https://packages.couchbase.com/couchbase-edge-server/config_schema.json

Allows config files to declare they conform to this schema. Otherwise ignored.

Cross-Origin Resource Sharing (CORS) configuration. If present, origin and headers are required. CORS is disabled by default.

List of HTTP headers that browser clients are allowed to include in requests.

5

Duration in seconds that browsers can cache preflight response results.

Sets the value of the Access-Control-Max-Age response header.

List of allowed origins.

Use ["*"] to allow all origins. This is recommended for development only; in production, restrict origins to known client hosts.

The databases to be served. Keys are the URI names to use.

A database configuration.

Collections to share. If omitted, all collections are shared. If it's an array, the items are the names of the collections to share (and create, if create is true). If it's an object, each key is a collection name and the value is an object describing the collection.

If true, database will be created on startup if it doesn't exist.

If true, clients can submit freeform SQL++ SELECT queries.

Not recommended in production due to potential for abuse: slow-running queries can be used as DoS attacks.

Enables client sync connections. pull is read-only, push is write-only, bidirectional or true enables both. Defaults to false, that is, sync is not allowed.

Accepted values: pull: clients can only pull (read) from this database. push: clients can only push (write) to this database. bidirectional or true: clients can both push and pull. If omitted or false, all client sync is disabled.

Enables writing to database via PUT / POST / DELETE requests. Lets clients write to the documents via the REST API. It does not affect clients syncing. So it's possible to disallow writes via REST but allow them via push replication, or vice versa.

This does not affect upstream replication or client sync. To prevent clients from writing to the database via sync, enable_client_sync must be omitted or set to pull.

Enables per-collection access control for this database.

Overrides the top-level enable_user_access_control setting, which applies when this property is omitted. When enabled, each user's access rules in the users file are enforced for this database, and users without explicit access to one of its keyspaces receive 403 Forbidden.

Database password, or raw AES256 key encoded as 64 hex digits.

Path of database file.

Database UUID to be replaced on first launch. The placeholder_uuid property should be used if the database has been copied from elsewhere. Every database file contains a universally unique ID (UUID); copying a database file means this is no longer unique, and that will cause problems with replication. If a canned initial database file is to be deployed to a number of Edge Servers, its current UUID can be set as the value of this property. The first time each server starts up, it will replace that UUID with a new, actually-unique one. You can find a database file's UUID via cblite info -v db.cblite2.

SQL++ queries clients can invoke. Keys are query names, values are SQL++.

A named query: either a SQL++ SELECT query string, or an object containing the query statement and optional allow access control settings.

Use the object form to restrict which users can run the query when enable_user_access_control is enabled. Without an allow property, any user with read access to the database can run the query.

Access control for this query.

Collection patterns, relative to the database. A user needs read access to at least one listed collection to run the query.

Patterns can be collection, scope.collection, scope.*, or *.

A SQL++ SELECT query.

If true, unauthenticated requests are allowed (guest access).

Default per-collection access control setting for all databases.

When enabled, each user's access rules in the users file are enforced, and users without explicit access to a keyspace receive 403 Forbidden. Individual databases can override this setting with their own enable_user_access_control property.

TLS settings. If present, tls_cert_path and tls_key_path are required.

Required Organization (O) field of client certificates (mTLS). Optional.

If set, a connecting client's certificate must have this exact Organization (O) subject field, or the connection is rejected. If omitted, the O field is not checked.

Required Organizational Unit (OU) field of client certificates (mTLS). Optional.

If set, a connecting client's certificate must have this exact Organizational Unit (OU) subject field, or the connection is rejected. If omitted, the OU field is not checked.

Path of file containing CA cert for authenticating clients (mTLS).

If present, enables mTLS: clients may authenticate using a TLS client certificate. Only certificates signed by this CA cert will be accepted. The Common Name (CN) field of the client cert will be used as the username for logging. mTLS and HTTP Basic auth can be active simultaneously; clients may use either method.

Path of file containing TLS server certificate.

Path of file containing matching private key.

0.0.0.0:59840

Listening interface IP address and port, separated by a colon. The interface address is optional and defaults to 0.0.0.0, i.e. all interfaces. A useful value for testing is 127.0.0.1, which allows only clients on the same device to connect. The default port number is 59840.

Logging configuration.

Configuration for audit logging.

Array of integer event IDs to disable, or "*" to disable all - (enable overrides these).

Array of integer event IDs to enable, or "*" to enable all. (Takes priority over 'disable').

Filename of audit log.

If true, audit events will omit the description property.

The description property can be useful for human readers, but is quite verbose and will significantly increase log file size.

true

Whether to log to stdout/stderr. On/off only; the levels logged are those set by domains.

Custom levels for specific logging domains. Keys are domain names. Common domains are Default, REST, Listener, DB, Query, Sync.

Minimum level to log for this domain: debug, verbose, info, warning, error or none. Applies to both console and log files.

Defaults vary by domain: info for Server, REST, Listener, Replicate and ClientSync; warning for most others. The debug level requires a debug build.

Configuration for file-based logging.

Path of existing directory where log files will be created.

binary

Format of log files: binary or text.

1000000

Size in bytes at which log files are rotated.

Number of older log files that are preserved.

Replications to run when the server starts.

An array of replication configuration objects. Each element defines one replication. The properties below (source, target, auth, and so on) belong to each individual array item.

Authorization credentials.

An OpenID Connect token: either an inline JWT string, or an object with a path property referencing a file that contains the JWT.

Use the file form, for example {"path": "/etc/edge-server/token.jwt"}, to support token rotation. The path can be absolute or relative. The file is read when the replication starts and is monitored for changes.

Password for HTTP Basic auth to remote server. Requires 'user'.

If true, force a disconnect and reconnect when the JWT token file changes on disk.

Only effective when openid_token uses the file form. When true, Edge Server proactively disconnects and reconnects with the new token whenever the file changes. When false, a log message is emitted and the new token is used the next time the replication starts.

A Sync Gateway session cookie.

This Edge Server's TLS client certificate, for mTLS. (Requires 'tls_client_cert_key'.)

Private key of TLS client certificate. (Requires 'tls_client_cert'.)

Username for HTTP Basic auth to remote server. Requires 'password'.

If true, replication is bidirectional.

Channel filter (incompatible with 'collections')

_default

Collections to replicate. If omitted, only the default collection is replicated.

If true, replication is continuous, i.e. keeps running forever.

Document IDs to replicate (incompatible with 'collections')

Extra HTTP headers; keys are header names, values are header values.

Header value

Path of file containing the required server certificate.

HTTP proxy settings

Proxy authorization credentials.

An OpenID Connect token.

Password for HTTP Basic auth to proxy. Requires 'user'.

This Edge Server's TLS client certificate, for mTLS. (Requires 'tls_client_cert_key'.)

Private key of TLS client certificate. (Requires 'tls_client_cert'.)

Username for HTTP Basic auth to proxy. Requires 'password'.

Hostname of proxy server

Port number of proxy server

HTTP

Proxy type: 'HTTP' or 'HTTPS'

The source database: a local name or remote 'wss:' URL.

The destination database: a local name or remote 'wss:' URL.

Path of file containing one or more additional root certificates to be trusted.

Path to JSON file containing users and roles.