Configuration reference

This topic describes configuration parameters of Тarantool Cluster Manager.

There are the following groups of TCM configuration parameters:

• cluster
• http
• log
• storage
• addon
• limits
• security
• mode
• feature
• initial-settings
• migrations
• default-cluster

The cluster group defines parameters of TCM interaction with connected Tarantool clusters.

• connection-rate-limit
• tarantool-timeout
• tarantool-ping-timeout
• tt-command
• refresh-state-period
• refresh-state-timeout
• discovery-period
• sharding-index
• skew-time
• fragmentation-threshold
• connectivity-check-timeout
• backoff-initial-delay
• backoff-max-delay
• backoff-failure-threshold
• connection-pool-check-timeout
• watcher-retry-delay
• stats-max-space-length
• stats-timeout

A rate limit for connections to Tarantool instances.

Type: uint

Default: 512

Environment variable: TCM_CLUSTER_CONNECTION_RATE_LIMIT Command-line option: --cluster.connection-rate-limit

A timeout for receiving a response from Tarantool instances.

Type: time.Duration

Default: 10s

Environment variable: TCM_CLUSTER_TARANTOOL_TIMEOUT Command-line option: --cluster.tarantool-timeout

A timeout for receiving a ping response from Tarantool instances.

Type: time.Duration

Default: 5s

Environment variable: TCM_CLUSTER_TARANTOOL_PING_TIMEOUT Command-line option: --cluster.tarantool-ping-timeout

The command that runs the tt utility on hosts with cluster instances.

Type: string

Default: tt

Environment variable: TCM_CLUSTER_TT_COMMAND Command-line option: --cluster.tt-command

The time interval for refreshing the cluster instances state on the Stateboard.

Type: time.Duration

Default: 5s

Environment variable: TCM_CLUSTER_REFRESH_STATE_PERIOD Command-line option: --cluster.refresh-state-period

The time limit for refreshing an instance state. If this limit is reached, an error is shown.

Type: time.Duration

Default: 4s

Environment variable: TCM_CLUSTER_REFRESH_STATE_TIMEOUT Command-line option: --cluster.refresh-state-timeout

The time interval for checking the leadership in replica sets.

Type: time.Duration

Default: 4s

Environment variable: TCM_CLUSTER_DISCOVERY_PERIOD Command-line option: --cluster.discovery-period

The name of the space field that is used as a sharding key.

Type: string

Default: bucket_id

Environment variable: TCM_CLUSTER_SHARDING_INDEX Command-line option: --cluster.sharding-index

The maximum time skew between any two cluster instances. If this limit is reached, a warning is shown.

Type: time.Duration

Default: 30s

Environment variable: TCM_CLUSTER_SKEW_TIME Command-line option: --cluster.skew-time

The count of allocated slabs that reflects high memory fragmentation. When this number is reached, a warning is shown.

See also: engines-memtx

Type: int

Default: 40

Environment variable: TCM_CLUSTER_FRAGMENTATION_THRESHOLD Command-line option: --cluster.fragmentation-threshold

The maximum time to wait for a response from a cluster node during availability check. If the node does not respond within this time, the check is considered failed.

Type: time.Duration

Default: 3s

Environment variable: TCM_CLUSTER_CONNECTIVITY_CHECK_TIMEOUT Command-line option: --cluster.connectivity-check-timeout

The initial delay before the first retry attempt to reconnect to a node after failure. Used to reduce load during frequent failures.

Type: time.Duration

Default: 1s

Environment variable: TCM_CLUSTER_BACKOFF_INITIAL_DELAY Command-line option: --cluster.backoff-initial-delay

The maximum delay between reconnect attempts. After reaching this delay, it stops increasing.

Type: time.Duration

Default: 30s

Environment variable: TCM_CLUSTER_BACKOFF_MAX_DELAY Command-line option: --cluster.backoff-max-delay

The number of failed connection attempts after which TCM stops further attempts and marks the node as unavailable.

Type: int

Default: 3

Environment variable: TCM_CLUSTER_BACKOFF_FAILURE_THRESHOLD Command-line option: --cluster.backoff-failure-threshold

The maximum time to wait for a connection response from the pool to a cluster node. Used to verify the connection validity.

Type: time.Duration

Default: 3s

Environment variable: TCM_CLUSTER_CONNECTION_POOL_CHECK_TIMEOUT Command-line option: --cluster.connection-pool-check-timeout

The delay between reconnect attempts to the watch system after a failure.

Type: time.Duration

Default: 1s

Environment variable: TCM_CLUSTER_WATCHER_RETRY_DELAY Command-line option: --cluster.watcher-retry-delay

The maximum number of records in the statistics buffer that will be stored before sending or processing.

Type: int

Default: 10000

Environment variable: TCM_CLUSTER_STATS_MAX_SPACE_LENGTH Command-line option: --cluster.stats-max-space-length

The maximum time to wait for a response from a node when querying statistics. If the node does not respond within this time, the query is considered failed.

Type: time.Duration

Default: 1m

Environment variable: TCM_CLUSTER_STATS_TIMEOUT Command-line option: --cluster.stats-timeout

The http group defines parameters of HTTP connections between TCM and clients.

• http.network
• http.host
• http.port
• http.request-size
• http.websocket.read-buffer-size
• http.websocket.write-buffer-size
• http.websocket.keepalive-ping-interval
• http.websocket.handshake-timeout
• http.websocket.init-timeout
• http.websession-cookie.name
• http.websession-cookie.path
• http.websession-cookie.domain
• http.websession-cookie.ttl
• http.websession-cookie.secure
• http.websession-cookie.http-only
• http.websession-cookie.same-site
• http.websession-cookie.cleanup-period
• http.cors.enabled
• http.cors.allowed-origins
• http.cors.allowed-methods
• http.cors.allowed-headers
• http.cors.exposed-headers
• http.cors.allow-credentials
• http.cors.debug
• http.tls.enabled
• http.tls.cert-file
• http.tls.key-file
• http.tls.server
• http.tls.min-version
• http.tls.max-version
• http.tls.curve-preferences
• http.tls.cipher-suites
• http.read-timeout
• http.read-header-timeout
• http.write-timeout
• http.idle-timeout
• http.disable-general-options-handler
• http.max-header-bytes
• http.api-timeout
• http.api-update-interval
• http.frontend-dir
• http.show-stack-trace
• http.trace
• http.max-static-size
• http.graphql.complexity

An addressing scheme that TCM uses.

Possible values:

• tcp: IPv4 address
• tcp6: IPv6 address
• unix: Unix domain socket

Type: string

Default: tcp

Environment variable: TCM_HTTP_NETWORK Command-line option: --http.network

A host name on which TCM serves.

Type: string

Default: 127.0.0.1

Environment variable: TCM_HTTP_HOST Command-line option: --http.host

A port on which TCM serves.

Type: int

Default: 8080

Environment variable: TCM_HTTP_PORT Command-line option: --http.port

The maximum size (in bytes) of a client HTTP request to TCM.

Type: int64

Default: 1572864

Environment variable: TCM_HTTP_REQUEST_SIZE Command-line option: --http.request-size

The size (in bytes) of the read buffer for WebSocket connections.

Type: int

Default: 16384

Environment variable: TCM_HTTP_WEBSOCKET_READ_BUFFER_SIZE Command-line option: --http.websocket.read-buffer-size

The size (in bytes) of the write buffer for WebSocket connections.

Type: int

Default: 16384

Environment variable: TCM_HTTP_WEBSOCKET_WRITE_BUFFER_SIZE Command-line option: --http.websocket.write-buffer-size

The time interval for sending WebSocket keepalive pings.

Type: time.Duration

Default: 20s

Environment variable: TCM_HTTP_WEBSOCKET_KEEPALIVE_PING_INTERVAL Command-line option: --http.websocket.keepalive-ping-interval

The time limit for completing a WebSocket opening handshake with a client.

Type: time.Duration

Default: 10s

Environment variable: TCM_HTTP_WEBSOCKET_HANDSHAKE_TIMEOUT Command-line option: --http.websocket.handshake-timeout

The time limit for establishing a WebSocket connection with a client.

Type: time.Duration

Default: 15s

Environment variable: TCM_HTTP_WEBSOCKET_INIT_TIMEOUT Command-line option: --http.websocket.init-timeout

The name of the cookie that TCM sends to clients.

This value is used as the cookie name in the Set-Cookie HTTP response header.

Type: string

Default: tcm

Environment variable: TCM_HTTP_WEBSESSION_COOKIE_NAME Command-line option: ---http.websession-cookie.name

The URL path that must be present in the requested URL in order to send the cookie.

This value is used in the Path attribute of the Set-Cookie HTTP response header.

Type: string

Default: ""

Environment variable: TCM_HTTP_WEBSESSION_COOKIE_PATH Command-line option: ---http.websession-cookie.path

The domain to which the cookie can be sent.

This value is used in the Domain attribute of the Set-Cookie HTTP response header.

Type: string

Default: ""

Environment variable: TCM_HTTP_WEBSESSION_COOKIE_DOMAIN Command-line option: ---http.websession-cookie.domain

The maximum lifetime of the TCM cookie.

This value is used in the Max-Age attribute of the Set-Cookie HTTP response header.

Type: time.Duration

Default: 2h0m0s

Environment variable: TCM_HTTP_WEBSESSION_COOKIE_TTL Command-line option: ---http.websession-cookie.ttl

Indicates whether the cookie can be sent only over the HTTPS protocol. In this case, it's never sent over the unencrypted HTTP, therefore preventing man-in-the-middle attacks.

When true, the Secure attribute is added to the Set-Cookie HTTP response header.

Type: bool

Default: false

Environment variable: TCM_HTTP_WEBSESSION_COOKIE_SECURE Command-line option: ---http.websession-cookie.secure

Indicates that the cookie can't be accessed from the JavaScript Document.cookie API. This helps mitigate cross-site scripting attacks.

When true, the HttpOnly attribute is added to the Set-Cookie HTTP response header.

Type: bool

Default: true

Environment variable: TCM_HTTP_WEBSESSION_COOKIE_HTTP_ONLY Command-line option: ---http.websession-cookie.http-only

Indicates if it is possible to send the TCM cookie along with cross-site requests. Possible values are the Go's http.SameSite constants:

• SameSiteDefaultMode
• SameSiteLaxMode
• SameSiteStrictMode
• SameSiteNoneMode

For details on SameSite modes, see the Set-Cookie header documentation in the MDN web docs.

This value is used in the SameSite attribute of the Set-Cookie HTTP response header.

Type: http.SameSite

Default: SameSiteDefaultMode

Environment variable: TCM_HTTP_WEBSESSION_COOKIE_SAME_SITE Command-line option: ---http.websession-cookie.same-site

Interval between cleanup runs for expired sessions. A session is considered expired if it hasn't been updated for the duration specified in the http.websession-cookie.ttl variable.

Type: time.Duration

Default value: 2m0s

Environment variable: TCM_HTTP_WEBSESSION_COOKIE_CLEANUP_PERIOD | Command-line flag: --http.websession-cookie.cleanup-period

Indicates whether to use the Cross-Origin Resource Sharing (CORS).

Type: bool

Default: false

Environment variable: TCM_HTTP_CORS_ENABLED Command-line option: --http.cors.enabled

The origins with which the HTTP response can be shared, separated by semicolons.

The specified values are sent in the Access-Control-Allow-Origin HTTP response headers.

Type: []string

Default: []

Environment variable: TCM_HTTP_CORS_ALLOWED_ORIGINS Command-line option: --http.cors.allowed-origins

HTTP request methods that are allowed when accessing a resource, separated by semicolons.

The specified values are sent in the Access-Control-Allow-Methods HTTP header of a response to a CORS preflight request.

Type: []string

Default: []

Environment variable: TCM_HTTP_CORS_ALLOWED_METHODS Command-line option: --http.cors.allowed-methods

HTTP headers that are allowed during the actual request, separated by semicolons.

The specified values are sent in the Access-Control-Allow-Headers HTTP header of a response to a CORS preflight request.

Type: []string

Default: []

Environment variable: TCM_HTTP_CORS_ALLOWED_HEADERS Command-line option: --http.cors.allowed-headers

Response headers that should be made available to scripts running in the browser, in response to a cross-origin request, separated by semicolons.

The specified values are sent in the Access-Control-Expose-Headers HTTP response headers.

Type: []string

Default: []

Environment variable: TCM_HTTP_CORS_EXPOSED_HEADERS Command-line option: --http.cors.exposed-headers

Whether to expose the response to the frontend JavaScript code when the request's credentials mode is include.

When true, the Access-Control-Allow-Credentials HTTP response header is sent.

Type: bool

Default: false

Environment variable: TCM_HTTP_CORS_ALLOW_CREDENTIALS Command-line option: --http.cors.allow-credentials

For debug purposes.

Type: bool

Default: false

Indicates whether TLS is enabled for client connections to TCM.

Type: bool

Default: false

Environment variable: TCM_HTTP_TLS_ENABLED Command-line option: --http.tls.enabled

A path to a TLS certificate file. Mandatory when TLS is enabled.

Type: string

Default: ""

Environment variable: TCM_HTTP_TLS_CERT_FILE Command-line option: --http.tls.cert-file

A path to a TLS private key file. Mandatory when TLS is enabled.

Type: string

Default: ""

Environment variable: TCM_HTTP_TLS_KEY_FILE Command-line option: --http.tls.key-file

The TLS server.

Type: string

Default: ""

Environment variable: TCM_HTTP_TLS_SERVER_NAME Command-line option: --http.tls.server-name

The minimum version of the TLS protocol.

Type: uint16

Default: 0

Environment variable: TCM_HTTP_TLS_MIN_VERSION Command-line option: --http.tls.min-version

The maximum version of the TLS protocol.

Type: uint16

Default: 0

Environment variable: TCM_HTTP_TLS_MAX_VERSION Command-line option: --http.tls.max-version

Elliptic curves that are used for TLS connections. Possible values are the Go's tls.CurveID constants:

• CurveP256
• CurveP384
• CurveP521
• X25519

Type: []tls.CurveID

Default: []

Environment variable: TCM_HTTP_TLS_CURVE_PREFERENCES Command-line option: --http.tls.curve-preferences

Enabled TLS cipher suites. The supported ciphers are:

TLS 1.0 - 1.2 cipher suites:

: - TLS_RSA_WITH_RC4_128_SHA - TLS_RSA_WITH_3DES_EDE_CBC_SHA - TLS_RSA_WITH_AES_128_CBC_SHA - TLS_RSA_WITH_AES_256_CBC_SHA - TLS_RSA_WITH_AES_128_CBC_SHA256 - TLS_RSA_WITH_AES_128_GCM_SHA256 - TLS_RSA_WITH_AES_256_GCM_SHA384 - TLS_ECDHE_ECDSA_WITH_RC4_128_SHA - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA - TLS_ECDHE_RSA_WITH_RC4_128_SHA - TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256

TLS 1.3 cipher suites:

: - TLS_AES_128_GCM_SHA256 - TLS_AES_256_GCM_SHA384 - TLS_CHACHA20_POLY1305_SHA256 - TLS_FALLBACK_SCSV isn't a standard cipher suite but an indicator that the client is doing version fallback - TLS_FALLBACK_SCSV uint16 = 0x5600 - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 = TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 = TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA25

For detailed information on ciphers, refer to the Golang tls.TLS_* constants.

The example below shows how to configure cipher suites:

 
http:  tls:    cipher-suites:      - TLS_AES_256_GCM_SHA384      - TLS_AES_128_GCM_SHA256      - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384      - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256      - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384      - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256      - TLS_DHE_RSA_WITH_AES_256_GCM_SHA384      - TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

Type: []uint16

Default: []

Environment variable: TCM_HTTP_TLS_CIPHER_SUITES Command-line option: --http.tls.cipher-suites

A timeout for reading an incoming request.

Type: time.Duration

Default: 30s

Environment variable: TCM_HTTP_READ_TIMEOUT Command-line option: --http.read-timeout

A timeout for reading headers of an incoming request.

Type: time.Duration

Default: 30s

Environment variable: TCM_HTTP_READ_HEADER_TIMEOUT Command-line option: --http.read-header-timeout

A timeout for writing a response.

Type: time.Duration

Default: 30s

Environment variable: TCM_HTTP_WRITE_TIMEOUT Command-line option: --http.write-timeout

The timeout for idle connections.

Type: time.Duration

Default: 30s

Environment variable: TCM_HTTP_IDLE_TIMEOUT Command-line option: --http.idle-timeout

Whether the client requests with the OPTIONS HTTP method are allowed.

Type: bool

Default: false

Environment variable: TCM_HTTP_DISABLE_GENERAL_OPTIONS_HANDLER Command-line option: --http.disable-general-options-handler

The maximum size (in bytes) of a header in a client's request to TCM.

Type: int

Default: 0

Environment variable: TCM_HTTP_MAX_HEADER_BYTES Command-line option: --http.max-header-bytes

The stateboard update timeout.

Type: time.Duration

Default: 8s

Environment variable: TCM_HTTP_API_TIMEOUT Command-line option: --http.api-timeout

The stateboard update interval.

Type: time.Duration

Default: 5s

Environment variable: TCM_HTTP_API_UPDATE_INTERVAL Command-line option: --http.api-update-interval

The directory with custom TCM frontend files (for development purposes).

Type: string

Default: ""

Environment variable: TCM_HTTP_FRONTEND_DIR Command-line option: --http.frontend-dir

Whether error stack traces are shown in the web UI.

Type: bool

Default: true

Environment variable: TCM_HTTP_SHOW_STACK_TRACE Command-line option: --http.show-stack-trace

Whether all query tracing information is written in logs.

Type: bool

Default: false

Environment variable: TCM_HTTP_TRACE Command-line option: --http.trace

The maximum size (in bytes) of a static content sent to TCM.

Type: int

Default: 104857600

Environment variable: TCM_HTTP_MAX_STATIC_SIZE Command-line option: --http.max-static-size

The maximum complexity of GraphQL queries that TCM processes. If this value is exceeded, TCM returns an error.

Type: int

Default: 40

Environment variable: TCM_HTTP_GRAPHQL_COMPLEXITY Command-line option: --http.graphql.complexity

The log section defines the TCM logging parameters.

• log.default.add-source
• log.default.show-stack-trace
• log.default.level
• log.default.format
• log.default.output
• log.default.no-colorized
• log.default.file.name
• log.default.file.maxsize
• log.default.file.maxage
• log.default.file.maxbackups
• log.default.file.compress
• log.default.syslog.protocol
• log.default.syslog.output
• log.default.syslog.priority
• log.default.syslog.facility
• log.default.syslog.tag
• log.default.syslog.timeout
• log.outputs

Whether sources are added to the TCM log.

Type: bool

Default: false

Environment variable: TCM_LOG_DEFAULT_ADD_SOURCE Command-line option: --log.default.add-source

Whether stack traces are added to the TCM log.

Type: bool

Default: false

Environment variable: TCM_LOG_DEFAULT_SHOW_STACK_TRACE Command-line option: --log.default.show-stack-trace

The default TCM logging level.

Possible values:

• VERBOSE
• INFO
• WARN
• ALARM

Type: string

Default: INFO

Environment variable: TCM_LOG_DEFAULT_LEVEL Command-line option: --log.default.level

TCM log entries format.

Possible values:

• struct
• json

Type: string

Default: struct

Environment variable: TCM_LOG_DEFAULT_FORMAT Command-line option: --log.default.format

The output used for TCM log.

Possible values:

• stdout
• stderr
• file
• syslog

Type: string

Default: stdout

Environment variable: TCM_LOG_DEFAULT_OUTPUT Command-line option: --log.default.output

Whether the stdout log is not colorized.

Type: bool

Default: false

Environment variable: TCM_LOG_DEFAULT_NO_COLORIZED Command-line option: --log.default.no-colorized

The name of the TCM log file.

Type: string

Default: ""

Environment variable: TCM_LOG_DEFAULT_FILE_NAME Command-line option: --log.default.file.name

The maximum size (in bytes) of the TCM log file.

Type: int

Default: 0

Environment variable: TCM_LOG_DEFAULT_FILE_MAXSIZE Command-line option: --log.default.file.maxsize

The maximum age of a TCM log file, in days.

Type: int

Default: 0

Environment variable: TCM_LOG_DEFAULT_FILE_MAXAGE Command-line option: --log.default.file.maxage

The maximum number of users in TCM.

Type: int

Default: 0

Environment variable: TCM_LOG_DEFAULT_FILE_MAXBACKUPS Command-line option: --log.default.file.maxbackups

Indicated that TCM compresses log files upon rotation.

Type: bool

Default: false

Environment variable: TCM_LOG_DEFAULT_FILE_COMPRESS Command-line option: --log.default.file.compress

The network protocol used for connecting to the syslog server. Typically, it's tcp, udp, or unix. All possible values are listed in the Go's net.Dial documentation.

Type: string

Default: tcp

Environment variable: TCM_LOG_DEFAULT_SYSLOG_PROTOCOL Command-line option: --log.default.syslog.protocol

The syslog server URI.

Type: string

Default: 127.0.0.1:5514

Environment variable: TCM_LOG_DEFAULT_SYSLOG_OUTPUT Command-line option: --log.default.syslog.output

The syslog severity level.

Type: string

Default: ""

Environment variable: TCM_LOG_DEFAULT_SYSLOG_PRIORITY Command-line option: --log.default.syslog.priority

The syslog facility.

Type: string

Default: ""

Environment variable: TCM_LOG_DEFAULT_SYSLOG_FACILITY Command-line option: --log.default.syslog.facility

The syslog tag.

Type: string

Default: ""

Environment variable: TCM_LOG_DEFAULT_SYSLOG_TAG Command-line option: --log.default.syslog.tag

The timeout for connecting to the syslog server.

Type: time.Duration

Default: 10s

Environment variable: TCM_LOG_DEFAULT_SYSLOG_TIMEOUT Command-line option: --log.default.syslog.timeout

An array of log outputs that TCM uses in addition to the default one that is defined by the log.default.* parameters. Each array item can include the parameters of the log.default group. If a parameter is skipped, its value is taken from log.default.

Type: []LogOuputConfig

Default: []

Environment variable: TCM_LOG_OUTPUTS Command-line option: --log-outputs

The storage section defines the parameters of the TCM backend store.

• storage.provider

etcd backend store parameters:

• storage.etcd.prefix
• storage.etcd.endpoints
• storage.etcd.dial-timeout
• storage.etcd.auto-sync-interval
• storage.etcd.dial-keep-alive-time
• storage.etcd.dial-keep-alive-timeout
• storage.etcd.bootstrap-timeout
• storage.etcd.max-call-send-msg-size
• storage.etcd.username
• storage.etcd.password
• storage.etcd.password-file
• storage.etcd.tls.enabled
• storage.etcd.tls.auto
• storage.etcd.tls.cert-file
• storage.etcd.tls.key-file
• storage.etcd.tls.trusted-ca-file
• storage.etcd.tls.client-cert-auth
• storage.etcd.tls.crl-file
• storage.etcd.tls.insecure-skip-verify
• storage.etcd.tls.skip-client-san-verify
• storage.etcd.tls.server-name
• storage.etcd.tls.cipher-suites
• storage.etcd.tls.allowed-cn
• storage.etcd.tls.allowed-hostname
• storage.etcd.tls.empty-cn
• storage.etcd.permit-without-stream
• storage.etcd.embed.enabled
• storage.etcd.embed.endpoints
• storage.etcd.embed.advertises
• storage.etcd.embed.tls.enabled
• storage.etcd.embed.tls.auto
• storage.etcd.embed.tls.cert-file
• storage.etcd.embed.tls.key-file
• storage.etcd.embed.tls.trusted-ca-file
• storage.etcd.embed.tls.client-cert-auth
• storage.etcd.embed.tls.crl-file
• storage.etcd.embed.tls.insecure-skip-verify
• storage.etcd.embed.tls.skip-client-san-verify
• storage.etcd.embed.tls.server-name
• storage.etcd.embed.tls.cipher-suites
• storage.etcd.embed.tls.allowed-cn
• storage.etcd.embed.tls.allowed-hostname
• storage.etcd.embed.tls.empty-cn
• storage.etcd.embed.peer-endpoints
• storage.etcd.embed.peer-advertises
• storage.etcd.embed.peer-tls.enabled
• storage.etcd.embed.peer-tls.auto
• storage.etcd.embed.peer-tls.cert-file
• storage.etcd.embed.peer-tls.key-file
• storage.etcd.embed.peer-tls.trusted-ca-file
• storage.etcd.embed.peer-tls.client-cert-auth
• storage.etcd.embed.peer-tls.crl-file
• storage.etcd.embed.peer-tls.insecure-skip-verify
• storage.etcd.embed.peer-tls.skip-client-san-verify
• storage.etcd.embed.peer-tls.server-name
• storage.etcd.embed.peer-tls.cipher-suites
• storage.etcd.embed.peer-tls.allowed-cn
• storage.etcd.embed.peer-tls.allowed-hostname
• storage.etcd.embed.peer-tls.empty-cn
• storage.etcd.embed.grpc-keep-alive-timeout
• storage.etcd.embed.grpc-keep-alive-interval
• storage.etcd.embed.grpc-keep-alive-min-time
• storage.etcd.embed.workdir
• storage.etcd.embed.waldir
• storage.etcd.embed.max-request-bytes
• storage.etcd.embed.debug
• storage.etcd.embed.start-timeout
• storage.etcd.embed.log-level
• storage.etcd.embed.initial-cluster
• storage.etcd.embed.initial-cluster-token
• storage.etcd.embed.name
• storage.etcd.embed.initial-cluster-state
• storage.etcd.embed.self-signed-cert-validity

Tarantool backend store parameters:

• storage.tarantool.prefix
• storage.tarantool.addr
• storage.tarantool.addrs
• storage.tarantool.auth
• storage.tarantool.timeout
• storage.tarantool.reconnect
• storage.tarantool.max-reconnects
• storage.tarantool.username
• storage.tarantool.password
• storage.tarantool.password-file
• storage.tarantool.rate-limit
• storage.tarantool.rate-limit-action
• storage.tarantool.concurrency
• storage.tarantool.skip-schema
• storage.tarantool.transport
• storage.tarantool.ssl.key-file
• storage.tarantool.ssl.cert-file
• storage.tarantool.ssl.ca-file
• storage.tarantool.ssl.ciphers
• storage.tarantool.ssl.password
• storage.tarantool.ssl.password-file
• storage.tarantool.required-protocol-info.auth
• storage.tarantool.required-protocol-info.version
• storage.tarantool.required-protocol-info.features
• storage.tarantool.embed.enabled
• storage.tarantool.embed.workdir
• storage.tarantool.embed.executable
• storage.tarantool.embed.config-filename
• storage.tarantool.embed.config
• storage.tarantool.embed.args
• storage.tarantool.embed.env

The type of the storage used for storing TCM configuration.

Possible values:

• etcd
• tarantool

Type: string

Default: etcd

Environment variable: TCM_STORAGE_PROVIDER Command-line option: --storage.provider

A prefix for the TCM configuration parameters in etcd.

Type: string

Default: "/tcm"

Environment variable: TCM_STORAGE_ETCD_PREFIX Command-line option: --storage.etcd.prefix

An array of node URIs of the etcd cluster where the TCM configuration is stored, separated by semicolons (;).

Type: []string

Default: ["http://127.0.0.1:2379"]

Environment variable: TCM_STORAGE_ETCD_ENDPOINTS Command-line option: --storage.etcd.endpoints

An etcd dial timeout.

Type: time.Duration

Default: 10s

Environment variable: TCM_STORAGE_ETCD_DIAL_TIMEOUT Command-line option: --storage.etcd.dial-timeout

An automated sync interval.

Type: time.Duration

Default: 0 (disabled)

Environment variable: TCM_STORAGE_ETCD_AUTO_SYNC_INTERVAL Command-line option: --storage.etcd.auto-sync-interval

A dial keep-alive time.

Type: time.Duration

Default: 30s

Environment variable: TCM_STORAGE_ETCD_DIAL_KEEP_ALIVE_TIME Command-line option: --storage.etcd.dial-keep-alive-time

A dial keep-alive timeout.

Type: time.Duration

Default: 30s

Environment variable: TCM_STORAGE_ETCD_DIAL_KEEP_ALIVE_TIMEOUT Command-line option: --storage.etcd.dial-keep-alive-timeout

A bootstrap timeout.

Type: time.Duration

Default: 30s

Environment variable: TCM_STORAGE_ETCD_BOOTSTRAP_TIMEOUT Command-line option: --storage.etcd.bootstrap-timeout

The maximum size (in bytes) of a transaction between TCM and etcd.

Type: int

Default: 2097152

Environment variable: TCM_STORAGE_ETCD_MAX_CALL_SEND_MSG_SIZE Command-line option: --storage.etcd.max-call-send-msg-size

A username for accessing the etcd storage.

Type: string

Default: ""

Environment variable: TCM_STORAGE_ETCD_USERNAME Command-line option: --storage.etcd.username

A password for accessing the etcd storage.

Type: string

Default: ""

Environment variable: TCM_STORAGE_ETCD_PASSWORD Command-line option: --storage.etcd.password

A path to the file with a password for accessing the etcd storage.

Type: string

Default: ""

Environment variable: TCM_STORAGE_ETCD_PASSWORD_FILE Command-line option: --storage.etcd.password-file

Indicates whether TLS is enabled for etcd connections.

Type: bool

Default: false

Environment variable: TCM_STORAGE_ETCD_TLS_ENABLED Command-line option: --storage.etcd.tls.enabled

Use generated certificates for etcd connections.

Type: bool

Default: false

Environment variable: TCM_STORAGE_ETCD_TLS_AUTO Command-line option: --storage.etcd.tls.auto

A path to a TLS certificate file to use for etcd connections.

Type: string

Default: ""

Environment variable: TCM_STORAGE_ETCD_TLS_CERT_FILE Command-line option: --storage.etcd.tls.cert-file

A path to a TLS private key file to use for etcd connections.

Type: string

Default: ""

Environment variable: TCM_STORAGE_ETCD_TLS_KEY_FILE Command-line option: --storage.etcd.tls.key-file

A path to a trusted CA certificate file to use for etcd connections.

Type: string

Default: ""

Environment variable: TCM_STORAGE_ETCD_TLS_TRUSTED_CA_FILE Command-line option: --storage.etcd.tls.trusted-ca-file

Indicates whether client cert authentication is enabled.

Type: bool

Default: false

Environment variable: TCM_STORAGE_ETCD_TLS_CLIENT_CERT_AUTH Command-line option: --storage.etcd.tls.client-cert-auth

A path to the client certificate revocation list file.

Type: string

Default: ""

Environment variable: TCM_STORAGE_ETCD_TLS_CRL_FILE Command-line option: --storage.etcd.tls.crl-file

Skip checking client certificate in etcd connections.

Type: bool

Default: false

Environment variable: TCM_STORAGE_ETCD_TLS_INSECURE_SKIP_VERIFY Command-line option: --storage.etcd.tls.insecure-skip-verify

Skip verification of SAN field in client certificate for etcd connections.

Type: bool

Default: false

Environment variable: TCM_STORAGE_ETCD_TLS_SKIP_CLIENT_SAN_VERIFY Command-line option: --storage.etcd.tls.skip-client-san-verify

Name of the TLS server for etcd connections.

Type: string

Default: ""

Environment variable: TCM_STORAGE_ETCD_TLS_SERVER_NAME Command-line option: --storage.etcd.tls.server-name

TLS cipher suites for etcd connections. Possible values are the Golang tls.TLS_* constants.

Type: []uint16

Default: []

Environment variable: TCM_STORAGE_ETCD_TLS_CIPHER_SUITES Command-line option: --storage.etcd.tls.cipher-suites

An allowed common name for authentication in etcd connections.

Type: string

Default: ""

Environment variable: TCM_STORAGE_ETCD_TLS_ALLOWED_CN Command-line option: --storage.etcd.tls.allowed-cn

An allowed TLS certificate name for authentication in etcd connections.

Type: string

Default: ""

Environment variable: TCM_STORAGE_ETCD_TLS_ALLOWED_HOSTNAME Command-line option: --storage.etcd.tls.allowed-hostname

Whether the empty common name is allowed in etcd connections.

Type: bool

Default: false

Environment variable: TCM_STORAGE_ETCD_TLS_EMPTY_CN Command-line option: --storage.etcd.tls.empty-cn

Whether keepalive pings can be send to the etcd server without active streams.

Type: bool

Default: false

Environment variable: TCM_STORAGE_ETCD_PERMIT_WITHOUT_STREAM Command-line option: --storage.etcd.permit-without-stream

The storage.etcd.embed group defines the configuration of the embedded etcd cluster to use as a TCM backend store. This cluster can be used for development purposes when the production or testing etcd cluster is not available or not needed.

See also tcm_backend_store_embed.

A prefix for the TCM configuration parameters in the Tarantool-based configuration storage.

Type: string

Default: "/tcm"

Environment variable: TCM_STORAGE_TARANTOOL_PREFIX Command-line option: --storage.tarantool.prefix

The URI for connecting to the Tarantool-based configuration storage.

Type: string

Default: "unix/:/tmp/tnt_config_instance.sock"

Environment variable: TCM_STORAGE_TARANTOOL_ADDR Command-line option: --storage.tarantool.addr

An array of the Tarantool-based configuration storage URIs.

Type: []string

Default: ["unix/:/tmp/tnt_config_instance.sock"]

Environment variable: TCM_STORAGE_TARANTOOL_ADDRS Command-line option: --storage.tarantool.addrs

An authentication method for the Tarantool-based configuration storage.

Possible values are the Go's go-tarantool/Auth constants:

• AutoAuth (0)
• ChapSha1Auth
• PapSha256Auth

Type: int

Default: 0

Environment variable: TCM_STORAGE_TARANTOOL_AUTH Command-line option: --storage.tarantool.auth

A request timeout for the Tarantool-based configuration storage.

See also go-tarantool.Opts.

Type: time.Duration

Default: 0s

Environment variable: TCM_STORAGE_TARANTOOL_TIMEOUT Command-line option: --storage.tarantool.timeout

A timeout between reconnect attempts for the Tarantool-based configuration storage.

See also go-tarantool.Opts.

Type: time.Duration

Default: 0s

Environment variable: TCM_STORAGE_TARANTOOL_RECONNECT Command-line option: --storage.tarantool.reconnect

The maximum number of reconnect attempts for the Tarantool-based configuration storage.

See also go-tarantool.Opts.

Type: int

Default: 0

Environment variable: TCM_STORAGE_TARANTOOL_MAX_RECONNECTS Command-line option: --storage.tarantool.max-reconnects

A username for connecting to the Tarantool-based configuration storage.

See also go-tarantool.Opts.

Type: string

Default: ""

Environment variable: TCM_STORAGE_TARANTOOL_USERNAME Command-line option: --storage.tarantool.username

A password for connecting to the Tarantool-based configuration storage.

See also go-tarantool.Opts.

Type: string

Default: ""

Environment variable: TCM_STORAGE_TARANTOOL_PASSWORD Command-line option: --storage.tarantool.password

A path to the file with a password for connecting to the Tarantool-based configuration storage.

Type: string

Default: ""

Environment variable: TCM_STORAGE_TARANTOOL_PASSWORD_FILE Command-line option: --storage.tarantool.password-file

A rate limit for connecting to the Tarantool-based configuration storage.

See also go-tarantool.Opts.

Type: int

Default: 0

Environment variable: TCM_STORAGE_TARANTOOL_RATE_LIMIT Command-line option: --storage.tarantool.rate-limit

An action to perform when the storage.tarantool.rate-limit is reached.

See also go-tarantool.Opts.

Type: int

Default: 0

Environment variable: TCM_STORAGE_TARANTOOL_RATE_LIMIT_ACTION Command-line option: --storage.tarantool.rate-limit-action

An amount of separate mutexes for request queues and buffers inside of a connection to the Tarantool TCM configuration storage.

See also go-tarantool.Opts.

Type: int

Default: 0

Environment variable: TCM_STORAGE_TARANTOOL_CONCURRENCY Command-line option: --storage.tarantool.concurrency

Whether the schema is loaded from the Tarantool TCM configuration storage.

See also go-tarantool.Opts.

Type: bool

Default: true

Environment variable: TCM_STORAGE_TARANTOOL_SKIP_SCHEMA Command-line option: --storage.tarantool.skip-schema

The connection type for the Tarantool TCM configuration storage.

See also go-tarantool.Opts.

Type: string

Default: ""

Environment variable: TCM_STORAGE_TARANTOOL_TRANSPORT Command-line option: --storage.tarantool.transport

A path to a TLS private key file to use for connecting to the Tarantool TCM configuration storage.

See also: configuration_connections_ssl.

Type: string

Default: ""

Environment variable: TCM_STORAGE_TARANTOOL_SSL_KEY_FILE Command-line option: --storage.tarantool.ssl.key-file

A path to an SSL certificate to use for connecting to the Tarantool TCM configuration storage.

See also: configuration_connections_ssl.

Type: string

Default: ""

Environment variable: TCM_STORAGE_TARANTOOL_SSL_CERT_FILE Command-line option: --storage.tarantool.ssl.cert-file

A path to a trusted CA certificate to use for connecting to the Tarantool TCM configuration storage.

See also: configuration_connections_ssl.

Type: string

Default: ""

Environment variable: TCM_STORAGE_TARANTOOL_SSL_CA_FILE Command-line option: --storage.tarantool.ssl.ca-file

A list of SSL cipher suites that can be used for connecting to the Tarantool TCM configuration storage. Possible values are listed in (uri.params.ssl_ciphers ).

See also: configuration_connections_ssl.

Type: string

Default: ""

Environment variable: TCM_STORAGE_TARANTOOL_SSL_CIPHERS Command-line option: --storage.tarantool.ssl.ciphers

A password for an encrypted private SSL key to use for connecting to the Tarantool TCM configuration storage.

See also: configuration_connections_ssl.

Type: string

Default: ""

Environment variable: TCM_STORAGE_TARANTOOL_SSL_PASSWORD Command-line option: --storage.tarantool.ssl.password

A text file with passwords for encrypted private SSL keys to use for connecting to the Tarantool TCM configuration storage.

See also: configuration_connections_ssl.

Type: string

Default: ""

Environment variable: TCM_STORAGE_TARANTOOL_SSL_PASSWORD_FILE Command-line option: --storage.tarantool.ssl.password-file

An authentication method for the Tarantool TCM configuration storage.

Possible values are the Go's go-tarantool/Auth constants:

• AutoAuth (0)
• ChapSha1Auth
• PapSha256Auth

See also go-tarantool.ProtocolInfo.

Type: int

Default: 0

Environment variable: TCM_STORAGE_TARANTOOL_SSL_REQUIRED_PROTOCOL_INFO_AUTH Command-line option: --storage.tarantool.required-protocol-info.auth

A Tarantool protocol version.

See also go-tarantool.ProtocolInfo.

Type: uint64

Default: 0

Environment variable: TCM_STORAGE_TARANTOOL_SSL_REQUIRED_PROTOCOL_INFO_VERSION Command-line option: --storage.tarantool.required-protocol-info.version

An array of Tarantool protocol features.

See also go-tarantool.ProtocolInfo.

Type: []int

Default: []

Environment variable: TCM_STORAGE_TARANTOOL_SSL_REQUIRED_PROTOCOL_INFO_FEATURES Command-line option: --storage.tarantool.required-protocol-info.features

The storage.tarantool.embed group parameters define the configuration of the embedded Tarantool cluster to use as a TCM backend store. This cluster can be used for development purposes when the production or testing cluster is not available or not needed.

See also tcm_backend_store_embed.

The addon section defines settings related to TCM add-ons.

• addon.enabled
• addon.addons-dir
• addon.max-upload-size
• addon.dev-addons-dir

Whether to enable the add-on functionality in TCM.

Type: bool

Default: false

Environment variable: TCM_ADDON_ENABLED Command-line option: --addon.enabled

The directory from which TCM takes add-ons.

Type: string

Default: addons

Environment variable: TCM_ADDON_ADDONS_DIR Command-line option: --addon.addons-dir

The maximum size (in bytes) of addon to upload to TCM.

Type: int64

Default: 104857600

Environment variable: TCM_ADDON_MAX_UPLOAD_SIZE Command-line option: --addon.max-upload-size

Additional add-on directories for development purposes, separated by semicolons (;).

Type: []string

Default: []

Environment variable: TCM_ADDON_DEV_ADDONS_DIR Command-line option: --addon.dev-addons-dir

The limits section defines limits on various TCM objects and relations between them.

• limits.users-count
• limits.clusters-count
• limits.roles-count
• limits.webhooks-count
• limits.user-secrets-count
• limits.user-websessions-count
• limits.linked-cluster-users

The maximum number of users in TCM.

Type: int

Default: 1000

Environment variable: TCM_LIMITS_USERS_COUNT Command-line option: --limits.users-count

The maximum number of clusters in TCM.

Type: int

Default: 10

Environment variable: TCM_LIMITS_CLUSTERS_COUNT Command-line option: --limits.clusters-count

The maximum number of roles in TCM.

Type: int

Default: 100

Environment variable: TCM_LIMITS_ROLES_COUNT Command-line option: --limits.roles-count

The maximum number of webhooks in TCM.

Type: int

Default: 200

Environment variable: TCM_LIMITS_WEBHOOKS_COUNT Command-line option: --limits.webhooks-count

The maximum number secrets that a TCM user can have.

Type: int

Default: 10

Environment variable: TCM_LIMITS_USER_SECRETS_COUNT Command-line option: --limits.user-secrets-count

The maximum number of open sessions that a TCM user can have.

Type: int

Default: 10

Environment variable: TCM_LIMITS_USER_WEBSESSIONS_COUNT Command-line option: --limits.user-websessions-count

The maximum number of clusters to which a single user can have access.

Type: int

Default: 10

Environment variable: TCM_LIMITS_LINKED_CLUSTER_USERS Command-line option: --limits.linked-cluster-users

The security section defines the security parameters of TCM.

• security.auth
• security.hash-cost
• security.encryption-key
• security.encryption-key-file
• security.bootstrap-password
• security.bootstrap-api-token
• security.integrity-check
• security.signature-private-key-file

Ways to log into TCM.

Possible values:

• local
• ldap

Type: []string

Default: [local]

Environment variable: TCM_SECURITY_AUTH Command-line option: --security.auth

A hash cost for hashing users' passwords.

Type: int

Default: 12

Environment variable: TCM_SECURITY_HASH_COST Command-line option: --security.hash-cost

An encryption key for passwords used by TCM for accessing Tarantool and etcd clusters.

Type: string

Default: ""

Environment variable: TCM_SECURITY_ENCRYPTION_KEY Command-line option: --security.encryption-key

A path to the file with the encryption key for passwords used by TCM for accessing Tarantool and etcd clusters.

Type: string

Default: ""

Environment variable: TCM_SECURITY_ENCRYPTION_KEY_FILE Command-line option: --security.encryption-key-file

A password for the first login of the admin user. Only for testing purposes.

Type: string

Default: ""

Environment variable: TCM_SECURITY_BOOTSTRAP_PASSWORD Command-line option: --security.bootstrap-password

A default API token for the admin user. Only for testing purposes.

Type: string

Default: ""

Environment variable: TCM_SECURITY_BOOTSTRAP_API_TOKEN Command-line option: --security.bootstrap-api-token

Whether to check the digital signature. If true, the error is raised in case an incorrect signature is detected.

Type: bool

Default: false

Environment variable: TCM_SECURITY_INTEGRITY_CHECK Command-line option: --security.integrity-check

A path to a file with the private key to sign TCM data.

Type: string

Default: ""

Environment variable: TCM_SECURITY_SIGNATURE_PRIVATE_KEY_FILE Command-line option: --security.signature-private-key-file

The TCM mode: production, development, or test.

Type: string

Default: production

Environment variable: TCM_MODE Command-line option: --mode

The feature section defines the security parameters of TCM.

• feature.ttgraph
• feature.column-store
• feature.tqe
• feature.api-token
• feature.tuples
• feature.tcf

Whether Tarantool Graph DB integration is enabled.

Type: bool

Default: false

Environment variable: TCM_FEATURE_TTGRAPH Command-line option: --feature.ttgraph

Whether Tarantool Column Store integration is enabled.

Type: bool

Default: false

Environment variable: TCM_FEATURE_COLUMN_STORE Command-line option: --feature.column-store

Whether Tarantool Queue Enterprise integration is enabled.

Type: bool

Default: false

Environment variable: TCM_FEATURE_TQE Command-line option: --feature.tqe

Whether the use of API tokens is enabled.

Type: bool

Default: false

Environment variable: TCM_FEATURE_API_TOKEN Command-line option: --feature.api-token

Whether the use of Tuples is enabled.

Type: bool

Default: false

Environment variable: TCM_FEATURE_TUPLES Command-line option: --feature.tuples

Whether the use of TCF is enabled.

Type: bool

Default: false

Environment variable: TCM_FEATURE_TCF Command-line option: --feature.tcf

The initial-settings group defines entities that are created automatically upon the first TCM startup.

See also tcm_configuration_initial.

• initial-settings.clusters

Section migrations contains settings for migrations.

Maximum time allowed for long-running migrations to prevent interruption, set by default.

Type: time.Duration

Default value: 6m0s

Environment variable: TCM_MIGRATIONS_DURATION Command-line option: --migrations.duration

Section default-cluster controls the default cluster.

Whether the default cluster (Default cluster) is automatically created.

Type: string

Possible values: true or false

Default value: true

Environment variable: TCM_DEFAULT_CLUSTER Command-line option: ``–default-cluster`