schema-project.json

title: JSON schema for Outblocks project configuration files

$ref: #/definitions/OutblocksProject

title: Outblocks

description: Project-wide DNS setup.

$ref: #/definitions/DNS

description: Project-wide state source.

$ref: #/definitions/State

description: Project-wide secrets provider.

$ref: #/definitions/Secrets

description: Project-wide dependencies to provision.

$ref: #/definitions/Dependencies

description: Project monitoring setup.

$ref: #/definitions/Monitoring

description: Project-wide plugins.

$ref: #/definitions/Plugin

description: Project-wide default app settings.

$ref: #/definitions/Defaults

title: DNS

description: SSL configuration.

$ref: #/definitions/SSL

title: SSL

description: Public key file path. Required to be in PEM format.

description: Private key file path. Required to be in PEM format.

description: Public key value in PEM format.

description: Private key value in PEM format.

description: State type, plugin specific value e.g. 'gcp' for gcp plugin or use 'local' for local state.

description: Path of local state, used only when state type is 'local'.

title: State

description: Secrets provider type, plugin specific value e.g. 'gcp' for gcp plugin.

title: Secrets

title: Dependencies

description: The type of the dependency.

description: Deploy config.

$ref: #/definitions/DependencyDeploy

description: Run config.

$ref: #/definitions/DependencyRun

const: storage

description: Enables versioning for objects.

description: Specify location for storage, refer to cloud provider docs for possible options.

description: Makes whole storage public so that all objects can be accessed.

description: Maximum amount of versions to keep.

description: Delete new objects after X days.

description: Expire archived versions after X days.

description: CORS settings.

$ref: #/definitions/DependencyStorageCORS

const: mysql

const: postgresql

description: Specify version of database, refer to cloud provider docs for possible options.

description: Makes database highly available meaning it will have a read replica available in case of master failure.

description: Specify tier of database, refer to cloud provider docs for possible options.

description: Database flags, refer to cloud provider docs for possible options.

description: Database users.

$ref: #/definitions/DependencyDatabaseUser

title: Database user

description: Explicitly set password, defaults to a randomly generated string.

description: Hostname that user is allowed to connect from. Not all databases may support it.

title: Storage CORS

description: The list of Origins eligible to receive CORS response headers. Note: "*" is permitted in the list of origins, and means "any Origin".

description: The list of HTTP methods on which to include CORS response headers, (GET, OPTIONS, POST, etc) Note: "*" is permitted in the list of methods, and means "any method".

description: The list of HTTP headers other than the simple response headers to give permission for the user-agent to share across domains.

description: The value in seconds to return in the Access-Control-Max-Age header used in preflight responses.

title: Run

title: Deploy

title: Monitoring

description: Monitoring plugin override. Defaults to first supported plugin available.

description: Monitoring notification channels.

$ref: #/definitions/MonitoringChannel

description: Monitoring targets.

$ref: #/definitions/MonitoringTarget

title: Monitoring channels

description: Notification channel type. Possible values: slack, email.

enum: slack email

const: slack

description: Bot user oauth token used for slack notification.

description: Channel used for slack notification.

required: type token channel

const: email

description: Email used for email channel type.

required: type email

title: Monitoring target

description: Target full url.

description: Check frequency in minutes. Defaults to 5 minutes.

description: Check locations to use. Defaults to 'all'.

title: Plugin

title: Defaults

description: Deploy config.

$ref: #/definitions/DefaultDeploy

description: DNS config.

$ref: #/definitions/DefaultDNS

description: Run config.

$ref: #/definitions/DefaultRun

title: Deploy defaults

description: Deploy plugin override. Defaults to first supported plugin available.

description: Additional environment variables added to every app that supports environment variables.

title: DNS defaults

description: DNS plugin override. Defaults to first supported plugin available.

title: Run defaults

description: Run plugin override. Defaults to first supported plugin available.


title: dto action

type: object

description: Enable this default header action

description: Name of the default header action

description: Expert settings for the Apache httpd.

description: Expert settings for the Security Gate.

type: boolean

description: Whether to ignore case.

default: true

description: Whether to invert the match.

default: false

type: string

description: A regex pattern used to match, cannot be empty. If you need a pattern that matches every string use ".*"

$ref: #/definitions/PatternDto-nullable

description: The regular expression, which matches the parts which should be rewritten.

description: The rewrite expression.

title: pattern

description: Whether to ignore case.

$ref: #/definitions/PatternWithoutInvertDto

description: A pattern for the header name.

description: A pattern for the header value.

description: A pattern for the header name.

description: A string to rewrite the header value with. Can make back-references to the header value pattern.

description: A pattern for the header value.

description: The name of the header to add.

description: The value of the header to add.

description: The actual pattern.

type: array

title: application

title: mapping

description: If the 'sub' claim should be extracted from the JWT and be used as audit token of the current session

description: All specified claims are checked and must match the claim's value of the decoded token. If a claim is an array, at least one entry must match the specified regex.

title: claim

description: The name of the claim you want to restrict.

description: The regular expression that must match the value of the specified claim name.

description: If the JWT standard claims expiry (exp) and not before (nbf) will be checked and must be valid.

description: From which cookie the token should be extracted.

description: How the token should be extracted from the request headers.

enum: header parameter cookie

description: From which part of the request the token should be extracted. Possible values are 'header', 'parameter', 'cookie'.

default: header

description: From which query parameter the token should be extracted.

description: How the token should be extracted.

description: List of JWKS service providers referenced by their name. Can be local or remote providers.

description: If disabled, requests without a token are accepted. However, if a token is present,it is extracted and validated and the configured restrictions and role extractions are applied.

description: Specifies which roles should be extracted from the claims.

title: role

description: Name of the claim you want to extract a role from.

description: The regular expression to match the role extraction and the rewrite expression of the role.

description: If enabled, the expiry claim (exp) of the JWT will be used as the role lifetime.

description: Enforce a signed JWT

description: The allowed skew when checking expiry / not before in seconds.

description: The claim to extract the technical client id from.

title: allowed roles

description: A pattern to match the content type for this allow rule.

description: Enable the allow rule.

description: Whether to log requests not matching this allow rule instead of blocking them.

description: A pattern to match the http method for this allow rule.

description: Unique name for the allow rule. If omitted, a unique name will be generated. To enable/disable the default allow rule or one from a mapping_template_file, use the same name.

default: Allow all

description: A pattern to match the path.

description: JSON objects are parsed only if their content-type matches the specified pattern.

default: json

description: If enabled, potential attack requests are only logged but not blocked.

description: The Microgateway mapping can be configured to rewrite the incoming URL to a different back-end URL (asymmetric mappings). Due to this rewriting, the incoming URL path (client_view) will be different from the back-end URL path (backend_view).

description: Check responses against API specification.

description: The OpenAPI specification.

description: The OpenAPI file path.

description: The specification to validate against.

description: If enabled, Microgateway parses JSON objects in requests and filters JSON attributes with allow rules and deny rules.

description: If enabled, each path segment is interpreted as a separate parameter value and the deny rules for parameter values are applied to it.

description: A list of access restrictions can be created. Each request matching the combination of HTTP method and path of a access restriction must have at least one of the specified roles to access the service. All matching restrictions must be satisfied to gain access.

title: access restriction

description: Can contain regular expressions that are applied when the HTTP method of a request matches one of the expressions. Use an empty pattern if all HTTP methods should match.

description: Can contain regular expressions that are applied when the requested path of the query matches the expressions. Use an empty pattern if all paths should match.

description: Can contain a list of roles for this service. Only sessions that have at least one of these roles will be able to access the service.

enum: inherit optional required

description: The client certificate verification mode to use on this mapping. This can be used to override the setting from the virtual host with a stronger verification level (e.g. off -> optional or optional -> required). Possible values are 'inherit', 'optional' or 'required'.

default: inherit

description: Defines the location of the authentication service. In case the required role for the mapping is missing on the current session, Airlock Gateway will redirect the client to this location. If this value is missing (default), the Global Denied Access URL will be used.

description: The authentication flow, allowed values are: redirect, deny_access, one_shot, one_shot_with_body, ntlm

default: redirect

description: In order to allow clean session termination on back-end systems when an Airlock Gateway session terminates, the administrator can configure one logout path per mapping.

description: Expert settings for the Security Gate.

title: host

description: The hostname of the back-end host. Only characters a-Z, numbers, and the special characters '.', ':',  '-' and '_' are allowed.

default: backend

type: integer

description: Configuring a back-end port.

enum: https http

description: Allowed values are: http, https

default: http

description: The unique name of the back-end. Only characters a-Z, numbers, and the special characters '.', ':',  '-' and '_' are allowed.

default: backendGroup

description: The back-end path specifies the internal back-end path, i.e. the path of the request sent to the application server.

description: Specifies whether Airlock Microgateway should compress the output on-the-fly for the client browser if supported and requested by the browser.

description: Specifies whether the connected back-end service is allowed to use the Airlock Microgateway Control API via the control cookie mechanism. The Control API is normally used by authentication applications to communicate with the Microgateway.

$ref: #/definitions/SimplePatternDto-nullable

description: Cookies that should be cryptographically encrypted before being sent to the client.

description: Cookies that should be passed in plain format to the client.

description: Whether to enable automatic CSRF token injection and validation on this mapping.

description: All incoming URLs that match one of these patterns are accepted by Airlock Microgateway without a valid CSRF token.

title: exception

description: Specifies the location (e.g. /index.html) to which the client is redirected if a missing or invalid CSRF token is detected.

default: /%ENTRYPATH%

title: denied rule groups

description: Enable deny rule group

title: exception

enum: basic standard strict

description: Allowed values are: basic, standard, strict.

default: standard

description: If enabled, offending requests are not blocked but only logged

description: If deny rule group key is defined, the settings will only affect the specific deny rule group.

description: Whether a trailing slash is mandatory at the end of the entry path or not.

description: Whether to ignore case.

description: Allowed values are: directory, regex.

description: This specifies the external URL path.

description: The entry path specifies the external URL path the mapping should be available under.

description: Specifies whether Airlock environment cookies containing useful request information are sent to the connected back-end.

description: Defines the maximum length of a parameter name in bytes.

description: Defines the maximum length for a parameter value in bytes.

description: Defines the maximum number of parameters inside the request.

description: A regular expression which specifies any parameters which should not be checked against these length checks.

description: The limits for HTTP parameters.

description: Defines the maximum number of items in a single JSON array (non-recursive).

description: Defines the maximum length for a JSON key, also known as 'JSON property' or 'JSON object member' in bytes.

description: Defines the maximum number of keys of a single JSON object (non-recursive).

description: Defines a regular expression to exclude JSON keys and the corresponding values from the length checks. The exceptions must be specified in the '#json' format for a JSON key.

description: Defines the maximum depth of nesting for JSON objects and JSON arrays.

description: Defines the maximum number of keys and array items in the whole JSON document (recursive).

description: Defines the maximum length for a JSON value (string or numbers) in bytes.

description: The limits for JSON structures.

description: Defines the maximum path length for requests to the current mapping in bytes.

description: The maximum allowed total size of the request body in bytes. It specifies the number of bytes from 0 (meaning unlimited) to 2147483647 (2GB) that are allowed in the request body. To restrict the size of file uploads, set this limit to the maximum combined size of all files uploaded at once.

description: The Airlock Gateway mapping template file path.

description: The unique name of the mapping.

description: Allowed values are: production, integration.

description: If enabled, requests are blocked if they contain the same parameter names with different parameter types (e.g. "id" is present as a POST parameter and as a query parameter simultaneously).

description: If enabled, offending requests are not blocked but only logged.

description: Exception pattern to exclude parameters from the parameter pollution detection.

description: If enabled, all the different values of a repeated parameter are joined by comma (in order of appearance). The aggregate value is then checked against deny rules (instead of the individual values).

description:
Specifies the priority of this mapping (highest: -999, lowest: 999) when a request matches the entry path of multiple mappings.
All mappings with entry_path.type regex must have a unique priority.

title: custom action

description: An action to add a header to all requests.

description: An action to add a header to all requests if it is not already present.

description: An action to add or replace an existing header to all requests.

description: A list of alpha-2 continent codes to redirect clients from. See here: https://en.wikipedia.org/wiki/List_of_sovereign_states_and_dependent_territories_by_continent_(data_file)

description: A list of country codes to redirect clients from. See here for alpha-2 codes to use: https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2

description: The http status code to use on redirect

description: The url to redirect to.

description: An action to redirect to a URL based on the geographic location of the request source IP.

description: A pattern for the header name.

description: The http status code to use on redirect

description: The url to redirect to.

description: A pattern for the header value.

description: An action to redirect to a URL based on a header name or value either matching the given name or value pattern on requests.

description: A unique name for this action; if not specified, a unique name will be generated.

description: An action to remove a header either matching given name or value pattern on requests.

description: An action to rewrite a header value either matching given name or value pattern on requests.

description: A list of request custom actions executed in order of appearance. Only one action type (e.g. add_header or header_redirect) can be specified in each entry. Create multiple list positions if needed.

title: custom action

description: An action to add a header to all responses.

description: An action to add a header to all responses if it is not already present.

description: An action to add or replace an existing header on all responses.

description: A unique name for this action; if not specified, a unique name will be generated.

description: An action to remove a header either matching given name or value pattern on responses.

description: A pattern to match the name of the cookie to rewrite. If this is set the name of the cookie must match this pattern for the rewrite to happen.

description: A pattern to match the domain, or part of the domain of a cookie to rewrite it.

description: What to replace the domain with; Can make back references to the pattern used to match.

description: Whether to `add`, `keep` or `remove` the `HttpOnly` (see: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#HttpOnly) flag on cookies. AUTO will set the flag for encrypted cookies and KEEP it for others.

description: A pattern to match the path of a response to rewrite.

description: What to replace the path with; Can make back references to the pattern used to match.

description: Whether to `add`, `keep` or `remove` the `Secure` (see: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#Secure) flag on cookies. AUTO will set the flag on all connections that use HTTPS and remove it on others.

description: An action to rewrite a cookie based on patterns for cookie name, domain etc.

description: An action to rewrite a header value either matching given name or value pattern on responses.

description: A string to rewrite value pattern matches in the cookie value. Can make back references to the pattern used for matching.

description: A pattern for the cookie value to apply for matching.

description: An action to rewrite the raw value of a cookie matching the given pattern.

description: Replacement rules for error responses returned by backend systems.

title: error page replacement

description: Error page file name that will be delivered to the client. (eg. 400.html)

description: The http response with the matching status code that should be replaced.

description: Rewrite the body of HTTP response.

title: rewrite

description: This regular expression pattern defines the content to rewrite.

description: A response from the back-end server is rewritten only if the response header «Content-Type» matches this regular expression.

description: This is the target string which will replace the string matched by Content Pattern

description: Rewriting HTML content may be necessary to modify URLs in the HTML content if the application creates absolute or incorrect links because it is not reverse proxy compatible

title: html

description: This list defines the content to rewrite. Possible values are 'url', event', 'embedded'.

description: This is the target string which will replace the string matched by URL Pattern

description: The URL pattern.

description: Rewrite the json body of http responses.

title: json

description: This regular expression pattern defines the content to rewrite.

description: The json path of the the property to rewrite.

description: This is the target content to replace the matched part with.

description: Rewrite option to modify the HTTP redirect location header sent from the back-end server before it is sent to the client.

title: location header

description: This is the target string which will replace the string matched by URL Pattern

description: The redirect URL pattern.

description: Allowed values are: enforce_session, optional_session, optional_session_no_refresh, ignore_session

description: Allowed values are: block, terminate_session, notify.

description: Defines the time in seconds Airlock Microgateway will wait for the back-end HTTP response. In case the request runs into the timeout, Airlock Microgateway will deliver an error page with the corresponding HTTP 503 status code.

description: Defines the minimum session idle time in seconds for this mapping. The value will be ignored if minimum session idle timeout is smaller or equal to the global session idle timeout setting.

description: Additional hostnames which refer to this virtual host.

description: The concatenated certificates of the CAs which are sent to the client during the SSL handshake, in PEM format.

description: The file containing the selection CA certificates.

description: The concatenated certificates of the CAs which are used as trust anchor during chain validation, in PEM format.

description: The file containing the validation CA certificates.

description: PEM representation of certificate revocation lists. If a client certificate is on such a list it will not be accepted. Although Airlock provides this functionality, it is recommended to check certificates against CRLs and other types of blacklists within the authentication service and not in Airlock.

description: The file containing the crl.

description: Defines the default verification mode for client certificates on this virtual host. Possible values are 'off', 'optional' or 'required'.

description: Maximum number of intermediate certificate issuers.

description: List of certificates of the CA chain for the certificate.

description: The CA chain file path.

description: The certificate in PEM format.

description: The certificate file path.

description: The private key for the certificate in PEM format.

description: The private key file path

description: Specifies whether encoded slashes (%2F) are allowed in URL path. Attention: combinations of client certificates per mapping and enabled encoded slashes in the same virtual host might result in configurations where client certificate evaluation might be evaded.

description: The hostname of the virtual host.

description: Specifies whether HTTP/2 connections are enabled for this host.

description: Specifies whether HTTP connections are enabled for this host.

description: Specifies the port on which this host listens for HTTP connections.

description: Specifies whether HTTPS connections are enabled for this host.

description: Specifies the port on which this host listens for HTTPS connections.

description: The logical name of the virtual host.

title: redirect

description: The destination can be relative to the current virtual host or an absolute URL including protocol and host. Relative redirect paths are extended with the incoming scheme and host header.

description: The absolute path starting with '/' as a regular expression from which to redirect.

description: The returned status code. Must be one of: [301, 302, 303, 307, 308]

description: Specifies the domain for Airlock's session cookie if the cookie is created inside this virtual host.

description: Specifies the cookie path for Airlock's session cookie if the cookie is created inside this virtual host.

description: Specifies whether a virtual host should reply only to requests that match the hostname or any of its server alias names.

description: Custom deny rule groups that can be referenced in mappings on top of the built in Airlock deny rules.

title: denied rule groups

description: Filter rule that blocks requests based on the evaluation of different request attributes.

title: denied rules

description: Unique name. In order to prevent overriding built-in deny rules, the name may not start with '(default)'.

description: Unique short name. In order to prevent overriding built-in deny rules, the name may not start with '(default)'.

description: Unique name. In order to prevent overriding built-in deny rule group, the name may not start with '(default)'.

description: Unique short name. In order to prevent overriding built-in deny rule group, the name may not start with '(default)'.

description: JWKS providers that are configured statically.

title: provider

description: Name of JWKS issuer. Corresponds to the 'Issuer' field in JWT.

description: JSON Object that represents the set of JWKS.

description: JSON file with the definitions of JWKS.

description: Name by which provider is referenced. Must be unique.

description: Refresh interval for fetching from remote JWKS providers in seconds.

description: Remote JWKS providers which are fetched according to the jwks_providers.refresh_interval.

title: provider

description: Name of JWKS issuer. This value is used to restrict the usage of the JWKS to JWTs with a matching issuer (claim 'iss').

description: URL of JWKS service provider.

title: tls

description: The TLS cipher suite to use. For documentation visit www.openssl.org and search for 'ciphers'.

description: The CA chain file path.

description: The certificate in PEM format.

description: The certificate file path.

description: The private key file path

description: Force new session for each request.

description: The TLS protocol to use. For the description of the default values see the Gateway documentation for 'Supported SSL/TLS versions'.

description: Verification which involves a server identity check to mitigate man in the middle attacks.

description: JWKS Providers which can be referenced in apps[].mappings[].access_token.

description: The encoded license.

description: The license file path.

description: Allowed values are: info, trace

title: metrics

title: statsd

description: Enable sending of statsd metrics. Default is 'true'

description: Use this to enable sending metrics using the statsd protocol.

description: Configuration for metrics sending.

description:
If set, Airlock Microgateway will treat the value of this header field as the useragent IP address.
Common values are 'X-Forwarded-For' or 'X-Client-IP'.
Warning: Make sure that internal_proxies is correctly configured for your setup.

description: List of hostnames, IP addresses or IP address ranges (e.g. 10.0.0.0/8) to trust as presenting a valid Remote-IP header.

description: Specifies the passphrase for the passphrase based encryption mechanism (PBE).

description: The path of the passphrase file.

description: Specifies the amount of idle time in seconds, after which an Airlock Microgateway session is terminated. This timeout should be smaller than all other session timeouts of your back-end applications. Even if the timeout can be configured in seconds, per default the resolution of the idle session timeout check is 5 seconds only.

description: Specifies the absolute lifetime of an Airlock Microgateway session in seconds. After this time a session will be terminated.

description: Name of the hosts running the Redis Server.

description:
Defines the redis session store connection mode. By default, the Microgateway tries to determine the connection mode depending on the number of redis hosts configured:
- server mode if only one host is configured
- cluster mode if several hosts are configured

Allowed values are: server, cluster and disabled.


stylecop.schema.json

title: StyleCop Analyzers Configuration

description: Configuration file for StyleCop Analyzers

description: The top-level object containing configuration properties for built-in rules.

description: Indentation configuration

description: Specifies the indentation size.

description: Specifies the tab width.

description: Specifies whether indentation should use hard tabs instead of spaces.

description: Configuration for spacing rules (SA1000-)

description: Configuration for readability rules (SA1100-)

description: When true, diagnostics will not be reported for using aliases of built-in types.

description: Configuration for ordering rules (SA1200-)

description: Specifies the traits used for ordering elements within a document, along with their precedence.

default: kind accessibility constant static readonly

enum: accessibility kind constant static readonly

description: When true, System using directives should be placed before other using directives.

description:
Specifies the desired placement of using directives.
insideNamespace: Place using directives inside the namespace definition
outsideNamespace: Place using directives outside the namespace definition
preserve: Allow using directives inside or outside the namespace definition

default: insideNamespace

description:
Specifies if using groups should be separated by a blank line.
allow: A blank line is allowed, but not required
require: A blank line is required
omit: A blank line is not allowed

enum: allow require omit

default: allow

description: Configuration for naming rules (SA1300-)

description: Determines whether common Hungarian notation prefixes should be allowed.

description: Allowed Hungarian notation prefixes.

description: Allowed namespace components, such as ones beginning with a lowercase letter.

description: Specifies whether inferred tuple element names will be analyzed as well.

description: Specifies the casing convention used for tuple element names.

enum: camelCase PascalCase

default: PascalCase

description: Configuration for ordering rules (SA1400-)

description: The set of type kinds which should be placed in separate files according to the type name.

enum: class interface struct delegate enum

description: Configuration for layout rules (SA1500-)

description:
Specifies the handling for newline characters which appear at the end of a file
allow: Files are allowed to end with a single newline character, but it is not required
require: Files are required to end with a single newline character
omit: Files may not end with a newline character

description: Specifies if SA1519 will allow consecutive using statements without braces

description: Specifies if SA1500 will allow the 'while' expression of a 'do'/'while' loop to be on the same line as the closing brace.

description: Configuration for documentation rules (SA1600-)

description: Specifies whether exposed elements need to be documented. When true, all publicly-exposed types and members require documentation.

description: Specifies whether internal elements need to be documented. When true, all internally-exposed types and members require documentation.

description: Specifies whether private elements need to be documented. When true, all types and members except for declared private fields require documentation.

description: Specifies whether interface members need to be documented. When true, all interface members require documentation, regardless of accessibility.

description: Specifies whether private fields need to be documented. When true, all fields require documentation, regardless of accessibility.

description: The name of the company which appears in file headers.

default: PlaceholderCompany

description: The copyright text which should appear in file headers.

default: Copyright (c) {companyName}. All rights reserved.

description: Replacement variables which may be used in the 'copyrightText' value.

description: Determines whether the file header should be wrapped in the StyleCop-standard XML structure.

description: The text used as decoration for the copyright header comment.

description: Specifies the preferred naming convention for files. The default value "stylecop" uses the naming convention defined by StyleCop Classic, while "metadata" uses a file naming convention that matches the metadata names of types.

default: stylecop

enum: stylecop metadata

description: The culture that should be used for documentation comments.

default: en-US

description: Specifies the top-level tags within XML documentation that will be excluded from punctuation analysis.