{
  "$id": "https://hashicorp.com/schemas/consul-ecs",
  "$schema": "https://json-schema.org/draft-07/schema",
  "additionalProperties": false,
  "description": "These are the top-level fields for the Consul ECS configuration format.",
  "properties": {
    "bootstrapDir": {
      "description": "The directory at which to mount the shared volume where Consul dataplane configuration is written by `consul-ecs mesh-init`.",
      "minLength": 1,
      "type": "string"
    },
    "consulLogin": {
      "additionalProperties": false,
      "description": "Configuration for logging into the AWS IAM auth method.",
      "properties": {
        "datacenter": {
          "description": "Auth method datacenter to use for login to Consul.",
          "type": [
            "string",
            "null"
          ]
        },
        "enabled": {
          "description": "Enables logging into Consul's AWS IAM auth method to obtain an ACL token. The auth method must be configured on the Consul server and the ECS task role must be trusted by the auth method. After logging in, the token is written to the file `<bootstrapDir>/service-token`.",
          "type": [
            "boolean",
            "null"
          ]
        },
        "includeEntity": {
          "description": "Enables IAM role details to be available to the login decision, such as the IAM role path and role tags. Defaults to `true`. This should only be set if the Consul AWS IAM auth method is configured with `EnableIAMEntityDetails=true`.",
          "type": [
            "boolean",
            "null"
          ]
        },
        "meta": {
          "description": "Optional key-value pairs to be passed as metadata in the auth method login request. The keys `consul.hashicorp.com/task-id` and `consul.hashicorp.com/cluster` are always included as metadata.",
          "patternProperties": {
            ".*": {
              "type": "string"
            }
          },
          "type": [
            "object",
            "null"
          ]
        },
        "method": {
          "description": "The name of Consul auth method used in the login request. Defaults to `iam-ecs-service-token`.",
          "type": [
            "string",
            "null"
          ]
        },
        "region": {
          "description": "Optional region used for AWS API calls. This should match the region of the URL in the `stsEndpoint` field, if set. If not set, the region will be discovered from the task metadata.",
          "type": [
            "string",
            "null"
          ]
        },
        "serverIdHeaderValue": {
          "description": "Optional value to include in the `X-Consul-IAM-ServerID` header in the login request. This can be used to protect against certain types of replay attacks. This must match the `ServerIDHeaderValue` field of the AWS IAM auth method on the Consul servers.",
          "type": [
            "string",
            "null"
          ]
        },
        "stsEndpoint": {
          "description": "Optional URL used for signing `sts:GetCallerIdentity` requests. This can be used to send requests to a private endpoint or through a network proxy. By default, this is unset. This must match the `STSEndpoint` setting of the AWS IAM auth method on the Consul servers.",
          "type": [
            "string",
            "null"
          ]
        }
      },
      "type": [
        "object",
        "null"
      ]
    },
    "consulServers": {
      "additionalProperties": false,
      "description": "Configuration for the Consul servers.",
      "properties": {
        "defaults": {
          "description": "Default TLS settings for Consul's http and gRPC interfaces",
          "properties": {
            "caCertFile": {
              "description": "The CA certificate file for Consul's internal HTTP and gRPC interfaces.",
              "type": [
                "string",
                "null"
              ]
            },
            "tls": {
              "description": "Whether to enable tls for internal RPC and HTTP traffic to the consul servers. Defaults to true",
              "type": [
                "boolean",
                "null"
              ]
            },
            "tlsServerName": {
              "description": "The server name to use as the SNI host when connecting via TLS.",
              "type": [
                "string",
                "null"
              ]
            }
          },
          "type": [
            "object",
            "null"
          ]
        },
        "grpc": {
          "description": "gRPC specific settings. Overrides `consulServers.defaults` for gRPC.",
          "properties": {
            "caCertFile": {
              "description": "The Consul server CA cert file for internal gRPC communication. Overrides `consulServers.defaults.caCertFile`",
              "type": [
                "string",
                "null"
              ]
            },
            "port": {
              "description": "The Consul server gRPC port. Defaults to 8503",
              "type": [
                "integer",
                "null"
              ]
            },
            "tls": {
              "description": "Whether to enable tls for internal RPC traffic to the consul servers. Overrides `consulServers.defaults.tls`",
              "type": [
                "boolean",
                "null"
              ]
            },
            "tlsServerName": {
              "description": "The server name to use as the SNI host when connecting via TLS. Overrides `consulServers.defaults.tlsServerName`",
              "type": [
                "string",
                "null"
              ]
            }
          },
          "type": [
            "object",
            "null"
          ]
        },
        "hosts": {
          "description": "The Consul server hosts. This can be an IP or hostname, or an exec command, such as `exec=<cmd>`. The exec command should return a list of IP addresses.",
          "type": "string"
        },
        "http": {
          "description": "HTTP specific settings. Overrides `consulServers.defaults` for http.",
          "properties": {
            "caCertFile": {
              "description": "The CA certificate file for Consul's internal HTTP interfaces. Overrides `consulServers.defaults.caCertFile`",
              "type": [
                "string",
                "null"
              ]
            },
            "https": {
              "description": "Whether to use HTTPS connections to the `consulServers.hosts`. Defaults to true.",
              "type": [
                "boolean",
                "null"
              ]
            },
            "port": {
              "description": "The Consul server HTTP(S) port. Defaults to 8501",
              "type": [
                "integer",
                "null"
              ]
            },
            "tls": {
              "description": "Whether to enable tls for internal HTTP traffic to the consul servers. Overrides `consulServers.defaults.tls`",
              "type": [
                "boolean",
                "null"
              ]
            },
            "tlsServerName": {
              "description": "The server name to use as the SNI host when connecting via TLS. Overrides `consulServers.defaults.tlsServerName`",
              "type": [
                "string",
                "null"
              ]
            }
          },
          "type": [
            "object",
            "null"
          ]
        },
        "skipServerWatch": {
          "description": "If true, the dataplane skips watching upstream server changes. Useful when servers are behind a load balancer. Defaults to false",
          "type": [
            "boolean",
            "null"
          ]
        }
      },
      "required": [
        "hosts"
      ],
      "type": "object"
    },
    "controller": {
      "additionalProperties": false,
      "description": "Configuration for the `consul-ecs controller` command.",
      "properties": {
        "iamRolePath": {
          "description": "IAM roles at this path will be trusted by the Consul IAM auth method configured by the controller. Defaults to `/consul-ecs/`.",
          "type": [
            "string",
            "null"
          ]
        },
        "partition": {
          "description": "The Consul partition name that the controller will use. Defaults to the `default` partition [Consul Enterprise].",
          "type": [
            "string",
            "null"
          ]
        },
        "partitionsEnabled": {
          "description": "Enables support for Consul partitions and namespaces [Consul Enterprise].",
          "type": [
            "boolean",
            "null"
          ]
        }
      },
      "type": [
        "object",
        "null"
      ]
    },
    "gateway": {
      "additionalProperties": false,
      "description": "Configuration for the gateway proxy registration.",
      "properties": {
        "healthCheckPort": {
          "description": "The port where a health check endpoint is configured to indicate Envoy's readiness. Defaults to 22000."
        },
        "kind": {
          "description": "Specifies the type of gateway to register.",
          "enum": [
            "mesh-gateway",
            "terminating-gateway",
            "api-gateway"
          ],
          "type": "string"
        },
        "lanAddress": {
          "additionalProperties": false,
          "description": "LAN address and port for the gateway. If not specified, defaults to the task/node address.",
          "properties": {
            "address": {
              "type": [
                "string",
                "null"
              ]
            },
            "port": {
              "type": [
                "integer",
                "null"
              ]
            }
          },
          "type": [
            "object",
            "null"
          ]
        },
        "meta": {
          "description": "Key-value pairs of metadata to include for the gateway.",
          "patternProperties": {
            ".*": {
              "type": "string"
            }
          },
          "type": [
            "object",
            "null"
          ]
        },
        "name": {
          "description": "The name the gateway will be registered as in Consul. Defaults to the Task family name.",
          "pattern": "(^$)|(^[a-z0-9]([a-z0-9-_]*[a-z0-9])?$)",
          "type": [
            "string",
            "null"
          ]
        },
        "namespace": {
          "description": "Consul namespace in which the gateway will be registered [Consul Enterprise].",
          "type": [
            "string",
            "null"
          ]
        },
        "partition": {
          "description": "Consul admin partition in which the gateway will be registered [Consul Enterprise].",
          "type": [
            "string",
            "null"
          ]
        },
        "proxy": {
          "description": "Object that contains the proxy parameters.",
          "properties": {
            "config": {
              "type": [
                "object",
                "null"
              ]
            }
          },
          "type": [
            "object",
            "null"
          ]
        },
        "tags": {
          "description": "List of string values that can be used to add labels to the gateway.",
          "items": {
            "type": "string"
          },
          "type": [
            "array",
            "null"
          ],
          "uniqueItems": true
        },
        "wanAddress": {
          "additionalProperties": false,
          "description": "WAN address and port for the gateway. If not specified, defaults to the task/node address.",
          "properties": {
            "address": {
              "type": [
                "string",
                "null"
              ]
            },
            "port": {
              "type": [
                "integer",
                "null"
              ]
            }
          },
          "type": [
            "object",
            "null"
          ]
        }
      },
      "required": [
        "kind"
      ],
      "type": "object"
    },
    "healthSyncContainers": {
      "description": "The names of containers that will have health check status synced from ECS into Consul. Cannot be specified with `service.checks`.",
      "items": {
        "type": "string"
      },
      "type": [
        "array",
        "null"
      ],
      "uniqueItems": true
    },
    "logLevel": {
      "description": "Sets the log level for the `consul-ecs mesh-init` and `consul-ecs controller` commands. Defaults to `INFO`.",
      "enum": [
        "TRACE",
        "DEBUG",
        "INFO",
        "WARN",
        "ERROR",
        null
      ],
      "type": [
        "string",
        "null"
      ]
    },
    "proxy": {
      "description": "Configuration for the sidecar proxy registration with Consul.",
      "expose": {
        "description": "Specifies a configuration for exposing HTTP paths through the proxy.",
        "properties": {
          "checks": {
            "description": "If enabled, all HTTP and gRPC checks registered with the agent are exposed through Envoy.",
            "type": "boolean"
          },
          "paths": {
            "description": "A list of paths to expose through Envoy.",
            "items": {
              "properties": {
                "listenerPort": {
                  "description": "The port where the proxy will listen for connections.",
                  "type": "integer"
                },
                "localPathPort": {
                  "description": "The port where the local service is listening for connections to the path.",
                  "type": "integer"
                },
                "path": {
                  "description": "The HTTP path to expose. The path must be prefixed by a slash.",
                  "type": "string"
                },
                "protocol": {
                  "description": "Sets the protocol of the listener.",
                  "enum": [
                    "http",
                    "http2"
                  ]
                }
              },
              "type": "object"
            },
            "type": "array"
          }
        },
        "type": [
          "object",
          "null"
        ]
      },
      "properties": {
        "config": {
          "description": "Object value that specifies an opaque JSON configuration. The JSON is stored and returned along with the service instance when called from the API.",
          "type": [
            "object",
            "null"
          ]
        },
        "healthCheckPort": {
          "description": "The port where a health check endpoint is configured to indicate Envoy's readiness. Defaults to 22000."
        },
        "localServiceAddress": {
          "description": "The IP address or hostname that Envoy should use to connect to the local service. Defaults to localhost.",
          "type": [
            "string",
            "null"
          ]
        },
        "meshGateway": {
          "description": "Specifies the mesh gateway configuration for the proxy.",
          "properties": {
            "mode": {
              "description": "Specifies how upstreams with a remote destination datacenter are resolved.",
              "enum": [
                "none",
                "local",
                "remote"
              ],
              "type": "string"
            }
          },
          "required": [
            "mode"
          ],
          "type": [
            "object",
            "null"
          ]
        },
        "publicListenerPort": {
          "description": "The public listener port for Envoy used for service-to-service communication. Defaults to 20000.",
          "type": [
            "integer",
            "null"
          ]
        },
        "upstreams": {
          "description": "The list of the upstream services that the proxy should create listeners for.",
          "items": {
            "additionalProperties": false,
            "description": "The list of the upstream services that the proxy should create listeners for. Each `upstream` object may contain the following fields.",
            "properties": {
              "config": {
                "description": "Specifies opaque configuration options that will be provided to the proxy instance for the upstream.",
                "type": [
                  "object",
                  "null"
                ]
              },
              "datacenter": {
                "description": "Specifies the datacenter to issue the discovery query to.",
                "type": [
                  "string",
                  "null"
                ]
              },
              "destinationName": {
                "description": "Specifies the name of the upstream service or prepared query to route the service mesh to.",
                "type": "string"
              },
              "destinationNamespace": {
                "description": "Specifies the namespace containing the upstream service [Consul Enterprise].",
                "type": [
                  "string",
                  "null"
                ]
              },
              "destinationPartition": {
                "description": "Specifies the name of the admin partition containing the upstream service [Consul Enterprise].",
                "type": [
                  "string",
                  "null"
                ]
              },
              "destinationPeer": {
                "description": "Specifies the name of the peer cluster which contains the upstream service.",
                "type": [
                  "string",
                  "null"
                ]
              },
              "destinationType": {
                "description": "Specifies the type of discovery query the proxy should use for finding service mesh instances.",
                "enum": [
                  "service",
                  "prepared_query",
                  null
                ],
                "type": [
                  "string",
                  "null"
                ]
              },
              "localBindAddress": {
                "description": "Specifies the address to bind a local listener to.",
                "type": [
                  "string",
                  "null"
                ]
              },
              "localBindPort": {
                "description": "Specifies the port to bind a local listener to. The application will make outbound connections to the upstream from the local port.",
                "type": "integer"
              },
              "meshGateway": {
                "description": "Specifies the mesh gateway configuration for the proxy for this upstream.",
                "properties": {
                  "mode": {
                    "description": "Specifies how the upstream with a remote destination datacenter gets resolved.",
                    "enum": [
                      "none",
                      "local",
                      "remote"
                    ],
                    "type": "string"
                  }
                },
                "required": [
                  "mode"
                ],
                "type": [
                  "object",
                  "null"
                ]
              }
            },
            "required": [
              "destinationName",
              "localBindPort"
            ],
            "type": "object"
          },
          "type": [
            "array",
            "null"
          ]
        }
      },
      "type": [
        "object",
        "null"
      ]
    },
    "service": {
      "additionalProperties": false,
      "description": "Configuration for Consul service registration.",
      "properties": {
        "enableTagOverride": {
          "description": "Determines if the anti-entropy feature for the service is enabled",
          "type": [
            "boolean",
            "null"
          ]
        },
        "meta": {
          "description": "Key-value pairs of metadata to include for the Consul service.",
          "patternProperties": {
            ".*": {
              "type": "string"
            }
          },
          "type": [
            "object",
            "null"
          ]
        },
        "name": {
          "description": "The name the service will be registered as in Consul. Defaults to the Task family name if empty or null.",
          "pattern": "(^$)|(^[a-z0-9]([a-z0-9-_]*[a-z0-9])?$)",
          "type": [
            "string",
            "null"
          ]
        },
        "namespace": {
          "description": "The Consul namespace where the service will be registered [Consul Enterprise].",
          "type": [
            "string",
            "null"
          ]
        },
        "partition": {
          "description": "The Consul admin partition where the service will be registered [Consul Enterprise].",
          "type": [
            "string",
            "null"
          ]
        },
        "port": {
          "description": "Port the application listens on, if any.",
          "type": "integer"
        },
        "tags": {
          "description": "List of string values that can be used to add service-level labels.",
          "items": {
            "type": "string"
          },
          "type": [
            "array",
            "null"
          ],
          "uniqueItems": true
        },
        "weights": {
          "additionalProperties": false,
          "description": "Configures the weight of the service in terms of its DNS service (SRV) response.",
          "properties": {
            "passing": {
              "description": "Weight for the service when its health checks are passing.",
              "type": "integer"
            },
            "warning": {
              "description": "Weight for the service when it has health checks in `warning` status.",
              "type": "integer"
            }
          },
          "required": [
            "passing",
            "warning"
          ],
          "type": [
            "object",
            "null"
          ]
        }
      },
      "required": [
        "port"
      ],
      "type": "object"
    },
    "transparentProxy": {
      "additionalProperties": false,
      "description": "Transparent proxy configuration for the Consul service",
      "properties": {
        "consulDNS": {
          "additionalProperties": false,
          "description": "Configuration for DNS inside the ECS task",
          "properties": {
            "enabled": {
              "description": "Whether Consul DNS should be enabled for this task. Requires transparent proxy to be enabled. Defaults to false. If enabled, services in the mesh will use Consul DNS for default DNS resolution.",
              "type": [
                "boolean",
                "null"
              ]
            }
          },
          "type": "object"
        },
        "enabled": {
          "description": "Whether transparent proxy is enabled or disabled for this task. Defaults to true",
          "type": [
            "boolean",
            "null"
          ]
        },
        "excludeInboundPorts": {
          "description": "List of inbound ports to exclude from traffic redirection",
          "items": {
            "type": "integer"
          },
          "type": [
            "array",
            "null"
          ],
          "uniqueItems": true
        },
        "excludeOutboundCIDRs": {
          "description": "List of outbound IP CIDRs to exclude from traffic redirection",
          "items": {
            "type": "string"
          },
          "type": [
            "array",
            "null"
          ],
          "uniqueItems": true
        },
        "excludeOutboundPorts": {
          "description": "List of outbound ports to exclude from traffic redirection",
          "items": {
            "type": "integer"
          },
          "type": [
            "array",
            "null"
          ],
          "uniqueItems": true
        },
        "excludeUIDs": {
          "description": "List of additional UserIDs to exclude from traffic redirection",
          "items": {
            "type": "string"
          },
          "type": [
            "array",
            "null"
          ],
          "uniqueItems": true
        }
      },
      "type": [
        "object",
        "null"
      ]
    }
  },
  "required": [
    "bootstrapDir",
    "consulServers"
  ],
  "title": "Consul ECS Configuration",
  "type": "object"
}