Advanced configuration

Some technical configurations can be applied to an instance directly in its configuration file. This should be used carefully as it may cause things to break.

Injecting advanced configuration

  • RPM

  • Debian

  • Kubernetes

  • Docker

On VMs, you have access to the /opt/horizon/etc/conf.d/horizon-extra.conf file. For each parameter you wish to override, create a newline and use the following syntax:

<parameter>=<value>

As an example, if you want to modify the file extension that DER certificates will have when sent as email attachments and set it to CRT, you need to add:

horizon.notification.mail.attachment.extension.der="crt"

After modifying the file, restart the Horizon service:

$ systemctl restart horizon
One added line means one modified option, you need to add as many lines at the end of the file as there are values that you want to override.

On VMs, you have access to the /opt/horizon/etc/conf.d/horizon-extra.conf file. For each parameter you wish to override, create a newline and use the following syntax:

<parameter>=<value>

As an example, if you want to modify the file extension that DER certificates will have when sent as email attachments and set it to CRT, you need to add:

horizon.notification.mail.attachment.extension.der="crt"

After modifying the file, restart the Horizon service:

$ systemctl restart horizon
One added line means one modified option, you need to add as many lines at the end of the file as there are values that you want to override.

The Horizon container provides a bundled application.conf file that is mostly configured through environment variables. To modify low-level behavior of Horizon that are not accessible through an environment variable, use the extraConfig value in your values.yaml file to update specific settings:

extraConfig: |
    horizon {
      notification.mail.attachment.extension.der = "der"
    }

Extra configurations are appended at the end of the config file, overriding any previously set config value.

The Horizon container provides a bundled application.conf file that is mostly configured through environment variables. To modify low-level behavior of Horizon that are not accessible through an environment variable, you can mount custom configuration files, giving you full control over how Horizon behaves.

The mounted folder :

  • MUST contain an pekko.conf file configuring the Pekko cluster. See the reference config to get an idea over what’s configurable.

  • CAN contain a application.conf file containing any extra config options unrelated to clustering.

A typical Docker command would then be :

$ docker run \
   -v [configurationPath]:/opt/horizon/etc/:rw \
   ...
   registry.evertrust.io/horizon:2.10.x

Startup scripts

Sometimes, you’ll want to run scripts each time the container starts up in order to configure files in the container or set environment variables. To do so, you’ll need to mount shell scripts into the /docker-entrypoint.d/ directory in the container :

  • Kubernetes

  • Docker

Using the Helm chart, this can be achieved easily using the following values.yaml overrides:

extraVolumes:
  - name: horizon-entrypoint-scripts
    configMap:
      name: horizon-entrypoint-scripts

extraVolumeMounts:
  - name: horizon-entrypoint-scripts
    mountPath: /docker-entrypoint.d/

Given you’ve previously create a ConfigMap called horizon-entrypoint-scripts:

apiVersion: v1
kind: ConfigMap
metadata:
  name: horizon-entrypoint-scripts
data:
  run-on-startup.sh: |
    echo "Hello World !"
$ docker run \ -v [scriptsPath]:/docker-entrypoint.d/ \
   ...
   registry.evertrust.io/horizon:2.10.x

Where scriptsPath is a directory containing one or multiple shell scripts that will be sourced before running Horizon.

By design, Horizon is configured to run as an unprivileged user inside the container to follow industry best practices. This means that your scripts won’t be able to perform privileged operations on the container, such as trusting custom CAs. If you do want to overcome this problem, you can run the container as root, even though it is generally discouraged.

Available settings

Parameter horizon.report.storage.* was deleted.
Parameter horizon.archive.storage.* was deleted.
Parameter horizon.pki.acme.authorization.* was deleted.

ACME Configuration

horizon.acme.url.default-scheme

horizon.acme.url.default-scheme = "https"

Protocol to use to calculate the ACME base URL if there isn’t any X-Forwarded-Proto nor X-Forwarded-Host in the header of the request

horizon.acme.url.prefix

horizon.acme.url.prefix = "/acme"

Prefix used to calculate the ACME base URL

horizon.acme.behavior.emulate-boulder

horizon.acme.behavior.emulate-boulder = true

Defines whether Horizon should behave like the Boulder ACME implementation (if set to false, Horizon will strictly follow the RFC). Only applicable if horizon.acme.http.json.prettify is set to "true"

horizon.acme.behavior.post-as-get

horizon.acme.behavior.post-as-get = true

Whether the ACME API can be used with GET requests instead of POST ones

horizon.acme.maximum.timeout

horizon.acme.maximum.timeout = "5m"

Maximum configurable timeout in the ACME profiles

horizon.acme.maximum.retry.delay

horizon.acme.maximum.retry.delay = "1h"

Maximum configurable delay in the ACME profiles

horizon.acme.maximum.retry.count

horizon.acme.maximum.retry.count = 15

Maximum configurable retry count in the ACME profiles

horizon.acme.order.updater.worker

horizon.acme.order.updater.worker = 5

Number of instances that will be started for each Horizon node to perform the ACME validation

horizon.acme.order.ttl

horizon.acme.order.ttl = "1m"

Order time to live

horizon.acme.response.verifier.worker

horizon.acme.response.verifier.worker = 5

Number of instances that will be started for each Horizon node to perform the ACME validation

horizon.acme.challenge.entropy

horizon.acme.challenge.entropy = 32

Acme challenge size

horizon.acme.http.json-prettify

horizon.acme.http.json-prettify = true

Http response as sent as prettyfied JSON

ACME Pki connector configuration

horizon.pki.acme.order.interval

horizon.pki.acme.order.interval = "5s"

Interval at which order status is checked against the ACME server

horizon.pki.acme.order.max-delay

horizon.pki.acme.order.max-delay = "30s"

Max delay before order retrieval against the ACME server is abandoned

Analytics Configuration

horizon.event.analytics.actor.timeout

horizon.event.analytics.actor.timeout = "1m"

The timeout for requests to the event analytics actor

horizon.event.analytics.actor.interval

horizon.event.analytics.actor.interval = "5s"

Interval at which the events are synchronized

horizon.event.analytics.enabled

horizon.event.analytics.enabled = false

Enable event analytics

horizon.discovery.event.analytics.actor.timeout

horizon.discovery.event.analytics.actor.timeout = "1m"

The timeout for requests to the discovery event analytics actor

horizon.discovery.event.analytics.actor.interval

horizon.discovery.event.analytics.actor.interval = "5s"

Interval at which the discovery events are synchronized

horizon.discovery.event.analytics.enabled

horizon.discovery.event.analytics.enabled = false

Enable discovery event analytics

horizon.certificate.analytics.actor.timeout

horizon.certificate.analytics.actor.timeout = "1m"

The timeout for requests to the certificate analytics actor

horizon.certificate.analytics.enabled

horizon.certificate.analytics.enabled = false

Enable certificate analytics

horizon.analytics.url

horizon.analytics.url = "jdbc:duckdb:"

The url to the analytics database. Should start with jdbc:duckdb: followed by the absolute path of the file.

horizon.analytics.pool-size

horizon.analytics.pool-size = 10

The thread pool size for the analytics operations. Should be equal to ((physical_core_count * 2) + effective_spindle_count)

horizon.analytics.memory-limit

horizon.analytics.memory-limit = "1GB"

The memory limit to set to the duck db analytics database

Archive Configuration

horizon.archive.certificate.batch-size

horizon.archive.certificate.batch-size = 1000

Batch size for certificate archive creation

horizon.archive.certificate.grace-period

horizon.archive.certificate.grace-period = "7d"

Grace period of certificate archives before they can be deleted. Decreasing this value means less time to securely download the archive before it is available for deletion

horizon.archive.event.batch-size

horizon.archive.event.batch-size = 1000

Batch size for event archive creation

horizon.archive.event.grace-period

horizon.archive.event.grace-period = "7d"

Grace period of event archives before they can be deleted. Decreasing this value means less time to securely download the archive before it is available for deletion

horizon.archive.event.minimum-retention

horizon.archive.event.minimum-retention = "90d"

Time frame after which event archiving is allowed

horizon.archive.parquet.buffer-size

horizon.archive.parquet.buffer-size = "8M"

Buffer size for the parquet writer. If using s3 backend, this should be no more than 2 times the 'storage.multipart-upload-buffer-size' to optimize performance

Async Enrollment Configuration

horizon.async-enrollment.interval

horizon.async-enrollment.interval = "5m"

Interval at which the background process polls in-progress enrollment requests

horizon.async-enrollment.retry.increment

horizon.async-enrollment.retry.increment = "5m"

Delay increment between consecutive polls for the same request (5, 10, 15, … minutes)

horizon.async-enrollment.retry.max-delay

horizon.async-enrollment.retry.max-delay = "60m"

Upper bound for the poll delay

horizon.async-enrollment.parallelism

horizon.async-enrollment.parallelism = 3

Parallelism for concurrent request polling

Auto Renew Configuration

horizon.auto-renew.interval

horizon.auto-renew.interval = "6h"

Interval at which the auto renewal process will check certificates to renew

horizon.auto-renew.parallelism.renewal

horizon.auto-renew.parallelism.renewal = 3

Parallelism for concurrent certificate renewals on auto renew

horizon.auto-renew.parallelism.profile

horizon.auto-renew.parallelism.profile = 1

Parallelism for concurrent profile auto renewal execution. Bumping this parameter will have a multiply effect on the horizon.auto-renew.parallelism.renewal parameter

Bootstrap Configuration

horizon.bootstrap.administrator.name

horizon.bootstrap.administrator.name = "administrator"

How long the authentication cache lasts

Default administrator account name

horizon.bootstrap.administrator.display-name

horizon.bootstrap.administrator.display-name = "Horizon Administrator"

Default administrator account display name

horizon.bootstrap.administrator.password.path

horizon.bootstrap.administrator.password.path = "var/run/adminPassword"

Relative path of the file where the initial admin password should be stored into

horizon.bootstrap.administrator.password.length

horizon.bootstrap.administrator.password.length = 24

Length (in bytes) of the initial admin password

horizon.bootstrap.local.identity.provider

horizon.bootstrap.local.identity.provider = "local"

Default administrator account identity provider to use

horizon.bootstrap.timeout

horizon.bootstrap.timeout = "1m"

Duration after which the bootstrap of Horizon times out

CA Configuration

horizon.ca.manager.default-cache-idletime

horizon.ca.manager.default-cache-idletime = "30d"

Default idle time after which a CA crl is removed from cache

horizon.ca.manager.timeout

horizon.ca.manager.timeout = "1m"

Duration that the CA manager actor will wait to retrieve information about certificates (trust status, trust chain, …​)

horizon.ca.maximum.timeout

horizon.ca.maximum.timeout = "5m"

Maximum configurable timeout for CRL/OCSP request for a CA

horizon.ca.maximum.refresh

horizon.ca.maximum.refresh = "7d"

Maximum configurable refresh for a CA’s CRL

horizon.ca.exporters

horizon.ca.exporters = []

List of exporters to export client authenticated CAs to

horizon.ca.exporters.[].enabled

horizon.ca.exporters.[].enabled = true

Whether this exporter should export client CAs

horizon.ca.exporters.[].type

horizon.ca.exporters.[].type = "k8s-configmap|k8s-secret|file"

Type of exporter. One of k8s-configmap, k8s-secret, file. The corresponding configuration parameters should be filled

horizon.ca.exporters.[].format

horizon.ca.exporters.[].format = "pem-blocks"

How to format the CA certificates. One of pem-blocks

horizon.ca.exporters.[].file.path

horizon.ca.exporters.[].file.path = "<path to file>"

Path to the file to write the CAs to. Mandatory if type is file

horizon.ca.exporters.[].k8s-configmap.name

horizon.ca.exporters.[].k8s-configmap.name = "<configmap name>"

Name of the configmap. Mandatory if type is k8s-configmap

horizon.ca.exporters.[].k8s-configmap.map-key

horizon.ca.exporters.[].k8s-configmap.map-key = "<key in the configmap data map>"

Key of the element in the configmap

horizon.ca.exporters.[].k8s-secret.name

horizon.ca.exporters.[].k8s-secret.name = "<secret name>"

Name of the secret. Mandatory if type is k8s-secret

horizon.ca.exporters.[].k8s-secret.secret-key

horizon.ca.exporters.[].k8s-secret.secret-key = "<key in the secret data map>"

Key of the element in the secret

CRL Configuration

horizon.crl.updater.batch

horizon.crl.updater.batch = 500

Number of certificates per batch when Horizon synchronizes the database with the CRL or updates the cached entries

This parameter replaces horizon.crl.updater.parallelism. Please modify your configuration accordingly

horizon.crl.refresh.queue.size

horizon.crl.refresh.queue.size = 100

The maximum number of CAs awaiting CRL synchronization for the certificate status cache. When modifying this value, the change should be reflected on the crl-task-dispatcher.thread-pool-executor.fixed-pool-size value

horizon.crl.refresh.queue.parallelism

horizon.crl.refresh.queue.parallelism = 5

Number of CRLs to synchronize in parallel for the certificate status cache

horizon.crl.synchronizer.timeout

horizon.crl.synchronizer.timeout = "30s"

Timeout for the synchronizer actor during DB synchronization

horizon.crl.synchronizer.queue.parallelism

horizon.crl.synchronizer.queue.parallelism = 1

Number of CRLs to synchronize in parallel for DB synchronization. When modifying this value, the change should be reflected on the crl-task-dispatcher.thread-pool-executor.fixed-pool-size value

horizon.crl.synchronizer.queue.size

horizon.crl.synchronizer.queue.size = 100

The maximum number of CAs awaiting CRL synchronization for DB synchronization

CSV Configuration

horizon.request.search.csv.delimiter

horizon.request.search.csv.delimiter = ";"

The CSV delimiter to use when exporting an HRQL query result to a CSV file

horizon.event.search.csv.delimiter

horizon.event.search.csv.delimiter = ";"

The CSV delimiter to use when exporting an HEQL query result to a CSV file

horizon.discovery.event.search.csv.delimiter

horizon.discovery.event.search.csv.delimiter = ";"

The CSV delimiter to use when exporting an HDQL query result to a CSV file

horizon.certificate.search.item.attribute.separator

horizon.certificate.search.item.attribute.separator = ":"

The CSV item attribute separator to use when exporting an HCQL query result to a CSV file

horizon.certificate.search.item.separator

horizon.certificate.search.item.separator = "\n"

The CSV item separator to use when exporting an HCQL query result to a CSV file

horizon.certificate.search.csv.delimiter

horizon.certificate.search.csv.delimiter = ";"

The CSV delimiter to use when exporting an HCQL query result to a CSV file

Certificate authentication

horizon.security.http.headers.certificate

horizon.security.http.headers.certificate = null

Name of the HTTP header containing the certificate

DCV Configuration

horizon.dcv.manager.timeout

horizon.dcv.manager.timeout = "1m"

Duration after which the DCV manager actor times out when retrieving dcv configuration in the database

horizon.dcv.manager.queue.size

horizon.dcv.manager.queue.size = 100

Number of DCV policy that can be queued

horizon.dcv.manager.validation.initial-delay

horizon.dcv.manager.validation.initial-delay = "30s"

Delay between DNS record creation and first validation attempt, to allow DNS propagation

horizon.dcv.validation.throttle.elements

horizon.dcv.validation.throttle.elements = 1

Maximum number of domains submitted for validation within the time window defined by throttle.per for each dcv policy

horizon.dcv.validation.throttle.per

horizon.dcv.validation.throttle.per = "1s"

Time window for the throttle

horizon.dcv.validation.worker-count

horizon.dcv.validation.worker-count = 1

Number of DCVWorkerActor instances to start per cluster node

horizon.dcv.search.page.default-size

horizon.dcv.search.page.default-size = 50

Default number of DCV lifecycle events returned per page

horizon.dcv.search.page.max-size

horizon.dcv.search.page.max-size = null

Maximum number of DCV lifecycle events that can be requested per page (null for unlimited)

horizon.dcv.search.timeout

horizon.dcv.search.timeout = "30s"

Timeout for DCV lifecycle event search queries

horizon.dcv.event.retention

horizon.dcv.event.retention = "30d"

Retention of DCV lifecycle event before they are removed from the database. This cannot be less than 30 days

Database Configuration

horizon.security.principal.search.timeout

horizon.security.principal.search.timeout = "0s"

Maximum time allowed for security principals search operations. For infinite timeout, use 0s

horizon.request.search.timeout

horizon.request.search.timeout = "0s"

Maximum time allowed for request search and aggregate operations. For infinite timeout, use 0s

horizon.event.search.timeout

horizon.event.search.timeout = "30s"

Maximum time allowed for event search operations. For infinite timeout, use 0s

horizon.discovery.event.search.timeout

horizon.discovery.event.search.timeout = "30s"

Maximum time allowed for discovery event search and aggregate operations. For infinite timeout, use 0s

horizon.certificate.search.timeout

horizon.certificate.search.timeout = "30s"

Maximum time allowed for certificate search and aggregate operations. For infinite timeout, use 0s

Discovery Event Configuration

horizon.discovery.event.ttl

horizon.discovery.event.ttl = null

Time to live of the discovery events. If not set, events never expire

Event Configuration

horizon.event.ttl

horizon.event.ttl = null

Time to live of the events. If not set, events never expire

horizon.event.chainsign

horizon.event.chainsign = true

Specify whether to chain and sign the Horizon events to ensure they haven’t been tampered with

horizon.event.seal.algorithm

horizon.event.seal.algorithm = "HS512"

Algorithm to use to hash the signature of the events in Horizon (other possible values are "HS384" and "HS256")

horizon.event.seal.secret

horizon.event.seal.secret = null

Secret to seal the events with

horizon.event.ignore-unsealed-pending

horizon.event.ignore-unsealed-pending = false

Do not throw an error if pending events are unsealed

horizon.event.timeout

horizon.event.timeout = "30s"

Duration after which the event manager times out when trying to retrieve the last signed event in the database

horizon.event.manager.interval

horizon.event.manager.interval = "5s"

How often will the Event Manager actor check in the database if new a new event appeared to sign it and display it in the "Events" section of Horizon

General

horizon.security.pop.iat.future

horizon.security.pop.iat.future = "5s"

Difference of time allowed between the "Issued At Time" and the validation time (or the server time) (in the future only)

horizon.security.pop.iat.past

horizon.security.pop.iat.past = "5s"

Difference of time allowed between the "Issued At Time" and the validation time (or the server time) (in the past only)

horizon.security.pop.iat.clock-skew

horizon.security.pop.iat.clock-skew = "30s"

Difference of time allowed between the client time and the server time

horizon.security.identity.local.password-reset.duration

horizon.security.identity.local.password-reset.duration = "2m"

Time to live of a password reset request (from the login prompt)

horizon.security.trustmanager.enforce-serverauth

horizon.security.trustmanager.enforce-serverauth = false

If set to true, enforces the use of the serverAuth EKU in the server authentication certificates (when Horizon accesses a service through TLS)

horizon.security.manager.timeout

horizon.security.manager.timeout = "1m"

Duration after which the security manager times out when trying to authenticate a principal with its session

horizon.request.default.grace-period

horizon.request.default.grace-period = "30d"

Default grace period for all requests

horizon.request.default.duration

horizon.request.default.duration = "7d"

Default duration for all requests

horizon.request.failed.duration

horizon.request.failed.duration = "7d"

Default duration for failed requests

horizon.intune.revocation.max-requests

horizon.intune.revocation.max-requests = 250

Number of revocation requests downloaded from Intune

Limited to 500 max

horizon.datasource.default-timeout

horizon.datasource.default-timeout = "5s"

Default timeout for REST requests for the REST datasource

horizon.scheduler.manager.timeout

horizon.scheduler.manager.timeout = "1m"

Duration after which the Scheduler manager actor times out when retrieving scheduled tasks in the database

horizon.notification.mail.attachment.extension.der

horizon.notification.mail.attachment.extension.der = "der"

File extension that DER certificates sent as email attachments (through the notifications feature) will be given

horizon.notification.mail.attachment.extension.p7b

horizon.notification.mail.attachment.extension.p7b = "p7b"

File extension that PKCS#7 certificates sent as email attachments (through the notifications feature) will be given

horizon.notification.mail.attachment.extension.pem

horizon.notification.mail.attachment.extension.pem = "pem"

File extension that PEM certificates sent as email attachments (through the notifications feature) will be given

horizon.hql.max-recursion-depth

horizon.hql.max-recursion-depth = 5

Maximum recursion allowed for the HQL queries

horizon.system.monitor.timeout

horizon.system.monitor.timeout = "30s"

Timeout for the system monitor loading

horizon.thirdparty.manager.timeout

horizon.thirdparty.manager.timeout = "1m"

Timeout for thirdparty synchronization requests

horizon.pki.manager.maximum.timeout

horizon.pki.manager.maximum.timeout = "5m"

Maximum configurable timeout on the PKI connectors

horizon.pki.manager.timeout

horizon.pki.manager.timeout = "1m"

Duration after which the PKI Manager times out when trying to enroll or revoke a certificate

horizon.pki.manager.queue.parallelism

horizon.pki.manager.queue.parallelism = 5

Number of parallel certificate requests (enrollment, revocation…) on the default queue

horizon.pki.manager.queue.size

horizon.pki.manager.queue.size = 100

Number of certificate requests (enrollment, revocation) that can be queued on the default queue

horizon.pki.manager.healthcheck.interval

horizon.pki.manager.healthcheck.interval = "5m"

Interval at which the PKI connectors statuses are checked

horizon.show-banner

horizon.show-banner = true

Hide the start-up banner

horizon.est.store-encryption-type

horizon.est.store-encryption-type = "AES_STRONG"

Default store encryption type to use when sending centralized EST responses

horizon.scim.discovery-endpoints.authenticated

horizon.scim.discovery-endpoints.authenticated = true

Choose whether or not scim discovery endpoints are authenticated

horizon.automation-policy.default.keytype

horizon.automation-policy.default.keytype = "rsa-2048"

Default key type used for automation when none are specified in the profile

horizon.endpoints

horizon.endpoints = null

Custom endpoint configuration

Global constraints Configuration

horizon.default.constraints.allowed.domains

horizon.default.constraints.allowed.domains = null

Default allowed domains: a regular expression that the dns or email domains should match

horizon.default.constraints.allowed.email.domains

horizon.default.constraints.allowed.email.domains = null

Default allowed email domains: a regular expression that the email domains should match (after the @)

horizon.default.constraints.allowed.dns.domains

horizon.default.constraints.allowed.dns.domains = null

Default allowed dns domains: a regular expression that the dns domains should match

Grading Configuration

horizon.grading.manager.timeout

horizon.grading.manager.timeout = "30s"

Duration after which the grading manager times out when retrieving the grading configuration from the database

horizon.grading.manager.queue.size

horizon.grading.manager.queue.size = 100

How large can the grading manager queue can get before it discards new grading requests

horizon.grading.timeout

horizon.grading.timeout = "30s"

Duration after which the grading actor times out when grading a certificate (upon enrolment)

HTTP Headers Configuration

horizon.security.http.headers.enforce-connection-close

horizon.security.http.headers.enforce-connection-close = true

Defines whether HTTP connections should remain open

horizon.security.http.headers.real-ip

horizon.security.http.headers.real-ip = "X-Real-IP"

Name of the HTTP header to use as Real IP

horizon.security.http.headers.scheme

horizon.security.http.headers.scheme = "X-Forwarded-Proto"

Name of the HTTP header containing the scheme requested - used for ACME

horizon.security.http.headers.host

horizon.security.http.headers.host = "X-Forwarded-Host"

Name of the HTTP header containing the host requested - used for ACME

Kubernetes Configuration

horizon.kubernetes.namespace-path

horizon.kubernetes.namespace-path = "/var/run/secrets/kubernetes.io/serviceaccount/namespace"

Path to the file containing the namespace identifier of the Kubernetes cluster

horizon.kubernetes.namespace

horizon.kubernetes.namespace = null

Namespace of the Kubernetes cluster. If defined, contents of the horizon.kubernetes.namespace-path will be ignored

horizon.kubernetes.api-ca-path

horizon.kubernetes.api-ca-path = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"

Path to the file containing the certificate authorities of the Kubernetes cluster

horizon.kubernetes.api-token-path

horizon.kubernetes.api-token-path = "/var/run/secrets/kubernetes.io/serviceaccount/token"

Path to the file containing the token to authenticate on the API of the Kubernetes cluster

horizon.kubernetes.api-service.host

horizon.kubernetes.api-service.host = "localhost"

Host on which to join the Kubernetes API

horizon.kubernetes.api-service.port

horizon.kubernetes.api-service.port = 8080

Port on which to join the Kubernetes API

horizon.kubernetes.api-service.request-timeout

horizon.kubernetes.api-service.request-timeout = "5s"

Timeout for requests to the Kubernetes API

horizon.kubernetes.api-service.secure

horizon.kubernetes.api-service.secure = true

Whether to join the Kubernetes API with http or https

horizon.kubernetes.api-service.tls-version

horizon.kubernetes.api-service.tls-version = "TLSv1.2"

TLS Version to use while connecting to the Kubernetes API

horizon.kubernetes.token-rotation-retry.max-attempts

horizon.kubernetes.token-rotation-retry.max-attempts = 5

Number of retries in case of 401 response from Kubernetes API (can occur on token rotation)

horizon.kubernetes.token-rotation-retry.min-backoff

horizon.kubernetes.token-rotation-retry.min-backoff = 10 ms

Mimimum backoff for retries in case of 401 response from Kubernetes API (can occur on token rotation)

horizon.kubernetes.token-rotation-retry.max-backoff

horizon.kubernetes.token-rotation-retry.max-backoff = 1 minute

Maximum backoff for retries in case of 401 response from Kubernetes API (can occur on token rotation)

horizon.kubernetes.token-rotation-retry.random-factor

horizon.kubernetes.token-rotation-retry.random-factor = 0.3

Random factor for retries in case of 401 response from Kubernetes API (can occur on token rotation)

Maintenance Configuration

horizon.maintenance.filter.timeout

horizon.maintenance.filter.timeout = "3s"

Timeout to check for maintenance state on each request

Metrics Configuration

horizon.metrics.enabled

horizon.metrics.enabled = false

Enable advanced metrics for collection

horizon.metrics.intervals.short

horizon.metrics.intervals.short = "30s"

Interval at which short lived metrics are computed

horizon.metrics.intervals.long

horizon.metrics.intervals.long = "5m"

Interval at which background metrics are computed

Nonce Configuration

horizon.automation.nonce.size

horizon.automation.nonce.size = 32

Size of the nonce value used for the JWT authentication token

horizon.automation.nonce.ttl

horizon.automation.nonce.ttl = "5s"

Time to live of the nonce used to validate the JWT authentication token

horizon.acme.nonce.size

horizon.acme.nonce.size = 32

Size (in bytes) of the challenge stored in the nonce

horizon.acme.nonce.ttl

horizon.acme.nonce.ttl = "5s"

Duration for which a nonce stays in Horizon before being removed

horizon.openid.nonce.size

horizon.openid.nonce.size = 32

Size (in bytes) of the challenge stored in the nonce

horizon.openid.nonce.ttl

horizon.openid.nonce.ttl = "5s"

Duration for which a nonce stays in Horizon before being removed

horizon.request.nonce.size

horizon.request.nonce.size = 32

Size (in bytes) of the challenge stored in the nonce

horizon.request.nonce.ttl

horizon.request.nonce.ttl = "5s"

Duration for which a nonce stays in Horizon before being removed

OpenID Configuration

horizon.openid.state-separator

horizon.openid.state-separator = "#"

Separator character of the OpenID state

horizon.openid.callback-scheme

horizon.openid.callback-scheme = "https"

Scheme to use for the callback

This parameter replaces horizon.openid.https-callback. Please modify your configuration accordingly

horizon.openid.token-auth-method-order

horizon.openid.token-auth-method-order = ["client_secret_post", "client_secret_basic"]

Selection order for the authentication method on the access token retrieval endpoint

Report Configuration

horizon.report.link.refresh-interval = "5m"

The refresh interval between the deletion of expired reports with link email

horizon.report.link.maxStored = "3"

Max stored number of CSV for a given report. If the field is negative or equal to zero, then the retention will be deactivated.

Search Configuration

horizon.security.principal.search.page.default-size

horizon.security.principal.search.page.default-size = 50

How many elements to retrieve in a security principals search query if no pageSize has been specified

horizon.security.principal.search.page.max-size

horizon.security.principal.search.page.max-size = null

How big can the pageSize parameter be in a security principals search query (Must be a positive integer)

horizon.request.search.page.default-size

horizon.request.search.page.default-size = 50

How many elements to retrieve in a request search query if no pageSize has been specified

horizon.request.search.page.max-size

horizon.request.search.page.max-size = null

How big can the pageSize parameter be in a request search query (Must be a positive integer)

horizon.event.search.page.default-size

horizon.event.search.page.default-size = 50

How many elements to retrieve in an event search query if no pageSize has been specified

horizon.event.search.page.max-size

horizon.event.search.page.max-size = null

How big can the pageSize parameter be in an event search query (Must be a positive integer)

horizon.discovery.event.search.page.default-size

horizon.discovery.event.search.page.default-size = 50

How many elements to retrieve in a request search query if no pageSize has been specified

horizon.discovery.event.search.page.max-size

horizon.discovery.event.search.page.max-size = null

How big can the pageSize parameter be in a request search query (Must be a positive integer)

horizon.certificate.search.page.default-size

horizon.certificate.search.page.default-size = 50

How many elements to retrieve in a request search query if no pageSize has been specified

horizon.certificate.search.page.max-size

horizon.certificate.search.page.max-size = null

How big can the pageSize parameter be in a request search query (Must be a positive integer)

Service Account Configuration

horizon.service-account.validated-token.cache

horizon.service-account.validated-token.cache = "5m"

Default idle time after which a token validation is no longer valid

horizon.service-account.refresh.passive

horizon.service-account.refresh.passive = "1d"

Default interval for JWKS updates

horizon.service-account.refresh.active

horizon.service-account.refresh.active = "1h"

Default cooldown after a JWKS update

horizon.service-account.refresh.timeout

horizon.service-account.refresh.timeout = "3m"

Timeout for the JWKS endpoint HTTP call during a passive refresh

horizon.service-account.refresh-timeout

horizon.service-account.refresh-timeout = "10s"

Default timeout for HTTP client requests when fetching JWKS endpoints

Storage Configuration

horizon.storage.whitelist

horizon.storage.whitelist = null

Whitelist of allowed storage types for heavy files

Tenancy Configuration

horizon.tenancy.timeout

horizon.tenancy.timeout = "1m"

Timeout for the tenancy cache actor initialization

horizon.tenancy.grace-period

horizon.tenancy.grace-period = "30d"

Grace period for the tenant when deleted before effective deletion can occur

Transient Key Configuration

horizon.transient-keys.lifetime

horizon.transient-keys.lifetime = "7d"

Lifetime for transient (non escrowed) keys

horizon.transient-keys.removal-interval

horizon.transient-keys.removal-interval = "30m"

Interval at which expired keys are removed from the database

Trigger Configuration

horizon.trigger.retry.initial-delay

horizon.trigger.retry.initial-delay = "5m"

How long must a trigger that fails for the first time wait before retrying

horizon.trigger.retry.max-attempts

horizon.trigger.retry.max-attempts = 15

Maximum amount of failed attempts that a trigger can have before canceling

horizon.trigger.manager.timeout

horizon.trigger.manager.timeout = "1m"

Trigger manager timeout

horizon.trigger.manager.interval

horizon.trigger.manager.interval = "5m"

How often does the trigger manager check for triggers to run

Validation Rules Configuration

horizon.validation.dns.timeout

horizon.validation.dns.timeout = "10s"

Timeout to fetch dns records when using validation rules

Vault Configuration

horizon.vault.escrow

horizon.vault.escrow = null

The name of the escrow vault

horizon.vault.configuration

horizon.vault.configuration = null

The name of the configuration vault

horizon.vault.manager.timeout

horizon.vault.manager.timeout = "1m"

Timeout for encryption requests