication configuration.
          # not used yet
          # auth:

          # TLS configuration
          tls:
            # Whether to enable TLS.
            # Default: false
            insecure: true

            # Whether to skip the server name verification.
            # Default: false
            insecure_skip_verify: false

            # Path to the CA certificate file.
            # If not specified, it will use the system CA certs pool.
            ca_file: "testdata/ca.crt"

            # PEM encoded CA certificate.
            # If not specified, it will use the system CA certs pool.
            # ca_pem: ""

            # The path to the certificate file, if TLS is enabled.
            # No default, this (or alternatively cert_pem) must be specified.
            # Specifying this effectively enable mTLS.
            # cert_file: "testdata/client.crt"

            # The path to the key file, if TLS is enabled.
            # No default, this (or alternatively key_pem) must be specified.
            # Specifying this effectively enable mTLS.
            # key_file: "testdata/client.key"

            # The certificate in PEM format, if TLS is enabled.
            # No default, this (or alternatively cert_file) must be specified.
            # Specifying this effectively enable mTLS.
            # cert_pem: ""

            # The key in PEM format, if TLS is enabled.
            # No default, this (or alternatively key_file) must be specified.
            # Specifying this effectively enable mTLS.
            # key_pem: ""

            # TLS Version. Available options:
            # - tls1.2
            # - tls1.3
            # Default: tls1.3
            tls_version: "tls1.3"

            # The certificate reload interval. If set, the client will reload the certificate
            # every time the interval is reached.
            # reload_interval: 10s
          # Backoff strategy configuration used to reconnect to the controller
          backoff:
            # this is the default type of the backoff strategy,
            type: exponential
            # the reconnection base delay in milliseconds
            base: 500
            # the reconnection factor determines how fast the delay increases
            factor: 1
            # the maximum delay between reconnection attempts in milliseconds
            max_delay: 1500
            # whether to apply jitter to the backoff delay
            jitter: true