Morio Settings
Settings Overview
cluster
Required Typeobject Settings that governs Morio cluster formation.
Show Example
cluster:
common:
name: 'Morio production cluster'
fqdn: 'morio.tokyo.morio.it'
broker:
nodes:
- 'broker1.tokyo.morio.it'
- 'broker2.tokyo.morio.it'
- 'broker3.tokyo.morio.it'
fqdn: 'brokers.tokyo.morio.it'
flanking:
nodes:
- 'flanking1.tokyo.morio.it'
- 'flanking2.tokyo.morio.it'
cluster.common
Optional Typeobject Settings that apply to all cluster nodes.
Show Example
cluster:
common:
name: 'Morio production cluster'
fqdn: 'morio.tokyo.morio.it'
cluster.common.name
Optional Typestring Lengthminimum2 Lengthmaximum255 Contentregex/^[A-Za-z0-9\s-_,.;:()]+$/ defaultMorio DeploymentA name for the Morio deployment. Will be used in the generated X.509 certificates.
Show Example
cluster:
common:
name: 'Morio production cluster'
cluster.broker
Required Typeobject Settings that apply to broker nodes.
Show Example
cluster:
broker:
nodes:
- 'broker1.tokyo.morio.it'
- 'broker2.tokyo.morio.it'
- 'broker3.tokyo.morio.it'
fqdn: 'brokers.tokyo.morio.it'
cluster.broker.nodes
Required Typearray Lengthminimum1 Lengthmaximum9 The list of broker nodes. This must hold an odd amount of entries to avoid split-brain scenarios. Also note that you cannot (currently) scale the amount of broker nodes after deployment, so choose carefully.
Show Example
cluster:
broker:
nodes:
- 'broker1.tokyo.morio.it'
- 'broker2.tokyo.morio.it'
- 'broker3.tokyo.morio.it'
cluster.broker.fqdn
Typestring Contentishostname The domain name for broker nodes of the cluster. When set, it must point to a round-robin DNS record that includes all broker nodes. This is only mandatory when there are multiple brokers.
Show Example
cluster:
broker:
fqdn: 'brokers.tokyo.morio.it'
cluster.flanking
Optional Typeobject Settings that apply to flanking nodes.
Show Example
cluster:
flanking:
nodes:
- 'flanking1.tokyo.morio.it'
- 'flanking2.tokyo.morio.it'
cluster.flanking.nodes
Optional Typearray Lengthminimum1 Lengthmaximum36 The list of flanking nodes. Unlike broker nodes, there is no requirement to have an odd amount of entries.
Show Example
cluster:
flanking:
nodes:
- 'flanking1.tokyo.morio.it'
- 'flanking2.tokyo.morio.it'
external
Optional Typeobject Holds settings about data sources and integrations external to Morio.
Show Example
external:
seed:
git:
git-id:
url: 'https://codeberg.org/certeu/moriohub.git'
modules:
- glob: 'git:modules/**@git-id'
processors:
- glob: 'git:modules/**@git-id'
charts:
- glob: 'git:modules/**@git-id'
sigma:
fields:
- glob: 'git:modules/**@git-id'
rules:
- glob: 'git:modules/**@git-id'
subs:
- glob: 'git:modules/**@git-id'
vault:
url: 'https://vault.tokyo.morio.it'
jwt_auth_path: 'morio'
kv_path: 'kv'
role: 'morio'
verify_certificate: true
external.seed
Optional Typeobject Controls seeding of external content inside Morio.
Show Example
external:
seed:
git:
git-id:
url: 'https://codeberg.org/certeu/moriohub.git'
modules:
- glob: 'git:modules/**@git-id'
processors:
- glob: 'git:modules/**@git-id'
charts:
- glob: 'git:modules/**@git-id'
sigma:
fields:
- glob: 'git:modules/**@git-id'
rules:
- glob: 'git:modules/**@git-id'
subs:
- glob: 'git:modules/**@git-id'
external.seed.charts
Typearray - [entry].glob: Required Typestring
A list of seed globs from which to load visualisation logic for Morio's UI service.
Show Example
external:
seed:
charts:
- glob: 'git:modules/**@git-id'
external.seed.git
Required Typeobject A git repository to seed content from.
Show Example
external:
seed:
git:
git-id:
url: 'https://codeberg.org/certeu/moriohub.git'
external.seed.git.git-id
Typeobject This marks the start of a settings pattern which allows multiple blocks of these settings to repeat under a different key.
In our documentation, we use
git-id as a placeholder key to illustrate this settings pattern.A git repository to seed content from.
Show Example
external:
seed:
git:
git-id:
url: 'https://codeberg.org/certeu/moriohub.git'
external.seed.git.git-id.url
Required Typestring ContentisURI The URL to use. Note that we do not support cloning over SSH.
Show Example
external:
seed:
git:
git-id:
url: 'https://codeberg.org/certeu/moriohub.git'
external.seed.git.git-id.ref
Optional Typestring The git branch/tag/ref to use. When this is not set, it will default to the value of MORIO_VERSION_TAG.
external.seed.modules
Typearray - [entry].glob: Required Typestring
A list of seed globs from which to load Morio client modules.
Show Example
external:
seed:
modules:
- glob: 'git:modules/**@git-id'
external.seed.processors
Typearray - [entry].glob: Required Typestring
A list of seed globs from which to load stream processing logic for Morio's Tap service.
Show Example
external:
seed:
processors:
- glob: 'git:modules/**@git-id'
external.seed.sigma
Optional Typeobject Controls seeding of Sigma rules, fields, and subs to transform them into stream processing detection logic.
Show Example
external:
seed:
sigma:
fields:
- glob: 'git:modules/**@git-id'
rules:
- glob: 'git:modules/**@git-id'
subs:
- glob: 'git:modules/**@git-id'
external.seed.sigma.fields
Required Typearray - [entry].glob: Required Typestring
Field mappings for Sigma rules inside Morio
Show Example
external:
seed:
sigma:
fields:
- glob: 'git:modules/**@git-id'
external.vault
Optional Typeobject Hold configuration for integrating Morio with Hashicorp Vault (or OpenBao).
Show Example
external:
vault:
url: 'https://vault.tokyo.morio.it'
jwt_auth_path: 'morio'
kv_path: 'kv'
role: 'morio'
verify_certificate: true
external.vault.url
Required Typestring ContentisURI The URL of your Vault instance.
Show Example
external:
vault:
url: 'https://vault.tokyo.morio.it'
external.vault.verify_certificate
Typeboolean Whether or not to verify the Vault TLS certificate.
Show Example
external:
vault:
verify_certificate: true
external.vault.role
Typestring defaultmorioThe role to assume for authentication to Vault.
Show Example
external:
vault:
role: 'morio'
external.vault.jwt_auth_path
Typestring defaultmorioThe path under which the JWT authentication method is anchored in Vault.
Show Example
external:
vault:
jwt_auth_path: 'morio'
iam
Optional Typeobject Holds the Identity and Access Management (IAM) settings
Show Example
iam:
policy:
rule-id:
when:
label: 'oidc/freesewing/group/users'
method: 'GET'
provider: 'freesewing'
user:
is_not: 'skully'
role:
or:
- 'user'
- 'manager'
url:
or:
- startsWith: '/-/api/cache/glob/check%7C'
- startsWith: '/-/api/inventory/hostnames/*'
- startsWith: '/-/api/cache/keys/check%7C'
then: 'allow'
providers:
apikey: {}
ldap-provider-id:
provider: 'ldap'
about: 'On-prem Active Directory'
server:
url: 'ldaps://dc1.tokyo.morio.it'
bindDN: 'CN=morio-test,OU=Functional,OU=MORIO,DC=tokyo,DC=morio,DC=it'
bindCredentials: '{|{ AD_PASSWORD }|}'
searchBase: 'OU=MORIO,DC=tokyo,DC=morio,DC=it'
searchFilter: '(&(objectClass=user)(samaccountname={{username}}))'
username_field: 'samaccountname'
label: 'Active Directory'
rbac:
user:
attribute: 'samaccountname'
regex: '.'
engineer:
attribute: 'samaccountname'
list:
- 'aaswartz'
- 'iamurdock'
- 'deritchie'
verify_certificate: true
trust_certificate: '-----BEGIN CERTIFICATE----- ...'
local: {}
oidc-provider-id:
provider: 'oidc'
label: 'FreeSewing Account'
about: 'Sign in with any FreeSewing account'
issuer: 'https:// backend.freesewing.eu'
client_secret: '{|{ MORIO_SSO_CLIENT_SECRET }|}'
client_id: 'morio'
username_field: 'preferred_username'
rbac:
user:
attribute: 'preferred_username'
regex: '.'
engineer:
attribute: 'preferred_username'
list:
- 'joost'
autodiscovery_url: 'https://backend.freesewing.eu/.well-known/openid-configuration'
token_endpoint_auth_method: 'client_secret_basic'
label_attributes:
email: 'email'
name: 'name'
role: 'role'
username: 'preferred_username'
uuid: 'sub'
iam.policy
Optional Typeobject Holds the various rules that make up the attribute-based access control (ABAC) policy. Refer to the Morio Access Policy Guide for details.
Show Example
iam:
policy:
rule-id:
when:
label: 'oidc/freesewing/group/users'
method: 'GET'
provider: 'freesewing'
user:
is_not: 'skully'
role:
or:
- 'user'
- 'manager'
url:
or:
- startsWith: '/-/api/cache/glob/check%7C'
- startsWith: '/-/api/inventory/hostnames/*'
- startsWith: '/-/api/cache/keys/check%7C'
then: 'allow'
iam.policy.rule-id
Typeobject This marks the start of a settings pattern which allows multiple blocks of these settings to repeat under a different key.
In our documentation, we use
rule-id as a placeholder key to illustrate this settings pattern.Holds the various rules that make up the attribute-based access control (ABAC) policy. Refer to the Morio Access Policy Guide for details.
Show Example
iam:
policy:
rule-id:
when:
label: 'oidc/freesewing/group/users'
method: 'GET'
provider: 'freesewing'
user:
is_not: 'skully'
role:
or:
- 'user'
- 'manager'
url:
or:
- startsWith: '/-/api/cache/glob/check%7C'
- startsWith: '/-/api/inventory/hostnames/*'
- startsWith: '/-/api/cache/keys/check%7C'
then: 'allow'
iam.policy.rule-id.when
Required Typeobject Lengthminimum1 The matching logic of the access policy rule. Refer to the Morio Access Policy Guide for details.
Show Example
iam:
policy:
rule-id:
when:
label: 'oidc/freesewing/group/users'
method: 'GET'
provider: 'freesewing'
user:
is_not: 'skully'
role:
or:
- 'user'
- 'manager'
url:
or:
- startsWith: '/-/api/cache/glob/check%7C'
- startsWith: '/-/api/inventory/hostnames/*'
- startsWith: '/-/api/cache/keys/check%7C'
iam.policy.rule-id.when.label
Typealternatives Allows matching against labels on the user account. Refer to the Morio Access Policy Guide for details.
Show Example
iam:
policy:
rule-id:
when:
label: 'oidc/freesewing/group/users'
iam.policy.rule-id.when.method
Typealternatives Contentone ofHEAD|GET|POST|PUT|DELETE|CONNECT|TRACE|OPTIONS Allows matching against the HTTP method (use UPPERCASE). Refer to the Morio Access Policy Guide for details.
Show Example
iam:
policy:
rule-id:
when:
method: 'GET'
iam.policy.rule-id.when.role
Typealternatives Contentone ofuser|manager|operator|engineer Allows matching against the RBAC role assigned to the account. Refer to the Morio Access Policy Guide for details.
Show Example
iam:
policy:
rule-id:
when:
role:
or:
- 'user'
- 'manager'
iam.policy.rule-id.when.provider
Typealternatives Allows matching against the ID of the identity provider used to authenticate. Refer to the Morio Access Policy Guide for details.
Show Example
iam:
policy:
rule-id:
when:
provider: 'freesewing'
iam.policy.rule-id.when.url
Typealternatives Allows matching against the request URL. Refer to the Morio Access Policy Guide for details.
Show Example
iam:
policy:
rule-id:
when:
url:
or:
- startsWith: '/-/api/cache/glob/check%7C'
- startsWith: '/-/api/inventory/hostnames/*'
- startsWith: '/-/api/cache/keys/check%7C'
iam.policy.rule-id.then
Required Typestring Contentone ofallow|deny Whether to allow or deny requests that match this rule. Refer to the Morio Access Policy Guide for details.
Show Example
iam:
policy:
rule-id:
then: 'allow'
iam.providers
Optional Typeobject Holds identity providers for HTTP-based authentication inside Morio. Refer to the Morio Identity Providers Guide.
Show Example
iam:
providers:
apikey: {}
ldap-provider-id:
provider: 'ldap'
about: 'On-prem Active Directory'
server:
url: 'ldaps://dc1.tokyo.morio.it'
bindDN: 'CN=morio-test,OU=Functional,OU=MORIO,DC=tokyo,DC=morio,DC=it'
bindCredentials: '{|{ AD_PASSWORD }|}'
searchBase: 'OU=MORIO,DC=tokyo,DC=morio,DC=it'
searchFilter: '(&(objectClass=user)(samaccountname={{username}}))'
username_field: 'samaccountname'
label: 'Active Directory'
rbac:
user:
attribute: 'samaccountname'
regex: '.'
engineer:
attribute: 'samaccountname'
list:
- 'aaswartz'
- 'iamurdock'
- 'deritchie'
verify_certificate: true
trust_certificate: '-----BEGIN CERTIFICATE----- ...'
local: {}
oidc-provider-id:
provider: 'oidc'
label: 'FreeSewing Account'
about: 'Sign in with any FreeSewing account'
issuer: 'https:// backend.freesewing.eu'
client_secret: '{|{ MORIO_SSO_CLIENT_SECRET }|}'
client_id: 'morio'
username_field: 'preferred_username'
rbac:
user:
attribute: 'preferred_username'
regex: '.'
engineer:
attribute: 'preferred_username'
list:
- 'joost'
autodiscovery_url: 'https://backend.freesewing.eu/.well-known/openid-configuration'
token_endpoint_auth_method: 'client_secret_basic'
label_attributes:
email: 'email'
name: 'name'
role: 'role'
username: 'preferred_username'
uuid: 'sub'
iam.providers.apikey
Optional Typeobject Show Example
iam:
providers:
apikey: {}
iam.providers.apikey.provider
Optional Typestring Contentequalsapikey defaultapikey
Holds the provider type, which for this provider must always be apikey
iam.providers.apikey.label
Optional Typestring defaultAPI KeyThe label to use for this identity provider in the Morio UI.
iam.providers.apikey.about
Optional Typestring defaultThis allows you to test your Morio API KeyA (brief) description that will be included in the inline help on the Morio login page. When you have multiple identity providers, this can help you clarify the purpose and use-case of each of them to your users.
iam.providers.local
Optional Typeobject Show Example
iam:
providers:
local: {}
iam.providers.local.provider
Optional Typestring Contentequalslocal defaultlocal
Holds the provider type, which for this provider must always be local
iam.providers.local.label
Optional Typestring defaultLocal Morio AccountThe label to use for this identity provider in the Morio UI.
iam.providers.local.about
Optional Typestring defaultAccounts local to this Morio clusterA (brief) description that will be included in the inline help on the Morio login page. When you have multiple identity providers, this can help you clarify the purpose and use-case of each of them to your users.
iam.providers.ldap-provider-id
Typeobject This marks the start of a settings pattern which allows multiple blocks of these settings to repeat under a different key.
In our documentation, we use
ldap-provider-id as a placeholder key to illustrate this settings pattern.
Settings for an LDAP identity provider.
You can configure multiple LDAP identity providers creating different keys
under iam.providers that implement this settings structure.
Show Example
iam:
providers:
ldap-provider-id:
provider: 'ldap'
about: 'On-prem Active Directory'
server:
url: 'ldaps://dc1.tokyo.morio.it'
bindDN: 'CN=morio-test,OU=Functional,OU=MORIO,DC=tokyo,DC=morio,DC=it'
bindCredentials: '{|{ AD_PASSWORD }|}'
searchBase: 'OU=MORIO,DC=tokyo,DC=morio,DC=it'
searchFilter: '(&(objectClass=user)(samaccountname={{username}}))'
username_field: 'samaccountname'
label: 'Active Directory'
rbac:
user:
attribute: 'samaccountname'
regex: '.'
engineer:
attribute: 'samaccountname'
list:
- 'aaswartz'
- 'iamurdock'
- 'deritchie'
verify_certificate: true
trust_certificate: '-----BEGIN CERTIFICATE----- ...'
iam.providers.ldap-provider-id.provider
Required Typestring Contentequalsldap
Holds the provider type, which for this provider must always be ldap
Show Example
iam:
providers:
ldap-provider-id:
provider: 'ldap'
iam.providers.ldap-provider-id.label
Required Typestring The label to use for this identity provider in the Morio UI.
Show Example
iam:
providers:
ldap-provider-id:
label: 'Active Directory'
iam.providers.ldap-provider-id.about
Optional Typestring A (brief) description that will be included in the inline help on the Morio login page. When you have multiple identity providers, this can help you clarify the purpose and use-case of each of them to your users.
Show Example
iam:
providers:
ldap-provider-id:
about: 'On-prem Active Directory'
iam.providers.ldap-provider-id.username_field
Required Typestring The LDAP field to use for the username within Morio.
Show Example
iam:
providers:
ldap-provider-id:
username_field: 'samaccountname'
iam.providers.ldap-provider-id.trust_certificate
Optional Typestring Contentregex/.*BEGIN CERTIFICATE.*/ A PEM-encoded certificate to trust for TLS connections.
Show Example
iam:
providers:
ldap-provider-id:
trust_certificate: '-----BEGIN CERTIFICATE----- ...'
iam.providers.ldap-provider-id.verify_certificate
Typeboolean defaultWhether to verify the certificate when establishing the TLS connection or not.
Show Example
iam:
providers:
ldap-provider-id:
verify_certificate: true
iam.providers.ldap-provider-id.server
Typeobject Settings to configure the LDAP server.
Show Example
iam:
providers:
ldap-provider-id:
server:
url: 'ldaps://dc1.tokyo.morio.it'
bindDN: 'CN=morio-test,OU=Functional,OU=MORIO,DC=tokyo,DC=morio,DC=it'
bindCredentials: '{|{ AD_PASSWORD }|}'
searchBase: 'OU=MORIO,DC=tokyo,DC=morio,DC=it'
searchFilter: '(&(objectClass=user)(samaccountname={{username}}))'
iam.providers.ldap-provider-id.server.url
Required Typestring ContentisURI The URI to connect to the LDAP server
Show Example
iam:
providers:
ldap-provider-id:
server:
url: 'ldaps://dc1.tokyo.morio.it'
iam.providers.ldap-provider-id.server.bindDN
Optional Typestring
The distinguished name (DN) with which to bind to the LDAP server.
Many LDAP servers do not allow anonymous searches. In such a case
we need an account to bind to the server so we can find the user.
Only then can we attempt to authenticate as the user to verify the credentials.
Show Example
iam:
providers:
ldap-provider-id:
server:
bindDN: 'CN=morio-test,OU=Functional,OU=MORIO,DC=tokyo,DC=morio,DC=it'
iam.providers.ldap-provider-id.server.bindCredentials
Optional Typestring The credentials that go with the bind DN.
Show Example
iam:
providers:
ldap-provider-id:
server:
bindCredentials: '{|{ AD_PASSWORD }|}'
iam.providers.ldap-provider-id.server.searchBase
Required Typestring The base under which to search for users who authenticate.
Show Example
iam:
providers:
ldap-provider-id:
server:
searchBase: 'OU=MORIO,DC=tokyo,DC=morio,DC=it'
iam.providers.ldap-provider-id.server.searchFilter
Optional Typestring The search filter. Typically used to filter out user accounts from other LDAP objects.
Show Example
iam:
providers:
ldap-provider-id:
server:
searchFilter: '(&(objectClass=user)(samaccountname={{username}}))'
iam.providers.ldap-provider-id.rbac
Typeobject Controls what Morio roles to assign to users authenticating through this identity provider.
Show Example
iam:
providers:
ldap-provider-id:
rbac:
user:
attribute: 'samaccountname'
regex: '.'
engineer:
attribute: 'samaccountname'
list:
- 'aaswartz'
- 'iamurdock'
- 'deritchie'
iam.providers.ldap-provider-id.rbac.user
Typeobject Propertiesxorlist|regex
Controls which users get assigned this role by matching an attribute from
the identity provider. Note that you can use either list or
regex but not both.
Show Example
iam:
providers:
ldap-provider-id:
rbac:
user:
attribute: 'samaccountname'
regex: '.'
The attribute to use from the identity provider.
Show Example
iam:
providers:
ldap-provider-id:
rbac:
user:
attribute: 'samaccountname'
A hard-coded list of attribute values to match.
iam.providers.ldap-provider-id.rbac.manager
Typeobject Propertiesxorlist|regex
Controls which users get assigned this role by matching an attribute from
the identity provider. Note that you can use either list or
regex but not both.
The attribute to use from the identity provider.
A hard-coded list of attribute values to match.
iam.providers.ldap-provider-id.rbac.operator
Typeobject Propertiesxorlist|regex
Controls which users get assigned this role by matching an attribute from
the identity provider. Note that you can use either list or
regex but not both.
The attribute to use from the identity provider.
A hard-coded list of attribute values to match.
iam.providers.ldap-provider-id.rbac.engineer
Typeobject Propertiesxorlist|regex
Controls which users get assigned this role by matching an attribute from
the identity provider. Note that you can use either list or
regex but not both.
Show Example
iam:
providers:
ldap-provider-id:
rbac:
engineer:
attribute: 'samaccountname'
list:
- 'aaswartz'
- 'iamurdock'
- 'deritchie'
The attribute to use from the identity provider.
Show Example
iam:
providers:
ldap-provider-id:
rbac:
engineer:
attribute: 'samaccountname'
A hard-coded list of attribute values to match.
Show Example
iam:
providers:
ldap-provider-id:
rbac:
engineer:
list:
- 'aaswartz'
- 'iamurdock'
- 'deritchie'
iam.providers.ldap-provider-id.label_attributes
Typeobject Controls adding labels to the user account based on attributes provided by the identity provider. You can use these labels in the Morio ABAC access policy, thus allowing you to implement access control based on group membership and so on.
For each entry:- Key: Typestring The Morio label name
- Value: Typestring The identity provider label name
iam.providers.oidc-provider-id
Typeobject This marks the start of a settings pattern which allows multiple blocks of these settings to repeat under a different key.
In our documentation, we use
oidc-provider-id as a placeholder key to illustrate this settings pattern.
Settings for an OIDC identity provider.
You can configure multiple OIDC identity providers creating different keys
under iam.providers that implement this settings structure.
Show Example
iam:
providers:
oidc-provider-id:
provider: 'oidc'
label: 'FreeSewing Account'
about: 'Sign in with any FreeSewing account'
issuer: 'https:// backend.freesewing.eu'
client_secret: '{|{ MORIO_SSO_CLIENT_SECRET }|}'
client_id: 'morio'
username_field: 'preferred_username'
rbac:
user:
attribute: 'preferred_username'
regex: '.'
engineer:
attribute: 'preferred_username'
list:
- 'joost'
autodiscovery_url: 'https://backend.freesewing.eu/.well-known/openid-configuration'
token_endpoint_auth_method: 'client_secret_basic'
label_attributes:
email: 'email'
name: 'name'
role: 'role'
username: 'preferred_username'
uuid: 'sub'
iam.providers.oidc-provider-id.provider
Required Typestring Contentequalsoidc
Holds the provider type, which for this provider must always be oidc
Show Example
iam:
providers:
oidc-provider-id:
provider: 'oidc'
iam.providers.oidc-provider-id.label
Required Typestring The label to use for this identity provider in the Morio UI.
Show Example
iam:
providers:
oidc-provider-id:
label: 'FreeSewing Account'
iam.providers.oidc-provider-id.about
Optional Typestring A (brief) description that will be included in the inline help on the Morio login page. When you have multiple identity providers, this can help you clarify the purpose and use-case of each of them to your users.
Show Example
iam:
providers:
oidc-provider-id:
about: 'Sign in with any FreeSewing account'
iam.providers.oidc-provider-id.issuer
Required Typestring The base URL of your identitity provider.
Show Example
iam:
providers:
oidc-provider-id:
issuer: 'https:// backend.freesewing.eu'
iam.providers.oidc-provider-id.client_secret
Required Typestring The client secret to exchange with the identity provider.
Show Example
iam:
providers:
oidc-provider-id:
client_secret: '{|{ MORIO_SSO_CLIENT_SECRET }|}'
iam.providers.oidc-provider-id.client_id
Required Typestring The client ID as configured on the identity provider.
Show Example
iam:
providers:
oidc-provider-id:
client_id: 'morio'
iam.providers.oidc-provider-id.username_field
Required Typestring The LDAP field to use for the username within Morio.
Show Example
iam:
providers:
oidc-provider-id:
username_field: 'preferred_username'
iam.providers.oidc-provider-id.autodiscovery_url
Optional Typestring ContentisURI
The exact autodiscovery URL. Typically, you do not need to configure this as
it can be determined from the issuer setting. However, for OIDC
identity providers that implement multi-tenancy, or when using multiple realms,
the URL path is often different from the default, and in such a case you can
specify the exact path here.
Show Example
iam:
providers:
oidc-provider-id:
autodiscovery_url: 'https://backend.freesewing.eu/.well-known/openid-configuration'
iam.providers.oidc-provider-id.token_endpoint_auth_method
Optional Typestring Controls how the client proves its identity to the identity provider.
Show Example
iam:
providers:
oidc-provider-id:
token_endpoint_auth_method: 'client_secret_basic'
iam.providers.oidc-provider-id.trust_certificate
Optional Typestring Contentregex/.*BEGIN CERTIFICATE.*/ A PEM-encoded certificate to trust for the TLS connection to the identity provider.
iam.providers.oidc-provider-id.verify_certificate
Typeboolean defaultWhether or not to verify the certificate on the TLS connection.
iam.providers.oidc-provider-id.rbac
Typeobject Controls what Morio roles to assign to users authenticating through this identity provider.
Show Example
iam:
providers:
oidc-provider-id:
rbac:
user:
attribute: 'preferred_username'
regex: '.'
engineer:
attribute: 'preferred_username'
list:
- 'joost'
iam.providers.oidc-provider-id.rbac.user
Typeobject Propertiesxorlist|regex
Controls which users get assigned this role by matching an attribute from
the identity provider. Note that you can use either list or
regex but not both.
Show Example
iam:
providers:
oidc-provider-id:
rbac:
user:
attribute: 'preferred_username'
regex: '.'
The attribute to use from the identity provider.
Show Example
iam:
providers:
oidc-provider-id:
rbac:
user:
attribute: 'preferred_username'
A hard-coded list of attribute values to match.
iam.providers.oidc-provider-id.rbac.manager
Typeobject Propertiesxorlist|regex
Controls which users get assigned this role by matching an attribute from
the identity provider. Note that you can use either list or
regex but not both.
The attribute to use from the identity provider.
A hard-coded list of attribute values to match.
iam.providers.oidc-provider-id.rbac.operator
Typeobject Propertiesxorlist|regex
Controls which users get assigned this role by matching an attribute from
the identity provider. Note that you can use either list or
regex but not both.
The attribute to use from the identity provider.
A hard-coded list of attribute values to match.
iam.providers.oidc-provider-id.rbac.engineer
Typeobject Propertiesxorlist|regex
Controls which users get assigned this role by matching an attribute from
the identity provider. Note that you can use either list or
regex but not both.
Show Example
iam:
providers:
oidc-provider-id:
rbac:
engineer:
attribute: 'preferred_username'
list:
- 'joost'
The attribute to use from the identity provider.
Show Example
iam:
providers:
oidc-provider-id:
rbac:
engineer:
attribute: 'preferred_username'
A hard-coded list of attribute values to match.
Show Example
iam:
providers:
oidc-provider-id:
rbac:
engineer:
list:
- 'joost'
iam.providers.oidc-provider-id.label_attributes
Typeobject Controls adding labels to the user account based on attributes provided by the identity provider. You can use these labels in the Morio ABAC access policy, thus allowing you to implement access control based on group membership and so on.
Show Example
iam:
providers:
oidc-provider-id:
label_attributes:
email: 'email'
name: 'name'
role: 'role'
username: 'preferred_username'
uuid: 'sub'
- Key: Typestring The Morio label name
- Value: Typestring The identity provider label name
local
Optional Typeobject local.fqdn
Optional Typestring Contentishostname This setting is required when not doing a setup via the API/UI but instead from settings on disk, and when you have multiple cluster nodes. Morio needs to know which cluster node it is, an uses this setting for that. Note that this should be specific to the local node, and thus different on each cluster node.
services
Optional Typeobject Settings for individual Morio services.
Show Example
services:
all:
env:
TEST: 'EXAMPLE'
FOO: 'bar'
bar: 'FOO'
api:
cors:
origins:
- 'https://some-app.corp.morio.it'
- 'http://localhost:3000'
env:
some: 'var'
broker:
env:
some: 'var'
ca:
env:
some: 'var'
cache:
instances:
single:
env:
some: 'var'
max_memory_gb: 1.25
nodes:
- 'flanking1.morio.it'
connector:
instances:
single:
env:
some: 'var'
nodes:
- 'flanking1.morio.it'
- 'flanking2.morio.it'
vector:
sources:
source-id:
type: 'local_morio'
topics:
- 'logs'
transforms:
transform-id:
type: 'remap'
inputs:
- 'source-id'
source: "parsed_message = parse_json!(.message)\n. = parsed_message"
sinks:
sink-id:
type: 'elasticsearch'
inputs:
- 'transform-id'
api_version: 'auto'
compression: 'none'
endpoints:
- 'https://elasticsearch.tokyo.morio.it'
auth:
user: '{|{ ELASTIC_INGESTION_USER }|}'
password: '{|{ ELASTIC_INGESTION_PASSWORD }|}'
strategy: 'basic'
mode: 'bulk'
bulk:
action: 'create'
index: 'logs-{{ .morio.module }}-morio.tokyo'
template_fallback_index: 'logs-fallback-morio.tokyo'
tls:
ca_file: '/etc/vector/internal-ca.crt'
console:
env:
some: 'var'
db:
env:
some: 'var'
eda:
instances:
eda-id:
description: 'EdA instance for the support team'
nodes:
- 'flanking1.morio.it'
cors:
origins:
- 'https://diy.support.corp.morio.it'
- 'http://localhost:3000'
proxy:
env:
some: 'var'
snmpproxy:
instances:
single:
auths:
auths-id:
version: 3
username: 'morio'
priv_protocol: 'AES'
auth_protocol: 'SHA256'
security_level: 'authPriv'
password: '{|{ SNMP_AUTH_PASSWORD }|}'
priv_password: '{|{ SNMP_PRIV_PASSWORD }|}'
env:
some: 'var'
nodes:
- 'flanking1.morio.it'
- 'flanking2.morio.it'
snmptraps:
instances:
single:
env:
some: 'var'
nodes:
- 'flanking1.morio.it'
snmptrapd_custom: "# SNMP v3 auth\ncreateUser -e 0x80000009030000000000 morio sha-256 {|{ SNMP_AUTH_PASSWORD }|} aes-128 {|{ SNMP_PRIV_PASSWORD }|}"
tap:
instances:
single:
env:
some: 'var'
threads: 4
max_memory_mb: 1250
nodes:
- 'flanking1.morio.it'
ui:
env:
some: 'var'
iam:
roles:
labels:
user: 'Staff'
manager: 'Team Leader'
operator: 'Operations'
engineer: 'Morio Core Team'
root: 'MVDP-mode'
watcher:
instances:
single:
env:
some: 'var'
ping_inventory: true
ca_list:
- 'CERT'
monitors:
icmp-example:
type: 'icmp'
name: 'Ping some hosts'
hosts:
- 'host1.morio.it'
- 'host2.morio.it'
tcp-example:
type: 'tcp'
name: 'Check some ports'
hosts:
- 'host1.morio.it'
- 'host2.morio.it'
ports:
- 1212
- 3434
check:
send: 'foo'
receive: 'bar'
http-example:
type: 'http'
name: 'Test some URLs'
hosts:
- 'https://host1.morio.it'
- 'https://host2.morio.it'
max_redirects: 2
username: 'foo'
password: 'bar'
check:
request:
method: 'GET'
headers:
X-Foo-bar: 'Affirmative'
body: 'hi'
response:
status: 200
headers:
X-Foo-bar: 'Affirmative'
body:
- 'looks'
- 'good'
services.all
Optional Typeobject Settings that apply to all services spawned by core (they do not apply to the core service itself).
Show Example
services:
all:
env:
TEST: 'EXAMPLE'
FOO: 'bar'
bar: 'FOO'
services.all.env
Typeobject A list of environment variables to set on the service container.
Show Example
services:
all:
env:
TEST: 'EXAMPLE'
FOO: 'bar'
bar: 'FOO'
- Key: Typestring The environment variable name
- Value: Typestring The environment variable value
services.api
Optional Typeobject Settings that apply to the API service
Show Example
services:
api:
cors:
origins:
- 'https://some-app.corp.morio.it'
- 'http://localhost:3000'
env:
some: 'var'
services.broker
Optional Typeobject Settings that apply to the Broker service
Show Example
services:
broker:
env:
some: 'var'
services.ca
Optional Typeobject Settings that apply to the CA service
Show Example
services:
ca:
env:
some: 'var'
services.cache
Optional Typeobject Settings that apply to the Cache service
Show Example
services:
cache:
instances:
single:
env:
some: 'var'
max_memory_gb: 1.25
nodes:
- 'flanking1.morio.it'
services.cache.instances
Optional Typeobject For consistency, all flanking services are configured through a instances key like this that can hold multiple services instances. However, not all services support multiple instances.
The cache service only allows a single instance.
Show Example
services:
cache:
instances:
single:
env:
some: 'var'
max_memory_gb: 1.25
nodes:
- 'flanking1.morio.it'
services.cache.instances.single
Typeobject Settings for the single instance of the Cache service.
Show Example
services:
cache:
instances:
single:
env:
some: 'var'
max_memory_gb: 1.25
nodes:
- 'flanking1.morio.it'
services.cache.instances.single.env
Typeobject A list of environment variables to set on the service container.
Show Example
services:
cache:
instances:
single:
env:
some: 'var'
- Key: Typestring The environment variable name
- Value: Typestring The environment variable value
services.cache.instances.single.max_memory_gb
Optional Typenumber default1
The maximum memory to allocate to the cache in Gigabytes.
When the limit is reached, caching will be impacted and keys
will be evicted using the volatile-lfu eviction policy.
Show Example
services:
cache:
instances:
single:
max_memory_gb: 1.25
services.cache.instances.single.nodes
Required Typearray Lengthequals1 The nodes to run the cache service on. Only one node is allowed. Array entries must be one of the cluster nodes.
Show Example
services:
cache:
instances:
single:
nodes:
- 'flanking1.morio.it'
services.connector
Optional Typeobject Settings that apply to the Connector service
Show Example
services:
connector:
instances:
single:
env:
some: 'var'
nodes:
- 'flanking1.morio.it'
- 'flanking2.morio.it'
vector:
sources:
source-id:
type: 'local_morio'
topics:
- 'logs'
transforms:
transform-id:
type: 'remap'
inputs:
- 'source-id'
source: "parsed_message = parse_json!(.message)\n. = parsed_message"
sinks:
sink-id:
type: 'elasticsearch'
inputs:
- 'transform-id'
api_version: 'auto'
compression: 'none'
endpoints:
- 'https://elasticsearch.tokyo.morio.it'
auth:
user: '{|{ ELASTIC_INGESTION_USER }|}'
password: '{|{ ELASTIC_INGESTION_PASSWORD }|}'
strategy: 'basic'
mode: 'bulk'
bulk:
action: 'create'
index: 'logs-{{ .morio.module }}-morio.tokyo'
template_fallback_index: 'logs-fallback-morio.tokyo'
tls:
ca_file: '/etc/vector/internal-ca.crt'
services.connector.instances
Optional Typeobject
For consistency, all flanking services are configured through a instances key like this that can hold multiple services instances. However, not all services support multiple instances.
The Connector service allows only a single
instance, but you can run it on multiple nodes.
Show Example
services:
connector:
instances:
single:
env:
some: 'var'
nodes:
- 'flanking1.morio.it'
- 'flanking2.morio.it'
vector:
sources:
source-id:
type: 'local_morio'
topics:
- 'logs'
transforms:
transform-id:
type: 'remap'
inputs:
- 'source-id'
source: "parsed_message = parse_json!(.message)\n. = parsed_message"
sinks:
sink-id:
type: 'elasticsearch'
inputs:
- 'transform-id'
api_version: 'auto'
compression: 'none'
endpoints:
- 'https://elasticsearch.tokyo.morio.it'
auth:
user: '{|{ ELASTIC_INGESTION_USER }|}'
password: '{|{ ELASTIC_INGESTION_PASSWORD }|}'
strategy: 'basic'
mode: 'bulk'
bulk:
action: 'create'
index: 'logs-{{ .morio.module }}-morio.tokyo'
template_fallback_index: 'logs-fallback-morio.tokyo'
tls:
ca_file: '/etc/vector/internal-ca.crt'
services.connector.instances.single
Typeobject Settings for the single instance of the Connector service.
Show Example
services:
connector:
instances:
single:
env:
some: 'var'
nodes:
- 'flanking1.morio.it'
- 'flanking2.morio.it'
vector:
sources:
source-id:
type: 'local_morio'
topics:
- 'logs'
transforms:
transform-id:
type: 'remap'
inputs:
- 'source-id'
source: "parsed_message = parse_json!(.message)\n. = parsed_message"
sinks:
sink-id:
type: 'elasticsearch'
inputs:
- 'transform-id'
api_version: 'auto'
compression: 'none'
endpoints:
- 'https://elasticsearch.tokyo.morio.it'
auth:
user: '{|{ ELASTIC_INGESTION_USER }|}'
password: '{|{ ELASTIC_INGESTION_PASSWORD }|}'
strategy: 'basic'
mode: 'bulk'
bulk:
action: 'create'
index: 'logs-{{ .morio.module }}-morio.tokyo'
template_fallback_index: 'logs-fallback-morio.tokyo'
tls:
ca_file: '/etc/vector/internal-ca.crt'
services.connector.instances.single.env
Typeobject A list of environment variables to set on the service container.
Show Example
services:
connector:
instances:
single:
env:
some: 'var'
- Key: Typestring The environment variable name
- Value: Typestring The environment variable value
services.connector.instances.single.nodes
Required Typearray The nodes to run the cache service on.
Show Example
services:
connector:
instances:
single:
nodes:
- 'flanking1.morio.it'
- 'flanking2.morio.it'
services.connector.instances.single.vector
Typeobject Show Example
services:
connector:
instances:
single:
vector:
sources:
source-id:
type: 'local_morio'
topics:
- 'logs'
transforms:
transform-id:
type: 'remap'
inputs:
- 'source-id'
source: "parsed_message = parse_json!(.message)\n. = parsed_message"
sinks:
sink-id:
type: 'elasticsearch'
inputs:
- 'transform-id'
api_version: 'auto'
compression: 'none'
endpoints:
- 'https://elasticsearch.tokyo.morio.it'
auth:
user: '{|{ ELASTIC_INGESTION_USER }|}'
password: '{|{ ELASTIC_INGESTION_PASSWORD }|}'
strategy: 'basic'
mode: 'bulk'
bulk:
action: 'create'
index: 'logs-{{ .morio.module }}-morio.tokyo'
template_fallback_index: 'logs-fallback-morio.tokyo'
tls:
ca_file: '/etc/vector/internal-ca.crt'
A Vector source configuration. Refer to the Vector Sinks reference.
Show Example
services:
connector:
instances:
single:
vector:
sources:
source-id:
type: 'local_morio'
topics:
- 'logs'
This marks the start of a settings pattern which allows multiple blocks of these settings to repeat under a different key.
In our documentation, we use
source-id as a placeholder key to illustrate this settings pattern.A Vector source configuration. Refer to the Vector Sinks reference.
Show Example
services:
connector:
instances:
single:
vector:
sources:
source-id:
type: 'local_morio'
topics:
- 'logs'
A Vector transform configuration. Refer to the Vector Transforms reference.
Show Example
services:
connector:
instances:
single:
vector:
transforms:
transform-id:
type: 'remap'
inputs:
- 'source-id'
source: "parsed_message = parse_json!(.message)\n. = parsed_message"
This marks the start of a settings pattern which allows multiple blocks of these settings to repeat under a different key.
In our documentation, we use
transform-id as a placeholder key to illustrate this settings pattern.A Vector transform configuration. Refer to the Vector Transforms reference.
Show Example
services:
connector:
instances:
single:
vector:
transforms:
transform-id:
type: 'remap'
inputs:
- 'source-id'
source: "parsed_message = parse_json!(.message)\n. = parsed_message"
The Vector sinks configuration. Refer to the Vector Sinks reference.
Show Example
services:
connector:
instances:
single:
vector:
sinks:
sink-id:
type: 'elasticsearch'
inputs:
- 'transform-id'
api_version: 'auto'
compression: 'none'
endpoints:
- 'https://elasticsearch.tokyo.morio.it'
auth:
user: '{|{ ELASTIC_INGESTION_USER }|}'
password: '{|{ ELASTIC_INGESTION_PASSWORD }|}'
strategy: 'basic'
mode: 'bulk'
bulk:
action: 'create'
index: 'logs-{{ .morio.module }}-morio.tokyo'
template_fallback_index: 'logs-fallback-morio.tokyo'
tls:
ca_file: '/etc/vector/internal-ca.crt'
This marks the start of a settings pattern which allows multiple blocks of these settings to repeat under a different key.
In our documentation, we use
sink-id as a placeholder key to illustrate this settings pattern.The Vector sinks configuration. Refer to the Vector Sinks reference.
Show Example
services:
connector:
instances:
single:
vector:
sinks:
sink-id:
type: 'elasticsearch'
inputs:
- 'transform-id'
api_version: 'auto'
compression: 'none'
endpoints:
- 'https://elasticsearch.tokyo.morio.it'
auth:
user: '{|{ ELASTIC_INGESTION_USER }|}'
password: '{|{ ELASTIC_INGESTION_PASSWORD }|}'
strategy: 'basic'
mode: 'bulk'
bulk:
action: 'create'
index: 'logs-{{ .morio.module }}-morio.tokyo'
template_fallback_index: 'logs-fallback-morio.tokyo'
tls:
ca_file: '/etc/vector/internal-ca.crt'
services.console
Optional Typeobject Settings that apply to the Console service
Show Example
services:
console:
env:
some: 'var'
services.db
Optional Typeobject Settings that apply to the DB service
Show Example
services:
db:
env:
some: 'var'
services.eda
Optional Typeobject Settings that apply to the EdA service
Show Example
services:
eda:
instances:
eda-id:
description: 'EdA instance for the support team'
nodes:
- 'flanking1.morio.it'
cors:
origins:
- 'https://diy.support.corp.morio.it'
- 'http://localhost:3000'
services.eda.instances
Required Typeobject
For consistency, all flanking services are configured through a instances key like this that can hold multiple services instances. However, not all services support multiple instances.
The EdA service does allow multiple instances,
but does not support running a single instance on multiple nodes.
Show Example
services:
eda:
instances:
eda-id:
description: 'EdA instance for the support team'
nodes:
- 'flanking1.morio.it'
cors:
origins:
- 'https://diy.support.corp.morio.it'
- 'http://localhost:3000'
services.eda.instances.eda-id
Typeobject This marks the start of a settings pattern which allows multiple blocks of these settings to repeat under a different key.
In our documentation, we use
eda-id as a placeholder key to illustrate this settings pattern.
For consistency, all flanking services are configured through a instances key like this that can hold multiple services instances. However, not all services support multiple instances.
The EdA service does allow multiple instances,
but does not support running a single instance on multiple nodes.
Show Example
services:
eda:
instances:
eda-id:
description: 'EdA instance for the support team'
nodes:
- 'flanking1.morio.it'
cors:
origins:
- 'https://diy.support.corp.morio.it'
- 'http://localhost:3000'
services.eda.instances.eda-id.nodes
Required Typearray Lengthequals1 The cluster node to run this instance on.
Show Example
services:
eda:
instances:
eda-id:
nodes:
- 'flanking1.morio.it'
services.eda.instances.eda-id.description
Typestring A description for this EdA instance.
Show Example
services:
eda:
instances:
eda-id:
description: 'EdA instance for the support team'
services.eda.instances.eda-id.cors
Optional Typeobject Allow configuration of the CORS headers returned by this service.
Show Example
services:
eda:
instances:
eda-id:
cors:
origins:
- 'https://diy.support.corp.morio.it'
- 'http://localhost:3000'
A list of origins to add to the CORS headers.
Show Example
services:
eda:
instances:
eda-id:
cors:
origins:
- 'https://diy.support.corp.morio.it'
- 'http://localhost:3000'
services.proxy
Optional Typeobject Settings that apply to the Proxy service
Show Example
services:
proxy:
env:
some: 'var'
services.snmpproxy
Optional Typeobject Settings that apply to the SNMPProxy service
Show Example
services:
snmpproxy:
instances:
single:
auths:
auths-id:
version: 3
username: 'morio'
priv_protocol: 'AES'
auth_protocol: 'SHA256'
security_level: 'authPriv'
password: '{|{ SNMP_AUTH_PASSWORD }|}'
priv_password: '{|{ SNMP_PRIV_PASSWORD }|}'
env:
some: 'var'
nodes:
- 'flanking1.morio.it'
- 'flanking2.morio.it'
services.snmpproxy.instances
Optional Typeobject
For consistency, all flanking services are configured through a instances key like this that can hold multiple services instances. However, not all services support multiple instances.
The SNMPProxy service allows only a single
instance, but you can run it on multiple nodes.
Show Example
services:
snmpproxy:
instances:
single:
auths:
auths-id:
version: 3
username: 'morio'
priv_protocol: 'AES'
auth_protocol: 'SHA256'
security_level: 'authPriv'
password: '{|{ SNMP_AUTH_PASSWORD }|}'
priv_password: '{|{ SNMP_PRIV_PASSWORD }|}'
env:
some: 'var'
nodes:
- 'flanking1.morio.it'
- 'flanking2.morio.it'
services.snmpproxy.instances.single
Typeobject Settings for the single SNMPProxy service instance.
Show Example
services:
snmpproxy:
instances:
single:
auths:
auths-id:
version: 3
username: 'morio'
priv_protocol: 'AES'
auth_protocol: 'SHA256'
security_level: 'authPriv'
password: '{|{ SNMP_AUTH_PASSWORD }|}'
priv_password: '{|{ SNMP_PRIV_PASSWORD }|}'
env:
some: 'var'
nodes:
- 'flanking1.morio.it'
- 'flanking2.morio.it'
services.snmpproxy.instances.single.nodes
Required Typearray The list of cluster nodes to run this service on.
Show Example
services:
snmpproxy:
instances:
single:
nodes:
- 'flanking1.morio.it'
- 'flanking2.morio.it'
services.snmpproxy.instances.single.env
Typeobject A list of environment variables to set on the service container.
Show Example
services:
snmpproxy:
instances:
single:
env:
some: 'var'
- Key: Typestring The environment variable name
- Value: Typestring The environment variable value
services.snmpproxy.instances.single.auths
Typeobject Extra authentication settings to add to the service.
Show Example
services:
snmpproxy:
instances:
single:
auths:
auths-id:
version: 3
username: 'morio'
priv_protocol: 'AES'
auth_protocol: 'SHA256'
security_level: 'authPriv'
password: '{|{ SNMP_AUTH_PASSWORD }|}'
priv_password: '{|{ SNMP_PRIV_PASSWORD }|}'
This marks the start of a settings pattern which allows multiple blocks of these settings to repeat under a different key.
In our documentation, we use
auths-id as a placeholder key to illustrate this settings pattern.Extra authentication settings to add to the service.
Show Example
services:
snmpproxy:
instances:
single:
auths:
auths-id:
version: 3
username: 'morio'
priv_protocol: 'AES'
auth_protocol: 'SHA256'
security_level: 'authPriv'
password: '{|{ SNMP_AUTH_PASSWORD }|}'
priv_password: '{|{ SNMP_PRIV_PASSWORD }|}'
The SNMP version to use for the authentication.
Show Example
services:
snmpproxy:
instances:
single:
auths:
auths-id:
version: 3
The username to use for the authentication.
Show Example
services:
snmpproxy:
instances:
single:
auths:
auths-id:
username: 'morio'
The privacy or encryption algorighm to use for the authentication.
Show Example
services:
snmpproxy:
instances:
single:
auths:
auths-id:
priv_protocol: 'AES'
The algorithm to use to check message integrity and the sender's identity.
Show Example
services:
snmpproxy:
instances:
single:
auths:
auths-id:
auth_protocol: 'SHA256'
The SNMP security level.
Show Example
services:
snmpproxy:
instances:
single:
auths:
auths-id:
security_level: 'authPriv'
The SNMP password for the authentication.
Show Example
services:
snmpproxy:
instances:
single:
auths:
auths-id:
password: '{|{ SNMP_AUTH_PASSWORD }|}'
The SNMP password for AuthPriv mode.
Show Example
services:
snmpproxy:
instances:
single:
auths:
auths-id:
priv_password: '{|{ SNMP_PRIV_PASSWORD }|}'
services.snmptraps
Optional Typeobject Settings that apply to the SNMPTraps service
Show Example
services:
snmptraps:
instances:
single:
env:
some: 'var'
nodes:
- 'flanking1.morio.it'
snmptrapd_custom: "# SNMP v3 auth\ncreateUser -e 0x80000009030000000000 morio sha-256 {|{ SNMP_AUTH_PASSWORD }|} aes-128 {|{ SNMP_PRIV_PASSWORD }|}"
services.snmptraps.instances
Optional Typeobject Show Example
services:
snmptraps:
instances:
single:
env:
some: 'var'
nodes:
- 'flanking1.morio.it'
snmptrapd_custom: "# SNMP v3 auth\ncreateUser -e 0x80000009030000000000 morio sha-256 {|{ SNMP_AUTH_PASSWORD }|} aes-128 {|{ SNMP_PRIV_PASSWORD }|}"
services.snmptraps.instances.single
Optional Typeobject Show Example
services:
snmptraps:
instances:
single:
env:
some: 'var'
nodes:
- 'flanking1.morio.it'
snmptrapd_custom: "# SNMP v3 auth\ncreateUser -e 0x80000009030000000000 morio sha-256 {|{ SNMP_AUTH_PASSWORD }|} aes-128 {|{ SNMP_PRIV_PASSWORD }|}"
services.snmptraps.instances.single.nodes
Required Typearray The list of cluster nodes to run this service on.
Show Example
services:
snmptraps:
instances:
single:
nodes:
- 'flanking1.morio.it'
services.snmptraps.instances.single.env
Typeobject A list of environment variables to set on the service container.
Show Example
services:
snmptraps:
instances:
single:
env:
some: 'var'
- Key: Typestring The environment variable name
- Value: Typestring The environment variable value
services.snmptraps.instances.single.snmptrapd_custom
Typestring This allows you to pass custom confirutation to the snmptrapd daemon.
Show Example
services:
snmptraps:
instances:
single:
snmptrapd_custom: "# SNMP v3 auth\ncreateUser -e 0x80000009030000000000 morio sha-256 {|{ SNMP_AUTH_PASSWORD }|} aes-128 {|{ SNMP_PRIV_PASSWORD }|}"
services.tap
Optional Typeobject Settings that apply to the Tap service
Show Example
services:
tap:
instances:
single:
env:
some: 'var'
threads: 4
max_memory_mb: 1250
nodes:
- 'flanking1.morio.it'
services.tap.instances
Optional Typeobject
For consistency, all flanking services are configured through a instances key like this that can hold multiple services instances. However, not all services support multiple instances.
The Tap service allows only a single instance, but you can increase its thread count.
Show Example
services:
tap:
instances:
single:
env:
some: 'var'
threads: 4
max_memory_mb: 1250
nodes:
- 'flanking1.morio.it'
services.tap.instances.single
Typeobject Settings for the single SNMPProxy service instance.
Show Example
services:
tap:
instances:
single:
env:
some: 'var'
threads: 4
max_memory_mb: 1250
nodes:
- 'flanking1.morio.it'
services.tap.instances.single.env
Typeobject A list of environment variables to set on the service container.
Show Example
services:
tap:
instances:
single:
env:
some: 'var'
- Key: Typestring The environment variable name
- Value: Typestring The environment variable value
services.tap.instances.single.threads
Optional Typenumber Valueisinteger default1The number of threads to run for stream processing. Increasing thread count is the recommended way to increase stream processing throughput.
Show Example
services:
tap:
instances:
single:
threads: 4
services.tap.instances.single.max_memory_mb
Optional Typenumber Valueisinteger Valueminimum500 default750The per-thread memory limit in Megabytes. When this limit is reached, the thread will be restarted, so setting it too low can cause a crash loop.
Show Example
services:
tap:
instances:
single:
max_memory_mb: 1250
services.tap.instances.single.nodes
Typearray Lengthequals1 The list of cluster nodes to run this service on.
Show Example
services:
tap:
instances:
single:
nodes:
- 'flanking1.morio.it'
services.ui
Optional Typeobject Settings that apply to the UI service
Show Example
services:
ui:
env:
some: 'var'
iam:
roles:
labels:
user: 'Staff'
manager: 'Team Leader'
operator: 'Operations'
engineer: 'Morio Core Team'
root: 'MVDP-mode'
services.ui.env
Typeobject A list of environment variables to set on the service container.
Show Example
services:
ui:
env:
some: 'var'
- Key: Typestring The environment variable name
- Value: Typestring The environment variable value
services.ui.iam
Optional Typeobject Settings that control the display of identity providers and roles on the login screen.
Show Example
services:
ui:
iam:
roles:
labels:
user: 'Staff'
manager: 'Team Leader'
operator: 'Operations'
engineer: 'Morio Core Team'
root: 'MVDP-mode'
services.ui.iam.roles
Optional Typeobject Allows you to use different labels for Morio's built-in RBAC roles.
Show Example
services:
ui:
iam:
roles:
labels:
user: 'Staff'
manager: 'Team Leader'
operator: 'Operations'
engineer: 'Morio Core Team'
root: 'MVDP-mode'
services.ui.iam.roles.labels
Optional Typeobject The labels to use for Morio's built-in RBAC roles.
Show Example
services:
ui:
iam:
roles:
labels:
user: 'Staff'
manager: 'Team Leader'
operator: 'Operations'
engineer: 'Morio Core Team'
root: 'MVDP-mode'
The label to use for the built-in user role.
Show Example
services:
ui:
iam:
roles:
labels:
user: 'Staff'
The label to use for the built-in manager role.
Show Example
services:
ui:
iam:
roles:
labels:
manager: 'Team Leader'
The label to use for the built-in operator role.
Show Example
services:
ui:
iam:
roles:
labels:
operator: 'Operations'
The label to use for the built-in engineer role.
Show Example
services:
ui:
iam:
roles:
labels:
engineer: 'Morio Core Team'
services.watcher
Optional Typeobject Settings that apply to the Watcher service
Show Example
services:
watcher:
instances:
single:
env:
some: 'var'
ping_inventory: true
ca_list:
- 'CERT'
monitors:
icmp-example:
type: 'icmp'
name: 'Ping some hosts'
hosts:
- 'host1.morio.it'
- 'host2.morio.it'
tcp-example:
type: 'tcp'
name: 'Check some ports'
hosts:
- 'host1.morio.it'
- 'host2.morio.it'
ports:
- 1212
- 3434
check:
send: 'foo'
receive: 'bar'
http-example:
type: 'http'
name: 'Test some URLs'
hosts:
- 'https://host1.morio.it'
- 'https://host2.morio.it'
max_redirects: 2
username: 'foo'
password: 'bar'
check:
request:
method: 'GET'
headers:
X-Foo-bar: 'Affirmative'
body: 'hi'
response:
status: 200
headers:
X-Foo-bar: 'Affirmative'
body:
- 'looks'
- 'good'
services.watcher.instances
Optional Typeobject
For consistency, all flanking services are configured through a instances key like this that can hold multiple services instances. However, not all services support multiple instances.
The Watcher service allows only a single instance, but you can run it on multiple nodes.
Show Example
services:
watcher:
instances:
single:
env:
some: 'var'
ping_inventory: true
ca_list:
- 'CERT'
monitors:
icmp-example:
type: 'icmp'
name: 'Ping some hosts'
hosts:
- 'host1.morio.it'
- 'host2.morio.it'
tcp-example:
type: 'tcp'
name: 'Check some ports'
hosts:
- 'host1.morio.it'
- 'host2.morio.it'
ports:
- 1212
- 3434
check:
send: 'foo'
receive: 'bar'
http-example:
type: 'http'
name: 'Test some URLs'
hosts:
- 'https://host1.morio.it'
- 'https://host2.morio.it'
max_redirects: 2
username: 'foo'
password: 'bar'
check:
request:
method: 'GET'
headers:
X-Foo-bar: 'Affirmative'
body: 'hi'
response:
status: 200
headers:
X-Foo-bar: 'Affirmative'
body:
- 'looks'
- 'good'
services.watcher.instances.single
Typeobject Settings for the single instance of the Watcher service.
Show Example
services:
watcher:
instances:
single:
env:
some: 'var'
ping_inventory: true
ca_list:
- 'CERT'
monitors:
icmp-example:
type: 'icmp'
name: 'Ping some hosts'
hosts:
- 'host1.morio.it'
- 'host2.morio.it'
tcp-example:
type: 'tcp'
name: 'Check some ports'
hosts:
- 'host1.morio.it'
- 'host2.morio.it'
ports:
- 1212
- 3434
check:
send: 'foo'
receive: 'bar'
http-example:
type: 'http'
name: 'Test some URLs'
hosts:
- 'https://host1.morio.it'
- 'https://host2.morio.it'
max_redirects: 2
username: 'foo'
password: 'bar'
check:
request:
method: 'GET'
headers:
X-Foo-bar: 'Affirmative'
body: 'hi'
response:
status: 200
headers:
X-Foo-bar: 'Affirmative'
body:
- 'looks'
- 'good'
services.watcher.instances.single.env
Typeobject A list of environment variables to set on the service container.
Show Example
services:
watcher:
instances:
single:
env:
some: 'var'
- Key: Typestring The environment variable name
- Value: Typestring The environment variable value
services.watcher.instances.single.ping_inventory
Optional Typeboolean Enable this to run an ICMP healthcheck to all hosts in the inventory/
Show Example
services:
watcher:
instances:
single:
ping_inventory: true
services.watcher.instances.single.ca_list
Optional Typearray A list of PEM-encoded certificates to add to the trusted CAs when running healthchecks.
Show Example
services:
watcher:
instances:
single:
ca_list:
- 'CERT'
services.watcher.instances.single.monitors
Optional Typeobject A list of monitors to run. Refer to the Elastic Heartbeat monitors documenation for all details.
Show Example
services:
watcher:
instances:
single:
monitors:
icmp-example:
type: 'icmp'
name: 'Ping some hosts'
hosts:
- 'host1.morio.it'
- 'host2.morio.it'
tcp-example:
type: 'tcp'
name: 'Check some ports'
hosts:
- 'host1.morio.it'
- 'host2.morio.it'
ports:
- 1212
- 3434
check:
send: 'foo'
receive: 'bar'
http-example:
type: 'http'
name: 'Test some URLs'
hosts:
- 'https://host1.morio.it'
- 'https://host2.morio.it'
max_redirects: 2
username: 'foo'
password: 'bar'
check:
request:
method: 'GET'
headers:
X-Foo-bar: 'Affirmative'
body: 'hi'
response:
status: 200
headers:
X-Foo-bar: 'Affirmative'
body:
- 'looks'
- 'good'
tokens
Typeobject Holds feature flags, vars, and secrets.
Show Example
tokens:
flags:
DISABLE_IDP_MRT: true
secrets:
SUPER_SECRET_PASSWORD: '{"v":2,"iv":"135364debdaff520eb9ed97e","ct":"08744465c41a5e0753","tag":"e02fbc19428f1ea00a6bab109944b3eb"}'
vars:
KEEP_SETTINGS_DRY: 'with variables'
tokens.flags
Typeobject Holds feature flags. Refer to the Feature Flags reference for details.
Show Example
tokens:
flags:
DISABLE_IDP_MRT: true
tokens.secrets
Typeobject Show Example
tokens:
secrets:
SUPER_SECRET_PASSWORD: '{"v":2,"iv":"135364debdaff520eb9ed97e","ct":"08744465c41a5e0753","tag":"e02fbc19428f1ea00a6bab109944b3eb"}'