Add missing Itential Platform properties to template and docs

roles/platform/CLAUDE.md

@@ -62,12 +62,16 @@ Installs and configures Itential Platform (IAP). Handles OS user/directory setup
 | Variable | Default | Purpose |
 |----------|---------|---------|
 | `platform_server_id` | `{{ inventory_hostname }}` | Unique server identifier in multi-node deployments |
+| `platform_server_id_strategy` | `mac:port` | Strategy to generate `server_id` when not explicitly set (`mac:port` or `random`) |
 | `platform_encrypted` | `true` | Platform uses encrypted code files |
 | `platform_task_worker_enabled` | `true` | Start task worker on boot |
 | `platform_job_worker_enabled` | `true` | Allow jobs to start on boot |
 | `platform_service_launch_timeout` | `600` | Seconds before adapter launch is considered failed |
 | `platform_shutdown_timeout` | `3` | Seconds to wait before forcing shutdown |
 | `platform_audit_enabled` | `false` | Enable detailed audit events |
+| `platform_event_worker_thread_count` | (unset) | Worker threads for event processing |
+| `platform_transformation_worker_thread_count` | (unset) | Worker threads for transformation processing |
+| `platform_otel_webserver_metrics_enabled` | `true` (in `telemetry.yml`) | Toggle for OpenTelemetry webserver metrics at `/metrics/webserver` |
 
 ### webserver.yml defaults
 
@@ -81,6 +85,9 @@ Installs and configures Itential Platform (IAP). Handles OS user/directory setup
 | `platform_webserver_https_secure_protocol` | `TLS_method` | OpenSSL method |
 | `platform_webserver_cache_control_enabled` | `true` | HTTP cache control headers. Itential Platform's own application default (when left unset in `platform.properties`) is `false` — the deployer explicitly overrides it to `true`. |
 | `platform_webserver_timeout` | `300000` | Request timeout (ms) |
+| `platform_webserver_https_key_contents` | (unset) | Inline PEM-encoded HTTPS private key, alternative to the file-based `platform_https_key_dest` |
+| `platform_webserver_https_cert_contents` | (unset) | Inline PEM-encoded HTTPS certificate, alternative to the file-based `platform_https_cert_dest` |
+| `platform_webserver_https_tls_min_version` / `_max_version` | (unset) | Pin TLS version range (`TLSv1.3`..`TLSv1`); overrides `platform_webserver_https_secure_protocol` |
 
 ### mongodb.yml defaults
 
@@ -94,6 +101,8 @@ Installs and configures Itential Platform (IAP). Handles OS user/directory setup
 | `platform_mongo_tls_enabled` | `true` | Use TLS for MongoDB connection |
 | `platform_mongo_tls_allow_invalid_certificates` | `false` (when TLS enabled) | Accept invalid/self-signed certs |
 | `platform_mongo_bypass_version_check` | `false` | Skip MongoDB version compatibility check |
+| `platform_mongo_max_idle_time_ms` | `300000` | Max time (ms) a pooled connection may sit idle; `0` disables the limit |
+| `platform_mongo_tls_ca_contents` | (unset) | Inline PEM-encoded CA chain, alternative to the file-based `platform_mongo_tls_ca_file` |
 
 ### redis.yml defaults
 
@@ -110,7 +119,13 @@ Installs and configures Itential Platform (IAP). Handles OS user/directory setup
 | `platform_redis_name` | `itentialmaster` | Redis primary name (must match `redis_sentinel_master_name`) |
 | `platform_redis_tls_enabled` | `true` | Enable TLS for both the Redis data connection and the Sentinel connection |
 | `platform_redis_tls` | (empty) | TLS options dict for NodeJS Redis client |
+| `platform_redis_tls_ca` / `_cert` / `_key` | (unset) | Inline PEM-encoded CA/cert/key, alternative to setting them inside `platform_redis_tls` |
 | `platform_redis_sentinel_tls` | (empty) | TLS options dict for Sentinel connection; used when `platform_redis_tls_enabled: true` |
+| `platform_redis_connect_timeout` | `30000` | Max time (ms) to wait for the initial Redis connection |
+| `platform_redis_command_timeout` | `60000` | Max time (ms) to wait for a Redis command to complete |
+| `platform_redis_sentinel_command_timeout` | `3000` | Max time (ms) to wait for a Sentinel command to complete |
+| `platform_redis_keep_alive` | `5000` | TCP keepalive delay (ms) on the Redis socket |
+| `platform_redis_persist_queues` | (empty) | Bull queue names to persist in Redis across restarts |
 
 ### pki.yml defaults (TLS paths)
 
@@ -144,9 +159,14 @@ Installs and configures Itential Platform (IAP). Handles OS user/directory setup
 | `platform_default_user_username` | `admin` | Default admin username |
 | `platform_default_user_password` | `admin` | Default admin password (change in production) |
 | `platform_auth_session_ttl` | `60` | Session timeout (minutes) |
+| `platform_auth_principal_ttl` | (unset) | User principal timeout (minutes); falls back to `platform_auth_session_ttl` when unset |
+| `platform_auth_relay_state_ttl` | `600` | SSO RelayState timeout (seconds) |
 | `platform_auth_unique_sessions_enabled` | `false` | Log out existing sessions on new login |
 
-### vault.yml defaults
+### hashivault.yml defaults
+
+In `6-properties.j2`, the entire `HASHICORP VAULT CONNECTION` section (header and all `vault_*`
+lines, including commented-out placeholders) is only rendered when `platform_configure_vault: true`.
 
 | Variable | Default | Purpose |
 |----------|---------|---------|
@@ -157,6 +177,19 @@ Installs and configures Itential Platform (IAP). Handles OS user/directory setup
 | `platform_vault_role_id` | (required if approle) | AppRole role ID |
 | `platform_vault_secret_id` | (required if approle) | AppRole secret ID |
 | `platform_vault_read_only` | `true` | Read-only Vault access |
+| `platform_secret_provider_name` | (unset) | Secrets provider name; required for CyberArk CCP (`CyberArkCcp`), not required for Hashicorp Vault |
+| `platform_vault_namespace` | (unset) | Vault Enterprise namespace; not used with open-source Vault |
+| `platform_vault_connection_timeout` | (unset) | Vault request timeout (ms) |
+
+### cyberark.yml defaults
+
+In `6-properties.j2`, the entire `CYBERARK CCP CONNECTION` section (header and all `cyberark_*`
+lines, including commented-out placeholders) is only rendered when
+`platform_secret_provider_name: CyberArkCcp`.
+
+| Variable | Default | Purpose |
+|----------|---------|---------|
+| `platform_cyberark_url`, `_app_id`, `_ca(_contents)`, `_key(_contents)`, `_certificate(_contents)`, `_allow_invalid_certificates`, `_connection_timeout`, `_reason_text` | (all unset) | CyberArk CCP connection settings; only relevant when `platform_secret_provider_name: CyberArkCcp` |
 
 ### logging.yml defaults
 

roles/platform/defaults/main/authentication.yml

@@ -18,6 +18,13 @@ platform_auth_session_cookie_name:
 # The time in minutes before a user session expires.
 platform_auth_session_ttl:
 
+# The time in minutes before a user principal expires. If not supplied it will fallback to
+# platform_auth_session_ttl.
+platform_auth_principal_ttl:
+
+# The time in seconds before the RelayState from SSO expires.
+platform_auth_relay_state_ttl: 600
+
 # Enables a default user to be used for login when SSO is not configured and no AAA Adapter exists.
 platform_default_user_enabled:
 

roles/platform/defaults/main/cyberark.yml

@@ -0,0 +1,48 @@
+# Copyright (c) 2024, Itential, Inc
+# GNU General Public License v3.0+ (see LICENSE or https://www.gnu.org/licenses/gpl-3.0.txt)
+---
+# ============================================================================
+# CyberArk Central Credential Provider (CCP) - Used only when platform_secret_provider_name
+# is set to 'CyberArkCcp'
+# ============================================================================
+
+# The URL to the CyberArk Central Credential Provider.
+platform_cyberark_url:
+
+# Specifies the unique ID of the application issuing the password request to CyberArk CCP.
+platform_cyberark_app_id:
+
+# If true, disables the validation checks for TLS certificates and allows the use of invalid
+# or self-signed certificates to connect.
+platform_cyberark_allow_invalid_certificates:
+
+# The .pem file that contains the root certificate chain from the Certificate Authority.
+# Specify the file name of the .pem file using absolute paths.
+platform_cyberark_ca:
+
+# The certificate key file location. Specify the location of the key file using absolute paths.
+platform_cyberark_key:
+
+# The .pem file that contains the client certificate. Specify the file name of the .pem file
+# using absolute paths.
+platform_cyberark_certificate:
+
+# String representation of the PEM-encoded root certificate chain from the Certificate
+# Authority. Alternative to platform_cyberark_ca when the CA contents should be inlined.
+platform_cyberark_ca_contents:
+
+# String representation of the PEM-encoded certificate key. Alternative to platform_cyberark_key
+# when the key contents should be inlined.
+platform_cyberark_key_contents:
+
+# String representation of the PEM-encoded client certificate. Alternative to
+# platform_cyberark_certificate when the certificate contents should be inlined.
+platform_cyberark_certificate_contents:
+
+# The number of seconds that the Central Credential Provider will try to retrieve the secret
+# value.
+platform_cyberark_connection_timeout:
+
+# Set this property to the reason for retrieving the password to have the reason text appear
+# in CyberArk Credential Provider's audit log.
+platform_cyberark_reason_text:

roles/platform/defaults/main/vault.yml → roles/platform/defaults/main/hashivault.yml

@@ -4,12 +4,20 @@
 # Flag to enable/disable configuring Vault in Itential Platform
 platform_configure_vault: false
 
+# Name of the secrets provider. Required for CyberArk CCP. Not required for Hashicorp Vault.
+# Valid values: CyberArkCcp, HashicorpVault
+platform_secret_provider_name:
+
 # The directory to store the vault root key in
 platform_vault_token_dir: "{{ platform_server_dir }}/keys"
 
 # The URL to the Hashicorp Vault server.
 platform_vault_url: http://localhost:8200
 
+# The Vault Enterprise namespace to scope all secret operations to. Required for multi-tenant
+# Vault Enterprise configurations. Not required for open-source Vault.
+platform_vault_namespace:
+
 # The authorization method to connect to Hashicorp Vault. Either token or approle.
 platform_vault_auth_method: token
 
@@ -49,3 +57,7 @@ platform_vault_secrets_endpoint: itential/data
 # If true, only reads secrets from Hashicorp Vault. Otherwise, the platform can write secrets
 # to Vault for storage.
 platform_vault_read_only: true
+
+# The number of milliseconds to wait before timing out requests to the Hashicorp Vault server.
+# Used by Hashicorp Vault only.
+platform_vault_connection_timeout:

roles/platform/defaults/main/logging.yml

@@ -19,6 +19,14 @@ platform_log_filename:
 # The minimum log level to display in the console (stdout).
 platform_log_level_console:
 
+# If true, log entries will be written in JSON format. Otherwise, log entries will be written
+# in plaintext.
+platform_log_format_json: false
+
+# If true, console logs will be written in JSON format. Otherwise, log entries will be written
+# in plaintext.
+platform_console_format_json: false
+
 # The absolute directory path where webserver log files are written.
 platform_webserver_log_directory: "{{ platform_log_dir }}"
 
@@ -57,3 +65,7 @@ platform_syslog_app_name:
 
 # The end of line character to include in the syslog message.
 platform_syslog_eol:
+
+# If true, syslog logs will be written in JSON format. Otherwise, log entries will be written
+# in plaintext.
+platform_syslog_format_json: false

roles/platform/defaults/main/mongodb.yml

@@ -30,6 +30,15 @@ platform_mongo_tls_enabled: true
 # and allows the use of invalid or self-signed certificates to connect.
 platform_mongo_tls_allow_invalid_certificates: "{{ false if platform_mongo_tls_enabled | bool else '' }}"
 
+# Root certificate chain from the Certificate Authority, as a PEM-encoded string.
+# Alternative to platform_mongo_tls_ca_file when the CA contents should be inlined instead of
+# referencing a file path.
+platform_mongo_tls_ca_contents:
+
 # The maximum number of connections in a connection pool.
 # Each application/adapter has its own connection pool.
 platform_mongo_max_pool_size:
+
+# The maximum number of milliseconds that a connection can remain idle in the pool.
+# Set to 0 for no limit.
+platform_mongo_max_idle_time_ms: 300000

roles/platform/defaults/main/redis.yml

@@ -1,6 +1,9 @@
 # Copyright (c) 2024, Itential, Inc
 # GNU General Public License v3.0+ (see LICENSE or https://www.gnu.org/licenses/gpl-3.0.txt)
 ---
+# The platform will match Bull queue names included to persist in Redis on restarts.
+platform_redis_persist_queues:
+
 # The Redis keyspace (database number) to use for the connection.
 platform_redis_db: 0
 
@@ -16,6 +19,9 @@ platform_redis_password: itential
 # The maximum number of times to retry a request to Redis when the connection is lost.
 platform_redis_max_retries_per_request: 20
 
+# The maximum time in milliseconds to wait for initial Redis connection before timing out.
+platform_redis_connect_timeout: 30000
+
 # The maximum number of times to retry writing a heartbeat message to Redis from a service.
 platform_redis_max_heartbeat_write_retries: 20
 
@@ -45,6 +51,23 @@ platform_redis_name: itentialmaster
 platform_redis_tls_enabled: true
 platform_redis_tls: {}
 
+# CA certificate, client certificate, and client private key used to verify/authenticate the
+# Redis TLS connection, as PEM-encoded strings. Alternative to setting these directly on
+# platform_redis_tls when the values should be inlined instead of nested in the TLS options dict.
+platform_redis_tls_ca:
+platform_redis_tls_cert:
+platform_redis_tls_key:
+
 # TLS options for the Sentinel connection itself. Refer to the NodeJS TLS library for all
 # supported options. Only used when platform_redis_tls_enabled is true.
 platform_redis_sentinel_tls: {}
+
+# The maximum time in milliseconds to wait for a Redis Sentinel command to complete. Only
+# applies when connecting via Redis Sentinel.
+platform_redis_sentinel_command_timeout: 3000
+
+# The maximum time in milliseconds to wait for a Redis command to complete before timing out.
+platform_redis_command_timeout: 60000
+
+# Enables TCP keepalive on the Redis socket. Value is the keepalive delay in milliseconds.
+platform_redis_keep_alive: 5000

roles/platform/defaults/main/server.yml

@@ -16,6 +16,11 @@ platform_service_directory:
 # If not provided, the server will generate one on startup.
 platform_server_id: "{{ inventory_hostname }}"
 
+# Strategy used to generate server ID, if one is not set using platform_server_id.
+# Selecting mac:port will generate a server_id using a combination of MAC address and port,
+# while random will generate a random ID on each startup.
+platform_server_id_strategy: mac:port
+
 # A whitelist of services (applications/adapters) to initialize on startup of the platform.
 # If no value is given, all services will be initialized.
 platform_services:
@@ -62,5 +67,11 @@ platform_external_request_timeout:
 # The interval for how often IAP polls for the number of devices, in hours.
 platform_device_count_polling_interval:
 
+# The number of worker threads available for event processing.
+platform_event_worker_thread_count:
+
+# The number of worker threads available for transformation processing.
+platform_transformation_worker_thread_count:
+
 # If true, the platform will track detailed audit events.
 platform_audit_enabled:

roles/platform/defaults/main/telemetry.yml

@@ -0,0 +1,6 @@
+# Copyright (c) 2024, Itential, Inc
+# GNU General Public License v3.0+ (see LICENSE or https://www.gnu.org/licenses/gpl-3.0.txt)
+---
+# Toggle for OpenTelemetry webserver metrics (requests, errors, duration, payload sizes --
+# served at /metrics/webserver).
+platform_otel_webserver_metrics_enabled: true

roles/platform/defaults/main/webserver.yml

@@ -24,10 +24,27 @@ platform_webserver_https_enabled: true
 # The port on which the webserver listens for HTTPS requests.
 platform_webserver_https_port: 3443
 
+# Public key used for HTTPS connections, as a PEM-encoded string. Alternative to the file-based
+# key deployed via platform_webserver_https_copy_certs when the key contents should be inlined.
+platform_webserver_https_key_contents:
+
 # The passphrase for the private key used to enable TLS sessions.
 platform_webserver_https_passphrase:
 
-# The set of allowed SSL/TLS protocol versions.
+# Certificate used for HTTPS connections, as a PEM-encoded string. Alternative to the file-based
+# cert deployed via platform_webserver_https_copy_certs when the cert contents should be inlined.
+platform_webserver_https_cert_contents:
+
+# Minimum permitted TLS version. Overrides platform_webserver_https_secure_protocol.
+# Valid values: TLSv1.3, TLSv1.2, TLSv1.1, TLSv1
+platform_webserver_https_tls_min_version:
+
+# Maximum permitted TLS version. Overrides platform_webserver_https_secure_protocol.
+# Valid values: TLSv1.3, TLSv1.2, TLSv1.1, TLSv1
+platform_webserver_https_tls_max_version:
+
+# The set of allowed SSL/TLS protocol versions. Ignored when either tls_min_version or
+# tls_max_version is given.
 platform_webserver_https_secure_protocol: TLS_method
 
 # The allowed SSL/TLS cipher suite.

roles/platform/defaults/main/workflow_worker.yml

@@ -5,6 +5,15 @@
 # If false, the task worker must be enabled manually via the UI/API.
 platform_task_worker_enabled: true
 
+# The number of worker threads available for task processing.
+platform_task_worker_thread_count: 1
+
+# The maximum number of tasks to run per period. The value 0 disables the rate limiter.
+platform_task_worker_rate_limit: 0
+
+# The time period in seconds for the task worker rate limit.
+platform_task_worker_rate_limit_period: 1
+
 # If true, will allow jobs to be started after the server startup process is complete.
 # If false, API calls to start Jobs will return an error until enabled manually via the UI/API.
 platform_job_worker_enabled: true