diff --git a/docs/itential_platform_guide.md b/docs/itential_platform_guide.md
index 593e02fe..9bf5d1cc 100644
--- a/docs/itential_platform_guide.md
+++ b/docs/itential_platform_guide.md
@@ -87,6 +87,8 @@ default variables located in `roles/platform/defaults/main/authentication.yml`.
 | platform_auth_broker_principal_enabled | Boolean | Enables a AAA adapter to custom build the principal object for a user with a "buildPrincipal" method. | `false` |
 | platform_auth_session_cookie_name | String | The name of the cookie used for a user session. | `token` |
 | platform_auth_session_ttl | Integer | The time in minutes before a user session expires. | 60 |
+| platform_auth_principal_ttl | Integer | The time in minutes before a user principal expires. If not supplied it will fallback to the session ttl. |  |
+| platform_auth_relay_state_ttl | Integer | The time in seconds before the RelayState from SSO expires. | 600 |
 | platform_default_user_enabled | Boolean | Enables a default user to be used for login when SSO is not configured and no AAA Adapter exists. | `true` |
 | platform_default_user_username | String | The username of the default user. | `admin` |
 | platform_default_user_password | String | The password of the default user. | `admin` |
@@ -125,6 +127,8 @@ default variables located in `roles/platform/defaults/main/logging.yml`.
 | platform_log_dir | String | The absolute directory path where log files are written. | `/var/log/itential/platform` |
 | platform_log_filename | String | The name of the primary platform log file. | `platform.log` |
 | platform_log_level_console | String | The minimum log level to display in the console (stdout). | `warn` |
+| platform_log_format_json | Boolean | If true, log entries will be written in JSON format. Otherwise, log entries will be written in plaintext. | `false` |
+| platform_console_format_json | Boolean | If true, console logs will be written in JSON format. Otherwise, log entries will be written in plaintext. | `false` |
 | platform_webserver_log_directory | String | The absolute directory path where webserver log files are written. | `/var/log/itential/platform` |
 | platform_webserver_log_filename | String | The name of the webserver log file. | `webserver.log` |
 | platform_log_level_syslog | String | The minimum log level to send to the syslog server. | `warning` |
@@ -138,6 +142,7 @@ default variables located in `roles/platform/defaults/main/logging.yml`.
 | platform_syslog_localhost | String | The hostname to include in the syslog message. | `localhost` |
 | platform_syslog_app_name | String | The process property to include as the application name in the syslog message. | `process.title` |
 | platform_syslog_eol | String | The end of line character to include in the syslog message. |  |
+| platform_syslog_format_json | Boolean | If true, syslog logs will be written in JSON format. Otherwise, log entries will be written in plaintext. | `false` |
 
 #### Platform UI Variables
 
@@ -160,11 +165,13 @@ variables located in `roles/platform/defaults/main/redis.yml`.
 
 | Variable | Type | Description | Default Value |
 | :------- | :--- | :---------- | :------------ |
+| platform_redis_persist_queues | List(String) | The platform will match Bull queue names included to persist in Redis on restarts. |  |
 | platform_redis_db | Integer | The Redis keyspace (database number) to use for the connection. | 0 |
 | platform_redis_auth_enabled | String | Flag to enable Redis authentication. | `true` |
 | platform_redis_username | String | The username to use when connecting to Redis. | `itential` |
 | platform_redis_password | String | The password to use when connecting to Redis. | `itential` |
 | platform_redis_max_retries_per_request | Integer |  The maximum number of times to retry a request to Redis when the connection is lost. | 20 |
+| platform_redis_connect_timeout | Integer | The maximum time in milliseconds to wait for initial Redis connection before timing out. | 30000 |
 | platform_redis_max_heartbeat_write_retries | Integer | The maximum number of times to retry writing a heartbeat message to Redis from a service. | 20 |
 | platform_redis_host | String | The hostname of the Redis server. Not used when connecting to Redis Sentinels. | `localhost` |
 | platform_redis_port | Integer | The port to use when connecting to this Redis instance. | 6379 |
@@ -173,6 +180,13 @@ variables located in `roles/platform/defaults/main/redis.yml`.
 | platform_redis_sentinel_password | String | The password to use when connecting to Sentinel. | `sentineluser` |
 | platform_redis_name | String | The Redis primary name. This only has meaning when Redis is running with replication enabled. The sentinels will monitor this node and consider it down only when the sentinels agree. Note: The primary name should not include special characters other than: .-_ and no whitespaces. | `itentialmaster` |
 | platform_redis_tls | Object | Redis TLS configuration options for secure connections. Refer to NodeJS TLS library for all supported options. |  |
+| platform_redis_tls_ca | String | CA certificate used to verify the Redis server certificate when using TLS, as a PEM-encoded string. Alternative to setting `ca` on `platform_redis_tls`. |  |
+| platform_redis_tls_cert | String | Client certificate used to authenticate to the Redis server when using TLS, as a PEM-encoded string. |  |
+| platform_redis_tls_key | String | Client private key used to authenticate to the Redis server when using TLS, as a PEM-encoded string. |  |
+| platform_redis_sentinel_tls | Object | TLS options for the Sentinel connection itself. Only used when `platform_redis_tls_enabled` is `true`. |  |
+| platform_redis_sentinel_command_timeout | Integer | The maximum time in milliseconds to wait for a Redis Sentinel command to complete. Only applies when connecting via Redis Sentinel. | 3000 |
+| platform_redis_command_timeout | Integer | The maximum time in milliseconds to wait for a Redis command to complete before timing out. | 60000 |
+| platform_redis_keep_alive | Integer | Enables TCP keepalive on the Redis socket. Value is the keepalive delay in milliseconds. | 5000 |
 
 #### SNMP Variables
 
@@ -186,13 +200,19 @@ These variables control SNMP behaviors. The following table lists the default va
 #### Vault Variables
 
 These variables control Hashicorp Vault integration behaviors. The following table lists the
-default variables located in `roles/platform/defaults/main/vault.yml`.
+default variables located in `roles/platform/defaults/main/hashivault.yml`.
+
+The `HASHICORP VAULT CONNECTION` section of `properties.json` is only rendered when
+`platform_configure_vault` is `true`. When it is `false` (the default), none of the
+`vault_*` properties are written to the file, not even as commented-out placeholders.
 
 | Variable | Type | Description | Default Value |
 | :------- | :--- | :---------- | :------------ |
 | platform_configure_vault | Boolean | Flag to enable/disable configuring Vault in Itential Platform | `false` |
+| platform_secret_provider_name | String | Name of the secrets provider. Required for CyberArk CCP (`CyberArkCcp`). Not required for Hashicorp Vault. |  |
 | platform_vault_token_dir | String | The directory to store the vault root key in | `{{ platform_server_dir }}/keys` |
 | platform_vault_url | String | The URL to the Hashicorp Vault server. | `http://localhost:8200` |
+| platform_vault_namespace | String | The Vault Enterprise namespace to scope all secret operations to. Required for multi-tenant Vault Enterprise configurations. Not required for open-source Vault. |  |
 | platform_vault_auth_method | String | The authorization method to connect to Hashicorp Vault. Either token or approle. | `token` |
 | platform_vault_token | String | Hashicorp Vault token used for token-based authentication |  |
 | platform_vault_role_id | String | Hashicorp Vault Role ID variable used for AppRole authentication |  |
@@ -204,6 +224,28 @@ default variables located in `roles/platform/defaults/main/vault.yml`.
 | platform_vault_role_secrets_env_file | The file path to the .env file containing Role ID and Secret ID for AppRole authentication | `{{ platform_vault_token_dir }}/vault-role-secrets.env` |
 | platform_vault_secrets_endpoint | String | The endpoint for the Secrets Engine that is used. | `itential/data` |
 | platform_vault_read_only | Boolean | If true, only reads secrets from Hashicorp Vault. Otherwise, the platform can write secrets to Vault for storage. | `true` |
+| platform_vault_connection_timeout | Integer | The number of milliseconds to wait before timing out requests to the Hashicorp Vault server. Used by Hashicorp Vault only. |  |
+
+The following CyberArk CCP variables are only relevant when `platform_secret_provider_name` is
+set to `CyberArkCcp`. They are located in `roles/platform/defaults/main/cyberark.yml`.
+
+The `CYBERARK CCP CONNECTION` section of `properties.json` is only rendered when
+`platform_secret_provider_name` is set to `CyberArkCcp`. Otherwise, none of the `cyberark_*`
+properties are written to the file, not even as commented-out placeholders.
+
+| Variable | Type | Description | Default Value |
+| :------- | :--- | :---------- | :------------ |
+| platform_cyberark_url | String | The URL to the CyberArk Central Credential Provider. |  |
+| platform_cyberark_app_id | String | Specifies the unique ID of the application issuing the password request to CyberArk CCP. |  |
+| platform_cyberark_allow_invalid_certificates | Boolean | If true, disables the validation checks for TLS certificates and allows the use of invalid or self-signed certificates to connect. |  |
+| platform_cyberark_ca | String | The .pem file that contains the root certificate chain from the Certificate Authority. Specify the file name of the .pem file using absolute paths. |  |
+| platform_cyberark_key | String | The certificate key file location. Specify the location of the key file using absolute paths. |  |
+| platform_cyberark_certificate | String | The .pem file that contains the client certificate. Specify the file name of the .pem file using absolute paths. |  |
+| platform_cyberark_ca_contents | String | String representation of the PEM-encoded root certificate chain from the Certificate Authority. |  |
+| platform_cyberark_key_contents | String | String representation of the PEM-encoded certificate key. |  |
+| platform_cyberark_certificate_contents | String | String representation of the PEM-encoded client certificate. |  |
+| platform_cyberark_connection_timeout | Integer | The number of seconds that the Central Credential Provider will try to retrieve the secret value. |  |
+| platform_cyberark_reason_text | String | Set this property to the reason for retrieving the password to have the reason text appear in CyberArk Credential Provider's audit log. |  |
 
 #### Webserver Variables
 
@@ -220,10 +262,14 @@ located in `roles/platform/defaults/main/webserver.yml`.
 | platform_webserver_https_enabled | Boolean | If true, allows the webserver to respond to secure HTTPS requests. | `true` |
 | platform_webserver_https_port | Integer | The port on which the webserver listens for HTTPS requests. | 3443 |
 | platform_https_key_dest | String | The path to the private key file used for HTTPS connections. | `/etc/pki/itential-platform/private/{{ inventory_hostname }}.key` |
+| platform_webserver_https_key_contents | String | Public key used for HTTPS connections, as a PEM-encoded string. Alternative to the file-based key. |  |
 | platform_webserver_https_copy_certs | Boolean | Flag to manage PKI infrastructure (create directories and copy certificates). | `true` |
 | platform_webserver_https_passphrase | String | The passphrase for the private key used to enable TLS sessions. |  |
 | platform_https_cert_dest | String | The path to the certificate file used for HTTPS connections. | `/etc/pki/itential-platform/https/{{ inventory_hostname }}.crt` |
-| platform_webserver_https_secure_protocol | String | The set of allowed SSL/TLS protocol versions. | `TLS_method` |
+| platform_webserver_https_cert_contents | String | Certificate used for HTTPS connections, as a PEM-encoded string. Alternative to the file-based cert. |  |
+| platform_webserver_https_tls_min_version | String | Minimum permitted TLS version (`TLSv1.3`, `TLSv1.2`, `TLSv1.1`, `TLSv1`). Overrides `platform_webserver_https_secure_protocol`. |  |
+| platform_webserver_https_tls_max_version | String | Maximum permitted TLS version (`TLSv1.3`, `TLSv1.2`, `TLSv1.1`, `TLSv1`). Overrides `platform_webserver_https_secure_protocol`. |  |
+| platform_webserver_https_secure_protocol | String | The set of allowed SSL/TLS protocol versions. Ignored when either TLS min or max version is given. | `TLS_method` |
 | platform_webserver_https_ciphers | String |  The allowed SSL/TLS cipher suite. | `ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!SRP:!CAMELLIA` |
 | platform_webserver_https_client_reneg_limit | Integer | Specifies the number of renegotiations that are allowed in a single HTTPS connection. | 3 |
 | platform_webserver_https_client_reneg_window | Integer | Specifies the time renegotiation window in seconds for a single HTTPS connection. | 600 |
@@ -237,6 +283,9 @@ located in `roles/platform/defaults/main/workflow_worker.yml`.
 | Variable | Type | Description | Default Value |
 | :------- | :--- | :---------- | :------------ |
 | platform_task_worker_enabled | Boolean | If true, will start working tasks immediately after the server startup process is complete. If false, the task worker must be enabled manually via the UI/API. | `true` |
+| platform_task_worker_thread_count | Integer | The number of worker threads available for task processing. | 1 |
+| platform_task_worker_rate_limit | Integer | The maximum number of tasks to run per period. The value 0 disables the rate limiter. | 0 |
+| platform_task_worker_rate_limit_period | Integer | The time period in seconds for the task worker rate limit. | 1 |
 | platform_job_worker_enabled | Boolean | If true, will allow jobs to be started after the server startup process is complete. If false, API calls to start Jobs will return an error until enabled manually via the UI/API. | `true` |
 
 #### MongoDB Variables
@@ -257,7 +306,9 @@ variables located in `roles/platform/defaults/main/mongodb.yml`.
 | platform_mongodb_copy_certs | Boolean | Flag to manage PKI infrastructure (create directories and copy certificates). | `true` |
 | platform_mongo_tls_allow_invalid_certificates | Boolean | If true, disables the validation checks for TLS certificates on other servers in the cluster and allows the use of invalid or self-signed certificates to connect. | `false` |
 | platform_mongo_tls_ca_file | String | The .pem file that contains the root certificate chain from the Certificate Authority. Specify the file name of the .pem file using absolute paths. |  |
+| platform_mongo_tls_ca_contents | String | Root certificate chain from the Certificate Authority, as a PEM-encoded string. Alternative to `platform_mongo_tls_ca_file`. |  |
 | platform_mongo_max_pool_size | Integer | The maximum number of connections in a connection pool. Each application/adapter has its own connection pool. |  |
+| platform_mongo_max_idle_time_ms | Integer | The maximum number of milliseconds that a connection can remain idle in the pool. Set to 0 for no limit. | 300000 |
 
 #### Platform Variables
 
@@ -318,6 +369,7 @@ located in `roles/platform/defaults/main/server.yml`.
 | :------- | :--- | :---------- | :------------ |
 | platform_profile_id | String | The name of the profile document to load from the MongoDB where legacy configuration properties are stored. Not required for installations that are using environment variables or a properties file. | |
 | platform_server_id | String | An identifier for the server instance. This is used to uniquely identify the server in a multi-server environment. If not provided, the server will generate one on startup. | `{{ inventory_hostname }}` |
+| platform_server_id_strategy | String | Strategy used to generate server ID, if one is not set using `platform_server_id`. `mac:port` generates an ID from the MAC address and port; `random` generates a random ID on each startup. | `mac:port` |
 | platform_services | List | A whitelist of services (applications/adapters) to initialize on startup of the platform. If no value is given, all services will be initialized. |  |
 | platform_service_blacklist | List | The service type that will be denied CRUD operation access. |  |
 | platform_encrypted | Boolean | Indicates whether the platform is using encrypted code files. | `true` |
@@ -333,8 +385,19 @@ located in `roles/platform/defaults/main/server.yml`.
 | platform_service_crash_recovery_reset_retries_after_ms | Integer | Specifies the amount of times between each retry before the count will reset in milliseconds. | 60000 |
 | platform_external_request_timeout | Integer | The timeout for external API requests, in seconds. | 5 |
 | platform_device_count_polling_interval | Integer | The interval for how often IAP polls for the number of devices, in hours. | 24 |
+| platform_event_worker_thread_count | Integer | The number of worker threads available for event processing. |  |
+| platform_transformation_worker_thread_count | Integer | The number of worker threads available for transformation processing. |  |
 | platform_audit_enabled | Boolean | If true, the platform will track detailed audit events. | `false` |
 
+#### Telemetry Variables
+
+These variables control OpenTelemetry integration behaviors. The following table lists the
+default variables located in `roles/platform/defaults/main/telemetry.yml`.
+
+| Variable | Type | Description | Default Value |
+| :------- | :--- | :---------- | :------------ |
+| platform_otel_webserver_metrics_enabled | Boolean | Toggle for OpenTelemetry webserver metrics (requests, errors, duration, payload sizes -- served at `/metrics/webserver`). | `true` |
+
 ## Building the Inventory
 
 ### Example Inventory - Single Itential Platform Node
diff --git a/roles/platform/CLAUDE.md b/roles/platform/CLAUDE.md
index caf6b4fd..29efd30c 100644
--- a/roles/platform/CLAUDE.md
+++ b/roles/platform/CLAUDE.md
@@ -62,12 +62,16 @@ Installs and configures Itential Platform (IAP). Handles OS user/directory setup
 | Variable | Default | Purpose |
 |----------|---------|---------|
 | `platform_server_id` | `{{ inventory_hostname }}` | Unique server identifier in multi-node deployments |
+| `platform_server_id_strategy` | `mac:port` | Strategy to generate `server_id` when not explicitly set (`mac:port` or `random`) |
 | `platform_encrypted` | `true` | Platform uses encrypted code files |
 | `platform_task_worker_enabled` | `true` | Start task worker on boot |
 | `platform_job_worker_enabled` | `true` | Allow jobs to start on boot |
 | `platform_service_launch_timeout` | `600` | Seconds before adapter launch is considered failed |
 | `platform_shutdown_timeout` | `3` | Seconds to wait before forcing shutdown |
 | `platform_audit_enabled` | `false` | Enable detailed audit events |
+| `platform_event_worker_thread_count` | (unset) | Worker threads for event processing |
+| `platform_transformation_worker_thread_count` | (unset) | Worker threads for transformation processing |
+| `platform_otel_webserver_metrics_enabled` | `true` (in `telemetry.yml`) | Toggle for OpenTelemetry webserver metrics at `/metrics/webserver` |
 
 ### webserver.yml defaults
 
@@ -81,6 +85,9 @@ Installs and configures Itential Platform (IAP). Handles OS user/directory setup
 | `platform_webserver_https_secure_protocol` | `TLS_method` | OpenSSL method |
 | `platform_webserver_cache_control_enabled` | `true` | HTTP cache control headers. Itential Platform's own application default (when left unset in `platform.properties`) is `false` — the deployer explicitly overrides it to `true`. |
 | `platform_webserver_timeout` | `300000` | Request timeout (ms) |
+| `platform_webserver_https_key_contents` | (unset) | Inline PEM-encoded HTTPS private key, alternative to the file-based `platform_https_key_dest` |
+| `platform_webserver_https_cert_contents` | (unset) | Inline PEM-encoded HTTPS certificate, alternative to the file-based `platform_https_cert_dest` |
+| `platform_webserver_https_tls_min_version` / `_max_version` | (unset) | Pin TLS version range (`TLSv1.3`..`TLSv1`); overrides `platform_webserver_https_secure_protocol` |
 
 ### mongodb.yml defaults
 
@@ -94,6 +101,8 @@ Installs and configures Itential Platform (IAP). Handles OS user/directory setup
 | `platform_mongo_tls_enabled` | `true` | Use TLS for MongoDB connection |
 | `platform_mongo_tls_allow_invalid_certificates` | `false` (when TLS enabled) | Accept invalid/self-signed certs |
 | `platform_mongo_bypass_version_check` | `false` | Skip MongoDB version compatibility check |
+| `platform_mongo_max_idle_time_ms` | `300000` | Max time (ms) a pooled connection may sit idle; `0` disables the limit |
+| `platform_mongo_tls_ca_contents` | (unset) | Inline PEM-encoded CA chain, alternative to the file-based `platform_mongo_tls_ca_file` |
 
 ### redis.yml defaults
 
@@ -110,7 +119,13 @@ Installs and configures Itential Platform (IAP). Handles OS user/directory setup
 | `platform_redis_name` | `itentialmaster` | Redis primary name (must match `redis_sentinel_master_name`) |
 | `platform_redis_tls_enabled` | `true` | Enable TLS for both the Redis data connection and the Sentinel connection |
 | `platform_redis_tls` | (empty) | TLS options dict for NodeJS Redis client |
+| `platform_redis_tls_ca` / `_cert` / `_key` | (unset) | Inline PEM-encoded CA/cert/key, alternative to setting them inside `platform_redis_tls` |
 | `platform_redis_sentinel_tls` | (empty) | TLS options dict for Sentinel connection; used when `platform_redis_tls_enabled: true` |
+| `platform_redis_connect_timeout` | `30000` | Max time (ms) to wait for the initial Redis connection |
+| `platform_redis_command_timeout` | `60000` | Max time (ms) to wait for a Redis command to complete |
+| `platform_redis_sentinel_command_timeout` | `3000` | Max time (ms) to wait for a Sentinel command to complete |
+| `platform_redis_keep_alive` | `5000` | TCP keepalive delay (ms) on the Redis socket |
+| `platform_redis_persist_queues` | (empty) | Bull queue names to persist in Redis across restarts |
 
 ### pki.yml defaults (TLS paths)
 
@@ -144,9 +159,14 @@ Installs and configures Itential Platform (IAP). Handles OS user/directory setup
 | `platform_default_user_username` | `admin` | Default admin username |
 | `platform_default_user_password` | `admin` | Default admin password (change in production) |
 | `platform_auth_session_ttl` | `60` | Session timeout (minutes) |
+| `platform_auth_principal_ttl` | (unset) | User principal timeout (minutes); falls back to `platform_auth_session_ttl` when unset |
+| `platform_auth_relay_state_ttl` | `600` | SSO RelayState timeout (seconds) |
 | `platform_auth_unique_sessions_enabled` | `false` | Log out existing sessions on new login |
 
-### vault.yml defaults
+### hashivault.yml defaults
+
+In `6-properties.j2`, the entire `HASHICORP VAULT CONNECTION` section (header and all `vault_*`
+lines, including commented-out placeholders) is only rendered when `platform_configure_vault: true`.
 
 | Variable | Default | Purpose |
 |----------|---------|---------|
@@ -157,6 +177,19 @@ Installs and configures Itential Platform (IAP). Handles OS user/directory setup
 | `platform_vault_role_id` | (required if approle) | AppRole role ID |
 | `platform_vault_secret_id` | (required if approle) | AppRole secret ID |
 | `platform_vault_read_only` | `true` | Read-only Vault access |
+| `platform_secret_provider_name` | (unset) | Secrets provider name; required for CyberArk CCP (`CyberArkCcp`), not required for Hashicorp Vault |
+| `platform_vault_namespace` | (unset) | Vault Enterprise namespace; not used with open-source Vault |
+| `platform_vault_connection_timeout` | (unset) | Vault request timeout (ms) |
+
+### cyberark.yml defaults
+
+In `6-properties.j2`, the entire `CYBERARK CCP CONNECTION` section (header and all `cyberark_*`
+lines, including commented-out placeholders) is only rendered when
+`platform_secret_provider_name: CyberArkCcp`.
+
+| Variable | Default | Purpose |
+|----------|---------|---------|
+| `platform_cyberark_url`, `_app_id`, `_ca(_contents)`, `_key(_contents)`, `_certificate(_contents)`, `_allow_invalid_certificates`, `_connection_timeout`, `_reason_text` | (all unset) | CyberArk CCP connection settings; only relevant when `platform_secret_provider_name: CyberArkCcp` |
 
 ### logging.yml defaults
 
diff --git a/roles/platform/defaults/main/authentication.yml b/roles/platform/defaults/main/authentication.yml
index 636d97da..36ef2639 100644
--- a/roles/platform/defaults/main/authentication.yml
+++ b/roles/platform/defaults/main/authentication.yml
@@ -18,6 +18,13 @@ platform_auth_session_cookie_name:
 # The time in minutes before a user session expires.
 platform_auth_session_ttl:
 
+# The time in minutes before a user principal expires. If not supplied it will fallback to
+# platform_auth_session_ttl.
+platform_auth_principal_ttl:
+
+# The time in seconds before the RelayState from SSO expires.
+platform_auth_relay_state_ttl: 600
+
 # Enables a default user to be used for login when SSO is not configured and no AAA Adapter exists.
 platform_default_user_enabled:
 
diff --git a/roles/platform/defaults/main/cyberark.yml b/roles/platform/defaults/main/cyberark.yml
new file mode 100644
index 00000000..158841da
--- /dev/null
+++ b/roles/platform/defaults/main/cyberark.yml
@@ -0,0 +1,48 @@
+# Copyright (c) 2024, Itential, Inc
+# GNU General Public License v3.0+ (see LICENSE or https://www.gnu.org/licenses/gpl-3.0.txt)
+---
+# ============================================================================
+# CyberArk Central Credential Provider (CCP) - Used only when platform_secret_provider_name
+# is set to 'CyberArkCcp'
+# ============================================================================
+
+# The URL to the CyberArk Central Credential Provider.
+platform_cyberark_url:
+
+# Specifies the unique ID of the application issuing the password request to CyberArk CCP.
+platform_cyberark_app_id:
+
+# If true, disables the validation checks for TLS certificates and allows the use of invalid
+# or self-signed certificates to connect.
+platform_cyberark_allow_invalid_certificates:
+
+# The .pem file that contains the root certificate chain from the Certificate Authority.
+# Specify the file name of the .pem file using absolute paths.
+platform_cyberark_ca:
+
+# The certificate key file location. Specify the location of the key file using absolute paths.
+platform_cyberark_key:
+
+# The .pem file that contains the client certificate. Specify the file name of the .pem file
+# using absolute paths.
+platform_cyberark_certificate:
+
+# String representation of the PEM-encoded root certificate chain from the Certificate
+# Authority. Alternative to platform_cyberark_ca when the CA contents should be inlined.
+platform_cyberark_ca_contents:
+
+# String representation of the PEM-encoded certificate key. Alternative to platform_cyberark_key
+# when the key contents should be inlined.
+platform_cyberark_key_contents:
+
+# String representation of the PEM-encoded client certificate. Alternative to
+# platform_cyberark_certificate when the certificate contents should be inlined.
+platform_cyberark_certificate_contents:
+
+# The number of seconds that the Central Credential Provider will try to retrieve the secret
+# value.
+platform_cyberark_connection_timeout:
+
+# Set this property to the reason for retrieving the password to have the reason text appear
+# in CyberArk Credential Provider's audit log.
+platform_cyberark_reason_text:
diff --git a/roles/platform/defaults/main/vault.yml b/roles/platform/defaults/main/hashivault.yml
similarity index 79%
rename from roles/platform/defaults/main/vault.yml
rename to roles/platform/defaults/main/hashivault.yml
index 350f545c..c1e432ed 100644
--- a/roles/platform/defaults/main/vault.yml
+++ b/roles/platform/defaults/main/hashivault.yml
@@ -4,12 +4,20 @@
 # Flag to enable/disable configuring Vault in Itential Platform
 platform_configure_vault: false
 
+# Name of the secrets provider. Required for CyberArk CCP. Not required for Hashicorp Vault.
+# Valid values: CyberArkCcp, HashicorpVault
+platform_secret_provider_name:
+
 # The directory to store the vault root key in
 platform_vault_token_dir: "{{ platform_server_dir }}/keys"
 
 # The URL to the Hashicorp Vault server.
 platform_vault_url: http://localhost:8200
 
+# The Vault Enterprise namespace to scope all secret operations to. Required for multi-tenant
+# Vault Enterprise configurations. Not required for open-source Vault.
+platform_vault_namespace:
+
 # The authorization method to connect to Hashicorp Vault. Either token or approle.
 platform_vault_auth_method: token
 
@@ -49,3 +57,7 @@ platform_vault_secrets_endpoint: itential/data
 # If true, only reads secrets from Hashicorp Vault. Otherwise, the platform can write secrets
 # to Vault for storage.
 platform_vault_read_only: true
+
+# The number of milliseconds to wait before timing out requests to the Hashicorp Vault server.
+# Used by Hashicorp Vault only.
+platform_vault_connection_timeout:
diff --git a/roles/platform/defaults/main/logging.yml b/roles/platform/defaults/main/logging.yml
index e2c189ba..9dbe7aed 100644
--- a/roles/platform/defaults/main/logging.yml
+++ b/roles/platform/defaults/main/logging.yml
@@ -19,6 +19,14 @@ platform_log_filename:
 # The minimum log level to display in the console (stdout).
 platform_log_level_console:
 
+# If true, log entries will be written in JSON format. Otherwise, log entries will be written
+# in plaintext.
+platform_log_format_json: false
+
+# If true, console logs will be written in JSON format. Otherwise, log entries will be written
+# in plaintext.
+platform_console_format_json: false
+
 # The absolute directory path where webserver log files are written.
 platform_webserver_log_directory: "{{ platform_log_dir }}"
 
@@ -57,3 +65,7 @@ platform_syslog_app_name:
 
 # The end of line character to include in the syslog message.
 platform_syslog_eol:
+
+# If true, syslog logs will be written in JSON format. Otherwise, log entries will be written
+# in plaintext.
+platform_syslog_format_json: false
diff --git a/roles/platform/defaults/main/mongodb.yml b/roles/platform/defaults/main/mongodb.yml
index a45c7efb..e4a9d23d 100644
--- a/roles/platform/defaults/main/mongodb.yml
+++ b/roles/platform/defaults/main/mongodb.yml
@@ -30,6 +30,15 @@ platform_mongo_tls_enabled: true
 # and allows the use of invalid or self-signed certificates to connect.
 platform_mongo_tls_allow_invalid_certificates: "{{ false if platform_mongo_tls_enabled | bool else '' }}"
 
+# Root certificate chain from the Certificate Authority, as a PEM-encoded string.
+# Alternative to platform_mongo_tls_ca_file when the CA contents should be inlined instead of
+# referencing a file path.
+platform_mongo_tls_ca_contents:
+
 # The maximum number of connections in a connection pool.
 # Each application/adapter has its own connection pool.
 platform_mongo_max_pool_size:
+
+# The maximum number of milliseconds that a connection can remain idle in the pool.
+# Set to 0 for no limit.
+platform_mongo_max_idle_time_ms: 300000
diff --git a/roles/platform/defaults/main/redis.yml b/roles/platform/defaults/main/redis.yml
index b1a79eda..0c08ace2 100644
--- a/roles/platform/defaults/main/redis.yml
+++ b/roles/platform/defaults/main/redis.yml
@@ -1,6 +1,9 @@
 # Copyright (c) 2024, Itential, Inc
 # GNU General Public License v3.0+ (see LICENSE or https://www.gnu.org/licenses/gpl-3.0.txt)
 ---
+# The platform will match Bull queue names included to persist in Redis on restarts.
+platform_redis_persist_queues:
+
 # The Redis keyspace (database number) to use for the connection.
 platform_redis_db: 0
 
@@ -16,6 +19,9 @@ platform_redis_password: itential
 # The maximum number of times to retry a request to Redis when the connection is lost.
 platform_redis_max_retries_per_request: 20
 
+# The maximum time in milliseconds to wait for initial Redis connection before timing out.
+platform_redis_connect_timeout: 30000
+
 # The maximum number of times to retry writing a heartbeat message to Redis from a service.
 platform_redis_max_heartbeat_write_retries: 20
 
@@ -45,6 +51,23 @@ platform_redis_name: itentialmaster
 platform_redis_tls_enabled: true
 platform_redis_tls: {}
 
+# CA certificate, client certificate, and client private key used to verify/authenticate the
+# Redis TLS connection, as PEM-encoded strings. Alternative to setting these directly on
+# platform_redis_tls when the values should be inlined instead of nested in the TLS options dict.
+platform_redis_tls_ca:
+platform_redis_tls_cert:
+platform_redis_tls_key:
+
 # TLS options for the Sentinel connection itself. Refer to the NodeJS TLS library for all
 # supported options. Only used when platform_redis_tls_enabled is true.
 platform_redis_sentinel_tls: {}
+
+# The maximum time in milliseconds to wait for a Redis Sentinel command to complete. Only
+# applies when connecting via Redis Sentinel.
+platform_redis_sentinel_command_timeout: 3000
+
+# The maximum time in milliseconds to wait for a Redis command to complete before timing out.
+platform_redis_command_timeout: 60000
+
+# Enables TCP keepalive on the Redis socket. Value is the keepalive delay in milliseconds.
+platform_redis_keep_alive: 5000
diff --git a/roles/platform/defaults/main/server.yml b/roles/platform/defaults/main/server.yml
index f4a9c73c..42c80fb9 100644
--- a/roles/platform/defaults/main/server.yml
+++ b/roles/platform/defaults/main/server.yml
@@ -16,6 +16,11 @@ platform_service_directory:
 # If not provided, the server will generate one on startup.
 platform_server_id: "{{ inventory_hostname }}"
 
+# Strategy used to generate server ID, if one is not set using platform_server_id.
+# Selecting mac:port will generate a server_id using a combination of MAC address and port,
+# while random will generate a random ID on each startup.
+platform_server_id_strategy: mac:port
+
 # A whitelist of services (applications/adapters) to initialize on startup of the platform.
 # If no value is given, all services will be initialized.
 platform_services:
@@ -62,5 +67,11 @@ platform_external_request_timeout:
 # The interval for how often IAP polls for the number of devices, in hours.
 platform_device_count_polling_interval:
 
+# The number of worker threads available for event processing.
+platform_event_worker_thread_count:
+
+# The number of worker threads available for transformation processing.
+platform_transformation_worker_thread_count:
+
 # If true, the platform will track detailed audit events.
 platform_audit_enabled:
diff --git a/roles/platform/defaults/main/telemetry.yml b/roles/platform/defaults/main/telemetry.yml
new file mode 100644
index 00000000..85c85c96
--- /dev/null
+++ b/roles/platform/defaults/main/telemetry.yml
@@ -0,0 +1,6 @@
+# Copyright (c) 2024, Itential, Inc
+# GNU General Public License v3.0+ (see LICENSE or https://www.gnu.org/licenses/gpl-3.0.txt)
+---
+# Toggle for OpenTelemetry webserver metrics (requests, errors, duration, payload sizes --
+# served at /metrics/webserver).
+platform_otel_webserver_metrics_enabled: true
diff --git a/roles/platform/defaults/main/webserver.yml b/roles/platform/defaults/main/webserver.yml
index 9c54c39c..d88d1802 100644
--- a/roles/platform/defaults/main/webserver.yml
+++ b/roles/platform/defaults/main/webserver.yml
@@ -24,10 +24,27 @@ platform_webserver_https_enabled: true
 # The port on which the webserver listens for HTTPS requests.
 platform_webserver_https_port: 3443
 
+# Public key used for HTTPS connections, as a PEM-encoded string. Alternative to the file-based
+# key deployed via platform_webserver_https_copy_certs when the key contents should be inlined.
+platform_webserver_https_key_contents:
+
 # The passphrase for the private key used to enable TLS sessions.
 platform_webserver_https_passphrase:
 
-# The set of allowed SSL/TLS protocol versions.
+# Certificate used for HTTPS connections, as a PEM-encoded string. Alternative to the file-based
+# cert deployed via platform_webserver_https_copy_certs when the cert contents should be inlined.
+platform_webserver_https_cert_contents:
+
+# Minimum permitted TLS version. Overrides platform_webserver_https_secure_protocol.
+# Valid values: TLSv1.3, TLSv1.2, TLSv1.1, TLSv1
+platform_webserver_https_tls_min_version:
+
+# Maximum permitted TLS version. Overrides platform_webserver_https_secure_protocol.
+# Valid values: TLSv1.3, TLSv1.2, TLSv1.1, TLSv1
+platform_webserver_https_tls_max_version:
+
+# The set of allowed SSL/TLS protocol versions. Ignored when either tls_min_version or
+# tls_max_version is given.
 platform_webserver_https_secure_protocol: TLS_method
 
 # The allowed SSL/TLS cipher suite.
diff --git a/roles/platform/defaults/main/workflow_worker.yml b/roles/platform/defaults/main/workflow_worker.yml
index 8d92d53c..125c3e44 100644
--- a/roles/platform/defaults/main/workflow_worker.yml
+++ b/roles/platform/defaults/main/workflow_worker.yml
@@ -5,6 +5,15 @@
 # If false, the task worker must be enabled manually via the UI/API.
 platform_task_worker_enabled: true
 
+# The number of worker threads available for task processing.
+platform_task_worker_thread_count: 1
+
+# The maximum number of tasks to run per period. The value 0 disables the rate limiter.
+platform_task_worker_rate_limit: 0
+
+# The time period in seconds for the task worker rate limit.
+platform_task_worker_rate_limit_period: 1
+
 # If true, will allow jobs to be started after the server startup process is complete.
 # If false, API calls to start Jobs will return an error until enabled manually via the UI/API.
 platform_job_worker_enabled: true
diff --git a/roles/platform/templates/6-properties.j2 b/roles/platform/templates/6-properties.j2
index 6bd65cb1..7ed6af00 100644
--- a/roles/platform/templates/6-properties.j2
+++ b/roles/platform/templates/6-properties.j2
@@ -32,6 +32,15 @@ server_id = {{ platform_server_id }}
 # server_id =
 {% endif %}
 
+# Strategy used to generate server ID, if one is not set using the server_id property.
+# Selecting mac:port will generate a server_id using a combination of MAC address and port,
+# while random will generate a random ID on each startup.
+{% if platform_server_id_strategy %}
+server_id_strategy = {{ platform_server_id_strategy }}
+{% else %}
+# server_id_strategy =
+{% endif %}
+
 # A whitelist of services (applications/adapters) to initialize on startup of the platform.
 # If no value is given, all services will be initialized.
 {% if platform_services %}
@@ -147,6 +156,20 @@ device_count_polling_interval = {{ platform_device_count_polling_interval }}
 # device_count_polling_interval =
 {% endif %}
 
+# The number of worker threads available for event processing.
+{% if platform_event_worker_thread_count %}
+event_worker_thread_count = {{ platform_event_worker_thread_count }}
+{% else %}
+# event_worker_thread_count =
+{% endif %}
+
+# The number of worker threads available for transformation processing.
+{% if platform_transformation_worker_thread_count %}
+transformation_worker_thread_count = {{ platform_transformation_worker_thread_count }}
+{% else %}
+# transformation_worker_thread_count =
+{% endif %}
+
 # If true, the platform will track detailed audit events.
 {% if ( (platform_audit_enabled is defined) and
         (platform_audit_enabled is boolean) ) %}
@@ -240,6 +263,14 @@ mongo_tls_ca_file = {{ platform_mongo_tls_ca_file }}
 # mongo_tls_ca_file =
 {% endif %}
 
+# Root certificate chain from the Certificate Authority. This should be a string containing
+# the PEM-encoded certificate.
+{% if platform_mongo_tls_ca_contents %}
+mongo_tls_ca_contents = {{ platform_mongo_tls_ca_contents }}
+{% else %}
+# mongo_tls_ca_contents =
+{% endif %}
+
 # The maximum number of connections in a connection pool.
 # Each application/adapter has its own connection pool.
 {% if platform_mongo_max_pool_size %}
@@ -248,10 +279,25 @@ mongo_max_pool_size = {{ platform_mongo_max_pool_size }}
 # mongo_max_pool_size =
 {% endif %}
 
+# The maximum number of milliseconds that a connection can remain idle in the pool.
+# Set to 0 for no limit.
+{% if platform_mongo_max_idle_time_ms %}
+mongo_max_idle_time_ms = {{ platform_mongo_max_idle_time_ms }}
+{% else %}
+# mongo_max_idle_time_ms =
+{% endif %}
+
 
 ####################
 # REDIS CONNECTION #
 ####################
+# The platform will match Bull queue names included to persist in Redis on restarts.
+{% if platform_redis_persist_queues %}
+redis_persist_queues = {{ platform_redis_persist_queues | join(',') }}
+{% else %}
+# redis_persist_queues =
+{% endif %}
+
 # The Redis keyspace (database number) to use for the connection.
 {% if platform_redis_db %}
 redis_db = {{ platform_redis_db }}
@@ -284,6 +330,13 @@ redis_max_retries_per_request = {{ platform_redis_max_retries_per_request }}
 # redis_max_retries_per_request =
 {% endif %}
 
+# The maximum time in milliseconds to wait for initial Redis connection before timing out.
+{% if platform_redis_connect_timeout %}
+redis_connect_timeout = {{ platform_redis_connect_timeout }}
+{% else %}
+# redis_connect_timeout =
+{% endif %}
+
 # The maximum number of times to retry writing a heartbeat message to Redis from a service.
 {% if platform_redis_max_heartbeat_write_retries %}
 redis_max_heartbeat_write_retries = {{ platform_redis_max_heartbeat_write_retries }}
@@ -345,6 +398,30 @@ redis_tls = {{ {'rejectUnauthorized': false, 'ca': platform_redis_ca_dest} | com
 # redis_tls =
 {% endif %}
 
+# CA certificate used to verify the Redis server certificate when using TLS. This should be a
+# string containing the PEM-encoded CA certificate.
+{% if platform_redis_tls_ca %}
+redis_tls_ca = {{ platform_redis_tls_ca }}
+{% else %}
+# redis_tls_ca =
+{% endif %}
+
+# Client certificate used to authenticate the client to the Redis server when using TLS. This
+# should be a string containing the PEM-encoded client certificate.
+{% if platform_redis_tls_cert %}
+redis_tls_cert = {{ platform_redis_tls_cert }}
+{% else %}
+# redis_tls_cert =
+{% endif %}
+
+# Client private key used to authenticate the client to the Redis server when using TLS. This
+# should be a string containing the PEM-encoded client private key.
+{% if platform_redis_tls_key %}
+redis_tls_key = {{ platform_redis_tls_key }}
+{% else %}
+# redis_tls_key =
+{% endif %}
+
 # Enables TLS when connecting to Redis via Sentinel. When true, the Redis client
 # uses TLS for both the Sentinel connection and the Redis data connection.
 {% if platform_redis_tls_enabled | bool %}
@@ -355,54 +432,92 @@ redis_sentinel_tls = {{ {'rejectUnauthorized': false, 'ca': platform_redis_ca_de
 # redis_sentinel_tls =
 {% endif %}
 
+# The maximum time in milliseconds to wait for a Redis Sentinel command to complete. Only
+# applies when connecting via Redis Sentinel.
+{% if platform_redis_sentinel_command_timeout %}
+redis_sentinel_command_timeout = {{ platform_redis_sentinel_command_timeout }}
+{% else %}
+# redis_sentinel_command_timeout =
+{% endif %}
 
+# The maximum time in milliseconds to wait for a Redis command to complete before timing out.
+{% if platform_redis_command_timeout %}
+redis_command_timeout = {{ platform_redis_command_timeout }}
+{% else %}
+# redis_command_timeout =
+{% endif %}
+
+# Enables TCP keepalive on the Redis socket. Value is the keepalive delay in milliseconds.
+{% if platform_redis_keep_alive %}
+redis_keep_alive = {{ platform_redis_keep_alive }}
+{% else %}
+# redis_keep_alive =
+{% endif %}
+
+
+# Name of the secrets provider. Required for CyberArk CCP. Not required for Hashicorp Vault.
+{% if platform_secret_provider_name %}
+secret_provider_name = {{ platform_secret_provider_name }}
+{% else %}
+# secret_provider_name =
+{% endif %}
+
+{% if platform_configure_vault | bool %}
 ##############################
 # HASHICORP VAULT CONNECTION #
 ##############################
 # The URL to the Hashicorp Vault server.
-{% if platform_configure_vault | bool and platform_vault_url %}
+{% if platform_vault_url %}
 vault_url = {{ platform_vault_url }}
 {% else %}
 # vault_url =
 {% endif %}
 
+# The Vault Enterprise namespace to scope all secret operations to. Required for multi-tenant
+# Vault Enterprise configurations. Not required for open-source Vault.
+{% if platform_vault_namespace %}
+vault_namespace = {{ platform_vault_namespace }}
+{% else %}
+# vault_namespace =
+{% endif %}
+
 # The authorization method to connect to Hashicorp Vault. Either token or approle.
-{% if platform_configure_vault | bool and platform_vault_auth_method %}
+{% if platform_vault_auth_method %}
 vault_auth_method = {{ platform_vault_auth_method }}
 {% else %}
 # vault_auth_method =
 {% endif %}
 
 # Hashicorp Vault Role ID used for AppRole authentication.
-{% if platform_configure_vault and platform_vault_role_id_property %}
+{% if platform_vault_role_id_property %}
 vault_role_id = {{ platform_vault_role_id_property }}
 {% else %}
 # vault_role_id =
 {% endif %}
 
 # Hashicorp Vault Secret ID used for AppRole login.
-{% if platform_configure_vault and platform_vault_secret_id_property %}
+{% if platform_vault_secret_id_property %}
 vault_secret_id = {{ platform_vault_secret_id_property }}
 {% else %}
 # vault_secret_id =
 {% endif %}
 
 # The path where the AppRole was enabled.
-{% if platform_configure_vault and platform_vault_approle_path %}
+{% if platform_vault_approle_path %}
 vault_approle_path = {{ platform_vault_approle_path }}
 {% else %}
 # vault_approle_path =
 {% endif %}
 
 # The file path to a token file. The token is used for authentication to access Vault secrets.
-{% if platform_configure_vault and platform_vault_auth_method == "token" and platform_vault_token_file %}
+{% if platform_vault_auth_method == "token" and platform_vault_token_file %}
 vault_token = {{ platform_vault_token_file }}
 {% else %}
 # vault_token =
 {% endif %}
 
 # The endpoint for the Secrets Engine that is used.
-{% if platform_configure_vault and platform_vault_secrets_endpoint %}
+{% if platform_vault_secrets_endpoint %}
 vault_secrets_endpoint = {{ platform_vault_secrets_endpoint }}
 {% else %}
 # vault_secrets_endpoint =
@@ -410,13 +525,111 @@ vault_secrets_endpoint = {{ platform_vault_secrets_endpoint }}
 
 # If true, only reads secrets from Hashicorp Vault. Otherwise, the platform can write secrets
 # to Vault for storage.
-{% if ( (platform_configure_vault is defined) and
-        (platform_vault_read_only is boolean) ) %}
+{% if platform_vault_read_only is boolean %}
 vault_read_only = {{ platform_vault_read_only | to_nice_json }}
 {% else %}
 # vault_read_only =
 {% endif %}
 
+# The number of milliseconds to wait before timing out requests to the Hashicorp Vault server.
+# Used by Hashicorp Vault only.
+{% if platform_vault_connection_timeout %}
+vault_connection_timeout = {{ platform_vault_connection_timeout }}
+{% else %}
+# vault_connection_timeout =
+{% endif %}
+{% endif %}
+
+{% if platform_secret_provider_name == 'CyberArkCcp' %}
+###############################
+# CYBERARK CCP CONNECTION #
+###############################
+# The URL to the CyberArk Central Credential Provider.
+{% if platform_cyberark_url %}
+cyberark_url = {{ platform_cyberark_url }}
+{% else %}
+# cyberark_url =
+{% endif %}
+
+# Specifies the unique ID of the application issuing the password request to CyberArk CCP.
+{% if platform_cyberark_app_id %}
+cyberark_app_id = {{ platform_cyberark_app_id }}
+{% else %}
+# cyberark_app_id =
+{% endif %}
+
+# If true, disables the validation checks for TLS certificates and allows the use of invalid
+# or self-signed certificates to connect. Used by CyberArk CCP only.
+{% if ( (platform_cyberark_allow_invalid_certificates is defined) and
+        (platform_cyberark_allow_invalid_certificates is boolean) ) %}
+cyberark_allow_invalid_certificates = {{ platform_cyberark_allow_invalid_certificates | to_nice_json }}
+{% else %}
+# cyberark_allow_invalid_certificates =
+{% endif %}
+
+# The .pem file that contains the root certificate chain from the Certificate Authority.
+# Specify the file name of the .pem file using absolute paths. Used by CyberArk CCP only.
+{% if platform_cyberark_ca %}
+cyberark_ca = {{ platform_cyberark_ca }}
+{% else %}
+# cyberark_ca =
+{% endif %}
+
+# The certificate key file location. Specify the location of the key file using absolute paths.
+# Used by CyberArk CCP only.
+{% if platform_cyberark_key %}
+cyberark_key = {{ platform_cyberark_key }}
+{% else %}
+# cyberark_key =
+{% endif %}
+
+# The .pem file that contains the client certificate. Specify the file name of the .pem file
+# using absolute paths. Used by CyberArk CCP only.
+{% if platform_cyberark_certificate %}
+cyberark_certificate = {{ platform_cyberark_certificate }}
+{% else %}
+# cyberark_certificate =
+{% endif %}
+
+# String representation of the PEM-encoded root certificate chain from the Certificate
+# Authority. Used by CyberArk CCP only.
+{% if platform_cyberark_ca_contents %}
+cyberark_ca_contents = {{ platform_cyberark_ca_contents }}
+{% else %}
+# cyberark_ca_contents =
+{% endif %}
+
+# String representation of the PEM-encoded certificate key. Used by CyberArk CCP only.
+{% if platform_cyberark_key_contents %}
+cyberark_key_contents = {{ platform_cyberark_key_contents }}
+{% else %}
+# cyberark_key_contents =
+{% endif %}
+
+# String representation of the PEM-encoded client certificate. Used by CyberArk CCP only.
+{% if platform_cyberark_certificate_contents %}
+cyberark_certificate_contents = {{ platform_cyberark_certificate_contents }}
+{% else %}
+# cyberark_certificate_contents =
+{% endif %}
+
+# The number of seconds that the Central Credential Provider will try to retrieve the secret
+# value. Used by CyberArk CCP only.
+{% if platform_cyberark_connection_timeout %}
+cyberark_connection_timeout = {{ platform_cyberark_connection_timeout }}
+{% else %}
+# cyberark_connection_timeout =
+{% endif %}
+
+# Set this property to the reason for retrieving the password to have the reason text appear
+# in CyberArk Credential Provider's audit log. Used by CyberArk CCP only.
+{% if platform_cyberark_reason_text %}
+cyberark_reason_text = {{ platform_cyberark_reason_text }}
+{% else %}
+# cyberark_reason_text =
+{% endif %}
+{% endif %}
+
 
 ###################
 # WORKFLOW WORKER #
@@ -430,6 +643,27 @@ task_worker_enabled = {{ platform_task_worker_enabled | to_nice_json }}
 # task_worker_enabled =
 {% endif %}
 
+# The number of worker threads available for task processing.
+{% if platform_task_worker_thread_count %}
+task_worker_thread_count = {{ platform_task_worker_thread_count }}
+{% else %}
+# task_worker_thread_count =
+{% endif %}
+
+# The maximum number of tasks to run per period. The value 0 disables the rate limiter.
+{% if platform_task_worker_rate_limit %}
+task_worker_rate_limit = {{ platform_task_worker_rate_limit }}
+{% else %}
+# task_worker_rate_limit =
+{% endif %}
+
+# The time period in seconds for the task worker rate limit.
+{% if platform_task_worker_rate_limit_period %}
+task_worker_rate_limit_period = {{ platform_task_worker_rate_limit_period }}
+{% else %}
+# task_worker_rate_limit_period =
+{% endif %}
+
 # If true, will allow jobs to be started after the server startup process is complete.
 # If false, API calls to start Jobs will return an error until enabled manually via the UI/API.
 {% if ( (platform_job_worker_enabled is defined) and
@@ -545,6 +779,21 @@ auth_session_ttl = {{ platform_auth_session_ttl }}
 # auth_session_ttl =
 {% endif %}
 
+# The time in minutes before a user principal expires. If not supplied it will fallback to
+# the session ttl.
+{% if platform_auth_principal_ttl %}
+auth_principal_ttl = {{ platform_auth_principal_ttl }}
+{% else %}
+# auth_principal_ttl =
+{% endif %}
+
+# The time in seconds before the RelayState from sso expires.
+{% if platform_auth_relay_state_ttl %}
+auth_relay_state_ttl = {{ platform_auth_relay_state_ttl }}
+{% else %}
+# auth_relay_state_ttl =
+{% endif %}
+
 # Enables a default user to be used for login when SSO is not configured and no AAA Adapter exists.
 {% if ( (platform_default_user_enabled is defined) and
         (platform_default_user_enabled is boolean) ) %}
@@ -632,6 +881,13 @@ webserver_https_key = {{ platform_https_key_dest }}
 # webserver_https_key =
 {% endif %}
 
+# Public key used for HTTPS connections. This should be a string containing the PEM-encoded key.
+{% if platform_webserver_https_key_contents %}
+webserver_https_key_contents = {{ platform_webserver_https_key_contents }}
+{% else %}
+# webserver_https_key_contents =
+{% endif %}
+
 # The passphrase for the private key used to enable TLS sessions.
 {% if platform_webserver_https_passphrase %}
 webserver_https_passphrase = {{ platform_webserver_https_passphrase }}
@@ -646,7 +902,30 @@ webserver_https_cert = {{ platform_https_cert_dest }}
 # webserver_https_cert =
 {% endif %}
 
-# The set of allowed SSL/TLS protocol versions.
+# Certificate used for HTTPS connections. This should be a string containing the PEM-encoded
+# certificate.
+{% if platform_webserver_https_cert_contents %}
+webserver_https_cert_contents = {{ platform_webserver_https_cert_contents }}
+{% else %}
+# webserver_https_cert_contents =
+{% endif %}
+
+# Minimum permitted TLS version. Overrides webserver_https_secure_protocol.
+{% if platform_webserver_https_tls_min_version %}
+webserver_https_tls_min_version = {{ platform_webserver_https_tls_min_version }}
+{% else %}
+# webserver_https_tls_min_version =
+{% endif %}
+
+# Maximum permitted TLS version. Overrides webserver_https_secure_protocol.
+{% if platform_webserver_https_tls_max_version %}
+webserver_https_tls_max_version = {{ platform_webserver_https_tls_max_version }}
+{% else %}
+# webserver_https_tls_max_version =
+{% endif %}
+
+# The set of allowed SSL/TLS protocol versions. Ignored when either tlsMinVersion or
+# tlsMaxVersion is given.
 {% if platform_webserver_https_secure_protocol %}
 webserver_https_secure_protocol = {{ platform_webserver_https_secure_protocol }}
 {% else %}
@@ -727,6 +1006,24 @@ log_level_console = {{ platform_log_level_console }}
 # log_level_console =
 {% endif %}
 
+# If true, log entries will be written in JSON format. Otherwise, log entries will be written
+# in plaintext.
+{% if ( (platform_log_format_json is defined) and
+        (platform_log_format_json is boolean) ) %}
+log_format_json = {{ platform_log_format_json | to_nice_json }}
+{% else %}
+# log_format_json =
+{% endif %}
+
+# If true, console logs will be written in JSON format. Otherwise, log entries will be written
+# in plaintext.
+{% if ( (platform_console_format_json is defined) and
+        (platform_console_format_json is boolean) ) %}
+console_format_json = {{ platform_console_format_json | to_nice_json }}
+{% else %}
+# console_format_json =
+{% endif %}
+
 # The absolute directory path where webserver log files are written.
 {% if platform_webserver_log_directory %}
 webserver_log_directory = {{ platform_webserver_log_directory }}
@@ -818,6 +1115,15 @@ syslog_eol = {{ platform_syslog_eol }}
 # syslog_eol =
 {% endif %}
 
+# If true, syslog logs will be written in JSON format. Otherwise, log entries will be written
+# in plaintext.
+{% if ( (platform_syslog_format_json is defined) and
+        (platform_syslog_format_json is boolean) ) %}
+syslog_format_json = {{ platform_syslog_format_json | to_nice_json }}
+{% else %}
+# syslog_format_json =
+{% endif %}
+
 
 ###########
 # BROKERS #
@@ -855,3 +1161,16 @@ snmp_alarm_configs = {{ platform_snmp_alarm_configs | to_json }}
 {% else %}
 # snmp_alarm_configs =
 {% endif %}
+
+
+#############
+# TELEMETRY #
+#############
+# Toggle for OpenTelemetry webserver metrics (requests, errors, duration, payload sizes --
+# served at /metrics/webserver).
+{% if ( (platform_otel_webserver_metrics_enabled is defined) and
+        (platform_otel_webserver_metrics_enabled is boolean) ) %}
+otel_webserver_metrics_enabled = {{ platform_otel_webserver_metrics_enabled | to_nice_json }}
+{% else %}
+# otel_webserver_metrics_enabled =
+{% endif %}