second first commit
This commit is contained in:
Zakaria
@@ -0,0 +1,839 @@
|
||||
quarkus:
|
||||
jackson:
|
||||
# Quarkus 3.37 stopped tolerating empty response beans; AWS StartApplication/
|
||||
# StopApplication legitimately return {}, so keep the pre-3.37 behaviour.
|
||||
fail-on-empty-beans: false
|
||||
log:
|
||||
console:
|
||||
format: "%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c{3.}] %s%e%n"
|
||||
category:
|
||||
"io.apicurio":
|
||||
level: WARN
|
||||
|
||||
http:
|
||||
port: ${floci.port}
|
||||
# Loopback by default. Any other address (0.0.0.0, a LAN IP) also needs
|
||||
# floci.security.allow-unsafe-network-exposure, or Floci refuses to start.
|
||||
# Env var: QUARKUS_HTTP_HOST=0.0.0.0
|
||||
host: 127.0.0.1
|
||||
# Quarkus 3.38 added a Host-header validation filter (DNS-rebinding protection for a dev server)
|
||||
# that it switches on by itself whenever the server is bound to loopback, which Floci is by
|
||||
# default. In TLS mode Quarkus listens on 127.0.0.1:4510/4511 behind the TCP proxy on 4566, and
|
||||
# the proxy passes the client's Host header through untouched. The filter is an exact-match set with no
|
||||
# wildcard support, and with require-localhost it admits only localhost, 127.0.0.1 and [::1].
|
||||
# An emulator has to answer under the names it documents and puts in its certificate
|
||||
# (localhost.floci.io, *.localhost.floci.io, *.execute-api.localhost.floci.io,
|
||||
# host.docker.internal) and under whatever a compose file calls it (FLOCI_HOSTNAME), none of
|
||||
# which an exact-match allow-list can express. Disabling the check restores the behaviour of
|
||||
# every release before Quarkus 3.39; the access boundary of a local emulator is the IAM and
|
||||
# signature enforcement configuration.
|
||||
host-validation:
|
||||
require-localhost: false
|
||||
limits:
|
||||
max-body-size: ${floci.protocols.max-request-size}M
|
||||
shutdown:
|
||||
# Enables the pre-shutdown phase so stop hooks run before the HTTP server stops.
|
||||
# No 'delay' value is set - observers run synchronously, no artificial sleep is introduced.
|
||||
delay-enabled: true
|
||||
native:
|
||||
# quarkus-jdbc-mysql used to force this. Without it the image has only UTF-8, UTF-16,
|
||||
# ISO-8859-1 and US-ASCII, which breaks latin1 MySQL columns and non-UTF-8 mail bodies.
|
||||
add-all-charsets: true
|
||||
resources:
|
||||
# The Pricing service reads its bundled snapshot, EC2 reads its image
|
||||
# catalog (ec2/image-catalog.yaml), SageMaker reads its instance type
|
||||
# catalog (sagemaker/instance-type-catalog.yaml), AppSync's GraphQL
|
||||
# parser reads its message bundles, and API Gateway's Velocity engine
|
||||
# reads its default properties at runtime via
|
||||
# ClassLoader#getResourceAsStream. Quarkus's static resource analysis
|
||||
# cannot detect these dynamically-built paths, so they are registered
|
||||
# explicitly to ensure GraalVM includes every file in the native image.
|
||||
# The IAM managed-policy catalog (iam/*) is not listed on purpose.
|
||||
# AwsManagedPolicies parses it while the image is built and the parsed
|
||||
# catalog lives in the image heap, so the 3.5 MB of source files would
|
||||
# only be a second copy of the same data.
|
||||
includes:
|
||||
- pricing-snapshots/**
|
||||
- ui/*.html
|
||||
- ec2/*.yaml
|
||||
- sagemaker/*.yaml
|
||||
- eks/*.json
|
||||
- i18n/*.properties
|
||||
- org/apache/velocity/runtime/defaults/*.properties
|
||||
# DriverManager finds the JDBC drivers through ServiceLoader, and the MySQL
|
||||
# driver reads its time zone table at connect time.
|
||||
- META-INF/services/java.sql.Driver
|
||||
- com/mysql/cj/util/TimeZoneMapping.properties
|
||||
# snappy-java registers 27 JNI libraries, one per platform. Only the one
|
||||
# for the running platform loads, so 23 are dropped. Linux x86_64 and
|
||||
# aarch64 cover the published images, Mac covers a local native build.
|
||||
excludes:
|
||||
- org/xerial/snappy/native/AIX/**
|
||||
- org/xerial/snappy/native/FreeBSD/**
|
||||
- org/xerial/snappy/native/SunOS/**
|
||||
- org/xerial/snappy/native/Windows/**
|
||||
- org/xerial/snappy/native/Linux/android-aarch64/**
|
||||
- org/xerial/snappy/native/Linux/android-arm/**
|
||||
- org/xerial/snappy/native/Linux/arm/**
|
||||
- org/xerial/snappy/native/Linux/armv6/**
|
||||
- org/xerial/snappy/native/Linux/armv7/**
|
||||
- org/xerial/snappy/native/Linux/loongarch64/**
|
||||
- org/xerial/snappy/native/Linux/ppc/**
|
||||
- org/xerial/snappy/native/Linux/ppc64/**
|
||||
- org/xerial/snappy/native/Linux/ppc64le/**
|
||||
- org/xerial/snappy/native/Linux/riscv64/**
|
||||
- org/xerial/snappy/native/Linux/s390x/**
|
||||
- org/xerial/snappy/native/Linux/x86/**
|
||||
- org/xerial/snappy/native/Linux/x86_64-musl/**
|
||||
# No --allow-incomplete-classpath and no --report-unsupported-elements-at-runtime: both have
|
||||
# been no-ops since GraalVM 22.1 (incomplete classpaths are the default, and Quarkus passes
|
||||
# --link-at-build-time itself, so a reachable class missing from the classpath fails the build).
|
||||
additional-build-args:
|
||||
- --enable-url-protocols=http,https
|
||||
- --initialize-at-run-time=io.vertx.ext.mail.impl.sasl.NTLMEngineImpl
|
||||
- --initialize-at-run-time=com.github.dockerjava.transport.NamedPipeSocket$Kernel32
|
||||
- --initialize-at-run-time=io.github.hectorvent.floci.services.acm.AcmService
|
||||
- --initialize-at-run-time=io.github.hectorvent.floci.services.acm.CertificateGenerator
|
||||
- --initialize-at-run-time=io.github.hectorvent.floci.config.TlsConfigSource
|
||||
- --initialize-at-run-time=io.github.hectorvent.floci.services.cognito.CognitoSrpHelper
|
||||
- --initialize-at-run-time=io.github.hectorvent.floci.services.route53.Route53Service
|
||||
- --initialize-at-run-time=io.github.hectorvent.floci.services.kms.KmsService
|
||||
- --initialize-at-run-time=io.github.hectorvent.floci.services.bedrockagentcore.BedrockAgentCoreEventService
|
||||
- --initialize-at-run-time=io.github.hectorvent.floci.services.cloudfront.CloudFrontService
|
||||
- --initialize-at-run-time=io.github.hectorvent.floci.services.emr.EmrService
|
||||
- --initialize-at-run-time=io.github.hectorvent.floci.services.elasticbeanstalk.ElasticBeanstalkService
|
||||
- --initialize-at-run-time=io.github.hectorvent.floci.services.elb.ElbClassicService
|
||||
- --initialize-at-run-time=io.github.hectorvent.floci.services.datasync.DataSyncService
|
||||
- --initialize-at-run-time=io.github.hectorvent.floci.services.lambda.launcher.LambdaExecutionRoleCredentials
|
||||
- --initialize-at-run-time=io.github.hectorvent.floci.services.ssoportal.SsoPortalService
|
||||
- --initialize-at-run-time=io.github.hectorvent.floci.services.redshift.proxy.S3CopySimulator
|
||||
# snappy-java (Firehose Snappy/HADOOP_SNAPPY delivery) extracts and loads a
|
||||
# bundled JNI library from the static initializers of these two classes.
|
||||
- --initialize-at-run-time=org.xerial.snappy.Snappy
|
||||
- --initialize-at-run-time=org.xerial.snappy.SnappyLoader
|
||||
- --initialize-at-run-time=org.postgresql.util.PasswordUtil$SecureRandomHolder
|
||||
- --initialize-at-run-time=org.postgresql.util.LazyCleanerImpl
|
||||
# Build-time property. The MySQL driver's AbandonedConnectionCleanupThread starts an
|
||||
# executor thread in its static initializer unless this is set, and a started thread
|
||||
# in the image heap fails the build.
|
||||
- -J-Dcom.mysql.cj.disableAbandonedConnectionCleanup=true
|
||||
|
||||
|
||||
floci:
|
||||
port: 4566
|
||||
base-url: "http://localhost:4566"
|
||||
network:
|
||||
security-group-enforcement:
|
||||
enabled: false
|
||||
helper-image: floci/network-helper:local
|
||||
# hostname: "" # When set, overrides the hostname in response URLs (e.g. SQS QueueUrl).
|
||||
# Needed for multi-container Docker setups. Example: FLOCI_HOSTNAME=floci
|
||||
default-region: us-east-1
|
||||
default-account-id: "000000000000"
|
||||
# Shared mock-response config for Textract/Comprehend/Rekognition/Translate. See AiMockConfigLoader.
|
||||
ai-mock-config-file: ${AI_MOCK_CONFIG:}
|
||||
storage:
|
||||
# Supported modes: memory, persistent, hybrid, wal
|
||||
mode: memory
|
||||
persistent-path: ./data
|
||||
host-persistent-path: ./data
|
||||
prune-volumes-on-delete: false
|
||||
# EFS access-point emulation for the shared local Docker volumes that stand in for EFS file
|
||||
# systems. All opt-in; with the defaults below (and no owner/permission overrides) volumes are
|
||||
# plain named volumes, so existing behaviour is unchanged. Emulates an access point's
|
||||
# RootDirectory.CreationInfo (owner-uid/owner-gid/root-permissions) and PosixUser
|
||||
# (mount-user/mount-group-add).
|
||||
efs:
|
||||
# owner-uid: # RootDirectory.CreationInfo.OwnerUid applied to the volume root (set with owner-gid)
|
||||
# owner-gid: # RootDirectory.CreationInfo.OwnerGid applied to the volume root (set with owner-uid)
|
||||
# root-permissions: # CreationInfo.Permissions, 3-4 octal digits; e.g. "0777", or "2775" for setgid
|
||||
init-image: busybox:stable
|
||||
# mount-user: # run mounting containers as "uid[:gid]" (access point PosixUser)
|
||||
# mount-group-add: # supplementary gid added to mounting containers
|
||||
wal:
|
||||
compaction-interval-ms: 30000
|
||||
services:
|
||||
ssm:
|
||||
flush-interval-ms: 5000
|
||||
dynamodb:
|
||||
flush-interval-ms: 5000
|
||||
sns:
|
||||
flush-interval-ms: 5000
|
||||
lambda:
|
||||
flush-interval-ms: 5000
|
||||
cloudwatchlogs:
|
||||
flush-interval-ms: 15000
|
||||
cloudwatchmetrics:
|
||||
flush-interval-ms: 5000
|
||||
secretsmanager:
|
||||
flush-interval-ms: 5000
|
||||
acm:
|
||||
flush-interval-ms: 5000
|
||||
opensearch:
|
||||
flush-interval-ms: 5000
|
||||
sagemaker:
|
||||
flush-interval-ms: 5000
|
||||
batch:
|
||||
flush-interval-ms: 5000
|
||||
lightsail:
|
||||
flush-interval-ms: 5000
|
||||
codepipeline:
|
||||
flush-interval-ms: 5000
|
||||
s3vectors:
|
||||
flush-interval-ms: 5000
|
||||
s3tables:
|
||||
flush-interval-ms: 5000
|
||||
ecs:
|
||||
flush-interval-ms: 5000
|
||||
codebuild:
|
||||
flush-interval-ms: 5000
|
||||
config:
|
||||
flush-interval-ms: 5000
|
||||
transcribe:
|
||||
flush-interval-ms: 5000
|
||||
codedeploy:
|
||||
flush-interval-ms: 5000
|
||||
tagging:
|
||||
flush-interval-ms: 5000
|
||||
elasticbeanstalk:
|
||||
flush-interval-ms: 5000
|
||||
rds:
|
||||
# Override storage mode for RDS (memory = no Docker volumes; hybrid/persistent = named volume per instance)
|
||||
# mode: memory
|
||||
ec2:
|
||||
# Override storage mode for EC2 (defaults to the global storage mode). EC2 networking and
|
||||
# instance metadata persist so CloudFormation-created VPC/subnet ids survive a restart (#1297).
|
||||
# mode: memory
|
||||
appsync:
|
||||
flush-interval-ms: 5000
|
||||
rum:
|
||||
flush-interval-ms: 5000
|
||||
resourceexplorer2:
|
||||
mode: hybrid
|
||||
flush-interval-ms: 5000
|
||||
fis:
|
||||
flush-interval-ms: 5000
|
||||
guardduty:
|
||||
flush-interval-ms: 5000
|
||||
emrserverless:
|
||||
flush-interval-ms: 5000
|
||||
lakeformation:
|
||||
flush-interval-ms: 5000
|
||||
|
||||
dns:
|
||||
# Extra hostname suffixes resolved to Floci's container IP by the embedded DNS server.
|
||||
# Useful when migrating from LocalStack — add localhost.localstack.cloud to avoid
|
||||
# changing Lambda endpoint environment variables.
|
||||
# Via env var (comma-separated): FLOCI_DNS_EXTRA_SUFFIXES=localhost.localstack.cloud,other.internal
|
||||
# extra-suffixes:
|
||||
# - localhost.localstack.cloud
|
||||
|
||||
# Public resolvers appended after Floci's embedded DNS on spawned containers' HostConfig.Dns,
|
||||
# and used as the fallback upstream for Floci's own DNS forwarder. Lets Lambda/CodeBuild
|
||||
# resolve public hostnames even if the embedded forwarder cannot answer.
|
||||
# Disable in offline/locked-down networks where these resolvers are blocked.
|
||||
container-fallback-enabled: true # FLOCI_DNS_CONTAINER_FALLBACK_ENABLED
|
||||
container-fallback-servers: # FLOCI_DNS_CONTAINER_FALLBACK_SERVERS=1.1.1.1,1.0.0.1
|
||||
- 8.8.8.8
|
||||
- 8.8.4.4
|
||||
|
||||
auth:
|
||||
validate-signatures: false
|
||||
presign-secret: local-emulator-secret
|
||||
|
||||
security:
|
||||
# Comma-separated browser origins allowed by the global CORS filter.
|
||||
# Env var: EXTRA_CORS_ALLOWED_ORIGINS=http://localhost:3000
|
||||
extra-cors-allowed-origins: ${EXTRA_CORS_ALLOWED_ORIGINS:}
|
||||
# Extra request/response CORS header names for browser clients.
|
||||
extra-cors-allowed-headers: ${EXTRA_CORS_ALLOWED_HEADERS:}
|
||||
extra-cors-expose-headers: ${EXTRA_CORS_EXPOSE_HEADERS:}
|
||||
disable-cors-headers: false
|
||||
# Grant Private Network Access preflights (Access-Control-Allow-Private-Network)
|
||||
# so a page on a public/secure origin can reach this loopback backend.
|
||||
cors-allow-private-network: false
|
||||
# Allow quarkus.http.host, and the TLS proxy that uses it, to listen outside loopback
|
||||
# (127.0.0.0/8, ::1, localhost). Anyone who can reach that address can call Floci's APIs.
|
||||
# The Docker images set it, since they listen on 0.0.0.0 inside the container.
|
||||
# Env var: FLOCI_SECURITY_ALLOW_UNSAFE_NETWORK_EXPOSURE=true
|
||||
allow-unsafe-network-exposure: false
|
||||
allow-private-jwt-targets: false
|
||||
|
||||
tls:
|
||||
enabled: false # FLOCI_TLS_ENABLED (default: false)
|
||||
# cert-path: "" # FLOCI_TLS_CERT_PATH (PEM certificate file)
|
||||
# key-path: "" # FLOCI_TLS_KEY_PATH (PEM private key file)
|
||||
self-signed: true # FLOCI_TLS_SELF_SIGNED: auto-generate a server cert signed by Floci's local CA if no cert-path provided
|
||||
aws-https-port: 443 # FLOCI_TLS_AWS_HTTPS_PORT — also bind 443 so CDK cfn-response/AWS-on-443 callbacks reach Floci (0 disables)
|
||||
|
||||
protocols:
|
||||
max-request-size: 2048 # FLOCI_PROTOCOLS_MAX_REQUEST_SIZE: max HTTP request body size in MB (legacy: floci.max-request-size / FLOCI_MAX_REQUEST_SIZE)
|
||||
strict-claiming: false # FLOCI_PROTOCOLS_STRICT_CLAIMING — reject RPC-signaled requests that no supported wire protocol claims
|
||||
reject-unknown-service-scope: true # FLOCI_PROTOCOLS_REJECT_UNKNOWN_SERVICE_SCOPE — reject REST requests signed for a service Floci does not implement
|
||||
|
||||
docker:
|
||||
log-max-size: "10m"
|
||||
log-max-file: "3"
|
||||
docker-host: unix:///var/run/docker.sock
|
||||
resource-namespace: "" # FLOCI_DOCKER_RESOURCE_NAMESPACE; scopes child container/volume names
|
||||
docker-config-path: ""
|
||||
# extra-labels: # Extra Docker labels applied to every Floci-created container and volume
|
||||
# - key: "com.example.project" # (FLOCI_DOCKER_EXTRA_LABELS_0__KEY / _0__VALUE; increment the index for more;
|
||||
# value: my-project # reserved keys floci, floci_emulator, floci_namespace are ignored)
|
||||
# - key: environment
|
||||
# value: dev
|
||||
|
||||
services:
|
||||
ssm:
|
||||
enabled: true
|
||||
max-parameter-history: 5
|
||||
sqs:
|
||||
enabled: true
|
||||
default-visibility-timeout: 30
|
||||
max-message-size: 1048576
|
||||
clear-fifo-deduplication-cache-on-purge: false
|
||||
s3:
|
||||
enabled: true
|
||||
enforce-auth: false
|
||||
default-presign-expiry-seconds: 3600
|
||||
global-bucket-namespace: false
|
||||
dynamodb:
|
||||
enabled: true
|
||||
sns:
|
||||
enabled: true
|
||||
lambda:
|
||||
enabled: true
|
||||
ephemeral: false
|
||||
# Extra Docker create flags for Lambda containers, for example: --env KEY=VALUE --volume /host:/container:ro
|
||||
docker-flags: ""
|
||||
ecr-base-uri: public.ecr.aws # FLOCI_SERVICES_LAMBDA_ECR_BASE_URI — registry for Lambda runtime images (legacy: floci.ecr-base-uri / FLOCI_ECR_BASE_URI)
|
||||
honour-architectures: false # Select the Lambda architecture for Docker pull and create
|
||||
default-memory-mb: 128
|
||||
default-timeout-seconds: 3
|
||||
# 500 ports, not the former 100 (9200-9299): one port is held per running Lambda
|
||||
# container, so this is the concurrent-execution ceiling, and a multi-account LZA needs
|
||||
# ~112 at once. See EmulatorConfig.runtimeApiBasePort for why 12000 and not a wider 9200.
|
||||
# Keep in step with the @WithDefault there — a value set here WINS over the annotation,
|
||||
# so changing only the default silently does nothing (the issue #2225 trap).
|
||||
runtime-api-base-port: 12000
|
||||
runtime-api-max-port: 12499
|
||||
code-path: ./data/lambda-code
|
||||
zip-max-entries: 100000
|
||||
poll-interval-ms: 1000
|
||||
container-idle-timeout-seconds: 300
|
||||
region-concurrency-limit: 1000
|
||||
unreserved-concurrency-min: 100
|
||||
accept-external-layer-arns: false # FLOCI_SERVICES_LAMBDA_ACCEPT_EXTERNAL_LAYER_ARNS - accept a Layers ARN from another account (content is never mounted). AWS answers these through the layer resource policy, which Floci does not model, so the default refuses them like AWS refuses a non-public one. Turn on to attach public layers such as Powertools.
|
||||
# aws-config-path: # Host path to bind-mount (read-only) at /opt/aws-config for real credential discovery
|
||||
# extra-hosts: # Extra /etc/hosts entries for Lambda containers, "hostname:ip" ("host-gateway" allowed as ip)
|
||||
# container-name-prefix: floci # FLOCI_SERVICES_LAMBDA_CONTAINER_NAME_PREFIX — base name prefix for spawned containers and code volumes ([A-Za-z0-9][A-Za-z0-9_.-]*; invalid values fall back to "floci")
|
||||
# code-volume-populate-concurrency: # FLOCI_SERVICES_LAMBDA_CODE_VOLUME_POPULATE_CONCURRENCY — max concurrent first-time code-volume populates (default max(2, cpus/2), which a CPU-constrained container collapses to 2)
|
||||
executor: docker # docker | kubernetes (run Lambda environments as pods)
|
||||
# kubernetes:
|
||||
# namespace: default # Namespace Lambda pods are created in
|
||||
# labels: # Extra pod labels, key=value entries
|
||||
# - team=platform
|
||||
# floci-address: # Host/IP pods use to reach Floci; auto-detected in-cluster
|
||||
# init-image: busybox:1.36 # Init container image (needs sh, wget, unzip)
|
||||
hot-reload:
|
||||
enabled: false
|
||||
apigateway:
|
||||
enabled: true
|
||||
vtl-max-loops: 10000 # Maximum #foreach iterations a VTL mapping template may execute (truncates the loop, does not fail the template)
|
||||
vtl-max-output-chars: 1048576 # Maximum characters a VTL mapping template may render before it fails
|
||||
vtl-timeout-millis: 5000 # Maximum wall-clock time a VTL mapping template may spend evaluating before it fails
|
||||
apigatewayv2:
|
||||
enabled: true
|
||||
iam:
|
||||
enabled: true
|
||||
enforcement-enabled: false
|
||||
seed-deployer-principal: false
|
||||
# account-alias: "" # When set, seeds the account alias at startup so callers can read one
|
||||
# without creating it first. Unset means the account has no alias,
|
||||
# matching AWS. Example: FLOCI_SERVICES_IAM_ACCOUNT_ALIAS=my-account
|
||||
msk:
|
||||
enabled: true
|
||||
mock: false
|
||||
default-image: "redpandadata/redpanda:latest"
|
||||
kafka-host-port-base: 9300
|
||||
kafka-host-port-max: 9399
|
||||
amazonmq:
|
||||
enabled: true
|
||||
mock: false
|
||||
default-image: "rabbitmq:3-management"
|
||||
amqp-host-port-base: 5672
|
||||
amqp-host-port-max: 5699
|
||||
console-host-port-base: 15672
|
||||
console-host-port-max: 15699
|
||||
kinesis-analytics:
|
||||
enabled: true
|
||||
mock: false
|
||||
# default-image: optional override; uncomment to pin every application to a single image
|
||||
# (e.g. a private registry mirror). When unset, the image is chosen from the requested
|
||||
# RuntimeEnvironment (KinesisAnalyticsRuntimes.imageFor, e.g. FLINK-1_19 -> apache/flink:1.19).
|
||||
# default-image: "apache/flink:1.18"
|
||||
elasticache:
|
||||
enabled: true
|
||||
proxy-base-port: 6379
|
||||
proxy-max-port: 6399
|
||||
default-image: "valkey/valkey:8"
|
||||
default-memcached-image: "memcached:1.6"
|
||||
memorydb:
|
||||
enabled: true
|
||||
mock: false
|
||||
proxy-base-port: 6400
|
||||
proxy-max-port: 6419
|
||||
default-image: "valkey/valkey:8"
|
||||
redshift:
|
||||
enabled: true
|
||||
default-port: 5439
|
||||
image-version: postgres:15-alpine
|
||||
poll-interval-ms: 1000
|
||||
proxy-base-port: 7100
|
||||
proxy-max-port: 7199
|
||||
default-credential-duration-seconds: 900 # GetClusterCredentials default lifetime (900-3600)
|
||||
# endpoint-host: localhost # Hostname clients use; empty -> DockerHostResolver
|
||||
proxy-handshake-timeout-millis: 10000 # Max time a client has to complete the startup/auth handshake
|
||||
proxy-backend-connect-timeout-millis: 5000 # Max time to wait for the backend TCP connect
|
||||
proxy-max-connections: 100 # Max concurrent proxy connections before new ones are refused
|
||||
rds:
|
||||
enabled: true
|
||||
mock: false # FLOCI_SERVICES_RDS_MOCK — true = metadata only, no Docker (useful for CI)
|
||||
proxy-base-port: 7001
|
||||
proxy-max-port: 7099
|
||||
# endpoint-host: localhost # Hostname clients use; enables published-port translation in Docker
|
||||
# Omit image overrides to adapt Floci's built-in images to EngineVersion.
|
||||
# Uncomment an override to pin that engine to an exact image.
|
||||
# default-postgres-image: "registry.example.com/postgres:16-alpine"
|
||||
# default-mysql-image: "registry.example.com/mysql:8.0"
|
||||
# default-mariadb-image: "registry.example.com/mariadb:11"
|
||||
default-sql-server-image: "mcr.microsoft.com/mssql/server:2022-latest"
|
||||
proxy-handshake-timeout-millis: 10000 # Max time a client has to complete the startup/auth handshake
|
||||
proxy-backend-connect-timeout-millis: 5000 # Max time to wait for the backend TCP connect
|
||||
proxy-max-connections: 100 # Max concurrent proxy connections before new ones are refused
|
||||
rds-data:
|
||||
enabled: true
|
||||
transaction-ttl-seconds: 180
|
||||
redshift-data:
|
||||
enabled: true
|
||||
result-ttl-hours: 24
|
||||
neptune:
|
||||
enabled: true
|
||||
proxy-base-port: 8182
|
||||
proxy-max-port: 8282
|
||||
db-type: "gremlin"
|
||||
default-image: "tinkerpop/gremlin-server:3.7.3"
|
||||
default-neo4j-image: "neo4j:5-community"
|
||||
eventbridge:
|
||||
enabled: true
|
||||
cloudmap:
|
||||
enabled: true
|
||||
emr:
|
||||
enabled: true
|
||||
wafv2:
|
||||
enabled: true
|
||||
scheduler:
|
||||
enabled: true
|
||||
cloudwatchlogs:
|
||||
enabled: true
|
||||
max-events-per-query: 10000
|
||||
max-stored-events: 20000
|
||||
cloudwatchmetrics:
|
||||
enabled: true
|
||||
secretsmanager:
|
||||
enabled: true
|
||||
default-recovery-window-days: 30
|
||||
scheduled-rotation-enabled: true
|
||||
rotation-tick-seconds: 60
|
||||
kinesis:
|
||||
enabled: true
|
||||
firehose:
|
||||
enabled: true
|
||||
tick-interval-seconds: 10
|
||||
flush-record-count: 0
|
||||
staging-bucket: floci-firehose-staging
|
||||
kms:
|
||||
enabled: true
|
||||
cognito:
|
||||
enabled: true
|
||||
stepfunctions:
|
||||
enabled: true
|
||||
allow-plaintext-http: false
|
||||
mock-config-file: ${SFN_MOCK_CONFIG:}
|
||||
swf:
|
||||
enabled: true
|
||||
timeout-sweep-enabled: true
|
||||
timeout-sweep-interval-seconds: 1
|
||||
cloudformation:
|
||||
enabled: true
|
||||
# Fail an AWS::Lambda::Function whose S3 code cannot be read, as real CloudFormation
|
||||
# does. Set true to fall back to the built-in stub handler instead (issue #2648).
|
||||
allow-stub-lambda-code: false
|
||||
# Stub a resource whose type has no provisioner: synthetic physical id, arn:aws:stub:::
|
||||
# ARN attribute, CREATE_COMPLETE, reported at warn with a resource status reason. Set
|
||||
# false to fail such a resource instead, which rolls the stack back.
|
||||
allow-stub-unsupported-resource-types: true
|
||||
acm:
|
||||
enabled: true
|
||||
validation-wait-seconds: 0
|
||||
athena:
|
||||
enabled: true
|
||||
mock: false
|
||||
duck:
|
||||
# url: http://floci-duck:3000 # set to skip container management
|
||||
default-image: "floci/floci-duck:latest"
|
||||
glue:
|
||||
enabled: true
|
||||
ses:
|
||||
enabled: true
|
||||
# smtp-host: mailpit # SMTP server for email relay (empty = store only)
|
||||
# smtp-port: 1025
|
||||
# smtp-user: ""
|
||||
# smtp-pass: ""
|
||||
# smtp-starttls: DISABLED # DISABLED, OPTIONAL, or REQUIRED
|
||||
opensearch:
|
||||
enabled: true
|
||||
mock: false
|
||||
# default-image: optional override; uncomment to lock every domain to a
|
||||
# single image (e.g. private registry mirror). When unset, the image is
|
||||
# picked from OpenSearchVersions.imageFor(EngineVersion).
|
||||
# default-image: "registry.example.com/opensearch:2.19.5"
|
||||
proxy-base-port: 9400
|
||||
proxy-max-port: 9499
|
||||
keep-running-on-shutdown: false
|
||||
ec2:
|
||||
enabled: true
|
||||
imds-port: 9169
|
||||
# Sweep EC2 containers left on the daemon by a previous run that died mid-launch or
|
||||
# mid-terminate (SIGKILL, OOM, docker kill), which no surviving record refers to.
|
||||
# Scoped to this deployment's own containers; stopped instances are never swept.
|
||||
reconcile-containers-on-startup: true
|
||||
ssh-port-range-start: 2200
|
||||
ssh-port-range-end: 2299
|
||||
publish-security-group-ports: true
|
||||
app-port-range-start: 30000
|
||||
app-port-range-end: 30999
|
||||
max-published-ports-per-instance: 20
|
||||
socat-image: alpine/socat
|
||||
mock: false
|
||||
aws-faithful-private-ip: false
|
||||
# container-ips-routable: true # Auto-detected by default (a throwaway TCP probe toward
|
||||
# the container network). Set explicitly when the probe
|
||||
# can't speak for your clients, e.g. Floci itself running
|
||||
# containerized. FLOCI_SERVICES_EC2_CONTAINER_IPS_ROUTABLE
|
||||
# Each VPC gets a real Docker network, so an instance's private IP is an address its
|
||||
# container actually holds and instances in different VPCs are on different bridges.
|
||||
vpc-networks:
|
||||
enabled: true # FLOCI_SERVICES_EC2_VPC_NETWORKS_ENABLED
|
||||
# Used only when a declared VPC CIDR cannot be honoured: absent, malformed, outside
|
||||
# RFC 1918, or already claimed on this Docker daemon. Substitutions are logged at WARN;
|
||||
# a reported private IP that does not match the declared CIDR is never silent.
|
||||
fallback-pool: 10.240.0.0/12 # FLOCI_SERVICES_EC2_VPC_NETWORKS_FALLBACK_POOL
|
||||
fallback-prefix-length: 16 # FLOCI_SERVICES_EC2_VPC_NETWORKS_FALLBACK_PREFIX_LENGTH
|
||||
# Remove VPC networks left behind by a previous run of THIS emulator (scoped by API port,
|
||||
# so Floci instances sharing a daemon never reconcile each other's networks).
|
||||
reconcile-on-startup: true # FLOCI_SERVICES_EC2_VPC_NETWORKS_RECONCILE_ON_STARTUP
|
||||
driver: bridge # FLOCI_SERVICES_EC2_VPC_NETWORKS_DRIVER
|
||||
ecs:
|
||||
enabled: true
|
||||
mock: false
|
||||
publish-awsvpc-ports-to-host: false
|
||||
host-volume-roots: []
|
||||
allow-unsafe-host-volumes: false
|
||||
appconfig:
|
||||
enabled: true
|
||||
appconfigdata:
|
||||
enabled: true
|
||||
ecr:
|
||||
enabled: true
|
||||
registry-image: "registry:2"
|
||||
registry-container-name: floci-ecr-registry
|
||||
registry-base-port: 5100
|
||||
registry-max-port: 5199
|
||||
data-path: ./data/ecr
|
||||
tls-enabled: false
|
||||
keep-running-on-shutdown: true
|
||||
uri-style: hostname
|
||||
prefer-local-images: true
|
||||
ui:
|
||||
enabled: true
|
||||
image: "floci/floci-ui:latest"
|
||||
container-name: floci-ui
|
||||
port: 4500
|
||||
keep-running-on-shutdown: false
|
||||
# endpoint: unset by default — Floci derives the sidecar's callback address automatically.
|
||||
# Set an absolute http:// or https:// URL here only to override that derivation.
|
||||
insecure-skip-tls-verify: false
|
||||
# The console-contract keys below are deliberately unset. Floci reads the console's own
|
||||
# io.floci.console.* image labels first, then a built-in profile, then the contract defaults
|
||||
# (/api/health, port 4500, status: ok). Setting a value here overrides all of that, so only
|
||||
# do it for a console that describes itself neither way. See docs/ui/console-contract.md.
|
||||
# internal-port: 4500
|
||||
# endpoint-env: AWS_ENDPOINT_URL
|
||||
# status-path: /api/health
|
||||
# status-ready-field: status # "none" means any 200 counts as ready
|
||||
# status-ready-value: ok
|
||||
# status-unavailable-value: unavailable
|
||||
# extra-env: # PORT and AWS_ENDPOINT_URL are ignored here: use
|
||||
# - MY_CONSOLE_FLAG=true # internal-port and endpoint above instead
|
||||
bedrock:
|
||||
enabled: true
|
||||
bedrock-runtime:
|
||||
enabled: true
|
||||
backend: stub
|
||||
proxy:
|
||||
passthrough: false
|
||||
# url: http://localhost:11434/v1
|
||||
# api-key: sk-...
|
||||
# default-model: llama3
|
||||
# model-mapping: "anthropic.claude-3-sonnet-20240229-v1:0=claude-3-sonnet"
|
||||
eks:
|
||||
enabled: true
|
||||
mock: false
|
||||
provider: k3s
|
||||
default-image: "rancher/k3s:latest"
|
||||
# image-template: "myregistry.io/k3s:v%s" # optional custom image format template taking cluster version
|
||||
api-server-base-port: 6500
|
||||
api-server-max-port: 6599
|
||||
data-path: ./data/eks
|
||||
keep-running-on-shutdown: false
|
||||
endpoint-mode: host # host = https://localhost:<hostPort> (host-reachable); network = container DNS name
|
||||
iam-auth-webhook: true # validate `aws eks get-token` SigV4 tokens through a k3s webhook
|
||||
ecr-registry-mirror: true # inject a registries.yaml so pods can pull images pushed to Floci ECR
|
||||
disable-cni: false # start k3s without its bundled flannel/kube-proxy so a real CNI (e.g. Cilium) can take over
|
||||
imds: false # expose link-local IMDS (169.254.169.254) inside the cluster container
|
||||
imds-pod-network: false # route link-local IMDS traffic from ordinary pod network namespaces (requires imds: true)
|
||||
irsa-signing-key: true # sign k3s service account tokens with the cluster OIDC key
|
||||
pod-identity-webhook: true # register a mutating webhook that injects pod identity credentials (needs floci.tls.enabled)
|
||||
mwaa:
|
||||
enabled: true
|
||||
mock: false
|
||||
default-postgres-image: "postgres:16-alpine"
|
||||
supported-versions: "2.10.5,2.9.3,2.8.4"
|
||||
default-version: "2.10.5"
|
||||
proxy-base-port: 8700
|
||||
proxy-max-port: 8799
|
||||
data-path: ./data/mwaa
|
||||
keep-running-on-shutdown: false
|
||||
dag-sync-interval-seconds: 30
|
||||
install-requirements: true
|
||||
elb:
|
||||
enabled: true
|
||||
mock: false
|
||||
elbv2:
|
||||
enabled: true
|
||||
mock: false
|
||||
codebuild:
|
||||
enabled: true
|
||||
# docker-network: floci-network
|
||||
sagemaker:
|
||||
enabled: true
|
||||
# docker-network: floci-network
|
||||
gpu:
|
||||
# Off by default: an existing deployment keeps launching CPU-only
|
||||
# containers. How many GPUs an ml.* type has is shipped in
|
||||
# sagemaker/instance-type-catalog.yaml; this is only about which of
|
||||
# this machine's devices Floci may hand out.
|
||||
enabled: false
|
||||
# cdi | device-ids | count. Podman resolves only cdi, and accepts
|
||||
# count while attaching no device, so cdi fails loudly instead.
|
||||
mode: cdi
|
||||
# Required for cdi and device-ids modes; unset allows no device.
|
||||
# devices:
|
||||
# - nvidia.com/gpu=GPU-<uuid>
|
||||
batch:
|
||||
enabled: true
|
||||
runner-mode: immediate
|
||||
# docker-network: floci-network
|
||||
codedeploy:
|
||||
enabled: true
|
||||
codepipeline:
|
||||
enabled: true
|
||||
autoscaling:
|
||||
enabled: true
|
||||
applicationautoscaling:
|
||||
enabled: true
|
||||
elasticbeanstalk:
|
||||
enabled: true
|
||||
backup:
|
||||
enabled: true
|
||||
job-completion-delay-seconds: 3
|
||||
fis:
|
||||
enabled: true
|
||||
route53:
|
||||
enabled: true
|
||||
vpc-association-control-plane-delay-ms: 0
|
||||
transfer:
|
||||
enabled: true
|
||||
textract:
|
||||
enabled: true
|
||||
comprehend:
|
||||
enabled: true
|
||||
rekognition:
|
||||
enabled: true
|
||||
translate:
|
||||
enabled: true
|
||||
pricing:
|
||||
enabled: true
|
||||
transcribe:
|
||||
enabled: true
|
||||
ce:
|
||||
enabled: true
|
||||
credit-usd-monthly: 0.0
|
||||
cur:
|
||||
enabled: true
|
||||
emit-mode: synchronous
|
||||
staging-bucket: floci-cur-staging
|
||||
bcm-pricing-calculator:
|
||||
enabled: true
|
||||
timestream-influxdb:
|
||||
enabled: true
|
||||
mock: false # FLOCI_SERVICES_TIMESTREAM_INFLUXDB_MOCK: true = metadata only, no Docker
|
||||
default-image: "influxdb:2.7"
|
||||
host-port-base: 8086
|
||||
host-port-max: 8185
|
||||
readiness-timeout-seconds: 120
|
||||
# docker-network: my-network # Docker network to attach InfluxDB containers to
|
||||
bcm-data-exports:
|
||||
enabled: true
|
||||
emit-mode: synchronous
|
||||
oam:
|
||||
enabled: true
|
||||
cloudtrail:
|
||||
enabled: true
|
||||
lightsail:
|
||||
enabled: true
|
||||
cloudcontrol:
|
||||
enabled: true
|
||||
resourceexplorer2:
|
||||
enabled: true
|
||||
cloudfront:
|
||||
enabled: true
|
||||
allowed-private-origin-hosts: []
|
||||
appsync:
|
||||
enabled: true
|
||||
schema-worker-threads: 4
|
||||
schema-worker-shutdown-timeout-seconds: 30
|
||||
vtl-max-loops: 10000 # Maximum #foreach iterations a VTL resolver template may execute (truncates the loop, does not fail the template)
|
||||
vtl-max-output-chars: 1048576 # Maximum characters a VTL resolver template may render before it fails
|
||||
vtl-timeout-millis: 5000 # Maximum wall-clock time a VTL resolver template may spend evaluating before it fails
|
||||
# graphql-url: http://floci-graphql:8181 # set to skip sidecar container management
|
||||
# Exact version on purpose: a cached :latest is never re-pulled. Published from floci-io/floci-sidecars.
|
||||
graphql-image: "floci/floci-sidecar-graphql:0.2.0"
|
||||
s3vectors:
|
||||
enabled: true
|
||||
s3tables:
|
||||
enabled: true
|
||||
iot:
|
||||
enabled: true
|
||||
rule-sql-strict: false
|
||||
# endpoint-address: "" # DescribeEndpoint value when the AWS IoT ports (8883, 443, 8443) reach Floci; default: host and port of base-url
|
||||
mqtt:
|
||||
enabled: true
|
||||
auto-start: false
|
||||
host: 0.0.0.0
|
||||
port: 1883
|
||||
tls-port: 8883
|
||||
iotdata:
|
||||
enabled: true
|
||||
cloudhsmv2:
|
||||
enabled: true
|
||||
efs:
|
||||
enabled: true
|
||||
organizations:
|
||||
enabled: true
|
||||
# management-account-email: "" # When set, overrides the management-account email reported by DescribeOrganization and account listings.
|
||||
rum:
|
||||
enabled: true
|
||||
networkfirewall:
|
||||
enabled: true
|
||||
servicecatalog:
|
||||
enabled: true
|
||||
guardduty:
|
||||
enabled: true
|
||||
emrserverless:
|
||||
enabled: true
|
||||
ssoadmin:
|
||||
enabled: true
|
||||
ssooidc:
|
||||
enabled: true
|
||||
local-principal-id: ${FLOCI_SERVICES_SSOOIDC_LOCAL_PRINCIPAL_ID:}
|
||||
macie2:
|
||||
enabled: true
|
||||
account:
|
||||
enabled: true
|
||||
controlcatalog:
|
||||
enabled: true
|
||||
accessanalyzer:
|
||||
enabled: true
|
||||
identitystore:
|
||||
enabled: true
|
||||
scim-bearer-token: ${FLOCI_SERVICES_IDENTITYSTORE_SCIM_BEARER_TOKEN:floci-scim-token}
|
||||
budgets:
|
||||
enabled: true
|
||||
inspector2:
|
||||
enabled: true
|
||||
securityhub:
|
||||
enabled: true
|
||||
detective:
|
||||
enabled: true
|
||||
controltower:
|
||||
enabled: true
|
||||
seed-landing-zone: false
|
||||
route53resolver:
|
||||
enabled: true
|
||||
connect:
|
||||
enabled: true
|
||||
appintegrations:
|
||||
enabled: true
|
||||
cognitoidentity:
|
||||
enabled: true
|
||||
globalaccelerator:
|
||||
enabled: true
|
||||
datasync:
|
||||
enabled: true
|
||||
aps:
|
||||
enabled: true
|
||||
lakeformation:
|
||||
enabled: true
|
||||
tagging:
|
||||
enabled: true
|
||||
pipes:
|
||||
enabled: true
|
||||
kafka-rest-bridge:
|
||||
default-image: "ghcr.io/aiven-open/karapace:latest"
|
||||
host-port-base: 9500
|
||||
host-port-max: 9599
|
||||
configservice:
|
||||
enabled: true
|
||||
docdb:
|
||||
enabled: true
|
||||
mock: false
|
||||
default-image: "mongo:7.0"
|
||||
bedrock-agent-core:
|
||||
enabled: true
|
||||
# invoke-response: '{"output":"yes"}' # Body returned by InvokeAgentRuntime
|
||||
# validate-runtime-exists: false # true = reject unknown runtime ARNs
|
||||
# harness-echo-prefix: 'You said: ' # Prefix on the reply InvokeHarness streams back
|
||||
# harness-empty-reply: 'No user message was supplied.'
|
||||
bedrock-agent-core-control:
|
||||
enabled: true
|
||||
servicequotas:
|
||||
enabled: true
|
||||
verifiedpermissions:
|
||||
enabled: true
|
||||
# cedar-url: http://floci-cedar:8180 # set to skip sidecar container management
|
||||
# Exact version on purpose: a cached :latest is never re-pulled. Published from floci-io/floci-sidecars.
|
||||
cedar-image: "floci/floci-sidecar-cedar:1.1.0"
|
||||
ram:
|
||||
enabled: true
|
||||
codegurureviewer:
|
||||
enabled: true
|
||||
codeartifact:
|
||||
enabled: true
|
||||
# maven-url: http://floci-reposilite:8080 # set to skip Reposilite sidecar container management
|
||||
maven-image: "dzikoysk/reposilite:3.6.3"
|
||||
marketplace:
|
||||
enabled: true
|
||||
dms:
|
||||
enabled: true
|
||||
Reference in New Issue
Block a user