--- security: # everything that's related to authentication auth: cloud: clientId: ${CAMUNDA_OPTIMIZE_AUTH0_CLIENTID:} clientSecret: ${CAMUNDA_OPTIMIZE_AUTH0_CLIENTSECRET:} domain: ${CAMUNDA_OPTIMIZE_AUTH0_BACKENDDOMAIN:} customDomain: ${CAMUNDA_OPTIMIZE_AUTH0_DOMAIN:} userIdAttributeName: "sub" organizationClaimName: "https://camunda.com/orgs" organizationId: ${CAMUNDA_OPTIMIZE_AUTH0_ORGANIZATION:} clusterId: ${CAMUNDA_OPTIMIZE_CLIENT_CLUSTERID:} audience: ${CAMUNDA_OPTIMIZE_CLIENT_AUDIENCE:} userAccessTokenAudience: ${CAMUNDA_OPTIMIZE_M2M_ACCOUNTS_AUTH0_AUDIENCE:} tokenUrl: ${CAMUNDA_OPTIMIZE_AUTH0_TOKEN_URL:} ccsm: redirectRootUrl: ${CAMUNDA_OPTIMIZE_IDENTITY_REDIRECT_ROOT_URL:} # These are here for backwards compatibility, but should not be used anymore. The values are now set using the # application-ccsm.yaml file issuerUrl: ${CAMUNDA_OPTIMIZE_IDENTITY_ISSUER_URL:} issuerBackendUrl: ${CAMUNDA_OPTIMIZE_IDENTITY_ISSUER_BACKEND_URL:} clientId: ${CAMUNDA_OPTIMIZE_IDENTITY_CLIENTID:} clientSecret: ${CAMUNDA_OPTIMIZE_IDENTITY_CLIENTSECRET:} audience: ${CAMUNDA_OPTIMIZE_IDENTITY_AUDIENCE:} baseUrl: ${CAMUNDA_OPTIMIZE_IDENTITY_BASE_URL:} # Set to true to enable detailed DEBUG/WARN logging of OIDC redirect flows. Useful for # diagnosing reverse-proxy misconfigurations (forwarded-header mismatches). Disabled by default. diagnosticsEnabled: ${CAMUNDA_OPTIMIZE_SECURITY_AUTH_CCSM_DIAGNOSTICS_ENABLED:false} # When true (default), rejects Microsoft Entra access tokens whose `ver` claim is not "2.0". # Set to false only as a last-resort escape hatch while updating the Azure app registration # to set api.requestedAccessTokenVersion = 2. entraTokenVersionCheckEnabled: ${CAMUNDA_OPTIMIZE_SECURITY_AUTH_CCSM_ENTRA_TOKEN_VERSION_CHECK_ENABLED:true} cookie: same-site: # decides if the Optimize auth cookie has the same site cookie flag set enabled: ${CAMUNDA_OPTIMIZE_SECURITY_AUTH_COOKIE_SAME_SITE_ENABLED:true} secure: auto # browser cookies can have a maximum of 4096 bytes, we deduct 128 to make place for overhead # information (expiration information, etc.) maxSize: ${CAMUNDA_OPTIMIZE_SECURITY_AUTH_COOKIE_MAX_SIZE:3968} token: # Optimize uses token-based authentication to keep track of which users are # logged in. Define when a token is supposed to expire. lifeMin: 60 # Optional secret used to sign authentication tokens, it's recommended to use at least a 64 character secret. # If set `null` a random secret will be generated with each startup of Optimize. secret: ${CAMUNDA_OPTIMIZE_SECURITY_AUTH_TOKEN_SECRET:null} # Configuration relating to the use of Optimize license: # True if Optimize is running in enterprise mode, or false if in trial mode enterprise: ${CAMUNDA_OPTIMIZE_ENTERPRISE:true} # Here you can define HTTP response headers that Optimize can send in its responses # to increase the security of your application. # Find more information here: https://owasp.org/www-project-secure-headers/ responseHeaders: # HTTP Strict Transport Security (HSTS) is a web security policy mechanism which helps to protect websites # against protocol downgrade attacks and cookie hijacking. HSTS: # The time, in seconds, that the browser should remember that this site is only to be accessed using HTTPS. # If you set the number to a negative value no HSTS header is sent. max-age: ${CAMUNDA_OPTIMIZE_SECURITY_RESPONSE_HEADERS_HSTS_MAX_AGE:63072000} # If this optional parameter is specified, this rule applies to all of the site’s subdomains as well. includeSubDomains: true # This header enables the cross-site scripting (XSS) filter in your browser. # Can have one of the following options: # * 0: Filter disabled. # * 1: Filter enabled. If a cross-site scripting attack is detected, in order to stop the attack, # the browser will sanitize the page. # * 1; mode=block: Filter enabled. Rather than sanitize the page, when a XSS attack is detected, the browser will # prevent rendering of the page. # * 1; report=http://[YOURDOMAIN]/your_report_URI: Filter enabled. The browser will sanitize the page and # report the violation. This is a Chromium function utilizing CSP # violation reports to send details to a URI of your choice. X-XSS-Protection: 1; mode=block # Setting this header will prevent the browser from interpreting files as a different MIME type to # what is specified in the Content-Type HTTP header (e.g. treating text/plain as text/css). X-Content-Type-Options: true # A Content Security Policy (CSP) has significant impact on the way browsers render pages. # By default Optimize uses the base-uri directive which restricts the URLs that can be used to the Optimize pages. # Find more details: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy Content-Security-Policy: base-uri 'self' m2mClient: # ID and secret of the Optimize Auth0 M2M Client m2mClientId: ${CAMUNDA_OPTIMIZE_M2M_ACCOUNTS_AUTH0_CLIENTID:} m2mClientSecret: ${CAMUNDA_OPTIMIZE_M2M_ACCOUNTS_AUTH0_CLIENTSECRET:} # A global access token used by all public APIs of Optimize api: # Authentication information to be provided for the public APIs of Optimize. # Provide either # 1. A static access token OR # 2. a URL for a resource server AND an audience to validate against. # If both are provided, the static access token will be ignored and the resource server will be used for validation # instead accessToken: ${OPTIMIZE_API_ACCESS_TOKEN:null} jwtSetUri: ${SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_JWK_SET_URI:null} audience: ${CAMUNDA_OPTIMIZE_API_AUDIENCE:optimize} # Self-managed (CCSM) only. When true, non-public /api/** endpoints also accept an # 'Authorization: Bearer ' header in addition to the existing Identity session cookie. # The bearer token is validated with the same jwtSetUri / audience configured above. # Requires jwtSetUri to be set. Defaults to false. jwtAuthForApiEnabled: ${CAMUNDA_OPTIMIZE_API_JWT_AUTH_ENABLED:false} container: # A host name or IP address, to identify a specific network interface on # which to listen. host: ${CONTAINER_HOST:localhost} # Allows you to specify a custom context path. If set, must start with a leading '/' contextPath: ${CAMUNDA_OPTIMIZE_CONTEXT_PATH:null} ports: # A port number that will be used by Optimize to process HTTP connections. # If set to null, ~ or left empty, http connections won't be accepted. http: ${CAMUNDA_OPTIMIZE_CONTAINER_PORTS_HTTP:8090} # A port number that will be used by Optimize to process # secure HTTPS connections. https: ${CAMUNDA_OPTIMIZE_CONTAINER_PORTS_HTTPS:8091} # A port number that will be used by Optimize's Actuator management server # always defaults to 8092 actuator: ${MANAGEMENT_SERVER_PORT:8092} # HTTPS requires an SSL Certificate. When you generate an SSL Certificate, # you are creating a keystore file and a keystore password for use when the # browser interface connects keystore: location: ${CAMUNDA_OPTIMIZE_CONTAINER_KEYSTORE_LOCATION:keystore.jks} password: ${CAMUNDA_OPTIMIZE_CONTAINER_KEYSTORE_PASSWORD:optimize} # Determines whether SNI checking should be enabled enableSniCheck: ${CAMUNDA_OPTIMIZE_CONTAINER_ENABLE_SNI_CHECK:true} # configuration of status reporting web socket status: # max number of threads\sessions that will be kept to report status connections: max: ${CAMUNDA_OPTIMIZE_CONTAINER_STATUS_CONNECTIONS_MAX:10} # Optional url to access Optimize (used for links to Optimize in e.g. alert emails) accessUrl: ${CONTAINER_ACCESS_URL:null} # Maximum size of a single request header. Note that higher values consume more memory maxRequestHeaderSizeInBytes: ${CAMUNDA_OPTIMIZE_CONTAINER_MAX_REQUEST_HEADER_SIZE_BYTES:8192} # Maximum size of a single response header. Note that higher values consume more memory maxResponseHeaderSizeInBytes: ${CAMUNDA_OPTIMIZE_CONTAINER_MAX_RESPONSE_HEADER_SIZE_BYTES:8192} # Enable HTTP/2 support http2Enabled: ${CAMUNDA_OPTIMIZE_CONTAINER_HTTP2_ENABLED:false} # Configuration for fetching user data users: cloud: accountsUrl: ${CAMUNDA_OPTIMIZE_M2M_ACCOUNTS_URL:} zeebe: # Toggles whether Optimize should attempt to import data from the connected Zeebe instance enabled: ${CAMUNDA_OPTIMIZE_ZEEBE_ENABLED:false} # The name suffix of the exported Zeebe records. This must match the record-prefix configured in the exporter of the instance name: "${CAMUNDA_OPTIMIZE_ZEEBE_NAME:zeebe-record}" # The number of partitions configured for the Zeebe record source partitionCount: ${CAMUNDA_OPTIMIZE_ZEEBE_PARTITION_COUNT:1} # The max page size for importing Zeebe data maxImportPageSize: ${CAMUNDA_OPTIMIZE_ZEEBE_MAX_IMPORT_PAGE_SIZE:200} # Determines whether Optimize should convert and store object variables from Zeebe includeObjectVariableValue: ${CAMUNDA_OPTIMIZE_ZEEBE_INCLUDE_OBJECT_VARIABLE:false} # Indicates whether variable import is enabled variableImportEnabled: ${CAMUNDA_OPTIMIZE_ZEEBE_VARIABLE_IMPORT_ENABLED:true} importConfig: # The number of successful fetches that should be attempted before increasing the batch size during fetching dynamicBatchSuccessAttempts: ${CAMUNDA_OPTIMIZE_ZEEBE_IMPORT_DYNAMIC_BATCH_SUCCESS_ATTEMPTS:10} # The number of empty pages to fetch before checking whether new data is available to import that cannot be reached # using the sequence query maxEmptyPagesToImport: ${CAMUNDA_OPTIMIZE_ZEEBE_IMPORT_MAX_EMPTY_PAGES_TO_IMPORT:10} jobRegistry: dispatcher: # Toggles whether this Optimize instance dispatches queued job registry entries. Only one # instance per cluster should have this enabled. enabled: ${CAMUNDA_OPTIMIZE_JOB_REGISTRY_DISPATCHER_ENABLED:false} # Delay, in seconds, before the dispatcher polls again for queued job registry entries, # counted from the completion of the previous poll intervalSeconds: ${CAMUNDA_OPTIMIZE_JOB_REGISTRY_DISPATCHER_INTERVAL_SECONDS:30} # The maximum number of queued entries read and dispatched per poll cycle batchSize: ${CAMUNDA_OPTIMIZE_JOB_REGISTRY_DISPATCHER_BATCH_SIZE:4} # The number of threads used to dispatch entries of a batch to their handlers concurrently threadCount: ${CAMUNDA_OPTIMIZE_JOB_REGISTRY_DISPATCHER_THREAD_COUNT:2} import: data: activity-instance: # Determines the page size for historic activity instance fetching. maxPageSize: 10000 incident: # Determines the page size for historic incident fetching. maxPageSize: 10000 process-definition-xml: # Determines the page size for process definition xml model # fetching. Should be a low value, as large models will lead to # memory or timeout problems. maxPageSize: 2 process-definition: # Determines the page size for process definition fetching. maxPageSize: 10000 process-instance: # Determines the maximum page size for historic process instance fetching. maxPageSize: 10000 variable: # Determines the page size for historic variable instance fetching. maxPageSize: 10000 # Controls whether Optimize fetches the serialized value of object variables from the Camunda Runtime REST API. # By default, this is active for backwards compatibility. If no variable plugin to handle object # variables is installed, it can be turned off to reduce the overhead of the variable import. includeObjectVariableValue: true user-task-instance: # Determines the page size for historic user task instance fetching maxPageSize: 10000 identity-link-log: # Determines the page size for identity link log fetching. maxPageSize: 10000 user-operation-log: # Determines the page size for user operations log fetching. maxPageSize: 10000 decision-definition-xml: # Determines the page size for decision definition xml model # fetching. Should be a low value, as large models will lead to # memory or timeout problems. maxPageSize: 2 decision-definition: # Determines the page size for decision definition fetching. maxPageSize: 10000 decision-instance: # Determines the page size for historic decision instance fetching. maxPageSize: 10000 tenant: # Determines the page size for tenants fetching. maxPageSize: 10000 group: # Determines the page size for groups fetching. maxPageSize: 10000 authorization: # Determines the page size for authorizations fetching. maxPageSize: 10000 dmn: # Determines if the DMN/decision data, such as decision definitions and instances # should be imported. enabled: true user-task-worker: # Determines if the user task worker data, such as assignee or candidate group id of a user task, should be imported. enabled: true # This sub-section controls to what extent and how Optimize fetches and displays metadata of user task workers. # The particular metadata is first-, last name and the email of the users or the names of the candidate groups. # The data is displayed in the context of reports when grouping/distributing by assignees/candidateGroups or # when filtering on them. metadata: # Determines whether Optimize imports and displays assignee user metadata, otherwise only the user id is shown. includeUserMetaData: true # Cron expression for when to fully refresh the internal metadata cache, it defaults to every third hour. # Otherwise deleted assignees/candidateGroups or metadata changes are not reflected in Optimize. cronTrigger: "0 */3 * * *" # The max page size when multiple users or groups are iterated during the metadata refresh. maxPageSize: 10000 # The entry limit of the cache that holds the metadata, if you need more entries you can increase that limit. # When increasing the limit, keep in mind to account for that by increasing the JVM heap memory as well. # Please refer to the technical guide on how to configure the heap size. maxEntryLimit: 100000 # Controls whether Camunda Customer Onboarding Demo data should be loaded to optimize (only for C8) customer-onboarding: ${CAMUNDA_OPTIMIZE_IMPORT_CUSTOMER_ONBOARDING:false} # Some data can no longer be imported to a given document if its number of nested documents has reached the configured # limit. Enable this setting to skip this data during import if the nested document limit has been reached. skipDataAfterNestedDocLimitReached: ${CAMUNDA_OPTIMIZE_IMPORT_DATA_SKIP_DATA_AFTER_NESTED_DOC_LIMIT_REACHED:false} # Number of threads being used to process the import jobs per data type that are writing data to elasticsearch. elasticsearchJobExecutorThreadCount: 1 # Adjust the queue size of the import jobs per data type that store data to elasticsearch. # A too large value might cause memory problems. elasticsearchJobExecutorQueueSize: 5 handler: backoff: # Interval which is used for the backoff time calculation. initial: 1000 # Once all pages are consumed, the import service component will # start scheduling fetching tasks in increasing periods of time, # controlled by 'backoff' counter. # This property sets maximal backoff interval in seconds max: 30 #States how often the import index should be stored to Elasticsearch. importIndexStorageIntervalInSec: 10 # the time interval the import backs off from the current tip of the time, to reread potentially missed concurrent writes currentTimeBackoffMilliseconds: 300000 # The identity sync enables Optimize to build up a in memory cache containing Optimize authorized users & groups. # This data is used in the collection permissions to allow convenient search capabilities # and to display member meta-data such as first name, last name or email. identitySync: # Whether to include metaData (firstName, lastName, email) when synchronizing users includeUserMetaData: true # Whether collection role cleanup should be performed collectionRoleCleanupEnabled: ${CAMUNDA_OPTIMIZE_IMPORT_IDENTITY_SYNC_COLLECTION_ROLE_CLEANUP_ENABLED:false} # Cron expression for when the identity sync should run, defaults to every second hour. cronTrigger: "0 */2 * * *" # The max page size when multiple users or groups are iterated during the import. maxPageSize: 10000 # The entry limit of the cache, if you need more entries you can increase that limit. # When increasing the limit, keep in mind to account for that by increasing the JVM heap memory as well. # Please refer to the technical guide on how to configure the heap size. maxEntryLimit: 100000 # everything that is related with configuring OpenSearch or creating # a connection to it. opensearch: connection: # Use AWS credentials for authentication awsEnabled: ${CAMUNDA_OPTIMIZE_OPENSEARCH_AWS_ENABLED:false} # Maximum time without connection to Opensearch, Optimize should # wait until a timeout triggers. timeout: 10000 # Maximum size of the Opensearch response consumer heap buffer. responseConsumerBufferLimitInMb: 100 # The path prefix under which Opensearch is available pathPrefix: "" # a list of Opensearch nodes Optimize can connect to. If you have built # an Opensearch cluster with several nodes it is recommended to define # several connection points in case one node fails. nodes: # the address/hostname under which the OpenSearch node is available. - host: "${CAMUNDA_OPTIMIZE_OPENSEARCH_HOST:localhost}" # A port number used by OpenSearch to accept HTTP connections. httpPort: ${CAMUNDA_OPTIMIZE_OPENSEARCH_HTTP_PORT:9200} # Determines whether the hostname verification should be skipped skipHostnameVerification: ${CAMUNDA_OPTIMIZE_OPENSEARCH_CONNECTION_SKIP_HOSTNAME_VERIFICATION:false} # HTTP forward proxy configuration proxy: # whether an HTTP proxy should be used for requests to OpenSearch enabled: false # the host of the proxy to use host: null # the port of the proxy to use port: null # whether this proxy is using a secured connection sslEnabled: false # optional username for proxy authentication username: null # optional password for proxy authentication password: null # Configuration relating to OS backup backup: # The repository name in which the backups should be stored repositoryName: ${CAMUNDA_OPTIMIZE_BACKUP_REPOSITORY_NAME:} # Opensearch security settings security: # the basic auth (x-pack) username username: ${CAMUNDA_OPTIMIZE_OPENSEARCH_SECURITY_USERNAME:null} # the basic auth (x-pack) password password: ${CAMUNDA_OPTIMIZE_OPENSEARCH_SECURITY_PASSWORD:null} # SSL/HTTPS secured connection settings ssl: # path to a PEM encoded file containing the certificate (or certificate chain) # that will be presented to clients when they connect. certificate: ${CAMUNDA_OPTIMIZE_OPENSEARCH_SECURITY_SSL_CERTIFICATE:null} # A list of paths to PEM encoded CA certificate files that should be trusted, e.g. ['/path/to/ca.crt']. # Note: if you are using a public CA that is already trusted by the Java runtime, # you do not need to set the certificate_authorities. certificate_authorities: ${CAMUNDA_OPTIMIZE_OPENSEARCH_SECURITY_SSL_CERTIFICATE_AUTHORITIES:[]} # used to enable or disable TLS/SSL for the HTTP connection enabled: ${CAMUNDA_OPTIMIZE_OPENSEARCH_SSL_ENABLED:false} # used to specify that the certificate was self-signed selfSigned: ${CAMUNDA_OPTIMIZE_OPENSEARCH_SECURITY_SSL_SELF_SIGNED:false} # Maximum time in seconds a request to opensearch should last, before a timeout # triggers. scrollTimeoutInSeconds: 60 settings: # the maximum number of buckets returned for an aggregation aggregationBucketLimit: 1000 index: # the prefix prepended to all Optimize index and alias names # NOTE: Changing this after Optimize was already run before, will create new empty indexes prefix: ${CAMUNDA_OPTIMIZE_OPENSEARCH_SETTINGS_INDEX_PREFIX:optimize} # How often should the data replicated in case of node failure. number_of_replicas: ${CAMUNDA_OPTIMIZE_OPENSEARCH_SETTINGS_INDEX_NUMBER_OF_REPLICAS:1} # How many shards should be used in the cluster for process instance and decision instance indices. # All other indices will be made up of a single shard # NOTE: this property only applies the first time Optimize is started and # the schema/mapping is deployed on Opensearch. If you want to take # this property to take effect again, you need to delete all indexes (with it all data) # and restart Optimize. This configuration will also only be applied to the current write instance indices. Archive # indices will have a single shard regardless number_of_shards: ${CAMUNDA_OPTIMIZE_OPENSEARCH_SETTINGS_INDEX_NUMBER_OF_SHARDS:1} # How long Elasticsearch waits until the documents are available # for search. A positive value defines the duration in seconds. # A value of -1 means that a refresh needs to be done manually. refresh_interval: 2s # Optimize uses nested documents to store list information such as activities or variables belonging to a # process instance. So this setting defines the maximum number of activities/variables that a single # process instance can contain. This limit helps to prevent out of memory errors and should be used with care. nested_documents_limit: ${CAMUNDA_OPTIMIZE_OPENSEARCH_SETTINGS_INDEX_NESTED_DOCUMENTS_LIMIT:10000} interceptorPlugins: # As per agreement, this is a temporary solution until # Optimize unifies config loading the same way it is done # in Zeebe. For now, limiting interceptors to 5. # Related issue: https://github.com/camunda/camunda/issues/22349 0: id: ${CAMUNDA_OPTIMIZE_OPENSEARCH_INTERCEPTORPLUGINS_0_ID:} className: ${CAMUNDA_OPTIMIZE_OPENSEARCH_INTERCEPTORPLUGINS_0_CLASSNAME:} jarPath: ${CAMUNDA_OPTIMIZE_OPENSEARCH_INTERCEPTORPLUGINS_0_JARPATH:} 1: id: ${CAMUNDA_OPTIMIZE_OPENSEARCH_INTERCEPTORPLUGINS_1_ID:} className: ${CAMUNDA_OPTIMIZE_OPENSEARCH_INTERCEPTORPLUGINS_1_CLASSNAME:} jarPath: ${CAMUNDA_OPTIMIZE_OPENSEARCH_INTERCEPTORPLUGINS_1_JARPATH:} 2: id: ${CAMUNDA_OPTIMIZE_OPENSEARCH_INTERCEPTORPLUGINS_2_ID:} className: ${CAMUNDA_OPTIMIZE_OPENSEARCH_INTERCEPTORPLUGINS_2_CLASSNAME:} jarPath: ${CAMUNDA_OPTIMIZE_OPENSEARCH_INTERCEPTORPLUGINS_2_JARPATH:} 3: id: ${CAMUNDA_OPTIMIZE_OPENSEARCH_INTERCEPTORPLUGINS_3_ID:} className: ${CAMUNDA_OPTIMIZE_OPENSEARCH_INTERCEPTORPLUGINS_3_CLASSNAME:} jarPath: ${CAMUNDA_OPTIMIZE_OPENSEARCH_INTERCEPTORPLUGINS_3_JARPATH:} 4: id: ${CAMUNDA_OPTIMIZE_OPENSEARCH_INTERCEPTORPLUGINS_4_ID:} className: ${CAMUNDA_OPTIMIZE_OPENSEARCH_INTERCEPTORPLUGINS_4_CLASSNAME:} jarPath: ${CAMUNDA_OPTIMIZE_OPENSEARCH_INTERCEPTORPLUGINS_4_JARPATH:} # everything that is related with configuring Elasticsearch or creating # a connection to it. es: connection: # Used to determine whether Optimize should attempt to check cluster tasks. # This can be used in case Optimize does not have permission to query cluster tasks. clusterTaskCheckingEnabled: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_CLUSTER_TASK_CHECKING_ENABLED:true} # Determines whether this Optimize instance should perform schema initialization initSchemaEnabled: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_INIT_SCHEMA_ENABLED:true} # Maximum time without connection to Elasticsearch, Optimize should # wait until a timeout triggers. timeout: 10000 # Maximum size of the Elasticsearch response consumer heap buffer. responseConsumerBufferLimitInMb: 100 # The path prefix under which Elasticsearch is available pathPrefix: "" # a list of Elasticsearch nodes Optimize can connect to. If you have built # an Elasticsearch cluster with several nodes it is recommended to define # several connection points in case one node fails. nodes: # the address/hostname under which the Elasticsearch node is available. - host: "${OPTIMIZE_ELASTICSEARCH_HOST:localhost}" # A port number used by Elasticsearch to accept HTTP connections. httpPort: ${OPTIMIZE_ELASTICSEARCH_HTTP_PORT:9200} # HTTP forward proxy configuration proxy: # whether an HTTP proxy should be used for requests to elasticsearch enabled: false # the host of the proxy to use host: null # the port of the proxy to use port: null # whether this proxy is using a secured connection sslEnabled: false # optional username for proxy authentication username: null # optional password for proxy authentication password: null # Determines whether the hostname verification should be skipped skipHostnameVerification: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_CONNECTION_SKIP_HOSTNAME_VERIFICATION:false} # Configuration relating to ES backup backup: # The repository name in which the backups should be stored repositoryName: ${CAMUNDA_OPTIMIZE_BACKUP_REPOSITORY_NAME:} # Elasticsearch security settings security: # the basic auth (x-pack) username username: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_SECURITY_USERNAME:null} # the basic auth (x-pack) password password: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_SECURITY_PASSWORD:null} # SSL/HTTPS secured connection settings ssl: # path to a PEM encoded file containing the certificate (or certificate chain) # that will be presented to clients when they connect. certificate: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_SECURITY_SSL_CERTIFICATE:null} # A list of paths to PEM encoded CA certificate files that should be trusted, e.g. ['/path/to/ca.crt']. # Note: if you are using a public CA that is already trusted by the Java runtime, # you do not need to set the certificate_authorities. certificate_authorities: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_SECURITY_SSL_CERTIFICATE_AUTHORITIES:[]} # used to enable or disable TLS/SSL for the HTTP connection enabled: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_SSL_ENABLED:false} # used to specify that the certificate was self-signed selfSigned: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_SECURITY_SSL_SELF_SIGNED:false} # Maximum time in seconds a request to elasticsearch should last, before a timeout # triggers. scrollTimeoutInSeconds: 60 settings: # the maximum number of buckets returned for an aggregation aggregationBucketLimit: 1000 index: # the prefix prepended to all Optimize index and alias names # NOTE: Changing this after Optimize was already run before, will create new empty indexes prefix: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_SETTINGS_INDEX_PREFIX:optimize} # How often should the data replicated in case of node failure. number_of_replicas: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_SETTINGS_INDEX_NUMBER_OF_REPLICAS:1} # How many shards should be used in the cluster for process instance and decision instance indices. # All other indices will be made up of a single shard # NOTE: this property only applies the first time Optimize is started and # the schema/mapping is deployed on Elasticsearch. If you want to take # this property to take effect again, you need to delete all indexes (with it all data) # and restart Optimize. This configuration will also only be applied to the current write instance indices. Archive # indices will have a single shard regardless number_of_shards: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_SETTINGS_INDEX_NUMBER_OF_SHARDS:1} # How long Elasticsearch waits until the documents are available # for search. A positive value defines the duration in seconds. # A value of -1 means that a refresh needs to be done manually. refresh_interval: 2s # Optimize uses nested documents to store list information such as activities or variables belonging to a # process instance. So this setting defines the maximum number of activities/variables that a single # process instance can contain. This limit helps to prevent out of memory errors and should be used with care. nested_documents_limit: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_SETTINGS_INDEX_NESTED_DOCUMENTS_LIMIT:10000} interceptorPlugins: # As per agreement, this is a temporary solution until # Optimize unifies config loading the same way it is done # in Zeebe. For now, limiting interceptors to 5. # Related issue: https://github.com/camunda/camunda/issues/22349 0: id: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_INTERCEPTORPLUGINS_0_ID:} className: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_INTERCEPTORPLUGINS_0_CLASSNAME:} jarPath: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_INTERCEPTORPLUGINS_0_JARPATH:} 1: id: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_INTERCEPTORPLUGINS_1_ID:} className: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_INTERCEPTORPLUGINS_1_CLASSNAME:} jarPath: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_INTERCEPTORPLUGINS_1_JARPATH:} 2: id: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_INTERCEPTORPLUGINS_2_ID:} className: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_INTERCEPTORPLUGINS_2_CLASSNAME:} jarPath: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_INTERCEPTORPLUGINS_2_JARPATH:} 3: id: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_INTERCEPTORPLUGINS_3_ID:} className: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_INTERCEPTORPLUGINS_3_CLASSNAME:} jarPath: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_INTERCEPTORPLUGINS_3_JARPATH:} 4: id: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_INTERCEPTORPLUGINS_4_ID:} className: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_INTERCEPTORPLUGINS_4_CLASSNAME:} jarPath: ${CAMUNDA_OPTIMIZE_ELASTICSEARCH_INTERCEPTORPLUGINS_4_JARPATH:} alerting: quartz: jobStore: "org.quartz.simpl.RAMJobStore" email: # A switch to control email sending process. enabled: ${CAMUNDA_OPTIMIZE_EMAIL_ENABLED:false} # Email address that can be used to send alerts or email digests address: ${CAMUNDA_OPTIMIZE_EMAIL_ADDRESS:} # The smtp server name hostname: ${CAMUNDA_OPTIMIZE_EMAIL_HOSTNAME:} # The smtp server port. This one is also used as SSL port for the security connection. port: ${CAMUNDA_OPTIMIZE_EMAIL_PORT:587} # A switch to control the checking of server identities for SSL email sending checkServerIdentity: ${CAMUNDA_OPTIMIZE_EMAIL_CHECK_SERVER_IDENTITY:false} # This is the company name that will be shown in the subject and body of e-mails sent by Optimize # This configuration's setting is subject to any legal agreements between Camunda and the user's organization. # Changes are only permitted with formal, written approval by Camunda. companyBranding: ${CAMUNDA_OPTIMIZE_EMAIL_COMPANY_BRANDING:Camunda} # Define configuration properties for the authentication of the email server authentication: # A switch to control whether the email server requires authentication enabled: ${CAMUNDA_OPTIMIZE_EMAIL_AUTHENTICATION_ENABLED:true} # Username of your smtp server username: ${CAMUNDA_OPTIMIZE_EMAIL_AUTHENTICATION_USERNAME:} # Corresponding password to the given user of your smtp server password: ${CAMUNDA_OPTIMIZE_EMAIL_AUTHENTICATION_PASSWORD:} # States how the connection to the server should be secured. # Possible values are 'NONE', 'STARTTLS' or 'SSL/TLS' securityProtocol: ${CAMUNDA_OPTIMIZE_EMAIL_AUTHENTICATION_SECURITY_PROTOCOL:NONE} digest: # cron expression to define when enabled email digests are to be sent cronTrigger: "0 0 9 * * MON" panelNotification: url: ${CAMUNDA_OPTIMIZE_NOTIFICATIONS_URL:} # Determines whether onboarding notifications should be sent after importing first instance of new process. # 'scheduleProcessOnboardingChecks' must be set to true for this to take effect. # Panel notifications are only available in SaaS enabled: ${CAMUNDA_OPTIMIZE_PANEL_NOTIFICATION_ENABLED:true} # Audience required to request an M2M token to use notifications API m2mTokenAudience: ${CAMUNDA_OPTIMIZE_PANEL_NOTIFICATION_M2M_TOKEN_AUDIENCE:} entity: # which users are authorized to create/edit/delete Optimize entities outside of a collection. # Available options: 'all', 'none' authorizedEditors: "all" # Specifies the frequency with which we want to refresh the KPI values on ES # The given number is the interval in seconds kpiRefreshInterval: 600 # flag to determine whether this Optimize instance should (re)create management entities on startup createOnStartup: ${CAMUNDA_OPTIMIZE_ENTITY_CREATE_ON_STARTUP:true} # Maximum number of characters allowed in the name of a report, collection, dashboard or alert. # Matches the orchestration cluster's equivalent limit for name fields. Note that a name well below # this can still be too large to index, as Elasticsearch/OpenSearch cap a term at 32766 bytes and a # character takes up to 3 bytes in UTF-8. Existing longer names remain readable. nameMaxLength: ${CAMUNDA_OPTIMIZE_ENTITY_NAME_MAX_LENGTH:32768} businessValue: # How often the business-value overview index is refreshed for all definitions and all range # presets (7d, 30d, 3m, 6m). The given number is the interval in seconds. Default: 24h. overviewRefreshInterval: ${CAMUNDA_OPTIMIZE_BUSINESS_VALUE_OVERVIEW_REFRESH_INTERVAL:86400} export: csv: # which users are authorized to download CSVs. Available options: 'all', 'none' authorizedUsers: "all" # Maximum number of records returned by CSV export # Note: Increasing this value comes at a memory cost for the Optimize application that varies based on the actual data. # As a rough guideline, an export of a 50000 records raw data report containing 8 variables on each instance # can cause temporary heap memory peaks of up to ~200MB with the actual CSV file having a size of ~20MB. # Please adjust the heap memory accordingly. limit: 1000 delimiter: "," sharing: # decides if the sharing feature of Optimize can be used in the UI. enabled: ${CAMUNDA_OPTIMIZE_SHARING_ENABLED:true} historyCleanup: # cron expression for when the cleanup should run cronTrigger: "${CAMUNDA_OPTIMIZE_HISTORY_CLEANUP_CRON_TRIGGER:0 1 * * *}" # default time to live (ttl) for data, when reached the corresponding process/decision instances will get cleaned up # Format is ISO_8601 duration https://en.wikipedia.org/wiki/ISO_8601#Durations ttl: ${CAMUNDA_OPTIMIZE_HISTORY_CLEANUP_TTL:P2Y} processDataCleanup: # switch for the Camunda process data cleanup, defaults to false enabled: ${CAMUNDA_OPTIMIZE_HISTORY_CLEANUP_PROCESS_DATA_CLEANUP_ENABLED:false} # type of process data cleanup to perform, possible values: # 'all' - delete everything related to the process instance # 'variables' - only delete associated variables of a process instance cleanupMode: ${CAMUNDA_OPTIMIZE_HISTORY_CLEANUP_PROCESS_DATA_CLEANUP_CLEANUP_MODE:all} # Defines the batch size in which Camunda engine process instance data gets cleaned up. # It may be reduced if requests fail due to request size constraints. batchSize: ${CAMUNDA_OPTIMIZE_HISTORY_CLEANUP_PROCESS_DATA_CLEANUP_BATCH_SIZE:10000} # process definition specific configuration parameters that will overwrite the general parameters (ttl, processDataCleanupMode) # for the specific processDefinition key perProcessDefinitionConfig: # 'myProcessDefinitionKey': # ttl: 'P2M' # cleanupMode: 'variables' externalVariableCleanup: # switch for the ingested variable data cleanup, defaults to false. Note that this cleans the external variable index, # not external variables already imported into process instances. enabled: ${CAMUNDA_OPTIMIZE_HISTORY_CLEANUP_EXTERNAL_VARIABLE_CLEANUP_ENABLED:false} locales: # all locales available # Note: for others than the default there must be a .json file available under ./config/localization. availableLocales: ["en", "de"] # the fallback locale is used if there is a locale requested that is not available in availableLocales fallbackLocale: "en" ui: # If you have SSO enabled, you can set the property below to hide the logout option if it is not needed logoutHidden: ${CAMUNDA_OPTIMIZE_UI_LOGOUT_HIDDEN:false} # The maximum number of data sources available for a report. The minimum value is 1, the maximum is 1024 maxNumDataSourcesForReport: ${CAMUNDA_OPTIMIZE_UI_MAX_NUM_REPORT_DATA_SOURCES:100} # Flag to disable userTask assignee specific analytics such as report types and filters userTaskAssigneeAnalyticsEnabled: ${CAMUNDA_OPTIMIZE_UI_USER_TASK_ASSIGNEE_ANALYTICS_ENABLED:true} # The URL for Optimize to use to navigate to console in the sidebar consoleUrl: ${CAMUNDA_OPTIMIZE_CLOUD_CONSOLE_URL:} # The URL for Optimize to use to navigate to modeler in the sidebar modelerUrl: ${CAMUNDA_OPTIMIZE_CLOUD_MODELER_URL:} telemetry: # Is telemetry initialized initializeTelemetry: ${CAMUNDA_OPTIMIZE_TELEMETRY_ENABLED:false} # Interval for telemetry reporting, defaults to every 24 hours. reportingIntervalInHours: 24 analytics: # Enable/Disable user interaction tracking enabled: ${CAMUNDA_OPTIMIZE_ANALYTICS_ENABLED:false} osano: scriptUrl: ${CAMUNDA_OPTIMIZE_ANALYTICS_OSANO_SCRIPT_URL:} mixpanel: apiHost: ${CAMUNDA_OPTIMIZE_ANALYTICS_MIXPANEL_API_HOST:https://api-eu.mixpanel.com} importPath: "/import" token: ${CAMUNDA_OPTIMIZE_ANALYTICS_MIXPANEL_TOKEN:} projectId: ${CAMUNDA_OPTIMIZE_ANALYTICS_MIXPANEL_PROJECT_ID:} serviceAccount: username: ${CAMUNDA_OPTIMIZE_ANALYTICS_MIXPANEL_SERVICE_USERNAME:} secret: ${CAMUNDA_OPTIMIZE_ANALYTICS_MIXPANEL_SERVICE_SECRET:} properties: stage: ${CAMUNDA_OPTIMIZE_ANALYTICS_MIXPANEL_STAGE:dev} organizationId: ${CAMUNDA_OPTIMIZE_AUTH0_ORGANIZATION:dev} clusterId: ${CAMUNDA_OPTIMIZE_CLIENT_CLUSTERID:dev} onboarding: # This is a UI flag to determine whether the onboarding UI actions should be display enabled: ${CAMUNDA_OPTIMIZE_ONBOARDING_ENABLED:false} appCuesScriptUrl: ${CAMUNDA_OPTIMIZE_ONBOARDING_APPCUES_SCRIPT_URL://fast.appcues.com/104513.js} # Determines whether this Optimize instance should check for whether or not processes are onboarded. Note: This # should be enabled for exactly one Optimize instance within the cluster scheduleProcessOnboardingChecks: ${CAMUNDA_OPTIMIZE_ONBOARDING_SCHEDULE_PROCESS_ONBOARDING_CHECKS:true} # Determines whether onboarding emails should be sent with process data. 'scheduleProcessOnboardingChecks' must be # set to true for this to take effect enableOnboardingEmails: ${CAMUNDA_OPTIMIZE_ONBOARDING_SEND_EMAILS:false} # How often (in seconds) shall optimize check for process instances updates? - Minimum 60s intervalForCheckingTriggerForOnboardingEmails: ${CAMUNDA_OPTIMIZE_ONBOARDING_INTERVAL_CHECK_DATA:180} properties: organizationId: ${CAMUNDA_OPTIMIZE_AUTH0_ORGANIZATION:dev} clusterId: ${CAMUNDA_OPTIMIZE_CLIENT_CLUSTERID:dev} # Configuration of application internal in-memory caches caches: # This cache is used to cache the list of engines a particular definition is available on by definition key. # It helps to optimize the performance for listings of reports, collection data sources and collection roles. definitionEngines: maxSize: 1000 # the time a read result will be cached defaultTtlMillis: 10000 # This cache is used to cache the latest definition available on each tenant. # It helps to optimize the performance for of report evaluations. definitions: maxSize: 1000 # the time a read result will be cached defaultTtlMillis: 10000 # This cache is used to cache the most recently fetched CCSaaS users. # It prevents too many fetch requests to the external service. cloudUsers: maxSize: ${CAMUNDA_OPTIMIZE_CLOUD_USER_CACHE_MAX_SIZE:10000} # the minimum interval (in seconds) between each request to repopulate the cache. minFetchIntervalSeconds: ${CAMUNDA_OPTIMIZE_CLOUD_USER_CACHE_MIN_FETCH_INTERVAL_SECONDS:600} # This cache is used to hold user tenant authorizations in CCSM cloudTenantAuthorizations: maxSize: ${CAMUNDA_OPTIMIZE_CACHES_CLOUD_TENANT_AUTHORIZATIONS_MAX_SIZE:10000} # the time (in millis) the tenant authorizations will be cached defaultTtlMillis: ${CAMUNDA_OPTIMIZE_CACHES_CLOUD_TENANT_AUTHORIZATIONS_MIN_FETCH_INTERVAL_SECONDS:300000} users: # This cache is used to hold users in a CCSM environment maxSize: ${CAMUNDA_OPTIMIZE_CACHES_USERS_MAX_SIZE:10000} defaultTtlMillis: ${CAMUNDA_OPTIMIZE_CACHES_USERS_DEFAULT_TTL_MILLIS:600000} # This cache tracks process definitions that have a pending or completed delete job, so Zeebe # import can suppress writes for them without a database round trip per import batch. maxSize # caps the newest-first job registry fetch used to populate the cache; job registry entries are # never cleaned up, so if the number of deleted process definitions ever exceeds maxSize, the # oldest ones silently drop out of suppression and their data can be reimported. deletedProcessDefinitions: maxSize: ${CAMUNDA_OPTIMIZE_DELETED_PROCESS_DEFINITION_CACHE_MAX_SIZE:10000} defaultTtlMillis: ${CAMUNDA_OPTIMIZE_DELETED_PROCESS_DEFINITION_CACHE_DEFAULT_TTL_MILLIS:300000} externalVariable: import: # Controls whether external ingested variable data is processed and imported into process instance data enabled: false # Determines the page size for the external variable import, that got ingested via the external variable API maxPageSize: 10000 multitenancy: # Currently only available in C8SM. Determines whether multi tenancy is enabled in Optimize. enabled: ${CAMUNDA_OPTIMIZE_MULTITENANCY_ENABLED:false}