Configuration
How the control plane loads its configuration, the settings every cluster needs, and the full reference.
Loading configuration
The control plane reads JSON, JSON5, JSONC or YAML files, then applies environment variables on top.
- Files. Pass
--configwith a file or a directory; files in a directory are merged. Repeat--configto merge several paths in order. Without--config, the control plane loads/etc/rivetif it exists. - Environment variables. Prefix a setting with
RIVET__and separate each level with__. For example,depot.log_directoryisRIVET__DEPOT__LOG_DIRECTORY.
rivet-engine --config /etc/rivet/config.json
Unknown settings are an error, so a typo stops the control plane at startup instead of being ignored.
Required settings
| Setting | Purpose |
|---|---|
auth.admin_token | Your Rivet token, the credential nodes and your backend use. The control plane refuses to start without it. |
depot.log_directory | The instance’s disk. The directory must already exist. See Storage. |
object_storage.primary | The bucket. The default keeps data in memory and loses it on restart. See Storage. |
api_peer.advertise_address | The host:port other instances use to reach this one on port 6421. Required when more than one instance runs. |
Rivet token
Your Rivet token is the auth.admin_token value. It works in every namespace. Generate one with openssl rand -hex 32 and keep it on your backend.
Clients pass it as a bearer token, or inside the endpoint URL:
export RIVET_ENDPOINT="https://default:$RIVET_TOKEN@rivet.example.com"
Use it to issue scoped tokens for browser clients, and keep the Rivet token itself out of them. See Scoped Tokens.
Crash reports
The control plane sends crash reports to Rivet by default. Turn them off with "telemetry": { "enabled": false } or RIVET__TELEMETRY__ENABLED=false.
Reference
Configuration for the private API service. This port is plaintext and unauthenticated. It must only be reachable on a private network.
Address reachable by other nodes. Defaults to a concrete bind address. Wildcard binds require an explicit advertisement. Explicit loopback is valid only when all participating workers share the same host.
Bind IP. Defaults to the host of advertise_address, or loopback for single-node development. DNS advertisements require an explicit bind IP. Explicit wildcard binds expose every interface.
Bounds for internal volume reads served on the API-peer listener.
Restores legacy unauthenticated access behavior for actor and routing endpoints.
Default access-token lifetime, in seconds.
Controls verification, issuance, and key maintenance. Defaults to true.
Pauses only new token minting. Defaults to true while JWT is enabled.
Monotonic topology fence. Increment when changing the derived issuer or signing leader.
Fail-closed maximum signing lifetime, in seconds (fourteen days by default). Normal rotation is still at day seven; this deadline only prevents A from signing forever if rotation stalls.
Time to publish a pending public key before activation, in seconds (ten minutes by default). It provides verifier propagation time and does not extend the active key's lifetime.
Normal active-key age at rotation, in seconds (seven days by default).
Maximum access-token lifetime, in seconds. V1 is capped at one day.
URL of the Cloud API (e.g., "https://cloud.rivet.dev/internal/route")
Optional overrides for the tablet frontier and worker-owned callback pool.
Creates this many tablets over this storage worker when the cluster has none, so a single-node engine serves actors without an operator. A restart finishes a run that stopped partway; tablets it did not start are left alone. Clusters with several storage workers leave it unset and run `depot tablet provision` instead.
Static tablet placement policy; membership and lease timings remain topology-owned.
How long a new worker must be listed in discovery, and pass one disk probe, before the coordinator places tablets on it. Must exceed the topology worker lease plus one renewal and the takeover grace, about 35 s, so a worker that crashes soon after it first appears has left discovery before it qualifies. Startup refuses a shorter value.
Whether the tablet coordinator places, splits and replaces tablets on its own. When disabled, the layout changes only through operator commands: a new cluster gets no first tablet until an operator creates one, and a missing worker is never replaced.
Maximum concurrent disk admission requests made by the tablet coordinator.
How long an assigned worker must be missing from discovery before its replicas are replaced. Counted from when discovery drops it, which is itself one lease after its last renewal.
Bytes per second that bulk runs may read across every tablet of this process, with a burst of a quarter second (at least 4 MiB). Bulk runs wait for their bytes; point reads never wait. Unset or 0 leaves bulk runs unpaced.
Whether SST blocks a bulk run fetches enter the shared block cache. Defaults to true; false keeps large scans from evicting other volumes' hot blocks.
Concurrent SST block fetches inside one bulk run's scan. Defaults to 1; 0 is treated as 1.
Chunk runs of at least this many chunks (4 KiB each) are read with the bulk scan settings below, as a table scan's read-ahead windows are. Unset or 0 reads every run with the normal settings.
Global checkpoint defaults; individual volume records can override retention.
SlateDB caches shared by every cold-store database of one engine process. These are fixed RAM caps of the storage worker process, separate from the log shard's and filesystems' budgets. With the defaults they hold up to 2 GiB together: 512 MiB of data blocks, 512 MiB of SST metadata and 1 GiB of unflushed memtables. Size a host for them beside `filesystem.max_process_cache_bytes`, the log shard's `max_memory_bytes` and loaded replicas, and the KV volume budget `kv_commands.max_worker_open_volume_bytes`.
Data block cache bytes for the whole process, not per database. Defaults to 512 MiB.
Largest SST a compaction writes before it starts the next one. A read whose index is not cached loads and decodes the SST's whole index, about 2% of the SST's bytes, so smaller compacted SSTs keep that cost small once the indexes of a growing database outgrow `meta_cache_bytes`. Defaults to 16 MiB.
Disk cache capacity in bytes; 0 disables the cache. When unset, a storage worker sizes it from the free space of its filesystem at startup, next to the log shard.
Directory for the local disk cache of cold-store object parts. Defaults to `cold-cache` inside `depot.log_directory`. Its contents are disposable.
Writes each SST a compaction uploads into the disk cache as well. Compaction output of large databases is mostly cold, and caching it costs local disk writes on the disk the log shard shares, so write-heavy deployments turn it off. Defaults to true.
Writes each SST a tablet flush uploads into the disk cache as well, so its first reads are local. Defaults to true.
Bytes fetched per cache miss and stored per cache file, a multiple of 1 KiB. Defaults to 1 MiB.
L0 SSTs a tablet database holds before SlateDB stalls memtable flushes until a compaction drains them. One compaction takes up to this many sources, so it drains a full L0 at once. Higher values absorb flush bursts at the cost of more SSTs per read. Defaults to 16.
Concurrent compactions per tablet database. A worker maintaining more than 8 tablets runs one per database. Defaults to 2.
Index, filter and statistics cache bytes for the whole process. Defaults to 512 MiB. Every SST probe needs that SST's index and filter in this cache, and a miss loads and decodes the SST's whole index. Indexes are about 2% of SST bytes, so 512 MiB keeps the metadata of about 25 GiB of SSTs per process in memory. Past that, reads start evicting indexes other reads need, and each actor start pays for more index decodes. A smaller cache reaches that point at proportionally less data.
Unflushed memtable bytes for the whole process, split evenly across the tablets this worker maintains (at most 512 MiB and at least 8 MiB per tablet). Defaults to 1 GiB.
Block compression for cold-store SSTs.
Floor for every typed Depot command deadline, in milliseconds. Each command keeps its own default (5 seconds generic, 30 seconds for actor storage); when set, the larger of the two bounds both the client's retry budget and the maintainer's handler timeout. Unset keeps the per-command defaults.
Exact coordinator subject capacity. Defaults to 256.
Most events of one durable state machine applied in one commit. Events that arrive while a commit is in flight are grouped up to this bound. Defaults to 16.
Maximum cached endpoint hints, including missing workers. Defaults to 4096.
Bytes one filesystem's row cache may retain, a fairness ceiling inside `max_process_cache_bytes`.
Bytes all filesystem row caches in one process may retain together.
Maximum application bytes in one filesystem transaction.
Most payload bytes one opening may have admitted ahead of the newest position its tablet's maintainer reported applied. A new write past it is refused with a retry hint before it is built, so a writer faster than the apply, as under a slow cold store or compaction, waits at admission instead of growing an unbounded backlog.
How long a write's overlay notes ("this page is at this sequence") outlive the write before the filesystem drops them and keeps their rows only as cache. A later miss on one of those rows reads it from the maintainer once it has applied the write. About ten times the usual apply latency.
Unflushed applied bytes at which a volume joins a tablet flush another volume requested. Defaults to 16 KiB.
Volume records whose old rows one tablet filesystem flush reads at once while it stages. Staging excludes every other store operation of the tablet. Defaults to 16.
Global bounds for source hold cleanup and background cross-region copies.
Minimum age before an unfinished fork's destination is checked.
Further bounded by the maintainer's row and byte budgets.
Optional overrides for topology's bounded heartbeat cleanup service, which runs under the storage owner's singleton election. Topology defines the resolved defaults.
Pause between the batches of one pass. Defaults to 10 seconds.
LIST entries examined per batch, 1 to 1000. Defaults to 128.
Time budget of one batch. Defaults to 2 seconds.
Conditional deletes in flight per batch, 1 to `batch_size`. Defaults to 4.
Time between the starts of consecutive passes over both heartbeat prefixes. Defaults to one hour.
Defaults to 24 hours; clean shutdown markers remain available during this window.
Optional limits for typed commands and maintainer-owned filesystems.
Warns on eviction below this idle time; defaults to 15 seconds.
Idle KV command volumes one tablet's host closes at once to make room past its cap or the worker's budget. Each open refused at a full cap starts one such close, so a burst admits at this many closes per close latency. A closing volume keeps its memory charge until its close finishes. Defaults to 32.
Received bytes of the KV commands one tablet's host has admitted and not finished. A command that would exceed it is refused at once as unavailable, which callers retry within their deadline. Must hold at least one command of `max_command_bytes`. Defaults to 64 MiB, so a worker maintaining four tablets holds at most 256 MiB of command payloads.
Maximum simultaneous handlers per registered command class.
KV command volumes one tablet's host holds open at once, closing ones included. Defaults to the worker-wide cap, so by default only the worker's memory budget limits a tablet.
Memory, in bytes, that the KV command volumes of this worker may hold together across every tablet it maintains, closing ones included. Each open volume is charged 80 KiB, its measured fixed cost with allocator headroom: its host slot, volume client and filesystem owner, plus the log replicas and maintainer state its open loads. Caches and command payloads are bounded separately. One worker-wide budget bounds memory however many tablets the worker holds, and a create burst opens one volume per new key, so the default of 5 GiB holds 65,536 volumes (default 5 GiB).
A count backstop to `max_worker_open_volume_bytes`; unset by default, so the byte budget alone sets the worker's cap.
KV commands one worker holds received and unanswered, and that one caller may have outstanding to one worker, isolated from volume lifecycle requests. A full window refuses a command at once as overloaded, and the caller retries it within its deadline. Each tablet's host admits at most the sum of its commands' concurrency caps (4,608 with the default caps and the engine's commands), so the default of 32,768 lets those caps, not this window, refuse load first on a worker that maintains up to seven tablets. Defaults to 32,768.
Idle close for volumes of short-lived commands, such as one Epoxy key per volume. Closing also begins the volume's unload. Defaults to 2 seconds.
Defaults to 60 seconds.
How long a tablet replica-set change may stay in Learning before the coordinator aborts it and the tablet returns to its old members. Defaults to one hour and must be at least 45 minutes. It counts from the phase's start, not from the learner's progress, so it must outlast the membership holder wait (15 minutes) plus the copy of the largest log suffix a learner may have to catch up.
Log shard requests a client keeps in flight to one storage worker. Later requests queue and go out together as one batch when a slot frees. Defaults to 2.
Existing directory owned by one storage process. Required when storage services start.
Exact replica subject capacity, shared by local clients and the shard. Defaults to 2048.
The log shard owns resolved defaults and validates relationships between these limits.
Disk reads executing at once beside the shard's write queue. Each holds one scan buffer of two maximum batches from `max_memory_bytes`. Defaults to 8.
Longest wait, in milliseconds, of a request other than an append in the shard's inbox. A request that waited longer is refused as overloaded before any work, with a retry hint, so a saturated shard sheds load instead of queueing past the volume client's quorum timeout. Defaults to 1000.
The same bound for appends, commit announcements, trims and forgets, which carry writes a volume client already admitted or free memory and disk, so opens and other new work are shed first. At least `max_admission_wait_ms` and just under the volume client's 2 s append timeout, past which the client has resent the append anyway. Defaults to 1800.
Disk bytes the shard's log may hold. When unset, a storage worker sizes it from the free space of its filesystem at startup, shared with the cold-store disk cache.
Most reads waiting on the shard's disk at once; a read that needs disk beyond it is rejected as overloaded and retried by the caller. Defaults to 256.
Memory, in bytes, that one log shard's loaded replicas may hold, charged at 1.5 KiB per replica, the measured heap of a quiet loaded replica with headroom. A load past it is refused as `too_many_loaded_volumes`, a typed refusal its open retries. The default of 1.5 GiB holds 1,048,576 replicas (default 1.5 GiB).
A count backstop to `max_loaded_volume_bytes`; unset by default, so the byte budget alone sets the shard's replica cap.
Encoded bytes of synced log entry payloads the shard keeps in memory for reads; defaults to a sixteenth of `max_memory_bytes`. Older payloads are read from disk.
Synced payload bytes one volume replica keeps after each disk write; defaults to 32 KiB.
Retry hint, in milliseconds, on a request refused because the inbox or a request budget is full. Defaults to 100.
Writes log segments into files zero-filled to `segment_bytes` ahead of use, so each commit overwrites allocated blocks and syncs only its data instead of journaling a file size change. On the load cluster's disks this halves the sync and commit latency. The unused allocation of the active segment and one spare segment count toward `max_disk_bytes`. Each write also records, in a header slot synced with it, how far earlier syncs reached, so a disk that returns synced pages as zeros is reported as corruption rather than read as free space. Needs `segment_bytes` above 8 KiB. Defaults to true.
How long log shard recovery may go without finishing another file before the shard fails (default 120 s). It does not bound the whole scan, which grows with the log.
How long a volume replica appends nothing before its synced payloads leave memory; defaults to 5000.
Early cold-write watermark, 1..99 percent of the disk cap; defaults to 75.
Concurrent topology endpoint lookups and heartbeat inspections admitted per process. Defaults to 128.
Queued events one tablet maintainer accepts before it rejects new requests as overloaded. Every volume open, read, apply and status notice for the tablet passes through it, so a burst of actor starts on one tablet needs room for several events per start. Must be positive. Defaults to 4096.
Volumes one tablet maintainer holds loaded at once, before opens of more are refused as overloaded. A loaded volume costs about 1.8 KiB of maintainer heap, so the default of 500,000 holds under 1 GiB per tablet. Must be positive.
Volume opens queued in one tablet maintainer's inbox, not yet taken by its runner, at which a new open is refused as overloaded at once instead of joining the inbox. Other inbox events do not count. Opens queued past this would mostly expire before admission. Must be positive. Defaults to 1024.
Client requests one tablet maintainer tracks at once before it rejects more as overloaded. Must be positive. Defaults to 1024.
Fallback interval for re-reading the tablet manifest. Routing misses and `NotMaintainer` replies refresh it at once. Defaults to 30 seconds.
Size of each background cold-read window per tablet maintainer: held-image source reads for forks, replica log reads for applies, fork jobs and fork cleanup jobs are each bounded by it separately, so they never take client read slots. Defaults to 4.
Client cold-store reads in flight per tablet maintainer: session opens, lifecycle row lookups and session reads share this window. A cold wake's reads fan out through it, so a narrow window serializes them. Object storage throughput scales almost linearly to about 32 parallel GETs, and a read slot is not always a GET, so 64 keeps a cold wake's reads from waiting on slots; on the load cluster a fully cold wake took about 850 ms at 4, 430 ms at 64 and 390 ms at 512. Defaults to 64.
Client session reads of one volume a tablet maintainer admits while reads of other volumes wait, so one large scan cannot hold every client cold-read slot. Slots no other volume waits for still go to that volume. Unset or 0 admits client reads in arrival order.
Filesystem read sessions per tablet maintainer. A session lives while its volume is being read and ends after `read_session_idle_ms` without a read, so this bounds how many volumes a tablet serves reads for at once. Opens past it are refused as overloaded. A held session retains about 1.2 KiB of maintainer heap, so the default of 16,384 holds under 20 MiB per tablet. Must be positive.
Minimum milliseconds between miss-triggered membership refresh attempts, including failures.
Throttle for memtable flushes that nobody urgently waits on: a pass that comes due waits up to this long, so passes that come due close together share one upload and one L0 SST. Defaults to ten seconds.
How long a session opened at the latest position stays registered after its last read, in milliseconds. An HTTP directory cursor resumes such a session between pages, and no client reopens it at its position, so a paging client keeps its cursor for this long between pages. Must be positive. Defaults to 30,000, the session lifetime.
How long a read session stays registered after its last read, in milliseconds. Each read extends it up to the session's lifetime, and a client reopens an ended session on its next read, so sessions track volumes being read rather than volumes open. Must be positive. Defaults to 2,000.
Simulation only: runner time each filesystem read request costs a tablet maintainer, in microseconds, spent on the simulated clock so a maintainer busy with reads queues them as a loaded one does. Unset in deployments, where real processing time passes on its own.
Stop-permit retry interval. Defaults to one second.
Teardown budget after a stop permit or timeout. Defaults to one minute.
Maximum coordinated stop wait from the first signal. Defaults to 30 minutes.
Queued store items one admission pass looks at past work that cannot start yet. Work beyond it waits for the next pass. Must be positive. Defaults to 1024.
Tablet filesystem flushes one tablet maintainer lets stage at once. Staging writes the flush's records into the store. Must be positive. Defaults to 1.
Tablet filesystem flushes one tablet maintainer keeps in flight at once, staging or uploading; a staging flush counts because it uploads next. Must be at least `store_max_flush_staging`. Defaults to 2.
Filesystem applies and loads one tablet maintainer admits to its store at once. They run concurrently, one task each, and their replica reads stay bounded by the cold byte budget, so the cap sizes concurrency for a burst of volume creates rather than memory. Must be positive. Defaults to 256.
Volume lock stripes of each tablet filesystem store. Two volumes on one stripe serialize their store work. Must be positive. Defaults to 1024.
Which tablet store operations take volume lock stripes.
Only work the maintainer core does not order takes a stripe.
Every store operation takes its volumes' stripes.
Optional process ownership overrides; the volume client defines the resolved defaults.
Volumes one engine process holds open at once; defaults to 32768. A held volume costs about 14 KiB of client state and under 64 KiB with its filesystem owner, so the default stays under 2 GiB. Page caches are bounded separately by the process cache budget.
Time an open waits for volume recovery before failing; defaults to 3000 ms.
Codec for a volume's logged write payloads.
Per-subject lifecycle request capacity, isolated from other UPS traffic. Defaults to 1024.
Entire lifecycle RPC budget, including route refreshes. Defaults to five seconds.
Committed suffix threshold, default 64 MiB and maximum 256 MiB.
Cold-write age from the first unflushed entry, plus up to a tenth of it as jitter. Defaults to one minute. Storage workers require the age with its jitter to stay below `stop_timeout_ms`, so a stopping worker never waits on a slower tiering cadence than its own stop budget.
Epoxy runs in a single datacenter with fixed membership, so it has no settings yet. The section stays so multi-region settings have a home.
TODO: Remove eventually and reenable gateway auth permanently. See RVTEE-672.
Host for HTTP traffic
Port for HTTP traffic
Timeout for guard-owned route authorization checks in milliseconds.
Timeout for resolving compute routes in milliseconds.
Timeout for pegboard actor route authorization checks in milliseconds.
Enables TCP_NODELAY on accepted Guard sockets. Defaults to true. Guard carries actor runners' Envoy WebSockets and client WebSocket and HTTP traffic, where most writes are small frames. With Nagle's algorithm on, a small frame waits for the peer to acknowledge the previous one, and a peer that delays its ACK holds it for about 40 ms. That delay landed on every actor's first response.
Configuration for the metrics service.
Configuration for host hardware metrics.
Times sequential writes and fsyncs on each data directory once at startup, in the background. Defaults to true.
Bytes the probe writes sequentially to each data directory. The fsync phase writes a further 400 KiB. Defaults to 64 MiB; at most 1 GiB.
A local directory used by one engine process at a time. Conditional writes are atomic only among requests of that process.
Created when it does not exist.
Azure Blob storage used by SlateDB, topology, and cluster configuration.
Google Cloud Storage; defaults to the adapter's application default credentials.
Milliseconds the first attempt of a small GET or HEAD may wait for response headers before the client cuts it off and retries it with its normal timeouts. A request on a stalled connection otherwise waits the full 30 s client timeout. Default 250, set from the load cluster's Azure account, where about 0.02% of small requests took longer; 0 disables it. Response bodies are never cut off.
The upload rate a conditional PUT's first attempt may fall to before it is cut off, which extends `write_first_attempt_ms` by the body's size. Default 8 MiB/s.
Milliseconds the first attempt of a small conditional PUT (a lease, heartbeat or manifest) may wait for response headers, before the upload time its body needs at `write_first_attempt_bytes_per_second`. Unset by default, which disables it. Healthy conditional PUT latency is calibrated only on Azure; a healthy GCS PUT can take over 250 ms. GCS also allows about one write per second to one object, so a retry shortly after a cut-off on the same lease or heartbeat object risks a 429, an unknown outcome and an extra readback. Set it only from measured conditional PUT latency of the backend.
Policy for outbound HTTP requests to user-configured destinations, such as serverless runner URLs. These requests originate from inside the trusted engine network, so without restrictions a caller who can configure a runner can reach internal-only services. The defaults deny every non-globally-routable destination except loopback.
Additional CIDRs that are always permitted, evaluated after `deny_cidrs`. Use this to reach a specific internal service without opening up the whole private range.
Hostnames that are always permitted, whatever they resolve to. Matched exactly and case-insensitively, with no wildcards. Use this for a first-party service whose address is not known ahead of time, such as a Kubernetes service name. Anything served at a listed host becomes reachable by every runner config, so list individual hosts rather than a shared entry point.
Allow plaintext `http://` destinations. When disabled only `https://` is permitted.
Allow destinations that resolve to loopback addresses (127.0.0.0/8, ::1). Enabled by default so local development against `http://localhost:...` works without configuration.
Allow destinations that resolve to private, link-local, shared (CGNAT), or otherwise non-globally-routable addresses. Self-hosted deployments that point runners at addresses on their own network, such as a Docker Compose service name, need this enabled.
Additional CIDRs that are always denied. Takes precedence over every allow rule.
Maximum number of redirects to follow. Every hop is re-checked against this policy.
Hashed index bucket volumes for each namespace and actor name (default 8, 1..=256). This is part of the index address format. Changing it on a running cluster strands existing rows in buckets that listing and destroy no longer target, so treat it as fixed per cluster.
Maximum actor index bucket pages one listing reads at once (default 32).
Lazy orphan deletes an actor listing runs at once (default 16).
Rows an actor listing's lazy orphan deletes may queue at once (default 1024).
Actor key reservations and key epochs cached in one process, each (default 100000). Reservations never change, so a cached one is kept until evicted.
Timeout of one start notice to a waiting gateway worker. Unit is in milliseconds (default 2000, 100..=30000).
Gateway workers one actor keeps waiting for its start (default 64, 1..=1024). A request that finds the list full waits on its fallback poll alone.
Maximum simultaneous handlers per pegboard command class on one storage worker. Each value is further capped by `depot.kv_commands.max_inflight_commands`.
Actor creation. Defaults to 256.
Actor state machine events, including envoy lifecycle reports. Defaults to 256.
Actor record reads by the gateway, the API and storage fencing. Defaults to 256.
Index inserts, deletes and listings. Defaults to 256.
Events, KV and SQLite requests queued from one actor on an Envoy connection (default 128, 1..=65536).
Commands and tunnel messages queued toward one actor on an Envoy connection (default 128, 1..=65536).
Envoy connects one process can admit in a burst; the budget starts full (default 400, 1..=1000000).
Envoy connects one process admits per second once its burst is spent (default 200, 1..=100000). A connect past the budget is closed at once with `envoy.connect_overloaded` and a retry hint, before any work, so a fleet reconnecting after an outage cannot overwhelm guard.
Retry hint sent with a shed Envoy connect. The Envoy waits between one and two hints, so shed connects return spread out, and caps the hint at 5 s so a shed runner still retries well inside the lost threshold. The same hint goes with a connect refused because storage could not register the Envoy yet. Unit is in milliseconds (default 1000, 100..=5000).
Maximum age of the process-local Envoy directory that actor allocation reads instead of listing the Envoy index on every allocation. Must be greater than 0. Unit is in milliseconds. Defaults to 1000.
Maximum age of an Envoy directory listing that allocation still uses while one background listing replaces it. Allocation waits for a listing only past this age. Must be at least `envoy_directory_cache_ms`. Unit is in milliseconds. Defaults to 5000.
Time a lifecycle event may spend retrying storage command deadlines before its Envoy socket is closed for reconnection. Defaults to 120000 ms.
Stale Envoy row deletes one reader runs at once (default 8).
Stale Envoy row deletes one reader may queue at once (default 256).
Lost checks one process holds for closed Envoy connections that may not reconnect (default 4096, 1..=65536). When full, the check due soonest is dropped and its actors are found lost on their next request.
How long a disconnected Envoy keeps its actors before stopping them, advertised to the Envoy on connect. The engine waits as long after a connection closes before it judges the Envoy's actors lost, so both sides agree. It must exceed the Envoy client's longest reconnect backoff (30 s), or an engine restart stops every actor. Unit is in milliseconds (default 40000).
Max time since last pong before the envoy connection is terminated. Unit is in milliseconds.
Envoy records cached for routing fallbacks in one process (default 10000).
Lifetime of a cached Envoy record read on a routing fallback, in milliseconds (default 2000).
Messages queued for one Envoy socket writer (default 128, 1..=65536).
Longest time an Envoy connection holds a gateway request for an actor generation whose start command it has not forwarded yet, in milliseconds (default 1000). A gateway sends a request right behind the start, so this keeps the request from reaching the Envoy first. When it runs out the request is forwarded anyway, and the Envoy refuses it as not found.
Messages queued toward one gateway tunnel stream on an Envoy connection (default 128, 1..=65536).
Ping interval for envoy updates in milliseconds.
Port for the new partition-backed gateway and Envoy Hyper listener (default 6422).
Retries one gateway process can bank for a burst of refusals; the budget starts full (default 100, 0..=100000).
Retries of refused requests one gateway process allows, as a percentage of the requests it receives (default 10, 0..=100). A refused request past this budget fails with `guard.service_unavailable` and its retry hint, so the client owns the next attempt.
Time after a gateway request starts waiting for an actor's start notice before its first fallback read. Unit is in milliseconds (default 2000, 100..=30000).
Time between later fallback reads while a gateway request waits for an actor's start. Unit is in milliseconds (default 2000, 100..=30000).
Actors one gateway process waits on at once for a start notice (default 65536, 1..=1048576). When full, a new request waits on its fallback poll alone.
Time an actor WebSocket upgrade may wait for its actor, as while storage recovers after an engine restart. Past it the gateway accepts the upgrade and closes it with `guard.service_unavailable` and a retry hint, so a client without a connect timeout retries instead of waiting forever. Unit is in milliseconds (default 15000, 1000..=45000).
Idle time after which a remote SQL session is closed and reopened on next use. Unit is in milliseconds (default 30000).
Largest response, in logical bytes, that one remote SQL request may return. A larger result fails the request instead of being sent. Unit is in bytes (default 25165824, 24 MiB; at most 64 MiB).
Threads shared by every remote SQL session in this process (default 4).
Sends SQLite pages the client is likely to read next along with the pages it asked for (default true). When off, the engine sends only requested pages but keeps maintaining its prefetch hints, so turning it back on needs no rebuild. Runtime configurable.
Maximum SQLite actor sessions retained by one Envoy connection (default 256).
Exact-subject worker requests and streams.
Per-class request caps. Depot classes travel on reserved subjects whose window is their incoming cap, so they take only an outgoing cap across every target.
The process-wide caps of a class that travels on unreserved subjects.
The outgoing cap of a subject-scoped class, across every target.
The outgoing cap of a subject-scoped class, across every target.
The outgoing cap of a subject-scoped class, across every target.
The outgoing cap of a subject-scoped class, across every target.
The outgoing cap of a subject-scoped class, across every target.
The process-wide caps of a class that travels on unreserved subjects.
The process-wide caps of a class that travels on unreserved subjects.
The process-wide caps of a class that travels on unreserved subjects.
Maximum concurrently reserved request subjects with isolated capacity.
Connections and flow-control windows per peer. Omitted values use the defaults.
Requests with a larger payload use a peer's large-request channels, so they never queue ahead of small requests on one stream (default 64 KiB).
Most bytes a peer channel writes at once from its queue (default 256 KiB).
Bytes of requests a peer channel queues for writing; a request that would exceed it is refused, though an empty queue always takes one (default 64 MiB).
Frames a peer channel queues for writing; a full queue refuses the request (default 8192).
Bytes of replies one served peer channel queues for writing. A channel at its cap refuses new requests as overloaded until its caller reads or the queued replies expire (default 64 MiB).
Bytes of replies queued across every served peer channel of this worker. At the cap every channel refuses new requests as overloaded (default 1 GiB).
HTTP/2 connection window of a request connection (default 16 MiB).
Connections per peer for unary requests, each carrying one peer channel (default 4).
HTTP/2 stream window this worker grants a peer channel's replies (default 4 MiB). A worker's server grants each incoming stream a fixed 4 MiB window.
HTTP/2 connection window of a stream connection (default 32 MiB).
Connections per peer for long-lived streams such as tunnels (default 2).
HTTP/2 stream window of a long-lived stream (default 1 MiB).
Concurrent HTTP request header reads (default 2048). Held only until the header decodes, then the request moves to its class or subject budget.
Pending requests per subject; a full queue rejects new requests immediately.
Default and maximum request budget, including resolution, transit, and queueing.
Buffered packets per stream direction; full buffers apply backpressure.
Time (in seconds) after which the engine process will forcibly exit after receiving SIGTERM. Must be greater than or equal to both worker_shutdown_duration and guard_shutdown_duration. Defaults to 35 minutes, allowing the Depot stop wait and teardown reserve.
Time (in seconds) to allow for guard to wait for pending requests after receiving SIGTERM. Defaults to 10 minutes.
Adjusts worker curve around this value (in millecores, i.e. 1000 = 1 core). Is not a hard limit. When unset, uses /sys/fs/cgroup/cpu.max, and if that is unset uses total host cpu.
Maximum concurrently running workflows of a given workflow name for the **entire cluster**.
Maximum deduplicated workflows considered in a single pull. Defaults to 10000.
Maximum wake condition keys read per workflow name in a single pull. Defaults to 20000, or 5000 for the depot compaction workflows. Set the "default" key to apply to all workflow names.
Maximum wake condition keys a worker clears when leasing workflows in a single pull. Defaults to 40000. Maximum workflows a worker attempts to lease in a single pull. Defaults to 1000.
Poll interval for pulling workflows and deciding whether a short sleep stays in memory. Unit is in milliseconds. Defaults to 16000.
Time (in seconds) to allow for the gasoline worker engine to stop gracefully after receiving SIGTERM. Defaults to 30 seconds.
Must be included in `datacenters`