1# BMCWEB_KVM 2option( 3 'kvm', 4 type: 'feature', 5 value: 'enabled', 6 description: '''Enable the KVM host video WebSocket. Path is /kvm/0. 7 Video is from the BMCs /dev/videodevice.''', 8) 9 10# BMCWEB_TESTS 11option( 12 'tests', 13 type: 'feature', 14 value: 'enabled', 15 description: 'Enable Unit tests for bmcweb', 16) 17 18# BMCWEB_VM_WEBSOCKET 19option( 20 'vm-websocket', 21 type: 'feature', 22 value: 'enabled', 23 description: '''Enable the Virtual Media WebSocket. Path is /vm/0/0 and /nbd/<id> to 24 open the websocket. See 25 https://github.com/openbmc/jsnbd/blob/master/README.''', 26) 27 28option( 29 'redfish-use-3-digit-messageid', 30 type: 'feature', 31 value: 'disabled', 32 description: '''Prior to a bug fix, bmcweb exposed error messages with a 33 MessageId of Base.x.y.z.Message which was incorrect. 34 Enabling this option causes return codes to return the old 35 incorrect version for backward compatibility. Will be 36 removed Q2-2025''', 37) 38 39# BMCWEB_NBDPROXY 40# if you use this option and are seeing this comment, please comment here: 41# https://github.com/openbmc/bmcweb/issues/188 and put forward your intentions 42# for this code. At this point, no daemon has been upstreamed that implements 43# this interface, so for the moment this appears to be dead code; In leiu of 44# removing it, it has been disabled to try to give those that use it the 45# opportunity to upstream their backend implementation 46#option( 47# 'vm-nbdproxy', 48# type: 'feature', 49# value: 'disabled', 50# description: 'Enable the Virtual Media WebSocket.' 51#) 52 53# BMCWEB_REST 54option( 55 'rest', 56 type: 'feature', 57 value: 'disabled', 58 description: '''Enable Phosphor REST (D-Bus) APIs. Paths directly map 59 Phosphor D-Bus object paths, for example, 60 /xyz/openbmc_project/logging/entry/enumerate. See 61 https://github.com/openbmc/docs/blob/master/rest-api.md.''', 62) 63 64# BMCWEB_REDFISH 65option( 66 'redfish', 67 type: 'feature', 68 value: 'enabled', 69 description: '''Enable Redfish APIs. Paths are under /redfish/v1/. See 70 https://github.com/openbmc/bmcweb/blob/master/DEVELOPING.md#redfish.''', 71) 72 73# BMCWEB_HOST_SERIAL_SOCKET 74option( 75 'host-serial-socket', 76 type: 'feature', 77 value: 'enabled', 78 description: '''Enable host serial console WebSocket. Path is /console0. 79 See https://github.com/openbmc/docs/blob/master/console.md.''', 80) 81 82# BMCWEB_STATIC_HOSTING 83option( 84 'static-hosting', 85 type: 'feature', 86 value: 'enabled', 87 description: '''Enable serving files from the /usr/share/www directory 88 as paths under /.''', 89) 90 91# BMCWEB_REDFISH_BMC_JOURNAL 92option( 93 'redfish-bmc-journal', 94 type: 'feature', 95 value: 'enabled', 96 description: '''Enable BMC journal access through Redfish. Paths are under 97 /redfish/v1/Managers/bmc/LogServices/Journal.''', 98) 99 100# BMCWEB_REDFISH_CPU_LOG 101option( 102 'redfish-cpu-log', 103 type: 'feature', 104 value: 'disabled', 105 description: '''Enable CPU log service transactions through Redfish. Paths 106 are under /redfish/v1/Systems/system/LogServices/Crashdump'.''', 107) 108 109# BMCWEB_REDFISH_DUMP_LOG 110option( 111 'redfish-dump-log', 112 type: 'feature', 113 value: 'disabled', 114 description: '''Enable Dump log service transactions through Redfish. Paths 115 are under /redfish/v1/Systems/system/LogServices/Dump 116 and /redfish/v1/Managers/bmc/LogServices/Dump''', 117) 118 119# BMCWEB_REDFISH_DBUS_LOG 120option( 121 'redfish-dbus-log', 122 type: 'feature', 123 value: 'disabled', 124 description: '''Enable DBUS log service transactions through Redfish. Paths 125 are under 126 /redfish/v1/Systems/system/LogServices/EventLog/Entries''', 127) 128 129# BMCWEB_EXPERIMENTAL_REDFISH_DBUS_LOG_SUBSCRIPTION 130option( 131 'experimental-redfish-dbus-log-subscription', 132 type: 'feature', 133 value: 'disabled', 134 description: ''' 135 Allows EventService subscriptions when the redfish-dbus-log option is 136 enabled. 137 This option is currently non-functional, given Redfish requirements for 138 MessageId support in Events. 139 Option will be removed begining of Q2-2025. 140 Should not be enabled on any production systems. 141 ''', 142) 143 144# BMCWEB_REDFISH_HOST_LOGGER 145option( 146 'redfish-host-logger', 147 type: 'feature', 148 value: 'enabled', 149 description: '''Enable host log service transactions based on 150 phosphor-hostlogger through Redfish. Paths are under 151 /redfish/v1/Systems/system/LogServices/HostLogger''', 152) 153 154# BMCWEB_REDFISH_PROVISIONING_FEATURE 155option( 156 'redfish-provisioning-feature', 157 type: 'feature', 158 value: 'disabled', 159 description: '''Enable provisioning feature support in redfish. Paths are 160 under /redfish/v1/Systems/system/''', 161) 162 163# BMCWEB_REDFISH_MANAGER_URI_NAME 164option( 165 'redfish-manager-uri-name', 166 type: 'string', 167 value: 'bmc', 168 description: '''The static Redfish Manager ID representing the BMC 169 instance. This option will appear in the Redfish tree at 170 /redfish/v1/Managers/<redfish-manager-uri-name>. 171 Defaults to \'bmc\' which resolves to 172 /redfish/v1/Managers/bmc''', 173) 174 175# BMCWEB_REDFISH_SYSTEM_URI_NAME 176option( 177 'redfish-system-uri-name', 178 type: 'string', 179 value: 'system', 180 description: '''The static Redfish System ID representing the host 181 instance. This option will appear in the Redfish tree at 182 /redfish/v1/Systems/<redfish-system-uri-name>. 183 Defaults to \'system\' which resolves to 184 /redfish/v1/Systems/system''', 185) 186 187# BMCWEB_LOGGING_LEVEL 188option( 189 'bmcweb-logging', 190 type: 'combo', 191 choices: [ 192 'disabled', 193 'enabled', 194 'debug', 195 'info', 196 'warning', 197 'error', 198 'critical', 199 ], 200 value: 'error', 201 description: '''Enable output the extended logging level. 202 - disabled: disable bmcweb log traces. 203 - enabled: treated as 'debug' 204 - For the other logging level option, see DEVELOPING.md.''', 205) 206 207# BMCWEB_BASIC_AUTH 208option( 209 'basic-auth', 210 type: 'feature', 211 value: 'enabled', 212 description: 'Enable basic authentication', 213) 214 215# BMCWEB_SESSION_AUTH 216option( 217 'session-auth', 218 type: 'feature', 219 value: 'enabled', 220 description: 'Enable session authentication', 221) 222 223# BMCWEB_XTOKEN_AUTH 224option( 225 'xtoken-auth', 226 type: 'feature', 227 value: 'enabled', 228 description: 'Enable xtoken authentication', 229) 230 231# BMCWEB_COOKIE_AUTH 232option( 233 'cookie-auth', 234 type: 'feature', 235 value: 'enabled', 236 description: 'Enable cookie authentication', 237) 238 239# BMCWEB_MUTUAL_TLS_AUTH 240option( 241 'mutual-tls-auth', 242 type: 'feature', 243 value: 'enabled', 244 description: '''Enables authenticating users through TLS client 245 certificates. The insecure-disable-ssl must be disabled for 246 this option to take effect.''', 247) 248 249# BMCWEB_MUTUAL_TLS_COMMON_NAME_PARSING_DEFAULT 250option( 251 'mutual-tls-common-name-parsing-default', 252 type: 'combo', 253 choices: ['CommonName', 'Whole', 'UserPrincipalName'], 254 description: '''Default MTLS parse mode to get username from the 255 client's x509 certificate''', 256) 257 258# BMCWEB_IBM_MANAGEMENT_CONSOLE 259option( 260 'ibm-management-console', 261 type: 'feature', 262 value: 'disabled', 263 description: '''Enable the IBM management console specific functionality. 264 Paths are under /ibm/v1/''', 265) 266 267# BMCWEB_GOOGLE_API 268option( 269 'google-api', 270 type: 'feature', 271 value: 'disabled', 272 description: '''Enable the Google specific functionality. Paths are under 273 /google/v1/''', 274) 275 276# BMCWEB_HTTP_BODY_LIMIT 277option( 278 'http-body-limit', 279 type: 'integer', 280 min: 0, 281 max: 512, 282 value: 30, 283 description: 'Specifies the http request body length limit', 284) 285 286# BMCWEB_REDFISH_NEW_POWERSUBSYSTEM_THERMALSUBSYSTEM 287option( 288 'redfish-new-powersubsystem-thermalsubsystem', 289 type: 'feature', 290 value: 'enabled', 291 description: '''Enable/disable the new PowerSubsystem, ThermalSubsystem, 292 and all children schemas. This includes displaying all 293 sensors in the SensorCollection.''', 294) 295 296# BMCWEB_REDFISH_ALLOW_DEPRECATED_POWER_THERMAL 297option( 298 'redfish-allow-deprecated-power-thermal', 299 type: 'feature', 300 value: 'enabled', 301 description: '''Enable/disable the old Power / Thermal. The default 302 condition is allowing the old Power / Thermal. This 303 will be disabled by default June 2024. ''', 304) 305 306# BMCWEB_REDFISH_OEM_MANAGER_FAN_DATA 307option( 308 'redfish-oem-manager-fan-data', 309 type: 'feature', 310 value: 'enabled', 311 description: '''Enables Redfish OEM fan data on the manager resource. 312 This includes PID and Stepwise controller data. See 313 OpenBMCManager schema for more detail.''', 314) 315 316# BMCWEB_REDFISH_UPDATESERVICE_USE_DBUS 317option( 318 'redfish-updateservice-use-dbus', 319 type: 'feature', 320 value: 'enabled', 321 description: '''Enables xyz.openbmc_project.Software.Update D-Bus interface 322 to propagate UpdateService requests to the corresponding 323 updater daemons instead of moving files to /tmp/images dir. 324 This option is temporary, should not be enabled on any 325 production systems. The code will be moved to the normal 326 code update flow and the option will be removed at the end 327 of Q3 2024. 328 ''', 329) 330 331# BMCWEB_REDFISH_ALLOW_SIMPLE_UPDATE 332option( 333 'redfish-allow-simple-update', 334 type: 'feature', 335 value: 'disabled', 336 description: '''Enables Redfish UpdateService SimpleUpdate Action. Note 337 that at this time this option is non-functional. Redfish 338 recommends using MultiPartUpdate.''', 339) 340 341 342option( 343 'https_port', 344 type: 'integer', 345 min: -1, 346 max: 65535, 347 value: 443, 348 description: '''HTTPS default port number. Set to -1 to disable and rely 349 only on additional_ports''', 350) 351 352 353# Additional ports 354# This series of options below allows setting up non-trivial deployments of 355# bmcweb, binding specific ports, authentication profiles, and device binds to 356# multiple ports. 357# Setting these options incorrectly can have severe security consequences and 358# should be reserved for platform experts familiar with their particular 359# platforms security requirements. 360 361option( 362 'additional-ports', 363 type: 'array', 364 value: [], 365 description: '''Additional ports to listen to. Allows bmcweb to listen to 366 multiple ports at a given protocol''', 367) 368 369option( 370 'additional-protocol', 371 type: 'array', 372 value: [], 373 description: '''Allows specifying a specific protocol type for a given 374 additional-ports index. Allows setting http, https, or both 375 to each socket index. If not provided for a given 376 additional-ports index, assumes https.''', 377) 378 379option( 380 'additional-bind-to-device', 381 type: 'array', 382 value: [], 383 description: '''Allows specifying an SO_BINDTODEVICE or BindToDevice systemd 384 directive for each additional socket file. If not provided 385 for a given additional-ports index, assumes bind to all 386 devices''', 387) 388 389option( 390 'additional-auth', 391 type: 'array', 392 value: [], 393 description: '''Allows specifying an authentication profile for each socket 394 created with additional-ports. Allows auth or noauth, and 395 defaults to auth if not provided. If noauth is provided, 396 authentication will not be performed for a given socket/port 397 index.''', 398) 399# end additional ports 400 401# BMCWEB_DNS_RESOLVER 402option( 403 'dns-resolver', 404 type: 'combo', 405 choices: ['systemd-dbus', 'asio'], 406 value: 'systemd-dbus', 407 description: '''Sets which DNS resolver backend should be used. 408 systemd-dbus uses the Systemd ResolveHostname on dbus, but requires dbus 409 support. asio relies on boost::asio::tcp::resolver, but cannot resolve 410 names when boost threading is disabled.''', 411) 412 413# BMCWEB_REDFISH_AGGREGATION 414option( 415 'redfish-aggregation', 416 type: 'feature', 417 value: 'disabled', 418 description: 'Allows this BMC to aggregate resources from satellite BMCs', 419) 420 421# BMCWEB_HYPERVISOR_COMPUTER_SYSTEM 422option( 423 'hypervisor-computer-system', 424 type: 'feature', 425 value: 'disabled', 426 description: '''This puts a hypervisor computer system resource at 427 /redfish/v1/Systems/hypervisor. This system resource has children 428 resources such as EthernetInterfaces and ComputerSystem.Reset.''', 429) 430 431# BMCWEB_EXPERIMENTAL_REDFISH_MULTI_COMPUTER_SYSTEM 432option( 433 'experimental-redfish-multi-computer-system', 434 type: 'feature', 435 value: 'disabled', 436 description: '''This is a temporary option flag for staging the 437 ComputerSystemCollection transition to multi-host. It, as well as the code 438 still beneath it will be removed on 6/1/2025. Do not enable in a 439 production environment, or where API stability is required.''', 440) 441 442# BMCWEB_EXPERIMENTAL_HTTP2 443option( 444 'experimental-http2', 445 type: 'feature', 446 value: 'disabled', 447 description: '''Enable HTTP/2 protocol support using nghttp2. Do not rely 448 on this option for any production systems. It may have 449 behavior changes or be removed at any time.''', 450) 451 452# BMCWEB_WATCHDOG_TIMEOUT 453option( 454 'watchdog-timeout-seconds', 455 type: 'integer', 456 min: 0, 457 max: 600, 458 value: 120, 459 description: '''Specifies the systemd watchdog timeout interval in seconds. 460 Set to 0 to disable the watchdog.''', 461) 462 463# Insecure options. Every option that starts with a `insecure` flag should 464# not be enabled by default for any platform, unless the author fully comprehends 465# the implications of doing so.In general, enabling these options will cause security 466# problems of varying degrees 467 468# BMCWEB_INSECURE_DISABLE_CSRF 469option( 470 'insecure-disable-csrf', 471 type: 'feature', 472 value: 'disabled', 473 description: '''Disable CSRF prevention checks.Should be set to false for 474 production systems.''', 475) 476 477# BMCWEB_INSECURE_DISABLE_SSL 478option( 479 'insecure-disable-ssl', 480 type: 'feature', 481 value: 'disabled', 482 description: '''Disable SSL ports. Should be set to false for production 483 systems.''', 484) 485 486# BMCWEB_INSECURE_DISABLE_AUTH 487option( 488 'insecure-disable-auth', 489 type: 'feature', 490 value: 'disabled', 491 description: '''Disable authentication and authoriztion on all ports. 492 Should be set to false for production systems.''', 493) 494 495# BMCWEB_INSECURE_IGNORE_CONTENT_TYPE 496option( 497 'insecure-ignore-content-type', 498 type: 'feature', 499 value: 'disabled', 500 description: '''Allows parsing PUT/POST/PATCH content as JSON regardless 501 of the presence of the content-type header. Enabling this 502 conflicts with the input parsing guidelines, but may be 503 required to support old clients that may not set the 504 Content-Type header on payloads.''', 505) 506 507# BMCWEB_INSECURE_PUSH_STYLE_NOTIFICATION 508option( 509 'insecure-push-style-notification', 510 type: 'feature', 511 value: 'disabled', 512 description: 'Enable HTTP push style eventing feature', 513) 514 515# BMCWEB_INSECURE_ENABLE_REDFISH_QUERY 516option( 517 'insecure-enable-redfish-query', 518 type: 'feature', 519 value: 'disabled', 520 description: '''Enables Redfish expand query parameter. This feature is 521 experimental, and has not been tested against the full 522 limits of user-facing behavior. It is not recommended to 523 enable on production systems at this time. Other query 524 parameters such as only are not controlled by this option.''', 525) 526