config.schema.json

{
  "$schema": "https://json-schema.org/draft-07/schema",
  "$id": "https://git-proxy.finos.org/config.schema.json",
  "title": "GitProxy configuration file",
  "description": "Configuration for customizing git-proxy",
  "type": "object",
  "properties": {
    "proxyUrl": {
      "type": "string",
      "description": "Deprecated: Used in early versions of git proxy to configure the remote host that traffic is proxied to. In later versions, the repository URL is used to determine the domain proxied, allowing multiple hosts to be proxied by one instance.",
      "deprecated": true
    },
    "cookieSecret": { "type": "string" },
    "sessionMaxAgeHours": { "type": "number" },
    "api": {
      "description": "Third party APIs",
      "type": "object",
      "properties": {
        "ls": {
          "type": "object",
          "description": "Configuration used in conjunction with ActiveDirectory auth, which relates to a REST API used to check user group membership, as opposed to direct querying via LDAP.<br />If this configuration is set direct querying of group membership via LDAP will be disabled.",
          "properties": {
            "userInADGroup": {
              "type": "string",
              "description": "URL template for a GET request that confirms a user's membership of a specific group. Should respond with a non-empty 200 status if the user is a member of the group, an empty response or non-200 status indicates that the user is not a group member. If set, this URL will be queried and direct queries via LDAP will be disabled. The template should contain the following string placeholders, which will be replaced to produce the final URL:<ul><li>\"&lt;domain&gt;\": AD domain,</li><li>\"&lt;name&gt;\": The group name to check membership of.</li><li>\"&lt;id&gt;\": The username to check group membership for.</li></ul>",
              "examples": [
                "https://somedomain.com/some/path/checkUserGroups?domain=<domain>&name=<name>&id=<id>"
              ]
            }
          },
          "additionalProperties": false
        },
        "gitleaks": {
          "type": "object",
          "description": "Configuration for the gitleaks [https://github.com/gitleaks/gitleaks](https://github.com/gitleaks/gitleaks) plugin",
          "properties": {
            "enabled": { "type": "boolean" },
            "ignoreGitleaksAllow": { "type": "boolean" },
            "noColor": { "type": "boolean" },
            "configPath": { "type": "string" }
          }
        }
      },
      "additionalProperties": false
    },
    "commitConfig": {
      "title": "CommitConfig",
      "description": "Block commits based on rules defined over author/committer e-mail addresses, commit message content and diff content",
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "author": {
          "title": "Author",
          "description": "Rules applied to commit authors",
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "email": {
              "title": "Email",
              "description": "Rules applied to author email addresses",
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "local": {
                  "title": "Local",
                  "description": "Rules applied to the local portion of the email address (i.e. section before the @ symbol)",
                  "type": "object",
                  "additionalProperties": false,
                  "properties": {
                    "block": {
                      "title": "Block",
                      "description": "Block commits with author email addresses where the first part matches this regular expression",
                      "type": "string"
                    }
                  },
                  "required": []
                },
                "domain": {
                  "title": "Domain",
                  "description": "Rules applied to the domain portion of the email address (i.e. section after the @ symbol)",
                  "type": "object",
                  "additionalProperties": false,
                  "properties": {
                    "allow": {
                      "title": "Allow",
                      "description": "Allow only commits where the domain part of the email address matches this regular expression",
                      "type": "string"
                    }
                  },
                  "required": []
                }
              },
              "required": []
            }
          },
          "required": []
        },
        "message": {
          "title": "Message",
          "description": "Rules applied to commit messages",
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "block": {
              "title": "MessageBlock",
              "description": "Block commits where the commit message matches any of the given patterns",
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "literals": {
                  "title": "MessageBlockLiteral",
                  "description": "Block commits where the commit message contains any of the given string literals",
                  "type": "array",
                  "items": { "type": "string" }
                },
                "patterns": {
                  "title": "MessageBlockLiteral",
                  "description": "Block commits where the commit message matches any of the given regular expressions",
                  "type": "array",
                  "items": { "type": "string" }
                }
              },
              "required": []
            }
          },
          "required": []
        },
        "diff": {
          "title": "Diff",
          "description": "Rules applied to commit diff content",
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "block": {
              "title": "DiffBlock",
              "description": "Block commits where the commit diff matches any of the given patterns",
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "literals": {
                  "title": "DiffBlockLiteral",
                  "description": "Block commits where the commit diff content contains any of the given string literals",
                  "type": "array",
                  "items": {
                    "type": "string"
                  }
                },
                "patterns": {
                  "title": "MessageBlockPatterns",
                  "description": "Block commits where the commit diff content matches any of the given regular expressions",
                  "type": "array",
                  "items": {}
                },
                "providers": {
                  "title": "MessageBlockProviders",
                  "description": "Block commits where the commit diff content matches any of the given regular expressions, except where the repository path (project/organisation) matches one of the listed privateOrganisations. The keys in this array are listed as the block type in logs.",
                  "type": "object",
                  "additionalProperties": { "type": "string" }
                }
              },
              "required": []
            }
          },
          "required": []
        }
      },
      "required": []
    },
    "attestationConfig": {
      "title": "AttestationConfig",
      "description": "Configuration for the attestation form displayed to reviewers. Reviewers will need to check the box next to each question in order to complete the review attestation.",
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "questions": {
          "title": "AttestationQuestions",
          "description": "Customisable attestation questions to add to attestation form.",
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": false,
            "properties": {
              "label": {
                "title": "QuestionLabel",
                "description": "The text of the question that will be displayed to the reviewer",
                "type": "string"
              },
              "tooltip": {
                "title": "QuestionTooltip",
                "description": "A tooltip and optional set of links that will be displayed on mouseover of the question and used to provide additional guidance to the reviewer.",
                "type": "object",
                "additionalProperties": false,
                "properties": {
                  "text": {
                    "type": "string",
                    "description": "Tooltip text"
                  },
                  "links": {
                    "type": "array",
                    "description": "An array of links to display under the tooltip text, providing additional context about the question",
                    "items": {
                      "type": "object",
                      "additionalProperties": false,
                      "properties": {
                        "text": { "type": "string", "description": "Link text" },
                        "url": { "type": "string", "format": "url", "description": "Link URL" }
                      },
                      "required": ["text", "url"]
                    }
                  }
                },
                "required": ["text"]
              }
            },
            "required": ["label", "tooltip"],
            "title": "Question"
          }
        }
      },
      "required": []
    },
    "domains": {
      "description": "Provide custom URLs for the git proxy interfaces in case it cannot determine its own URL",
      "type": "object",
      "properties": {
        "proxy": {
          "title": "ProxyUrl",
          "description": "Override for the default proxy URL, should include the protocol",
          "type": "string",
          "format": "url"
        },
        "service": {
          "title": "Service UI URL",
          "description": "Override for the service UI URL, should include the protocol",
          "type": "string",
          "format": "url"
        }
      }
    },
    "rateLimit": {
      "description": "API Rate limiting configuration.",
      "type": "object",
      "properties": {
        "windowMs": {
          "type": "number",
          "description": "How long to remember requests for, in milliseconds (default 10 mins)."
        },
        "limit": {
          "type": "number",
          "description": "How many requests to allow (default 150)."
        },
        "statusCode": {
          "type": "number",
          "description": "HTTP status code after limit is reached (default is 429)."
        },
        "message": {
          "type": "string",
          "description": "Response to return after limit is reached."
        }
      },
      "required": ["windowMs", "limit"],
      "additionalProperties": false
    },
    "privateOrganizations": {
      "description": "Provider searches for listed private organizations are disabled, see commitConfig.diff.block.providers",
      "type": "array"
    },
    "urlShortener": {
      "description": "Customisable URL shortener to share in proxy responses and warnings",
      "type": "string"
    },
    "contactEmail": {
      "description": "Customisable e-mail address to share in proxy responses and warnings",
      "type": "string"
    },
    "csrfProtection": {
      "description": "Flag to enable CSRF protections for UI",
      "type": "boolean"
    },
    "plugins": {
      "type": "array",
      "description": "List of plugins to integrate on GitProxy's push or pull actions. Each value is either a file path or a module name.",
      "items": {
        "type": "string"
      }
    },
    "authorisedList": {
      "description": "List of repositories that are authorised to be pushed to through the proxy.",
      "type": "array",
      "items": {
        "$ref": "#/definitions/authorisedRepo"
      }
    },
    "sink": {
      "description": "List of database sources. The first source in the configuration with enabled=true will be used.",
      "type": "array",
      "items": {
        "$ref": "#/definitions/database"
      }
    },
    "authentication": {
      "description": "List of authentication sources. The first source in the configuration with enabled=true will be used.",
      "type": "array",
      "items": {
        "$ref": "#/definitions/authenticationElement"
      }
    },
    "tempPassword": {
      "description": "Toggle the generation of temporary password for git-proxy admin user",
      "type": "object",
      "properties": {
        "sendEmail": { "type": "boolean" },
        "emailConfig": {
          "description": "Generic object to configure nodemailer. For full type information, please see https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/nodemailer",
          "type": "object"
        }
      }
    },
    "apiAuthentication": {
      "description": "List of authentication sources for API endpoints. May be empty, in which case all endpoints are public.",
      "type": "array",
      "items": {
        "$ref": "#/definitions/authenticationElement"
      }
    },
    "tls": {
      "description": "TLS configuration for secure connections",
      "type": "object",
      "properties": {
        "enabled": { "type": "boolean" },
        "key": { "type": "string" },
        "cert": { "type": "string" }
      },
      "required": ["enabled", "key", "cert"]
    },
    "sslKeyPemPath": {
      "description": "Deprecated: Path to SSL private key file (use tls.key instead)",
      "type": "string",
      "deprecated": true
    },
    "sslCertPemPath": {
      "description": "Deprecated: Path to SSL certificate file (use tls.cert instead)",
      "type": "string",
      "deprecated": true
    },
    "configurationSources": {
      "enabled": { "type": "boolean" },
      "reloadIntervalSeconds": { "type": "number" },
      "merge": { "type": "boolean" },
      "sources": {
        "type": "array",
        "items": {
          "type": "object",
          "description": "Configuration source"
        }
      }
    },
    "uiRouteAuth": {
      "description": "UI routes that require authentication (logged in or admin)",
      "type": "object",
      "properties": {
        "enabled": { "type": "boolean" },
        "rules": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/routeAuthRule"
          }
        }
      }
    }
  },
  "definitions": {
    "authorisedRepo": {
      "type": "object",
      "properties": {
        "project": { "type": "string" },
        "name": { "type": "string" },
        "url": { "type": "string" }
      },
      "required": ["project", "name", "url"]
    },
    "database": {
      "description": "Configuration entry for a database",
      "oneOf": [
        {
          "type": "object",
          "name": "MongoDB Config",
          "description": "Connection properties for mongoDB. Options may be passed in either the connection string or broken out in the options object",
          "properties": {
            "type": { "type": "string", "const": "mongo" },
            "enabled": { "type": "boolean" },
            "connectionString": {
              "type": "string",
              "description": "mongoDB Client connection string, see [https://www.mongodb.com/docs/manual/reference/connection-string/](https://www.mongodb.com/docs/manual/reference/connection-string/)"
            },
            "options": {
              "type": "object",
              "description": "mongoDB Client connection options. Please note that only custom options are described here, see [https://www.mongodb.com/docs/drivers/node/current/connect/connection-options/](https://www.mongodb.com/docs/drivers/node/current/connect/connection-options/) for all config options.",
              "properties": {
                "authMechanismProperties": {
                  "type": "object",
                  "properties": {
                    "AWS_CREDENTIAL_PROVIDER": {
                      "type": "boolean",
                      "description": "If set to true, the `fromNodeProviderChain()` function from @aws-sdk/credential-providers is passed as the `AWS_CREDENTIAL_PROVIDER`"
                    }
                  },
                  "additionalProperties": true
                }
              },
              "required": [],
              "additionalProperties": true
            }
          },
          "required": ["type", "enabled", "connectionString"]
        },
        {
          "type": "object",
          "name": "File-based DB Config",
          "description": "Connection properties for an neDB file-based database",
          "properties": {
            "type": { "type": "string", "const": "fs" },
            "enabled": { "type": "boolean" }
          },
          "required": ["type", "enabled"]
        }
      ]
    },
    "authenticationElement": {
      "type": "object",
      "description": "Configuration for an authentication source",
      "oneOf": [
        {
          "title": "Local Auth Config",
          "description": "Configuration for the use of the local database as the authentication source.",
          "properties": {
            "type": { "type": "string", "const": "local" },
            "enabled": { "type": "boolean" }
          },
          "required": ["type", "enabled"]
        },
        {
          "title": "Active Directory Auth Config",
          "description": "Configuration for Active Directory authentication.",
          "properties": {
            "type": { "type": "string", "const": "ActiveDirectory" },
            "enabled": { "type": "boolean" },
            "adminGroup": {
              "type": "string",
              "description": "Group that indicates that a user is an admin"
            },
            "userGroup": {
              "type": "string",
              "description": "Group that indicates that a user should be able to login to the Git Proxy UI and can work as a reviewer"
            },
            "domain": { "type": "string", "description": "Active Directory domain" },
            "adConfig": {
              "type": "object",
              "description": "Additional Active Directory configuration supporting LDAP connection which can be used to confirm group membership. For the full set of available options see the activedirectory 2 NPM module docs at https://www.npmjs.com/package/activedirectory2#activedirectoryoptions <br /><br />Please note that if the Third Party APIs config `api.ls.userInADGroup` is set then the REST API it represents is used in preference to direct querying of group memebership via LDAP.",
              "properties": {
                "url": {
                  "type": "string",
                  "description": "Active Directory server to connect to, e.g. `ldap://ad.example.com`."
                },
                "baseDN": {
                  "type": "string",
                  "description": "The root DN from which all searches will be performed, e.g. `dc=example,dc=com`."
                },
                "username": {
                  "type": "string",
                  "description": "An account name capable of performing the operations desired."
                },
                "password": {
                  "type": "string",
                  "description": "Password for the given `username`."
                },
                "searchBase": {
                  "type": "string",
                  "description": "Override baseDN to query for users in other OUs or sub-trees."
                }
              },
              "required": ["url", "baseDN", "username", "password"]
            }
          },
          "required": ["type", "enabled", "adminGroup", "userGroup", "domain"]
        },
        {
          "title": "Open ID Connect Auth Config",
          "description": "Configuration for Open ID Connect authentication.",
          "properties": {
            "type": { "type": "string", "const": "openidconnect" },
            "enabled": { "type": "boolean" },
            "oidcConfig": {
              "type": "object",
              "description": "Additional OIDC configuration.",
              "properties": {
                "issuer": { "type": "string" },
                "clientID": { "type": "string" },
                "clientSecret": { "type": "string" },
                "callbackURL": { "type": "string" },
                "scope": { "type": "string" }
              },
              "required": ["issuer", "clientID", "clientSecret", "callbackURL", "scope"]
            }
          },
          "required": ["type", "enabled", "oidcConfig"]
        },
        {
          "title": "JWT Auth Config",
          "description": "Configuration for JWT authentication.",
          "properties": {
            "type": { "type": "string", "const": "jwt" },
            "enabled": { "type": "boolean" },
            "jwtConfig": {
              "type": "object",
              "description": "Additional JWT configuration.",
              "properties": {
                "clientID": { "type": "string" },
                "authorityURL": { "type": "string" },
                "expectedAudience": { "type": "string" },
                "roleMapping": {
                  "type": "object",
                  "properties": {
                    "admin": { "type": "object" }
                  }
                }
              },
              "required": ["clientID", "authorityURL"]
            }
          },
          "required": ["type", "enabled", "jwtConfig"]
        }
      ]
    },
    "routeAuthRule": {
      "type": "object",
      "properties": {
        "pattern": { "type": "string" },
        "adminOnly": { "type": "boolean" },
        "loginRequired": { "type": "boolean" }
      }
    },
    "roleMapping": {
      "type": "object",
      "description": "Mapping of application roles to JWT claims. Each key is a role name, and its value is an object mapping claim names to expected values.",
      "additionalProperties": {
        "type": "object",
        "additionalProperties": { "type": "string" }
      }
    }
  },
  "additionalProperties": false
}