tasks/config/docker.yaml

# enable-template

log:
    stdout: true
    level: {{ default "info" (env "LOG_LEVEL") }}

persistence:
    numHistoryShards: {{ default "4" (env "NUM_HISTORY_SHARDS") }}

    defaultStore: default
    visibilityStore: visibility

    {{- $db := env "DB" -}}
    {{- if not (eq $db "cassandra" "mysql8" "postgres12" "postgres12_pgx") -}}
      {{- fail "Invalid DB value. Supported values are cassandra, mysql8, postgres12, postgres12_pgx" -}}
    {{- end }}

    datastores:
        default:
        {{- if eq $db "cassandra" }}
            cassandra:
                hosts: {{ env "CASSANDRA_SEEDS" }}
                keyspace: {{ default "temporal" (env "KEYSPACE") | quote }}
                user: {{ env "CASSANDRA_USER" | quote }}
                password: {{ env "CASSANDRA_PASSWORD" | quote }}
                {{- if env "CASSANDRA_ALLOWED_AUTHENTICATORS" }}
                allowedAuthenticators: {{ range splitList "," (env "CASSANDRA_ALLOWED_AUTHENTICATORS") }}
                    - {{ trim . }}
                  {{- end }}
                {{- end }}
                port: {{ default "9042" (env "CASSANDRA_PORT") }}
                maxConns: {{ default "20" (env "CASSANDRA_MAX_CONNS") }}
                tls:
                    enabled: {{ default "false" (env "CASSANDRA_TLS_ENABLED") }}
                    caFile: {{ env "CASSANDRA_CA" }}
                    certFile: {{ env "CASSANDRA_CERT" }}
                    keyFile: {{ env "CASSANDRA_CERT_KEY" }}
                    caData: {{ env "CASSANDRA_CA_DATA" }}
                    certData: {{ env "CASSANDRA_CERT_DATA" }}
                    keyData: {{ env "CASSANDRA_CERT_KEY_DATA" }}
                    enableHostVerification: {{ default "false" (env "CASSANDRA_HOST_VERIFICATION") }}
                    serverName: {{ env "CASSANDRA_HOST_NAME" }}
                {{- if env "CASSANDRA_ADDRESS_TRANSLATOR" }}
                addressTranslator:
                    translator: {{ env "CASSANDRA_ADDRESS_TRANSLATOR" }}
                    {{- if env "CASSANDRA_ADDRESS_TRANSLATOR_OPTIONS" }}
                    options:
                        advertised-hostname: {{ env "CASSANDRA_ADDRESS_TRANSLATOR_OPTIONS" }}
                    {{- end }}
                {{- end }}
        {{- else if eq $db "mysql8" }}
            sql:
                pluginName: {{ $db }}
                databaseName: {{ default "temporal" (env "DBNAME") | quote }}
                connectAddr: {{ env "MYSQL_SEEDS" }}:{{ default "3306" (env "DB_PORT") }}
                connectProtocol: "tcp"
                user: {{ env "MYSQL_USER" | quote }}
                password: {{ env "MYSQL_PWD" | quote }}
                {{- if env "MYSQL_TX_ISOLATION_COMPAT" }}
                connectAttributes:
                    tx_isolation: "'READ-COMMITTED'"
                {{- end }}
                maxConns: {{ default "20" (env "SQL_MAX_CONNS") }}
                maxIdleConns: {{ default "20" (env "SQL_MAX_IDLE_CONNS") }}
                maxConnLifetime: {{ default "1h" (env "SQL_MAX_CONN_TIME") }}
                tls:
                    enabled: {{ default "false" (env "SQL_TLS_ENABLED") }}
                    caFile: {{ env "SQL_CA" }}
                    certFile: {{ env "SQL_CERT" }}
                    keyFile: {{ env "SQL_CERT_KEY" }}
                    enableHostVerification: {{ default "false" (env "SQL_HOST_VERIFICATION") }}
                    serverName: {{ env "SQL_HOST_NAME" }}
        {{- else if eq $db "postgres12" "postgres12_pgx" }}
            sql:
                pluginName: {{ $db }}
                databaseName: {{ default "temporal" (env "DBNAME") | quote }}
                connectAddr: {{ env "POSTGRES_SEEDS" }}:{{ default "5432" (env "DB_PORT") }}
                connectProtocol: "tcp"
                user: {{ env "POSTGRES_USER" | quote }}
                password: {{ env "POSTGRES_PWD" | quote }}
                maxConns: {{ default "20" (env "SQL_MAX_CONNS") }}
                maxIdleConns: {{ default "20" (env "SQL_MAX_IDLE_CONNS") }}
                maxConnLifetime: {{ default "1h" (env "SQL_MAX_CONN_TIME") }}
                tls:
                    enabled: {{ default "false" (env "SQL_TLS_ENABLED") }}
                    caFile: {{ env "SQL_CA" }}
                    certFile: {{ env "SQL_CERT" }}
                    keyFile: {{ env "SQL_CERT_KEY" }}
                    enableHostVerification: {{ default "false" (env "SQL_HOST_VERIFICATION") }}
                    serverName: {{ env "SQL_HOST_NAME" }}
        {{- end }}

        visibility:
            {{- if eq (env "ENABLE_ES") "true" }}
            elasticsearch:
                version: {{ env "ES_VERSION" }}
                url:
                    scheme: {{ default "http" (env "ES_SCHEME") }}
                    host: {{ env "ES_SEEDS" }}:{{ default "9200" (env "ES_PORT") }}
                username: {{ env "ES_USER" | quote }}
                password: {{ env "ES_PWD" | quote }}
                indices:
                    visibility: {{ default "temporal_visibility_v1_dev" (env "ES_VIS_INDEX") | quote }}
                    {{- with env "ES_SEC_VIS_INDEX" }}
                    secondary_visibility: {{ . | quote }}
                    {{- end }}
            {{- else if eq $db "mysql8" }}
            sql:
                {{ $visibility_seeds := coalesce (env "VISIBILITY_MYSQL_SEEDS") (env "MYSQL_SEEDS") }}
                {{ $visibility_port := coalesce (env "VISIBILITY_DB_PORT") (env "DB_PORT") "3306" }}
                {{ $visibility_user := coalesce (env "VISIBILITY_MYSQL_USER") (env "MYSQL_USER") }}
                {{ $visibility_pwd := coalesce (env "VISIBILITY_MYSQL_PWD") (env "MYSQL_PWD") }}
                pluginName: {{ $db }}
                databaseName: {{ default "temporal_visibility" (env "VISIBILITY_DBNAME") | quote }}
                connectAddr: {{ $visibility_seeds }}:{{ $visibility_port }}
                connectProtocol: "tcp"
                user: {{ $visibility_user | quote }}
                password: {{ $visibility_pwd | quote }}
                {{- if env "MYSQL_TX_ISOLATION_COMPAT" }}
                connectAttributes:
                    tx_isolation: "'READ-COMMITTED'"
                {{- end }}
                maxConns: {{ default "10" (env "SQL_VIS_MAX_CONNS") }}
                maxIdleConns: {{ default "10" (env "SQL_VIS_MAX_IDLE_CONNS")  }}
                maxConnLifetime: {{ default "1h" (env "SQL_VIS_MAX_CONN_TIME") }}
                tls:
                    enabled: {{ default "false" (env "SQL_TLS_ENABLED") }}
                    caFile: {{ env "SQL_CA" }}
                    certFile: {{ env "SQL_CERT" }}
                    keyFile: {{ env "SQL_CERT_KEY" }}
                    enableHostVerification: {{ default "false" (env "SQL_HOST_VERIFICATION") }}
                    serverName: {{ env "SQL_HOST_NAME" }}
            {{- else if eq $db "postgres12" "postgres12_pgx" }}
            sql:
                {{ $visibility_seeds := coalesce (env "VISIBILITY_POSTGRES_SEEDS") (env "POSTGRES_SEEDS") }}
                {{ $visibility_port := coalesce (env "VISIBILITY_DB_PORT") (env "POSTGRES_PORT") "5432" }}
                {{ $visibility_user := coalesce (env "VISIBILITY_POSTGRES_USER") (env "POSTGRES_USER") }}
                {{ $visibility_pwd := coalesce (env "VISIBILITY_POSTGRES_PWD") (env "POSTGRES_PWD") }}
                pluginName: {{ $db }}
                databaseName: {{ default "temporal_visibility" (env "VISIBILITY_DBNAME") | quote }}
                connectAddr: {{ $visibility_seeds }}:{{ $visibility_port }}
                connectProtocol: "tcp"
                user: {{ $visibility_user | quote }}
                password: {{ $visibility_pwd | quote }}
                maxConns: {{ default "10" (env "SQL_VIS_MAX_CONNS") }}
                maxIdleConns: {{ default "10" (env "SQL_VIS_MAX_IDLE_CONNS") }}
                maxConnLifetime: {{ default "1h" (env "SQL_VIS_MAX_CONN_TIME") }}
                tls:
                    enabled: {{ default "false" (env "SQL_TLS_ENABLED") }}
                    caFile: {{ env "SQL_CA" }}
                    certFile: {{ env "SQL_CERT" }}
                    keyFile: {{ env "SQL_CERT_KEY" }}
                    enableHostVerification: {{ default "false" (env "SQL_HOST_VERIFICATION") }}
                    serverName: {{ env "SQL_HOST_NAME" }}
            {{- else -}}
              {{- fail "No visibility configured. Cassandra is no longer supported for visibility." -}}
            {{- end }}

global:
    membership:
        maxJoinDuration: 30s
        broadcastAddress: "{{ env "TEMPORAL_BROADCAST_ADDRESS" }}"
    pprof:
        port: {{ default "0" (env "PPROF_PORT") }}
    tls:
        refreshInterval: {{ default "0s" (env "TEMPORAL_TLS_REFRESH_INTERVAL") }}
        expirationChecks:
            warningWindow: {{ default "0s" (env "TEMPORAL_TLS_EXPIRATION_CHECKS_WARNING_WINDOW") }}
            errorWindow: {{ default "0s" (env "TEMPORAL_TLS_EXPIRATION_CHECKS_ERROR_WINDOW") }}
            checkInterval: {{ default "0s" (env "TEMPORAL_TLS_EXPIRATION_CHECKS_CHECK_INTERVAL") }}
        internode:
            # This server section configures the TLS certificate that internal temporal
            # cluster nodes (history, matching, and internal-frontend) present to other
            # clients within the Temporal Cluster.
            server:
                requireClientAuth: {{ default "false" (env "TEMPORAL_TLS_REQUIRE_CLIENT_AUTH") }}

                certFile: {{ env "TEMPORAL_TLS_SERVER_CERT" }}
                keyFile: {{ env "TEMPORAL_TLS_SERVER_KEY" }}
                {{- with env "TEMPORAL_TLS_SERVER_CA_CERT" }}
                clientCaFiles:
                    - {{ . }}
                {{- end }}

                certData: {{ env "TEMPORAL_TLS_SERVER_CERT_DATA" }}
                keyData: {{ env "TEMPORAL_TLS_SERVER_KEY_DATA" }}
                {{- with env "TEMPORAL_TLS_SERVER_CA_CERT_DATA" }}
                clientCaData:
                    - {{ . }}
                {{- end }}

            # This client section is used to configure the TLS clients within
            # the Temporal Cluster that connect to an Internode (history, matching, or
            # internal-frontend)
            client:
                serverName: {{ env "TEMPORAL_TLS_INTERNODE_SERVER_NAME" }}
                disableHostVerification: {{ default "false" (env "TEMPORAL_TLS_INTERNODE_DISABLE_HOST_VERIFICATION") }}
                {{- with env "TEMPORAL_TLS_SERVER_CA_CERT" }}
                rootCaFiles:
                    - {{ . }}
                {{- end }}
                {{- with env "TEMPORAL_TLS_SERVER_CA_CERT_DATA" }}
                rootCaData:
                    - {{ . }}
                {{- end }}
        frontend:
            # This server section configures the TLS certificate that the Frontend
            # server presents to external clients.
            server:
                requireClientAuth: {{ default "false" (env "TEMPORAL_TLS_REQUIRE_CLIENT_AUTH") }}
                certFile: {{ env "TEMPORAL_TLS_FRONTEND_CERT" }}
                keyFile: {{ env "TEMPORAL_TLS_FRONTEND_KEY" }}
                {{- if env "TEMPORAL_TLS_CLIENT1_CA_CERT" }}
                clientCaFiles:
                    - {{ env "TEMPORAL_TLS_CLIENT1_CA_CERT" }}
                    - {{ env "TEMPORAL_TLS_CLIENT2_CA_CERT" }}
                {{- end }}

                certData: {{ env "TEMPORAL_TLS_FRONTEND_CERT_DATA" }}
                keyData: {{ env "TEMPORAL_TLS_FRONTEND_KEY_DATA" }}
                {{- if env "TEMPORAL_TLS_CLIENT1_CA_CERT_DATA" }}
                clientCaData:
                    - {{ env "TEMPORAL_TLS_CLIENT1_CA_CERT_DATA" }}
                    - {{ env "TEMPORAL_TLS_CLIENT2_CA_CERT_DATA" }}
                {{- end }}

            # This client section is used to configure the TLS clients within
            # the Temporal Cluster (specifically the Worker role) that connect to the Frontend service
            client:
                serverName: {{ env "TEMPORAL_TLS_FRONTEND_SERVER_NAME" }}
                disableHostVerification: {{ default "false" (env "TEMPORAL_TLS_FRONTEND_DISABLE_HOST_VERIFICATION") }}
                {{- with env "TEMPORAL_TLS_SERVER_CA_CERT" }}
                rootCaFiles:
                    - {{ . }}
                {{- end }}
                {{- with env "TEMPORAL_TLS_SERVER_CA_CERT_DATA" }}
                rootCaData:
                    - {{ . }}
                {{- end }}
    {{- with env "STATSD_ENDPOINT" }}
    metrics:
        statsd:
            hostPort: {{ . }}
            prefix: "temporal"
    {{- end }}
    {{- with env "PROMETHEUS_ENDPOINT" }}
    metrics:
        prometheus:
            timerType: {{ default "histogram" (env "PROMETHEUS_TIMER_TYPE") }}
            listenAddress: {{ . }}
    {{- end }}
    authorization:
        jwtKeyProvider:
            keySourceURIs:
                {{- with env "TEMPORAL_JWT_KEY_SOURCE1" }}
                - {{ . }}
                {{- end }}
                {{- with env "TEMPORAL_JWT_KEY_SOURCE2" }}
                - {{ . }}
                {{- end }}
            refreshInterval: {{ default "1m" (env "TEMPORAL_JWT_KEY_REFRESH") }}
        permissionsClaimName: {{ default "permissions" (env "TEMPORAL_JWT_PERMISSIONS_CLAIM") }}
        permissionsRegex: {{ default "" (env "TEMPORAL_JWT_PERMISSIONS_REGEX") }}
        authorizer: {{ env "TEMPORAL_AUTH_AUTHORIZER" }}
        claimMapper: {{ env "TEMPORAL_AUTH_CLAIM_MAPPER" }}

{{- $temporalGrpcPort := default "7233" (env "FRONTEND_GRPC_PORT") }}
{{- $temporalHTTPPort := default "7243" (env "FRONTEND_HTTP_PORT") }}
{{- $temporalInternalHTTPPort := default "7246" (env "INTERNAL_FRONTEND_HTTP_PORT") }}
services:
    frontend:
        rpc:
            grpcPort: {{ $temporalGrpcPort }}
            membershipPort: {{ default "6933" (env "FRONTEND_MEMBERSHIP_PORT") }}
            bindOnIP: {{ default "127.0.0.1" (env "BIND_ON_IP") }}
            httpPort: {{ $temporalHTTPPort }}

    {{- if env "USE_INTERNAL_FRONTEND" }}
    internal-frontend:
        rpc:
            grpcPort: {{ default "7236" (env "INTERNAL_FRONTEND_GRPC_PORT") }}
            membershipPort: {{ default "6936" (env "INTERNAL_FRONTEND_MEMBERSHIP_PORT") }}
            bindOnIP: {{ default "127.0.0.1" (env "BIND_ON_IP") }}
            httpPort: {{ $temporalInternalHTTPPort }}
    {{- end }}

    matching:
        rpc:
            grpcPort: {{ default "7235" (env "MATCHING_GRPC_PORT") }}
            membershipPort: {{ default "6935" (env "MATCHING_MEMBERSHIP_PORT") }}
            bindOnIP: {{ default "127.0.0.1" (env "BIND_ON_IP") }}

    history:
        rpc:
            grpcPort: {{ default "7234" (env "HISTORY_GRPC_PORT") }}
            membershipPort: {{ default "6934" (env "HISTORY_MEMBERSHIP_PORT") }}
            bindOnIP: {{ default "127.0.0.1" (env "BIND_ON_IP") }}

    worker:
        rpc:
            grpcPort: {{ default "7239" (env "WORKER_GRPC_PORT") }}
            membershipPort: {{ default "6939" (env "WORKER_MEMBERSHIP_PORT") }}
            bindOnIP: {{ default "127.0.0.1" (env "BIND_ON_IP") }}

clusterMetadata:
    enableGlobalNamespace: false
    failoverVersionIncrement: 10
    masterClusterName: "active"
    currentClusterName: "active"
    clusterInformation:
        active:
            enabled: true
            initialFailoverVersion: 1
            rpcName: "frontend"
            rpcAddress: "127.0.0.1:{{ $temporalGrpcPort }}"
            httpAddress: "127.0.0.1:{{ $temporalHTTPPort }}"

dcRedirectionPolicy:
    policy: "noop"

archival:
  history:
    state: "enabled"
    enableRead: true
    provider:
      filestore:
        fileMode: "0666"
        dirMode: "0766"
  visibility:
    state: "enabled"
    enableRead: true
    provider:
      filestore:
        fileMode: "0666"
        dirMode: "0766"

namespaceDefaults:
  archival:
    history:
      state: "disabled"
      URI: "file:///tmp/temporal_archival/development"
    visibility:
      state: "disabled"
      URI: "file:///tmp/temporal_vis_archival/development"

{{- if or (env "USE_INTERNAL_FRONTEND") (and (not (env "TEMPORAL_AUTH_AUTHORIZER")) (not (env "TEMPORAL_AUTH_CLAIM_MAPPER"))) }}
{{/* publicClient is not needed with internal frontend, or if not using authorizer + claim mapper */}}
{{- else }}
{{ $publicIp := default "127.0.0.1" (env "BIND_ON_IP") -}}
{{- $defaultPublicHostPost := print $publicIp ":" $temporalGrpcPort -}}
publicClient:
    hostPort: "{{ default $defaultPublicHostPost (env "PUBLIC_FRONTEND_ADDRESS") }}"
{{- end }}

dynamicConfigClient:
    filepath: "{{ default "/etc/temporal/config/dynamicconfig/docker.yaml" (env "DYNAMIC_CONFIG_FILE_PATH") }}"
    pollInterval: "60s"