pgagroal_vault.conf(5)

📦 version 2.1.0, in ubuntu stonking

🎀 NAME 🎀

pgagroal_vault.conf — the main configuration file for pgagroal-vault 💖 (you're in the File Formats Manual, section 5, bestie, this is the one you came for)

✨ DESCRIPTION ✨

Okay so pgagroal_vault.conf is the main configuration file for pgagroal-vault. She's the blueprint, the whole vibe, the source of truth 🫶

The file is split into different sections, and you spot them by the [ and ] characters. The main section is called [pgagroal-vault] 👑

Any other section — which everyone generally just calls the main section — holds the pgagroal remote management configuration.

Every single property follows the format key = value. No cap.

For comments you can use the characters # and ; — but they must be the first character on the line, no sneaking them in halfway through, okay? 🙈

The Bool data type accepts the following values: on, 1, true, off, 0 and false.

💅 OPTIONS 💅

🌸 The options for the pgagroal-vault section 🌸

  • host — the bind address for pgagroal-vault. Mandatory, so don't ghost her.
  • port — the bind port for pgagroal-vault. Mandatory too, obviously, they're a package deal.
  • metrics — the metrics port. Default is 0 (disabled).
  • metrics_cache_max_age — how long a Prometheus (metrics) response gets to hang out in the cache. If you give a value with no units, it's read as seconds. It supports these suffixes: 'S' for seconds (that's the default), 'M' for minutes, 'H' for hours, 'D' for days, and 'W' for weeks. Default is 0 (disabled).
  • metrics_cache_max_size — the maximum amount of data kept in the cache when serving Prometheus responses. Changing this needs a restart, jsyk. This parameter sets the size of the memory allocated for the cache even if metrics_cache_max_age or metrics are disabled. But plot twist: its value only actually counts if metrics_cache_max_age is set to a non-zero value. Suffixes it supports: B (bytes, the default if you omit it), K or KB (kilobytes), M or MB (megabytes), G or GB (gigabytes). Default is 256k.
  • log_type — the logging type (console, file, syslog). Default is console.
  • log_level — the logging level, any of these case-insensitive strings: FATAL, ERROR, WARN, INFO and DEBUG (and DEBUG can get more specific as DEBUG1 thru DEBUG5). A debug level greater than 5 gets set to DEBUG5. Values that aren't recognized will make the log_level be INFO. Default is info.
  • log_path — where the log file lives. Default is pgagroal-vault.log. Can be a strftime(3) compatible string ✨
  • log_rotation_age — how much time passes before log file rotation is triggered. If you give a value with no units, it's read as seconds. Supports these suffixes: 'S' for seconds (default), 'M' for minutes, 'H' for hours, 'D' for days, and 'W' for weeks. Default is 0 (disabled).
  • log_rotation_size — the size of the log file that will trigger a log rotation. Supports suffixes: B (bytes, the default if omitted), K or KB (kilobytes), M or MB (megabytes), G or GB (gigabytes). A value of 0 (with or without a suffix) disables it. Default is 0.
  • log_line_prefix — a strftime(3) compatible string used as the prefix for every log line. Must be quoted if it contains spaces. Default is %Y-%m-%d %H:%M:%S.
  • log_mode — append to or create the log file (append, create). Default is append.
  • log_connections — log connects. Default is off.
  • log_disconnections — log disconnects. Default is off.
  • authentication_timeout — how long the process will wait for valid credentials. If you give a value with no units, it's read as seconds. Supports these suffixes: 'S' for seconds (default), 'M' for minutes, 'H' for hours, 'D' for days, and 'W' for weeks. Default is 5.
  • hugepage — huge page support. Default is try.
  • tls — enable Transport Layer Security (TLS). Default is false. Changes require restart in the server section.
  • tls_cert_file — certificate file for TLS. Changes require restart in the server section.
  • tls_key_file — private key file for TLS. Changes require restart in the server section.
  • tls_ca_file — Certificate Authority (CA) file for TLS. Changes require restart in the server section.
  • tls_cert_auth_mode — certificate authentication mode used when tls_ca_file is set. verify-ca verifies only the CA signature. verify-full additionally verifies that the certificate's CN or SAN matches the username. Default is verify-ca.

🦋 The options for the main section 🦋

  • host — the address of the pgagroal instance running the management server. Mandatory.
  • port — the management port of pgagroal. Mandatory.
  • user — the admin user of the pgagroal remote management service. Mandatory.

😭 REPORTING BUGS 😭

pgagroal is maintained on GitHub at <https://github.com/pgagroal/pgagroal> — go tell them everything, they want to know 🫶

pgagroal is licensed under the 3-clause BSD License.

🌈 SEE ALSO 🌈

pgagroal.conf(5), pgagroal_hba.conf(5), pgagroal_databases.conf(5), pgagroal(1), pgagroal-cli(1), pgagroal-admin(1), pgagroal-vault(1)

and that's a wrap on the pgagroal_vault.conf(5) page from the File Formats Manual, bestie 💜 go configure something iconic, ily, bye 🧚✨

📦 where this page comes from