Zakaria/FlociClone
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity
Files
fix/efs-shared-file-system
FlociClone/src/main/resources/application.yml
T
Zakaria bc3d16bfb6 feat(efs): one shared store per file system, served to EC2 over NFS 
An EFS file system is now one Docker volume, floci-efs-<file system id>,
that every mount of it shares, as on AWS:

- An access point or ECS rootDirectory mounts its folder of that volume
  (Docker volume subpath), so a mount of the file system root sees every
  access point's files, and Lambda and ECS see each other's. Before, each
  access point (Lambda) or root directory (ECS) got its own volume.
- An access point's root directory is created on first use from its
  CreationInfo, every missing directory on the path with its owner and
  permissions; without CreationInfo a missing root directory is refused.
- A Lambda function runs as the access point's POSIX user and secondary
  groups. ECS tasks keep their own user, as on AWS.
- CreateAccessPoint validates RootDirectory.Path, CreationInfo and
  PosixUser the way EFS does.
- DeleteFileSystem removes the file system's volume.

Each mount target is now a real EC2 network interface in its subnet, so
its address comes from the subnet's lease table and no instance is handed
it, and a privileged helper container serves the volume over NFSv4.1 at
that address on the VPC's Docker network (kernel nfsd, image built
locally from docker/efs-nfs-server.Dockerfile). A mount target is
creating until its server answers. The embedded DNS server resolves
[zone.]fs-id.efs.region.amazonaws.com to a mount target, so an EC2
instance mounts the file system with AWS's own commands (NFS client or
amazon-efs-utils without tls). Servers come back after a restart, their
addresses re-reserved first. floci.services.efs.nfs-servers turns it off.

Two EC2 fixes this needed:
- DeleteNetworkInterface returns the interface's addresses to the subnet;
  they stayed leased until restart, also for ECS awsvpc tasks.
- A VPC whose CIDR is substituted keeps each subnet at its declared
  offset inside the substitute range, instead of the next free slice in
  declaration order, so the plan and persisted addresses survive a
  restart that loads subnets in another order.
2026-10-25 21:44:24 -04:00

849 lines
36 KiB
YAML
Raw Permalink Blame History

quarkus:
jackson:
# Quarkus 3.37 stopped tolerating empty response beans; AWS StartApplication/
# StopApplication legitimately return {}, so keep the pre-3.37 behaviour.
fail-on-empty-beans: false
log:
console:
format: "%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c{3.}] %s%e%n"
category:
"io.apicurio":
level: WARN
http:
port: ${floci.port}
# Loopback by default. Any other address (0.0.0.0, a LAN IP) also needs
# floci.security.allow-unsafe-network-exposure, or Floci refuses to start.
# Env var: QUARKUS_HTTP_HOST=0.0.0.0
host: 127.0.0.1
# Quarkus 3.38 added a Host-header validation filter (DNS-rebinding protection for a dev server)
# that it switches on by itself whenever the server is bound to loopback, which Floci is by
# default. In TLS mode Quarkus listens on 127.0.0.1:4510/4511 behind the TCP proxy on 4566, and
# the proxy passes the client's Host header through untouched. The filter is an exact-match set with no
# wildcard support, and with require-localhost it admits only localhost, 127.0.0.1 and [::1].
# An emulator has to answer under the names it documents and puts in its certificate
# (localhost.floci.io, *.localhost.floci.io, *.execute-api.localhost.floci.io,
# host.docker.internal) and under whatever a compose file calls it (FLOCI_HOSTNAME), none of
# which an exact-match allow-list can express. Disabling the check restores the behaviour of
# every release before Quarkus 3.39; the access boundary of a local emulator is the IAM and
# signature enforcement configuration.
host-validation:
require-localhost: false
limits:
max-body-size: ${floci.protocols.max-request-size}M
shutdown:
# Enables the pre-shutdown phase so stop hooks run before the HTTP server stops.
# No 'delay' value is set - observers run synchronously, no artificial sleep is introduced.
delay-enabled: true
native:
# quarkus-jdbc-mysql used to force this. Without it the image has only UTF-8, UTF-16,
# ISO-8859-1 and US-ASCII, which breaks latin1 MySQL columns and non-UTF-8 mail bodies.
add-all-charsets: true
resources:
# The Pricing service reads its bundled snapshot, EC2 reads its image
# catalog (ec2/image-catalog.yaml), SageMaker reads its instance type
# catalog (sagemaker/instance-type-catalog.yaml), AppSync's GraphQL
# parser reads its message bundles, and API Gateway's Velocity engine
# reads its default properties at runtime via
# ClassLoader#getResourceAsStream. Quarkus's static resource analysis
# cannot detect these dynamically-built paths, so they are registered
# explicitly to ensure GraalVM includes every file in the native image.
# The IAM managed-policy catalog (iam/*) is not listed on purpose.
# AwsManagedPolicies parses it while the image is built and the parsed
# catalog lives in the image heap, so the 3.5 MB of source files would
# only be a second copy of the same data.
includes:
- pricing-snapshots/**
- ui/*.html
- ec2/*.yaml
- sagemaker/*.yaml
- eks/*.json
- i18n/*.properties
- org/apache/velocity/runtime/defaults/*.properties
# DriverManager finds the JDBC drivers through ServiceLoader, and the MySQL
# driver reads its time zone table at connect time.
- META-INF/services/java.sql.Driver
- com/mysql/cj/util/TimeZoneMapping.properties
# snappy-java registers 27 JNI libraries, one per platform. Only the one
# for the running platform loads, so 23 are dropped. Linux x86_64 and
# aarch64 cover the published images, Mac covers a local native build.
excludes:
- org/xerial/snappy/native/AIX/**
- org/xerial/snappy/native/FreeBSD/**
- org/xerial/snappy/native/SunOS/**
- org/xerial/snappy/native/Windows/**
- org/xerial/snappy/native/Linux/android-aarch64/**
- org/xerial/snappy/native/Linux/android-arm/**
- org/xerial/snappy/native/Linux/arm/**
- org/xerial/snappy/native/Linux/armv6/**
- org/xerial/snappy/native/Linux/armv7/**
- org/xerial/snappy/native/Linux/loongarch64/**
- org/xerial/snappy/native/Linux/ppc/**
- org/xerial/snappy/native/Linux/ppc64/**
- org/xerial/snappy/native/Linux/ppc64le/**
- org/xerial/snappy/native/Linux/riscv64/**
- org/xerial/snappy/native/Linux/s390x/**
- org/xerial/snappy/native/Linux/x86/**
- org/xerial/snappy/native/Linux/x86_64-musl/**
# No --allow-incomplete-classpath and no --report-unsupported-elements-at-runtime: both have
# been no-ops since GraalVM 22.1 (incomplete classpaths are the default, and Quarkus passes
# --link-at-build-time itself, so a reachable class missing from the classpath fails the build).
additional-build-args:
- --enable-url-protocols=http,https
- --initialize-at-run-time=io.vertx.ext.mail.impl.sasl.NTLMEngineImpl
- --initialize-at-run-time=com.github.dockerjava.transport.NamedPipeSocket$Kernel32
- --initialize-at-run-time=io.github.hectorvent.floci.services.acm.AcmService
- --initialize-at-run-time=io.github.hectorvent.floci.services.acm.CertificateGenerator
- --initialize-at-run-time=io.github.hectorvent.floci.config.TlsConfigSource
- --initialize-at-run-time=io.github.hectorvent.floci.services.cognito.CognitoSrpHelper
- --initialize-at-run-time=io.github.hectorvent.floci.services.route53.Route53Service
- --initialize-at-run-time=io.github.hectorvent.floci.services.kms.KmsService
- --initialize-at-run-time=io.github.hectorvent.floci.services.bedrockagentcore.BedrockAgentCoreEventService
- --initialize-at-run-time=io.github.hectorvent.floci.services.cloudfront.CloudFrontService
- --initialize-at-run-time=io.github.hectorvent.floci.services.emr.EmrService
- --initialize-at-run-time=io.github.hectorvent.floci.services.elasticbeanstalk.ElasticBeanstalkService
- --initialize-at-run-time=io.github.hectorvent.floci.services.elb.ElbClassicService
- --initialize-at-run-time=io.github.hectorvent.floci.services.datasync.DataSyncService
- --initialize-at-run-time=io.github.hectorvent.floci.services.lambda.launcher.LambdaExecutionRoleCredentials
- --initialize-at-run-time=io.github.hectorvent.floci.services.ssoportal.SsoPortalService
- --initialize-at-run-time=io.github.hectorvent.floci.services.redshift.proxy.S3CopySimulator
# snappy-java (Firehose Snappy/HADOOP_SNAPPY delivery) extracts and loads a
# bundled JNI library from the static initializers of these two classes.
- --initialize-at-run-time=org.xerial.snappy.Snappy
- --initialize-at-run-time=org.xerial.snappy.SnappyLoader
- --initialize-at-run-time=org.postgresql.util.PasswordUtil$SecureRandomHolder
- --initialize-at-run-time=org.postgresql.util.LazyCleanerImpl
# Build-time property. The MySQL driver's AbandonedConnectionCleanupThread starts an
# executor thread in its static initializer unless this is set, and a started thread
# in the image heap fails the build.
- -J-Dcom.mysql.cj.disableAbandonedConnectionCleanup=true
floci:
port: 4566
base-url: "http://localhost:4566"
network:
security-group-enforcement:
enabled: false
helper-image: floci/network-helper:local
# hostname: "" # When set, overrides the hostname in response URLs (e.g. SQS QueueUrl).
# Needed for multi-container Docker setups. Example: FLOCI_HOSTNAME=floci
default-region: us-east-1
default-account-id: "000000000000"
# Shared mock-response config for Textract/Comprehend/Rekognition/Translate. See AiMockConfigLoader.
ai-mock-config-file: ${AI_MOCK_CONFIG:}
storage:
# Supported modes: memory, persistent, hybrid, wal
mode: memory
persistent-path: ./data
host-persistent-path: ./data
prune-volumes-on-delete: false
# EFS access-point emulation for the shared local Docker volumes that stand in for EFS file
# systems. All opt-in; with the defaults below (and no owner/permission overrides) volumes are
# plain named volumes, so existing behaviour is unchanged. Emulates an access point's
# RootDirectory.CreationInfo (owner-uid/owner-gid/root-permissions) and PosixUser
# (mount-user/mount-group-add).
efs:
# owner-uid: # RootDirectory.CreationInfo.OwnerUid applied to the volume root (set with owner-gid)
# owner-gid: # RootDirectory.CreationInfo.OwnerGid applied to the volume root (set with owner-uid)
# root-permissions: # CreationInfo.Permissions, 3-4 octal digits; e.g. "0777", or "2775" for setgid
init-image: busybox:stable
# mount-user: # run mounting containers as "uid[:gid]" (access point PosixUser)
# mount-group-add: # supplementary gid added to mounting containers
wal:
compaction-interval-ms: 30000
services:
ssm:
flush-interval-ms: 5000
kafkaconnect:
flush-interval-ms: 5000
dynamodb:
flush-interval-ms: 5000
sns:
flush-interval-ms: 5000
lambda:
flush-interval-ms: 5000
cloudwatchlogs:
flush-interval-ms: 15000
cloudwatchmetrics:
flush-interval-ms: 5000
secretsmanager:
flush-interval-ms: 5000
acm:
flush-interval-ms: 5000
opensearch:
flush-interval-ms: 5000
sagemaker:
flush-interval-ms: 5000
batch:
flush-interval-ms: 5000
lightsail:
flush-interval-ms: 5000
codepipeline:
flush-interval-ms: 5000
s3vectors:
flush-interval-ms: 5000
s3tables:
flush-interval-ms: 5000
ecs:
flush-interval-ms: 5000
codebuild:
flush-interval-ms: 5000
config:
flush-interval-ms: 5000
transcribe:
flush-interval-ms: 5000
codedeploy:
flush-interval-ms: 5000
tagging:
flush-interval-ms: 5000
elasticbeanstalk:
flush-interval-ms: 5000
rds:
# Override storage mode for RDS (memory = no Docker volumes; hybrid/persistent = named volume per instance)
# mode: memory
ec2:
# Override storage mode for EC2 (defaults to the global storage mode). EC2 networking and
# instance metadata persist so CloudFormation-created VPC/subnet ids survive a restart (#1297).
# mode: memory
appsync:
flush-interval-ms: 5000
rum:
flush-interval-ms: 5000
resourceexplorer2:
mode: hybrid
flush-interval-ms: 5000
fis:
flush-interval-ms: 5000
guardduty:
flush-interval-ms: 5000
emrserverless:
flush-interval-ms: 5000
lakeformation:
flush-interval-ms: 5000
dns:
# Extra hostname suffixes resolved to Floci's container IP by the embedded DNS server.
# Useful when migrating from LocalStack — add localhost.localstack.cloud to avoid
# changing Lambda endpoint environment variables.
# Via env var (comma-separated): FLOCI_DNS_EXTRA_SUFFIXES=localhost.localstack.cloud,other.internal
# extra-suffixes:
# - localhost.localstack.cloud
# Public resolvers appended after Floci's embedded DNS on spawned containers' HostConfig.Dns,
# and used as the fallback upstream for Floci's own DNS forwarder. Lets Lambda/CodeBuild
# resolve public hostnames even if the embedded forwarder cannot answer.
# Disable in offline/locked-down networks where these resolvers are blocked.
container-fallback-enabled: true # FLOCI_DNS_CONTAINER_FALLBACK_ENABLED
container-fallback-servers: # FLOCI_DNS_CONTAINER_FALLBACK_SERVERS=1.1.1.1,1.0.0.1
- 8.8.8.8
- 8.8.4.4
auth:
validate-signatures: false
presign-secret: local-emulator-secret
security:
# Comma-separated browser origins allowed by the global CORS filter.
# Env var: EXTRA_CORS_ALLOWED_ORIGINS=http://localhost:3000
extra-cors-allowed-origins: ${EXTRA_CORS_ALLOWED_ORIGINS:}
# Extra request/response CORS header names for browser clients.
extra-cors-allowed-headers: ${EXTRA_CORS_ALLOWED_HEADERS:}
extra-cors-expose-headers: ${EXTRA_CORS_EXPOSE_HEADERS:}
disable-cors-headers: false
# Grant Private Network Access preflights (Access-Control-Allow-Private-Network)
# so a page on a public/secure origin can reach this loopback backend.
cors-allow-private-network: false
# Allow quarkus.http.host, and the TLS proxy that uses it, to listen outside loopback
# (127.0.0.0/8, ::1, localhost). Anyone who can reach that address can call Floci's APIs.
# The Docker images set it, since they listen on 0.0.0.0 inside the container.
# Env var: FLOCI_SECURITY_ALLOW_UNSAFE_NETWORK_EXPOSURE=true
allow-unsafe-network-exposure: false
allow-private-jwt-targets: false
tls:
enabled: false # FLOCI_TLS_ENABLED (default: false)
# cert-path: "" # FLOCI_TLS_CERT_PATH (PEM certificate file)
# key-path: "" # FLOCI_TLS_KEY_PATH (PEM private key file)
self-signed: true # FLOCI_TLS_SELF_SIGNED: auto-generate a server cert signed by Floci's local CA if no cert-path provided
aws-https-port: 443 # FLOCI_TLS_AWS_HTTPS_PORT — also bind 443 so CDK cfn-response/AWS-on-443 callbacks reach Floci (0 disables)
protocols:
max-request-size: 2048 # FLOCI_PROTOCOLS_MAX_REQUEST_SIZE: max HTTP request body size in MB (legacy: floci.max-request-size / FLOCI_MAX_REQUEST_SIZE)
strict-claiming: false # FLOCI_PROTOCOLS_STRICT_CLAIMING — reject RPC-signaled requests that no supported wire protocol claims
reject-unknown-service-scope: true # FLOCI_PROTOCOLS_REJECT_UNKNOWN_SERVICE_SCOPE — reject REST requests signed for a service Floci does not implement
docker:
log-max-size: "10m"
log-max-file: "3"
docker-host: unix:///var/run/docker.sock
resource-namespace: "" # FLOCI_DOCKER_RESOURCE_NAMESPACE; scopes child container/volume names
docker-config-path: ""
# extra-labels: # Extra Docker labels applied to every Floci-created container and volume
# - key: "com.example.project" # (FLOCI_DOCKER_EXTRA_LABELS_0__KEY / _0__VALUE; increment the index for more;
# value: my-project # reserved keys floci, floci_emulator, floci_namespace are ignored)
# - key: environment
# value: dev
services:
ssm:
enabled: true
max-parameter-history: 5
sqs:
enabled: true
default-visibility-timeout: 30
max-message-size: 1048576
clear-fifo-deduplication-cache-on-purge: false
s3:
enabled: true
enforce-auth: false
default-presign-expiry-seconds: 3600
global-bucket-namespace: false
dynamodb:
enabled: true
sns:
enabled: true
lambda:
enabled: true
ephemeral: false
# Extra Docker create flags for Lambda containers, for example: --env KEY=VALUE --volume /host:/container:ro
docker-flags: ""
ecr-base-uri: public.ecr.aws # FLOCI_SERVICES_LAMBDA_ECR_BASE_URI — registry for Lambda runtime images (legacy: floci.ecr-base-uri / FLOCI_ECR_BASE_URI)
honour-architectures: false # Select the Lambda architecture for Docker pull and create
default-memory-mb: 128
default-timeout-seconds: 3
# 500 ports, not the former 100 (9200-9299): one port is held per running Lambda
# container, so this is the concurrent-execution ceiling, and a multi-account LZA needs
# ~112 at once. See EmulatorConfig.runtimeApiBasePort for why 12000 and not a wider 9200.
# Keep in step with the @WithDefault there — a value set here WINS over the annotation,
# so changing only the default silently does nothing (the issue #2225 trap).
runtime-api-base-port: 12000
runtime-api-max-port: 12499
code-path: ./data/lambda-code
zip-max-entries: 100000
poll-interval-ms: 1000
container-idle-timeout-seconds: 300
region-concurrency-limit: 1000
unreserved-concurrency-min: 100
accept-external-layer-arns: false # FLOCI_SERVICES_LAMBDA_ACCEPT_EXTERNAL_LAYER_ARNS - accept a Layers ARN from another account (content is never mounted). AWS answers these through the layer resource policy, which Floci does not model, so the default refuses them like AWS refuses a non-public one. Turn on to attach public layers such as Powertools.
# aws-config-path: # Host path to bind-mount (read-only) at /opt/aws-config for real credential discovery
# extra-hosts: # Extra /etc/hosts entries for Lambda containers, "hostname:ip" ("host-gateway" allowed as ip)
# container-name-prefix: floci # FLOCI_SERVICES_LAMBDA_CONTAINER_NAME_PREFIX — base name prefix for spawned containers and code volumes ([A-Za-z0-9][A-Za-z0-9_.-]*; invalid values fall back to "floci")
# code-volume-populate-concurrency: # FLOCI_SERVICES_LAMBDA_CODE_VOLUME_POPULATE_CONCURRENCY — max concurrent first-time code-volume populates (default max(2, cpus/2), which a CPU-constrained container collapses to 2)
executor: docker # docker | kubernetes (run Lambda environments as pods)
# kubernetes:
# namespace: default # Namespace Lambda pods are created in
# labels: # Extra pod labels, key=value entries
# - team=platform
# floci-address: # Host/IP pods use to reach Floci; auto-detected in-cluster
# init-image: busybox:1.36 # Init container image (needs sh, wget, unzip)
hot-reload:
enabled: false
apigateway:
enabled: true
vtl-max-loops: 10000 # Maximum #foreach iterations a VTL mapping template may execute (truncates the loop, does not fail the template)
vtl-max-output-chars: 1048576 # Maximum characters a VTL mapping template may render before it fails
vtl-timeout-millis: 5000 # Maximum wall-clock time a VTL mapping template may spend evaluating before it fails
apigatewayv2:
enabled: true
iam:
enabled: true
enforcement-enabled: false
seed-deployer-principal: false
# account-alias: "" # When set, seeds the account alias at startup so callers can read one
# without creating it first. Unset means the account has no alias,
# matching AWS. Example: FLOCI_SERVICES_IAM_ACCOUNT_ALIAS=my-account
msk:
enabled: true
mock: false
default-image: "redpandadata/redpanda:latest"
kafka-host-port-base: 9300
kafka-host-port-max: 9399
kafkaconnect:
enabled: true
mock: false
worker-image: apache/kafka:3.9.0
amazonmq:
enabled: true
mock: false
default-image: "rabbitmq:3-management"
amqp-host-port-base: 5672
amqp-host-port-max: 5699
console-host-port-base: 15672
console-host-port-max: 15699
kinesis-analytics:
enabled: true
mock: false
# default-image: optional override; uncomment to pin every application to a single image
# (e.g. a private registry mirror). When unset, the image is chosen from the requested
# RuntimeEnvironment (KinesisAnalyticsRuntimes.imageFor, e.g. FLINK-1_19 -> apache/flink:1.19).
# default-image: "apache/flink:1.18"
elasticache:
enabled: true
proxy-base-port: 6379
proxy-max-port: 6399
default-image: "valkey/valkey:8"
default-memcached-image: "memcached:1.6"
memorydb:
enabled: true
mock: false
proxy-base-port: 6400
proxy-max-port: 6419
default-image: "valkey/valkey:8"
redshift:
enabled: true
default-port: 5439
image-version: postgres:15-alpine
poll-interval-ms: 1000
proxy-base-port: 7100
proxy-max-port: 7199
default-credential-duration-seconds: 900 # GetClusterCredentials default lifetime (900-3600)
# endpoint-host: localhost # Hostname clients use; empty -> DockerHostResolver
proxy-handshake-timeout-millis: 10000 # Max time a client has to complete the startup/auth handshake
proxy-backend-connect-timeout-millis: 5000 # Max time to wait for the backend TCP connect
proxy-max-connections: 100 # Max concurrent proxy connections before new ones are refused
rds:
enabled: true
mock: false # FLOCI_SERVICES_RDS_MOCK — true = metadata only, no Docker (useful for CI)
proxy-base-port: 7001
proxy-max-port: 7099
# endpoint-host: localhost # Hostname clients use; enables published-port translation in Docker
# Omit image overrides to adapt Floci's built-in images to EngineVersion.
# Uncomment an override to pin that engine to an exact image.
# default-postgres-image: "registry.example.com/postgres:16-alpine"
# default-mysql-image: "registry.example.com/mysql:8.0"
# default-mariadb-image: "registry.example.com/mariadb:11"
default-sql-server-image: "mcr.microsoft.com/mssql/server:2022-latest"
proxy-handshake-timeout-millis: 10000 # Max time a client has to complete the startup/auth handshake
proxy-backend-connect-timeout-millis: 5000 # Max time to wait for the backend TCP connect
proxy-max-connections: 100 # Max concurrent proxy connections before new ones are refused
rds-data:
enabled: true
transaction-ttl-seconds: 180
redshift-data:
enabled: true
result-ttl-hours: 24
neptune:
enabled: true
proxy-base-port: 8182
proxy-max-port: 8282
db-type: "gremlin"
default-image: "tinkerpop/gremlin-server:3.7.3"
default-neo4j-image: "neo4j:5-community"
eventbridge:
enabled: true
cloudmap:
enabled: true
emr:
enabled: true
wafv2:
enabled: true
scheduler:
enabled: true
cloudwatchlogs:
enabled: true
max-events-per-query: 10000
max-stored-events: 20000
cloudwatchmetrics:
enabled: true
secretsmanager:
enabled: true
default-recovery-window-days: 30
scheduled-rotation-enabled: true
rotation-tick-seconds: 60
kinesis:
enabled: true
firehose:
enabled: true
tick-interval-seconds: 10
flush-record-count: 0
staging-bucket: floci-firehose-staging
kms:
enabled: true
cognito:
enabled: true
stepfunctions:
enabled: true
allow-plaintext-http: false
mock-config-file: ${SFN_MOCK_CONFIG:}
swf:
enabled: true
timeout-sweep-enabled: true
timeout-sweep-interval-seconds: 1
cloudformation:
enabled: true
# Fail an AWS::Lambda::Function whose S3 code cannot be read, as real CloudFormation
# does. Set true to fall back to the built-in stub handler instead (issue #2648).
allow-stub-lambda-code: false
# Stub a resource whose type has no provisioner: synthetic physical id, arn:aws:stub:::
# ARN attribute, CREATE_COMPLETE, reported at warn with a resource status reason. Set
# false to fail such a resource instead, which rolls the stack back.
allow-stub-unsupported-resource-types: true
acm:
enabled: true
validation-wait-seconds: 0
athena:
enabled: true
mock: false
duck:
# url: http://floci-duck:3000 # set to skip container management
default-image: "floci/floci-duck:latest"
glue:
enabled: true
ses:
enabled: true
# smtp-host: mailpit # SMTP server for email relay (empty = store only)
# smtp-port: 1025
# smtp-user: ""
# smtp-pass: ""
# smtp-starttls: DISABLED # DISABLED, OPTIONAL, or REQUIRED
opensearch:
enabled: true
mock: false
# default-image: optional override; uncomment to lock every domain to a
# single image (e.g. private registry mirror). When unset, the image is
# picked from OpenSearchVersions.imageFor(EngineVersion).
# default-image: "registry.example.com/opensearch:2.19.5"
proxy-base-port: 9400
proxy-max-port: 9499
keep-running-on-shutdown: false
ec2:
enabled: true
imds-port: 9169
# Sweep EC2 containers left on the daemon by a previous run that died mid-launch or
# mid-terminate (SIGKILL, OOM, docker kill), which no surviving record refers to.
# Scoped to this deployment's own containers; stopped instances are never swept.
reconcile-containers-on-startup: true
ssh-port-range-start: 2200
ssh-port-range-end: 2299
publish-security-group-ports: true
app-port-range-start: 30000
app-port-range-end: 30999
max-published-ports-per-instance: 20
socat-image: alpine/socat
mock: false
aws-faithful-private-ip: false
# container-ips-routable: true # Auto-detected by default (a throwaway TCP probe toward
# the container network). Set explicitly when the probe
# can't speak for your clients, e.g. Floci itself running
# containerized. FLOCI_SERVICES_EC2_CONTAINER_IPS_ROUTABLE
# Each VPC gets a real Docker network, so an instance's private IP is an address its
# container actually holds and instances in different VPCs are on different bridges.
vpc-networks:
enabled: true # FLOCI_SERVICES_EC2_VPC_NETWORKS_ENABLED
# Used only when a declared VPC CIDR cannot be honoured: absent, malformed, outside
# RFC 1918, or already claimed on this Docker daemon. Substitutions are logged at WARN;
# a reported private IP that does not match the declared CIDR is never silent.
fallback-pool: 10.240.0.0/12 # FLOCI_SERVICES_EC2_VPC_NETWORKS_FALLBACK_POOL
fallback-prefix-length: 16 # FLOCI_SERVICES_EC2_VPC_NETWORKS_FALLBACK_PREFIX_LENGTH
# Remove VPC networks left behind by a previous run of THIS emulator (scoped by API port,
# so Floci instances sharing a daemon never reconcile each other's networks).
reconcile-on-startup: true # FLOCI_SERVICES_EC2_VPC_NETWORKS_RECONCILE_ON_STARTUP
driver: bridge # FLOCI_SERVICES_EC2_VPC_NETWORKS_DRIVER
ecs:
enabled: true
mock: false
publish-awsvpc-ports-to-host: false
host-volume-roots: []
allow-unsafe-host-volumes: false
appconfig:
enabled: true
appconfigdata:
enabled: true
ecr:
enabled: true
registry-image: "registry:2"
registry-container-name: floci-ecr-registry
registry-base-port: 5100
registry-max-port: 5199
data-path: ./data/ecr
tls-enabled: false
keep-running-on-shutdown: true
uri-style: hostname
prefer-local-images: true
ui:
enabled: true
image: "floci/floci-ui:latest"
container-name: floci-ui
port: 4500
keep-running-on-shutdown: false
# endpoint: unset by default — Floci derives the sidecar's callback address automatically.
# Set an absolute http:// or https:// URL here only to override that derivation.
insecure-skip-tls-verify: false
# The console-contract keys below are deliberately unset. Floci reads the console's own
# io.floci.console.* image labels first, then a built-in profile, then the contract defaults
# (/api/health, port 4500, status: ok). Setting a value here overrides all of that, so only
# do it for a console that describes itself neither way. See docs/ui/console-contract.md.
# internal-port: 4500
# endpoint-env: AWS_ENDPOINT_URL
# status-path: /api/health
# status-ready-field: status # "none" means any 200 counts as ready
# status-ready-value: ok
# status-unavailable-value: unavailable
# extra-env: # PORT and AWS_ENDPOINT_URL are ignored here: use
# - MY_CONSOLE_FLAG=true # internal-port and endpoint above instead
bedrock:
enabled: true
bedrock-runtime:
enabled: true
backend: stub
proxy:
passthrough: false
# url: http://localhost:11434/v1
# api-key: sk-...
# default-model: llama3
# model-mapping: "anthropic.claude-3-sonnet-20240229-v1:0=claude-3-sonnet"
eks:
enabled: true
mock: false
provider: k3s
default-image: "rancher/k3s:latest"
# image-template: "myregistry.io/k3s:v%s" # optional custom image format template taking cluster version
api-server-base-port: 6500
api-server-max-port: 6599
data-path: ./data/eks
keep-running-on-shutdown: false
endpoint-mode: host # host = https://localhost:<hostPort> (host-reachable); network = container DNS name
iam-auth-webhook: true # validate `aws eks get-token` SigV4 tokens through a k3s webhook
ecr-registry-mirror: true # inject a registries.yaml so pods can pull images pushed to Floci ECR
disable-cni: false # start k3s without its bundled flannel/kube-proxy so a real CNI (e.g. Cilium) can take over
imds: false # expose link-local IMDS (169.254.169.254) inside the cluster container
imds-pod-network: false # route link-local IMDS traffic from ordinary pod network namespaces (requires imds: true)
irsa-signing-key: true # sign k3s service account tokens with the cluster OIDC key
pod-identity-webhook: true # register a mutating webhook that injects pod identity credentials (needs floci.tls.enabled)
mwaa:
enabled: true
mock: false
default-postgres-image: "postgres:16-alpine"
supported-versions: "2.10.5,2.9.3,2.8.4"
default-version: "2.10.5"
proxy-base-port: 8700
proxy-max-port: 8799
data-path: ./data/mwaa
keep-running-on-shutdown: false
dag-sync-interval-seconds: 30
install-requirements: true
elb:
enabled: true
mock: false
elbv2:
enabled: true
mock: false
listener-forwarder-image: alpine/socat:1.8.1.3
codebuild:
enabled: true
# docker-network: floci-network
sagemaker:
enabled: true
# docker-network: floci-network
gpu:
# Off by default: an existing deployment keeps launching CPU-only
# containers. How many GPUs an ml.* type has is shipped in
# sagemaker/instance-type-catalog.yaml; this is only about which of
# this machine's devices Floci may hand out.
enabled: false
# cdi | device-ids | count. Podman resolves only cdi, and accepts
# count while attaching no device, so cdi fails loudly instead.
mode: cdi
# Required for cdi and device-ids modes; unset allows no device.
# devices:
# - nvidia.com/gpu=GPU-<uuid>
batch:
enabled: true
runner-mode: immediate
# docker-network: floci-network
codedeploy:
enabled: true
codepipeline:
enabled: true
autoscaling:
enabled: true
applicationautoscaling:
enabled: true
elasticbeanstalk:
enabled: true
backup:
enabled: true
job-completion-delay-seconds: 3
fis:
enabled: true
route53:
enabled: true
vpc-association-control-plane-delay-ms: 0
transfer:
enabled: true
textract:
enabled: true
comprehend:
enabled: true
rekognition:
enabled: true
translate:
enabled: true
pricing:
enabled: true
transcribe:
enabled: true
ce:
enabled: true
credit-usd-monthly: 0.0
cur:
enabled: true
emit-mode: synchronous
staging-bucket: floci-cur-staging
bcm-pricing-calculator:
enabled: true
timestream-influxdb:
enabled: true
mock: false # FLOCI_SERVICES_TIMESTREAM_INFLUXDB_MOCK: true = metadata only, no Docker
default-image: "influxdb:2.7"
host-port-base: 8086
host-port-max: 8185
readiness-timeout-seconds: 120
# docker-network: my-network # Docker network to attach InfluxDB containers to
bcm-data-exports:
enabled: true
emit-mode: synchronous
oam:
enabled: true
cloudtrail:
enabled: true
lightsail:
enabled: true
cloudcontrol:
enabled: true
resourceexplorer2:
enabled: true
cloudfront:
enabled: true
allowed-private-origin-hosts: []
appsync:
enabled: true
schema-worker-threads: 4
schema-worker-shutdown-timeout-seconds: 30
vtl-max-loops: 10000 # Maximum #foreach iterations a VTL resolver template may execute (truncates the loop, does not fail the template)
vtl-max-output-chars: 1048576 # Maximum characters a VTL resolver template may render before it fails
vtl-timeout-millis: 5000 # Maximum wall-clock time a VTL resolver template may spend evaluating before it fails
# graphql-url: http://floci-graphql:8181 # set to skip sidecar container management
# Exact version on purpose: a cached :latest is never re-pulled. Published from floci-io/floci-sidecars.
graphql-image: "floci/floci-sidecar-graphql:0.2.0"
s3vectors:
enabled: true
s3tables:
enabled: true
iot:
enabled: true
rule-sql-strict: false
# endpoint-address: "" # DescribeEndpoint value when the AWS IoT ports (8883, 443, 8443) reach Floci; default: host and port of base-url
mqtt:
enabled: true
auto-start: false
host: 0.0.0.0
port: 1883
tls-port: 8883
iotdata:
enabled: true
cloudhsmv2:
enabled: true
efs:
enabled: true
nfs-servers: true # serve each mount target over NFSv4.1 for EC2 instances
nfs-server-image: floci/efs-nfs-server:local # built locally on first use
organizations:
enabled: true
# management-account-email: "" # When set, overrides the management-account email reported by DescribeOrganization and account listings.
rum:
enabled: true
networkfirewall:
enabled: true
servicecatalog:
enabled: true
guardduty:
enabled: true
emrserverless:
enabled: true
ssoadmin:
enabled: true
ssooidc:
enabled: true
local-principal-id: ${FLOCI_SERVICES_SSOOIDC_LOCAL_PRINCIPAL_ID:}
macie2:
enabled: true
account:
enabled: true
controlcatalog:
enabled: true
accessanalyzer:
enabled: true
identitystore:
enabled: true
scim-bearer-token: ${FLOCI_SERVICES_IDENTITYSTORE_SCIM_BEARER_TOKEN:floci-scim-token}
budgets:
enabled: true
inspector2:
enabled: true
securityhub:
enabled: true
detective:
enabled: true
controltower:
enabled: true
seed-landing-zone: false
route53resolver:
enabled: true
connect:
enabled: true
appintegrations:
enabled: true
cognitoidentity:
enabled: true
globalaccelerator:
enabled: true
datasync:
enabled: true
aps:
enabled: true
lakeformation:
enabled: true
tagging:
enabled: true
pipes:
enabled: true
kafka-rest-bridge:
default-image: "ghcr.io/aiven-open/karapace:latest"
host-port-base: 9500
host-port-max: 9599
configservice:
enabled: true
docdb:
enabled: true
mock: false
default-image: "mongo:7.0"
bedrock-agent-core:
enabled: true
# invoke-response: '{"output":"yes"}' # Body returned by InvokeAgentRuntime
# validate-runtime-exists: false # true = reject unknown runtime ARNs
# harness-echo-prefix: 'You said: ' # Prefix on the reply InvokeHarness streams back
# harness-empty-reply: 'No user message was supplied.'
bedrock-agent-core-control:
enabled: true
servicequotas:
enabled: true
verifiedpermissions:
enabled: true
# cedar-url: http://floci-cedar:8180 # set to skip sidecar container management
# Exact version on purpose: a cached :latest is never re-pulled. Published from floci-io/floci-sidecars.
cedar-image: "floci/floci-sidecar-cedar:1.1.0"
ram:
enabled: true
codegurureviewer:
enabled: true
codeartifact:
enabled: true
# maven-url: http://floci-reposilite:8080 # set to skip Reposilite sidecar container management
maven-image: "dzikoysk/reposilite:3.6.3"
marketplace:
enabled: true
dms:
enabled: true
Reference in New Issue View Git Blame Copy Permalink