Configuration Reference
This page is generated from the configuration accepted by the BoilStream server. Do not edit it directly. The release gate rejects unknown fields and fails when this reference differs from the server schema.
Required means the field must be present when its parent section is configured. A dash means the schema does not supply a default; the deployment profile may still provide one.
audit
| Key | Type | Required | Schema default |
|---|---|---|---|
audit | object | yes | — |
audit.backend | ndjson or duckdb or s3 or disabled | yes | — |
audit.buffer_size | integer | no | 1000 |
audit.enabled | boolean | yes | — |
audit.include_ip_address | boolean | no | true |
audit.include_query_text | boolean | no | true |
audit.log_path | string | no | — |
audit.sample_rate | number | no | — |
auth
| Key | Type | Required | Schema default |
|---|---|---|---|
auth | object | yes | — |
auth.admin_groups | array of string | yes | — |
auth.auth0 | object | yes | — |
auth.auth0.audience | string | no | — |
auth.auth0.groups_namespace | string | no | — |
auth.auth0.tenant | string | no | — |
auth.authorization_enabled | boolean | yes | — |
auth.azure | object | yes | — |
auth.azure.allow_multi_tenant | boolean | yes | — |
auth.azure.client_id | string | no | — |
auth.azure.tenant_id | string | no | — |
auth.cognito | object | yes | — |
auth.cognito.audience | string | no | — |
auth.cognito.region | string | no | — |
auth.cognito.user_pool_id | string | no | — |
auth.gcp | object | yes | — |
auth.gcp.client_id | string | no | — |
auth.gcp.project_id | string | no | — |
auth.gcp.require_workspace_domain | boolean | yes | — |
auth.max_concurrent_sessions | integer | no | 20 |
auth.max_session_ttl_hours | integer | no | 8 |
auth.max_sessions_per_hour | integer | no | 1000 |
auth.okta | object | yes | — |
auth.okta.audience | string | no | — |
auth.okta.auth_server_id | string | no | — |
auth.okta.org_domain | string | no | — |
auth.providers | array of string | yes | — |
auth.read_only_groups | array of string | yes | — |
auth_server
| Key | Type | Required | Schema default |
|---|---|---|---|
auth_server | object | no | — |
auth_server.admin_username | string | no | — |
auth_server.app_domain | string | no | — |
auth_server.auto_create_default_ducklake | boolean | no | — |
auth_server.cors_allowed_origins | array of string | no | — |
auth_server.default_user_role | string | no | — |
auth_server.email_encryption_pgp_public_key | string | no | — |
auth_server.email_encryption_pgp_public_key_path | string | no | — |
auth_server.enable_ducklake | boolean | no | — |
auth_server.enable_hydration | boolean | no | — |
auth_server.enabled | boolean | no | false |
auth_server.encryption_key_path | string | no | — |
auth_server.grants_db_path | string | no | — |
auth_server.hydration | object | no | |
auth_server.hydration.max_admitted_bytes | integer | no | — |
auth_server.hydration.max_queue_depth | integer | no | — |
auth_server.hydration.max_retries | integer | no | — |
auth_server.hydration.per_ducklake_quota_bytes | integer | no | — |
auth_server.hydration.worker_count | integer | no | — |
auth_server.port | integer | no | — |
auth_server.session_ttl_hours | integer | no | — |
auth_server.superadmin_backup_backend | string | no | — |
auth_server.superadmin_backup_interval_seconds | integer | no | — |
auth_server.superadmin_backup_path | string | no | — |
auth_server.superadmin_db_path | string | no | — |
auth_server.superadmin_mfa_secret_path | string | no | ./superadmin_mfa_secret.txt |
auth_server.superadmin_password_path | string | no | ./superadmin_password.txt |
auth_server.tls_auto_reload | boolean | no | — |
auth_server.tls_cert | string | no | — |
auth_server.tls_key | string | no | — |
auth_server.tls_loopback_cert | string | no | — |
auth_server.tls_loopback_key | string | no | — |
auth_server.tls_reload_check_interval_seconds | integer | no | — |
auth_server.users_backup_backend | string | no | — |
auth_server.users_backup_interval_seconds | integer | no | — |
auth_server.users_backup_path | string | no | — |
auth_server.users_db_path | string | no | — |
auth_server.webauthn_additional_rp_origins | array of string | no | null |
auth_server.webauthn_rp_id | string | no | — |
auth_server.webauthn_rp_origin | string | no | — |
aws
| Key | Type | Required | Schema default |
|---|---|---|---|
aws | object | yes | — |
aws.access_key_id | string | no | — |
aws.https_conn_pool_size | integer | yes | — |
aws.region | string | yes | — |
aws.secret_access_key | string | no | — |
cluster_mode
| Key | Type | Required | Schema default |
|---|---|---|---|
cluster_mode | object | no | — |
cluster_mode.advertised_host | string | no | — |
cluster_mode.broker_heartbeat_interval_secs | integer | no | — |
cluster_mode.broker_stale_threshold_secs | integer | no | — |
cluster_mode.enabled | boolean | yes | — |
cluster_mode.internal_api_port | integer | no | — |
cluster_mode.leader_heartbeat_interval_secs | integer | no | — |
cluster_mode.leader_stale_threshold_secs | integer | no | — |
cluster_mode.node_id_path | string | no | — |
cluster_mode.public_host | string | no | — |
cluster_mode.public_tcp_port | integer | no | — |
cluster_mode.swarm_enabled | boolean | no | null |
cluster_mode.swarm_lease_default_ttl_secs | integer | no | null |
cluster_mode.swarm_reaper_interval_secs | integer | no | null |
cluster_mode.swarm_task_retention_secs | integer | no | null |
cluster_mode.tls | object | no | — |
cluster_mode.tls.ca_cert_path | string | no | — |
cluster_mode.tls.cert_path | string | no | — |
cluster_mode.tls.enabled | boolean | yes | — |
cluster_mode.tls.key_path | string | no | — |
cluster_mode.tls.require_client_cert | boolean | no | — |
duckdb_persistence
| Key | Type | Required | Schema default |
|---|---|---|---|
duckdb_persistence | object | no | — |
duckdb_persistence.commit_interval_ms | integer | no | 1000 |
duckdb_persistence.dry_run | boolean | no | — |
duckdb_persistence.enabled | boolean | yes | — |
duckdb_persistence.max_writers | integer | no | — |
duckdb_persistence.storage_path | string | yes | — |
duckdb_persistence.super_dry_run | boolean | no | — |
duckdb_persistence.total_databases | integer | no | — |
ducklake
| Key | Type | Required | Schema default |
|---|---|---|---|
ducklake | array of object | no | — |
ducklake[] | object | yes | — |
ducklake[].attach | string | yes | — |
ducklake[].data_path | string | yes | — |
ducklake[].enabled | boolean | no | true |
ducklake[].name | string | yes | — |
ducklake[].processing_interval_seconds | integer | no | 30 |
ducklake[].reconciliation | object | no | |
ducklake[].reconciliation.interval_minutes | integer | no | 60 |
ducklake[].reconciliation.max_concurrent_registrations | integer | no | 10 |
ducklake[].reconciliation.on_startup | boolean | no | true |
ducklake[].topics | array of string | no | — |
http_ingestion
| Key | Type | Required | Schema default |
|---|---|---|---|
http_ingestion | object | yes | — |
http_ingestion.bind_address | string | yes | — |
http_ingestion.cors | object | yes | — |
http_ingestion.cors.allow_credentials | boolean | yes | — |
http_ingestion.cors.allowed_origins | array of string | yes | — |
http_ingestion.cors.max_age_seconds | integer | yes | — |
http_ingestion.enabled | boolean | yes | — |
http_ingestion.http2 | object | yes | — |
http_ingestion.http2.accept_threads | integer | yes | — |
http_ingestion.http2.initial_connection_window_size | integer | yes | — |
http_ingestion.http2.initial_stream_window_size | integer | yes | — |
http_ingestion.http2.keep_alive_interval_secs | integer | yes | — |
http_ingestion.http2.keep_alive_timeout_secs | integer | yes | — |
http_ingestion.http2.max_concurrent_streams | integer | yes | — |
http_ingestion.http2.max_connections | integer | yes | — |
http_ingestion.http2.max_frame_size | integer | yes | — |
http_ingestion.max_request_size | integer | yes | — |
http_ingestion.memory_pool | object | yes | — |
http_ingestion.memory_pool.buffer_count | integer | no | 2000 |
http_ingestion.memory_pool.buffer_size | integer | no | 131072 |
http_ingestion.port | integer | yes | — |
http_ingestion.rate_limiting | object | yes | — |
http_ingestion.rate_limiting.enabled | boolean | yes | — |
http_ingestion.rate_limiting.global_requests_per_second | integer | yes | — |
http_ingestion.rate_limiting.tenant_burst_size | integer | yes | — |
http_ingestion.rate_limiting.tenant_overrides | map of object | no | {} |
http_ingestion.rate_limiting.tenant_requests_per_second | integer | yes | — |
http_ingestion.tls | object | yes | — |
http_ingestion.tls.cert_path | string | yes | — |
http_ingestion.tls.cert_pem | string | no | `` |
http_ingestion.tls.key_path | string | yes | — |
http_ingestion.tls.key_pem | string | no | `` |
http_ingestion.token_secret_key | string | yes | — |
kafka
| Key | Type | Required | Schema default |
|---|---|---|---|
kafka | object | yes | — |
kafka.bind_address | string | yes | — |
kafka.enabled | boolean | yes | — |
kafka.port | integer | yes | — |
kafka.rate_limiting | object | no | |
kafka.rate_limiting.burst_limit | integer | no | 15000 |
kafka.rate_limiting.disabled | boolean | no | false |
kafka.rate_limiting.global_limit | integer | no | 100000 |
kafka.rate_limiting.max_requests_per_second | integer | no | 10000 |
kafka.tls | object | no | |
kafka.tls.cert_path | string | no | — |
kafka.tls.cert_pem | string | no | — |
kafka.tls.enabled | boolean | yes | — |
kafka.tls.key_path | string | no | — |
kafka.tls.key_pem | string | no | — |
logging
| Key | Type | Required | Schema default |
|---|---|---|---|
logging | object | yes | — |
logging.rust_log | string | yes | — |
metrics
| Key | Type | Required | Schema default |
|---|---|---|---|
metrics | object | yes | — |
metrics.flush_interval_ms | integer | yes | — |
metrics.port | integer | yes | — |
oauth_providers
| Key | Type | Required | Schema default |
|---|---|---|---|
oauth_providers | object | no | — |
oauth_providers.github | object | no | — |
oauth_providers.github.allowed_orgs | array of string | no | — |
oauth_providers.github.audit_org_teams | boolean | no | — |
oauth_providers.github.client_id | string | yes | — |
oauth_providers.github.client_secret | string | yes | — |
oauth_providers.github.redirect_uri | string | no | — |
oauth_providers.github.team_role_mappings | map of string | no | — |
oauth_providers.google | object | no | — |
oauth_providers.google.allowed_domains | array of string | no | — |
oauth_providers.google.client_id | string | yes | — |
oauth_providers.google.client_secret | string | yes | — |
oauth_providers.google.redirect_uri | string | no | — |
oauth_providers.oauth2 | array of object | no | — |
oauth_providers.oauth2[] | object | yes | — |
oauth_providers.oauth2[].auth_url | string | yes | — |
oauth_providers.oauth2[].client_id | string | yes | — |
oauth_providers.oauth2[].client_secret | string | yes | — |
oauth_providers.oauth2[].name | string | yes | — |
oauth_providers.oauth2[].redirect_uri | string | no | — |
oauth_providers.oauth2[].scopes | array of string | yes | — |
oauth_providers.oauth2[].token_url | string | yes | — |
oauth_providers.oauth2[].userinfo_url | string | yes | — |
oauth_providers.saml | array of object | no | — |
oauth_providers.saml[] | object | yes | — |
oauth_providers.saml[].attribute_mappings | object | yes | — |
oauth_providers.saml[].attribute_mappings.display_name | string | no | — |
oauth_providers.saml[].attribute_mappings.email | string | yes | — |
oauth_providers.saml[].attribute_mappings.first_name | string | no | — |
oauth_providers.saml[].attribute_mappings.groups | string | no | — |
oauth_providers.saml[].attribute_mappings.last_name | string | no | — |
oauth_providers.saml[].attribute_mappings.username | string | yes | — |
oauth_providers.saml[].enabled | boolean | yes | — |
oauth_providers.saml[].idp_certificate | string | yes | — |
oauth_providers.saml[].idp_entity_id | string | yes | — |
oauth_providers.saml[].idp_slo_url | string | no | — |
oauth_providers.saml[].idp_sso_url | string | yes | — |
oauth_providers.saml[].name | string | yes | — |
oauth_providers.saml[].sp_acs_url | string | yes | — |
oauth_providers.saml[].sp_certificate | string | yes | — |
oauth_providers.saml[].sp_entity_id | string | yes | — |
oauth_providers.saml[].sp_private_key | string | yes | — |
oauth_providers.saml[].sp_slo_url | string | no | — |
otlp
| Key | Type | Required | Schema default |
|---|---|---|---|
otlp | object | no | null |
otlp.auto_provision_tables | boolean | no | false |
otlp.default_catalog | string | no | `` |
otlp.default_schema | string | no | main |
otlp.enabled | boolean | yes | — |
otlp.max_batch_size | integer | no | 1000 |
otlp.port | integer | no | 4317 |
otlp.topic_mapping | one of the documented shapes | no |
pgwire
| Key | Type | Required | Schema default |
|---|---|---|---|
pgwire | object | yes | — |
pgwire.connection_timeout_seconds | integer | no | 1800 |
pgwire.enabled | boolean | yes | — |
pgwire.idle_timeout_seconds | integer | no | 900 |
pgwire.init_timeout_seconds | integer | no | 120 |
pgwire.initialization_sql | string | no | `` |
pgwire.max_connections | integer | no | 150 |
pgwire.metadata_backup_backend | string | no | — |
pgwire.metadata_backup_interval_seconds | integer | no | — |
pgwire.metadata_backup_path | string | no | — |
pgwire.metadata_db_path | string | no | ./metadata.duckdb |
pgwire.port | integer | yes | — |
pgwire.query_timeout_seconds | integer | no | 300 |
pgwire.refresh_interval_seconds | integer | no | 5 |
pgwire.tenant_data_base_path | string | no | /tmp/boilstream/tenants |
pgwire.tls | object | yes | — |
pgwire.tls.cert_path | string | no | — |
pgwire.tls.cert_pem | string | no | — |
pgwire.tls.enabled | boolean | yes | — |
pgwire.tls.key_path | string | no | — |
pgwire.tls.key_pem | string | no | — |
processing
| Key | Type | Required | Schema default |
|---|---|---|---|
processing | object | yes | — |
processing.bg_dry_run | boolean | no | — |
processing.buffer_pool_max_size | integer | yes | — |
processing.data_processing_threads | integer | yes | — |
processing.dry_run | boolean | no | — |
processing.enable_5mb_part_padding | boolean | no | true |
processing.include_metadata_columns | boolean | yes | — |
processing.max_file_size_mb | integer | no | 1024 |
processing.max_flush_latency_ms | integer | no | 10000 |
processing.max_part_size_mb | integer | no | 32 |
processing.parquet | object | yes | — |
processing.parquet.compression | string | yes | — |
processing.parquet.dictionary_enabled | boolean | yes | — |
processing.schema_validation_enabled | boolean | yes | — |
processing.snapshot_interval_minutes | integer | no | 10 |
processing.window_queue_capacity | integer | yes | — |
rate_limiting
| Key | Type | Required | Schema default |
|---|---|---|---|
rate_limiting | object | yes | — |
rate_limiting.base_size_bytes | integer | no | 4096 |
rate_limiting.burst_limit | integer | yes | — |
rate_limiting.disabled | boolean | yes | — |
rate_limiting.global_limit | integer | yes | — |
rate_limiting.max_requests | integer | yes | — |
server
| Key | Type | Required | Schema default |
|---|---|---|---|
server | object | yes | — |
server.admin_flight_port | integer | no | — |
server.consumer_flight_port | integer | no | — |
server.flight_base_port | integer | yes | — |
server.flight_thread_count | integer | no | 1 |
server.router | object | yes | — |
server.router.batch_size | integer | yes | — |
server.router.retry_delay_ms | integer | yes | — |
server.router.spsc_queue_capacity | integer | yes | — |
server.tokio_worker_threads | integer | no | — |
server.valkey_url | string | no | — |
storage
| Key | Type | Required | Schema default |
|---|---|---|---|
storage | object | yes | — |
storage.backends | array of object | yes | — |
storage.backends[] | object | yes | — |
storage.backends[].access_key | string | no | — |
storage.backends[].attach_name | string | no | — |
storage.backends[].azure_access_key | string | no | — |
storage.backends[].azure_account | string | no | — |
storage.backends[].azure_container | string | no | — |
storage.backends[].backend_type | s3 or azure or gcp or filesystem or noop | yes | — |
storage.backends[].bucket | string | no | — |
storage.backends[].database_path | string | no | — |
storage.backends[].ducklake | array of string | no | — |
storage.backends[].enabled | boolean | yes | — |
storage.backends[].endpoint | string | no | — |
storage.backends[].gcp_project_id | string | no | — |
storage.backends[].gcp_service_account_key | string | no | — |
storage.backends[].initial_backoff_ms | integer | no | — |
storage.backends[].max_concurrent_uploads | integer | no | — |
storage.backends[].max_retries | integer | no | — |
storage.backends[].max_retry_attempts | integer | no | — |
storage.backends[].name | string | yes | — |
storage.backends[].prefix | string | no | — |
storage.backends[].primary | boolean | yes | — |
storage.backends[].region | string | no | — |
storage.backends[].secret_key | string | no | — |
storage.backends[].use_path_style | boolean | no | — |
tantivy
| Key | Type | Required | Schema default |
|---|---|---|---|
tantivy | object | no | null |
tantivy.arena_mb | integer | no | 50 |
tantivy.bundle_buffer_pool_size | integer | no | 8 |
tantivy.bundle_buffer_size_mb | integer | no | 64 |
tantivy.channel_capacity | integer | no | 32 |
tantivy.commit_interval_secs | integer | no | 30 |
tantivy.data_dir | string | yes | — |
tantivy.enable_for_all_topics | boolean | no | false |
tantivy.enabled | boolean | yes | — |
tantivy.hot_segments_to_keep | integer | no | 2 |
tantivy.s3_upload_enabled | boolean | no | true |
tantivy.upload_retry_base_delay_ms | integer | no | 1000 |
tantivy.upload_retry_max | integer | no | 10 |
tantivy.writer_threads_per_topic | integer | no | 4 |
tls
| Key | Type | Required | Schema default |
|---|---|---|---|
tls | object | yes | — |
tls.cert_path | string | no | — |
tls.cert_pem | string | no | — |
tls.disabled | boolean | yes | — |
tls.grpc_default_ssl_roots_file_path | string | no | — |
tls.key_path | string | no | — |
tls.key_pem | string | no | — |