1# BMCWEB_KVM 2option( 3 'kvm', 4 type: 'feature', 5 value: 'enabled', 6 description: '''Enable the KVM host video WebSocket. Path is /kvm/0. 7 Video is from the BMCs /dev/videodevice.''', 8) 9 10# BMCWEB_TESTS 11option( 12 'tests', 13 type: 'feature', 14 value: 'enabled', 15 description: 'Enable Unit tests for bmcweb', 16) 17 18# BMCWEB_VM_WEBSOCKET 19option( 20 'vm-websocket', 21 type: 'feature', 22 value: 'enabled', 23 description: '''Enable the Virtual Media WebSocket. Path is /vm/0/0 and /nbd/<id> to 24 open the websocket. See 25 https://github.com/openbmc/jsnbd/blob/master/README.''', 26) 27 28# BMCWEB_NBDPROXY 29# if you use this option and are seeing this comment, please comment here: 30# https://github.com/openbmc/bmcweb/issues/188 and put forward your intentions 31# for this code. At this point, no daemon has been upstreamed that implements 32# this interface, so for the moment this appears to be dead code; In leiu of 33# removing it, it has been disabled to try to give those that use it the 34# opportunity to upstream their backend implementation 35#option( 36# 'vm-nbdproxy', 37# type: 'feature', 38# value: 'disabled', 39# description: 'Enable the Virtual Media WebSocket.' 40#) 41 42# BMCWEB_REST 43option( 44 'rest', 45 type: 'feature', 46 value: 'disabled', 47 description: '''Enable Phosphor REST (D-Bus) APIs. Paths directly map 48 Phosphor D-Bus object paths, for example, 49 /xyz/openbmc_project/logging/entry/enumerate. See 50 https://github.com/openbmc/docs/blob/master/rest-api.md.''', 51) 52 53# BMCWEB_REDFISH 54option( 55 'redfish', 56 type: 'feature', 57 value: 'enabled', 58 description: '''Enable Redfish APIs. Paths are under /redfish/v1/. See 59 https://github.com/openbmc/bmcweb/blob/master/DEVELOPING.md#redfish.''', 60) 61 62# BMCWEB_HOST_SERIAL_SOCKET 63option( 64 'host-serial-socket', 65 type: 'feature', 66 value: 'enabled', 67 description: '''Enable host serial console WebSocket. Path is /console0. 68 See https://github.com/openbmc/docs/blob/master/console.md.''', 69) 70 71# BMCWEB_STATIC_HOSTING 72option( 73 'static-hosting', 74 type: 'feature', 75 value: 'enabled', 76 description: '''Enable serving files from the /usr/share/www directory 77 as paths under /.''', 78) 79 80# BMCWEB_REDFISH_BMC_JOURNAL 81option( 82 'redfish-bmc-journal', 83 type: 'feature', 84 value: 'enabled', 85 description: '''Enable BMC journal access through Redfish. Paths are under 86 /redfish/v1/Managers/bmc/LogServices/Journal.''', 87) 88 89# BMCWEB_REDFISH_CPU_LOG 90option( 91 'redfish-cpu-log', 92 type: 'feature', 93 value: 'disabled', 94 description: '''Enable CPU log service transactions through Redfish. Paths 95 are under /redfish/v1/Systems/system/LogServices/Crashdump'.''', 96) 97 98# BMCWEB_REDFISH_DUMP_LOG 99option( 100 'redfish-dump-log', 101 type: 'feature', 102 value: 'enabled', 103 description: '''Enable Dump log service transactions through Redfish. Paths 104 are under /redfish/v1/Systems/system/LogServices/Dump 105 and /redfish/v1/Managers/bmc/LogServices/Dump''', 106) 107 108# BMCWEB_REDFISH_DBUS_LOG 109option( 110 'redfish-dbus-log', 111 type: 'feature', 112 value: 'disabled', 113 description: '''Enable DBUS log service transactions through Redfish. Paths 114 are under 115 /redfish/v1/Systems/system/LogServices/EventLog/Entries''', 116) 117 118# BMCWEB_EXPERIMENTAL_REDFISH_DBUS_LOG_SUBSCRIPTION 119option( 120 'experimental-redfish-dbus-log-subscription', 121 type: 'feature', 122 value: 'disabled', 123 description: ''' 124 Allows EventService subscriptions when the redfish-dbus-log option is 125 enabled. 126 This option is currently non-functional, given Redfish requirements for 127 MessageId support in Events. 128 Option will be removed begining of Q2-2026. 129 Should not be enabled on any production systems. 130 ''', 131) 132 133# BMCWEB_REDFISH_HOST_LOGGER 134option( 135 'redfish-host-logger', 136 type: 'feature', 137 value: 'enabled', 138 description: '''Enable host log service transactions based on 139 phosphor-hostlogger through Redfish. Paths are under 140 /redfish/v1/Systems/system/LogServices/HostLogger''', 141) 142 143# BMCWEB_REDFISH_EVENTLOG_LOCATION 144option( 145 'redfish-eventlog-location', 146 type: 'combo', 147 choices: ['systems', 'managers'], 148 value: 'systems', 149 description: '''Set which Redfish resource enables event log service 150 transactions through Redfish. By default, this option 151 is set to systems. In that case paths are under 152 /redfish/v1/Systems/<redfish-system-uri-name>/LogServices/EventLog 153 Change to managers, for paths to be under 154 /redfish/v1/Managers/<redfish-manager-uri-name>/LogServices/EventLog''', 155) 156 157# BMCWEB_REDFISH_PROVISIONING_FEATURE 158option( 159 'redfish-provisioning-feature', 160 type: 'feature', 161 value: 'disabled', 162 description: '''Enable provisioning feature support in redfish. Paths are 163 under /redfish/v1/Systems/system/''', 164) 165 166# BMCWEB_REDFISH_MANAGER_URI_NAME 167option( 168 'redfish-manager-uri-name', 169 type: 'string', 170 value: 'bmc', 171 description: '''The static Redfish Manager ID representing the BMC 172 instance. This option will appear in the Redfish tree at 173 /redfish/v1/Managers/<redfish-manager-uri-name>. 174 Defaults to \'bmc\' which resolves to 175 /redfish/v1/Managers/bmc''', 176) 177 178# BMCWEB_REDFISH_SYSTEM_URI_NAME 179option( 180 'redfish-system-uri-name', 181 type: 'string', 182 value: 'system', 183 description: '''The static Redfish System ID representing the host 184 instance. This option will appear in the Redfish tree at 185 /redfish/v1/Systems/<redfish-system-uri-name>. 186 Defaults to \'system\' which resolves to 187 /redfish/v1/Systems/system''', 188) 189 190# BMCWEB_LOGGING_LEVEL 191option( 192 'bmcweb-logging', 193 type: 'combo', 194 choices: [ 195 'disabled', 196 'enabled', 197 'debug', 198 'info', 199 'warning', 200 'error', 201 'critical', 202 ], 203 value: 'error', 204 description: '''Enable output the extended logging level. 205 - disabled: disable bmcweb log traces. 206 - enabled: treated as 'debug' 207 - For the other logging level option, see DEVELOPING.md.''', 208) 209 210# BMCWEB_BASIC_AUTH 211option( 212 'basic-auth', 213 type: 'feature', 214 value: 'enabled', 215 description: 'Enable basic authentication', 216) 217 218# BMCWEB_SESSION_AUTH 219option( 220 'session-auth', 221 type: 'feature', 222 value: 'enabled', 223 description: 'Enable session authentication', 224) 225 226# BMCWEB_XTOKEN_AUTH 227option( 228 'xtoken-auth', 229 type: 'feature', 230 value: 'enabled', 231 description: 'Enable xtoken authentication', 232) 233 234# BMCWEB_COOKIE_AUTH 235option( 236 'cookie-auth', 237 type: 'feature', 238 value: 'enabled', 239 description: 'Enable cookie authentication', 240) 241 242# BMCWEB_MUTUAL_TLS_AUTH 243option( 244 'mutual-tls-auth', 245 type: 'feature', 246 value: 'enabled', 247 description: '''Enables authenticating users through TLS client 248 certificates. The insecure-disable-ssl must be disabled for 249 this option to take effect.''', 250) 251 252# BMCWEB_MUTUAL_TLS_COMMON_NAME_PARSING_DEFAULT 253option( 254 'mutual-tls-common-name-parsing-default', 255 type: 'combo', 256 choices: ['CommonName', 'Whole', 'UserPrincipalName'], 257 description: '''Default MTLS parse mode to get username from the 258 client's x509 certificate''', 259) 260 261# BMCWEB_IBM_MANAGEMENT_CONSOLE 262option( 263 'ibm-management-console', 264 type: 'feature', 265 value: 'disabled', 266 description: '''Enable the IBM management console specific functionality. 267 Paths are under /ibm/v1/''', 268) 269 270# BMCWEB_GOOGLE_API 271option( 272 'google-api', 273 type: 'feature', 274 value: 'disabled', 275 description: '''Enable the Google specific functionality. Paths are under 276 /google/v1/''', 277) 278 279# BMCWEB_HTTP_BODY_LIMIT 280option( 281 'http-body-limit', 282 type: 'integer', 283 min: 0, 284 max: 512, 285 value: 30, 286 description: 'Specifies the http request body length limit', 287) 288 289# BMCWEB_HTTP_ZSTD 290option( 291 'http-zstd', 292 type: 'feature', 293 value: 'enabled', 294 description: 'Allows compression/decompression using zstd', 295) 296 297# BMCWEB_REDFISH_NEW_POWERSUBSYSTEM_THERMALSUBSYSTEM 298option( 299 'redfish-new-powersubsystem-thermalsubsystem', 300 type: 'feature', 301 value: 'enabled', 302 description: '''Enable/disable the new PowerSubsystem, ThermalSubsystem, 303 and all children schemas. This includes displaying all 304 sensors in the SensorCollection.''', 305) 306 307# BMCWEB_REDFISH_ALLOW_DEPRECATED_INDICATORLED 308option( 309 'redfish-allow-deprecated-indicatorled', 310 type: 'feature', 311 value: 'disabled', 312 description: '''Enable/disable the deprecated IndicatorLED property. The 313 default condition is disabled. The code to enable this 314 option will be removed by March 2026.''', 315) 316 317# BMCWEB_REDFISH_USE_HARDCODED_SYSTEM_LOCATION_INDICATOR 318option( 319 'redfish-use-hardcoded-system-location-indicator', 320 type: 'feature', 321 value: 'enabled', 322 description: '''Enable/disable the use of hard-coded LED group 323 enclosure_identify_blink and enclosure_identify for getting 324 and setting the LocationIndicatorActive for the Systems 325 response. It, as well as the code still beneath it will 326 be removed on June 2026.''', 327) 328 329# BMCWEB_REDFISH_ALLOW_DEPRECATED_POWER_THERMAL 330option( 331 'redfish-allow-deprecated-power-thermal', 332 type: 'feature', 333 value: 'disabled', 334 description: '''Enable/disable the old Power / Thermal. This has been 335 replaced by the new PowerSubsystem, ThermalSubsystem, and 336 the redfish-new-powersubsystem-thermalsubsystem option. 337 This option will be removed June 2026.''', 338) 339 340# BMCWEB_REDFISH_OEM_MANAGER_FAN_DATA 341option( 342 'redfish-oem-manager-fan-data', 343 type: 'feature', 344 value: 'enabled', 345 description: '''Enables Redfish OEM fan data on the manager resource. 346 This includes PID and Stepwise controller data. See 347 OpenBMCManager schema for more detail.''', 348) 349 350# BMCWEB_REDFISH_UPDATESERVICE_USE_DBUS 351option( 352 'redfish-updateservice-use-dbus', 353 type: 'feature', 354 value: 'enabled', 355 description: '''Enables xyz.openbmc_project.Software.Update D-Bus interface 356 to propagate UpdateService requests to the corresponding 357 updater daemons instead of moving files to /tmp/images dir. 358 ''', 359) 360 361# BMCWEB_REDFISH_ALLOW_SIMPLE_UPDATE 362option( 363 'redfish-allow-simple-update', 364 type: 'feature', 365 value: 'disabled', 366 description: '''Enables Redfish UpdateService SimpleUpdate Action. Note 367 that at this time this option is non-functional. Redfish 368 recommends using MultiPartUpdate.''', 369) 370 371 372option( 373 'https_port', 374 type: 'integer', 375 min: -1, 376 max: 65535, 377 value: 443, 378 description: '''HTTPS default port number. Set to -1 to disable and rely 379 only on additional_ports''', 380) 381 382 383# Additional ports 384# This series of options below allows setting up non-trivial deployments of 385# bmcweb, binding specific ports, authentication profiles, and device binds to 386# multiple ports. 387# Setting these options incorrectly can have severe security consequences and 388# should be reserved for platform experts familiar with their particular 389# platforms security requirements. 390 391option( 392 'additional-ports', 393 type: 'array', 394 value: [], 395 description: '''Additional ports to listen to. Allows bmcweb to listen to 396 multiple ports at a given protocol''', 397) 398 399option( 400 'additional-protocol', 401 type: 'array', 402 value: [], 403 description: '''Allows specifying a specific protocol type for a given 404 additional-ports index. Allows setting http, https, or both 405 to each socket index. If not provided for a given 406 additional-ports index, assumes https.''', 407) 408 409option( 410 'additional-bind-to-device', 411 type: 'array', 412 value: [], 413 description: '''Allows specifying an SO_BINDTODEVICE or BindToDevice systemd 414 directive for each additional socket file. If not provided 415 for a given additional-ports index, assumes bind to all 416 devices''', 417) 418 419option( 420 'additional-auth', 421 type: 'array', 422 value: [], 423 description: '''Allows specifying an authentication profile for each socket 424 created with additional-ports. Allows auth or noauth, and 425 defaults to auth if not provided. If noauth is provided, 426 authentication will not be performed for a given socket/port 427 index.''', 428) 429# end additional ports 430 431# BMCWEB_DNS_RESOLVER 432option( 433 'dns-resolver', 434 type: 'combo', 435 choices: ['systemd-dbus', 'asio'], 436 value: 'systemd-dbus', 437 description: '''Sets which DNS resolver backend should be used. 438 systemd-dbus uses the Systemd ResolveHostname on dbus, but requires dbus 439 support. asio relies on boost::asio::tcp::resolver, but cannot resolve 440 names when boost threading is disabled.''', 441) 442 443# BMCWEB_REDFISH_AGGREGATION 444option( 445 'redfish-aggregation', 446 type: 'feature', 447 value: 'disabled', 448 description: 'Allows this BMC to aggregate resources from satellite BMCs', 449) 450 451# BMCWEB_HYPERVISOR_COMPUTER_SYSTEM 452option( 453 'hypervisor-computer-system', 454 type: 'feature', 455 value: 'disabled', 456 description: '''This puts a hypervisor computer system resource at 457 /redfish/v1/Systems/hypervisor. This system resource has children 458 resources such as EthernetInterfaces and ComputerSystem.Reset.''', 459) 460 461# BMCWEB_EXPERIMENTAL_REDFISH_MULTI_COMPUTER_SYSTEM 462option( 463 'experimental-redfish-multi-computer-system', 464 type: 'feature', 465 value: 'disabled', 466 description: '''This is a temporary option flag for staging the 467 ComputerSystemCollection transition to multi-host. It, as well as the code 468 still beneath it will be removed on 1/1/2026. Do not enable in a 469 production environment, or where API stability is required.''', 470) 471 472# BMCWEB_EXPERIMENTAL_BMCWEB_USER 473option( 474 'experimental-bmcweb-user', 475 type: 'feature', 476 value: 'disabled', 477 description: '''Enable to run bmcweb as the bmcweb user. This is 478 experimental. Expect many things to be broken if you enable this 479 option, and this should not be used for production usage. This 480 option will be removed Q1 2026.''', 481) 482 483# BMCWEB_HTTP2 484option( 485 'http2', 486 type: 'feature', 487 value: 'enabled', 488 description: 'Enable HTTP/2 protocol support using nghttp2.', 489) 490 491# BMCWEB_WATCHDOG_TIMEOUT 492option( 493 'watchdog-timeout-seconds', 494 type: 'integer', 495 min: 0, 496 max: 600, 497 value: 120, 498 description: '''Specifies the systemd watchdog timeout interval in seconds. 499 Set to 0 to disable the watchdog.''', 500) 501 502# Insecure options. Every option that starts with a `insecure` flag should 503# not be enabled by default for any platform, unless the author fully comprehends 504# the implications of doing so.In general, enabling these options will cause security 505# problems of varying degrees 506 507# BMCWEB_INSECURE_DISABLE_CSRF 508option( 509 'insecure-disable-csrf', 510 type: 'feature', 511 value: 'disabled', 512 description: '''Disable CSRF prevention checks.Should be set to false for 513 production systems.''', 514) 515 516# BMCWEB_INSECURE_DISABLE_SSL 517option( 518 'insecure-disable-ssl', 519 type: 'feature', 520 value: 'disabled', 521 description: '''Disable SSL ports. Should be set to false for production 522 systems.''', 523) 524 525# BMCWEB_INSECURE_DISABLE_AUTH 526option( 527 'insecure-disable-auth', 528 type: 'feature', 529 value: 'disabled', 530 description: '''Disable authentication and authoriztion on all ports. 531 Should be set to false for production systems.''', 532) 533 534# BMCWEB_INSECURE_IGNORE_CONTENT_TYPE 535option( 536 'insecure-ignore-content-type', 537 type: 'feature', 538 value: 'disabled', 539 description: '''Allows parsing PUT/POST/PATCH content as JSON regardless 540 of the presence of the content-type header. Enabling this 541 conflicts with the input parsing guidelines, but may be 542 required to support old clients that may not set the 543 Content-Type header on payloads.''', 544) 545 546# BMCWEB_INSECURE_PUSH_STYLE_NOTIFICATION 547option( 548 'insecure-push-style-notification', 549 type: 'feature', 550 value: 'disabled', 551 description: 'Enable HTTP push style eventing feature', 552) 553 554# BMCWEB_INSECURE_ENABLE_REDFISH_QUERY 555option( 556 'insecure-enable-redfish-query', 557 type: 'feature', 558 value: 'disabled', 559 description: '''Enables Redfish expand query parameter. This feature is 560 experimental, and has not been tested against the full 561 limits of user-facing behavior. It is not recommended to 562 enable on production systems at this time. Other query 563 parameters such as only are not controlled by this option.''', 564) 565 566