All properties

This page lists every property in the application.properties files of Flow's core and dispatcher images at 5.0.0-beta.39: 189 properties, 120 for core and 69 for the dispatcher. It's the complete list. For the properties most deployments set, start with the Configuration reference.

• Restart: each service reads its properties when it starts, so a changed property takes effect only when you restart that service. Behaviour an admin changes while Flow runs is a setting: see All settings.
• Environment variable: derived, not listed in the file. Spring's relaxed binding reads each property from an environment variable named for it in upper case, with dots, dashes and list indexes turned into underscores, and the variable overrides the file: flow.encrypt.secret becomes FLOW_ENCRYPT_SECRET.
• Default: the value in the file. A secret's default is never shown: its row says "(set your own)". Keep secrets in a Kubernetes Secret, as Set the required configuration shows. "Not set" marks a property the file shows only as a commented-out example.
• Description: the comment above the property in the file, with internal project codes removed. "See" names the property whose comment covers this one too. A Note is added by the docs, from Flow's specifications and changelog.

Rows are sorted by property, so properties that share a prefix sit together.

Core

Set these on core (service-core). The file is service-core/src/main/resources/application.properties.

Property	Environment variable	Default	Description
core.feature.docs.enable	CORE_FEATURE_DOCS_ENABLE	true
core.feature.notifications.enable	CORE_FEATURE_NOTIFICATIONS_ENABLE	true
core.feature.support.enable	CORE_FEATURE_SUPPORT_ENABLE	true
core.platform.name	CORE_PLATFORM_NAME	Boomerang
flamingock.lock-quit-trying-after-millis	FLAMINGOCK_LOCK_QUIT_TRYING_AFTER_MILLIS	1800000	See flamingock.management-mode.
flamingock.management-mode	FLAMINGOCK_MANAGEMENT_MODE	INITIALIZING_BEAN	Change units run while the context starts, before the web server and the scheduled sweeps; a failed unit fails startup and is retried on the next start. Replicas starting together wait on the lock for up to 30 minutes (a large v3 upgrade outlasts Flamingock's 3-minute default), then skip what another replica applied. flamingock.enabled=false turns migrations off.
flow.activation-code	FLOW_ACTIVATION_CODE	(set your own)	The activation code that makes the first admin of an empty install: at least 32 characters, else the start fails. Unset, activation is off and the start warns. flow.otc / FLOW_OTC is the retired name, still read when this is unset. An admin claim (flow.security.admin-claim.*) replaces the code. Note: Must be at least 32 characters. See Make the first admin with the activation code.
flow.apps.flow.url	FLOW_APPS_FLOW_URL	/apps/flow
flow.apps.url	FLOW_APPS_URL	/apps/flow	Note: Not read by Flow at this release; flow.apps.flow.url is.
flow.artifacts.enabled	FLOW_ARTIFACTS_ENABLED	false	Artifacts: files upload tasks attach to a run, kept in an S3-compatible store (AWS S3, MinIO, Cloud Storage's S3 mode). Off until enabled; every artifact call then answers ARTIFACTS_NOT_CONFIGURED. Retention, the largest artifact and the storage quota are admin settings (Settings > Artifacts, Quotas), not properties. link-endpoint is the store address that task pods reach when it differs from service-core's (e.g. host.docker.internal under OrbStack).
flow.artifacts.link-ttl-minutes	FLOW_ARTIFACTS_LINK_TTL_MINUTES	15	See flow.artifacts.enabled.
flow.artifacts.store.access-key	FLOW_ARTIFACTS_STORE_ACCESS_KEY	(set your own)	See flow.artifacts.enabled.
flow.artifacts.store.bucket	FLOW_ARTIFACTS_STORE_BUCKET	flow-artifacts	See flow.artifacts.enabled.
flow.artifacts.store.endpoint	FLOW_ARTIFACTS_STORE_ENDPOINT	blank	See flow.artifacts.enabled.
flow.artifacts.store.link-endpoint	FLOW_ARTIFACTS_STORE_LINK_ENDPOINT	blank	See flow.artifacts.enabled.
flow.artifacts.store.path-style	FLOW_ARTIFACTS_STORE_PATH_STYLE	true	See flow.artifacts.enabled.
flow.artifacts.store.region	FLOW_ARTIFACTS_STORE_REGION	us-east-1	See flow.artifacts.enabled.
flow.artifacts.store.secret-key	FLOW_ARTIFACTS_STORE_SECRET_KEY	(set your own)	See flow.artifacts.enabled.
flow.artifacts.upload-grace-minutes	FLOW_ARTIFACTS_UPLOAD_GRACE_MINUTES	60	See flow.artifacts.enabled. Note: How long, in minutes, a partly written upload is kept before Flow deletes it.
flow.auth.oidc.client-id	FLOW_AUTH_OIDC_CLIENT_ID	blank	See flow.auth.oidc.issuer.
flow.auth.oidc.issuer	FLOW_AUTH_OIDC_ISSUER	blank	flow.auth.oidc.issuer and flow.auth.oidc.client-id seed the auth settings' oidc.issuer and oidc.clientId at startup, only while those settings are empty (OidcSettingsSeedService); a value set later in Settings wins and is never overwritten. The issuer must be an absolute https URL (http only for localhost). Blank leaves the settings alone. Note: See Sign in with OpenID Connect.
flow.baseUrl	FLOW_BASEURL	blank
flow.dispatcher.auth.enabled	FLOW_DISPATCHER_AUTH_ENABLED	true	/dispatcher/** requires a real Flow token (global scope + a machine actorKind - see TokenActorKind/DispatcherAuthFilter). Set false only for local dev/test to disable enforcement entirely. Replaces the interim flow.dispatcher.token shared secret.
flow.dispatcher.lease-ms	FLOW_DISPATCHER_LEASE_MS	90000	Lease length (ms), set when a dispatcher claims a task and renewed by each heartbeat. MUST stay >= 2x the dispatcher beat interval (30s) plus a sweep interval - 90s is the floor - so a healthy dispatcher's lease never lapses between its claim and its next heartbeat, or between two.
flow.dispatcher.poll.recheck-ms	FLOW_DISPATCHER_POLL_RECHECK_MS	1000	How often (ms) a held dispatcher poll looks at the claimable page again; a task admitted just after a look waits up to this long to be claimed, and a sequential chain pays it on every hop. Floor 100. Cost: each dispatcher re-checks every pool it polls, so its idle queries per second are pools x 1000 / this value, all on the claim_page index. One dispatcher with seven pools against its own engine would set 200 (35 queries/s instead of 7).
flow.encrypt.salt	FLOW_ENCRYPT_SALT	(set your own)	See flow.encrypt.secret.
flow.encrypt.secret	FLOW_ENCRYPT_SECRET	(set your own)	Encryption of secured settings (AES-GCM). flow.encrypt.* is the key every install must set; a blank pair refuses startup. mongo.encrypt.* is the pair a v3 install encrypted with, read once by the migration that re-encrypts those values. Both default to FLOW_ENCRYPT_SECRET/FLOW_ENCRYPT_SALT, the variables v3's chart generated and kept in its Secret, so a v3 install upgrades with that Secret unchanged. MONGO_ENCRYPT_SECRET/MONGO_ENCRYPT_SALT override the v3 pair on its own. Note: See Keep the encryption key.
flow.engine.task.log.max-bytes	FLOW_ENGINE_TASK_LOG_MAX_BYTES	10485760	Task logs. A task's stored log, when its dispatcher uploaded one, is served first. Otherwise the engine reads the live log from the dispatcher holding the claim, at the logsUrl it registered and with the token it registered; nothing on core names a dispatcher (engine/LogClient.java). The most bytes of a finished log a dispatcher may store for a task (PUT /dispatcher/v1/taskrun/{id}/log); a larger one is refused whole, never truncated.
flow.engine.task.params.max-bytes	FLOW_ENGINE_TASK_PARAMS_MAX_BYTES	16384	Engine-enforced payload caps (bytes, serialized JSON): resolved TaskRun params are checked at admission (oversize = the task is invalidated before it is ever claimable) and TaskRun results at end (oversize = the task fails, results are not persisted). Large values pass by reference: a workspace path or a URI. The results check is a storage guard against a faulty dispatcher, not an executor limit - each dispatcher enforces its own (Kubernetes' 4096-byte termination message).
flow.engine.task.results.max-bytes	FLOW_ENGINE_TASK_RESULTS_MAX_BYTES	1048576	See flow.engine.task.params.max-bytes.
flow.environment	FLOW_ENVIRONMENT	blank
flow.error.include-cause	FLOW_ERROR_INCLUDE_CAUSE	false	Note: true adds the underlying exception to an error response, as cause.
flow.events.sink.destinations[0].header-name	FLOW_EVENTS_SINK_DESTINATIONS_0_HEADER_NAME	not set	See flow.events.sink.destinations[0].url. Commented out in the file, as an example: flow.events.sink.destinations[0].header-name=Authorization.
flow.events.sink.destinations[0].header-value	FLOW_EVENTS_SINK_DESTINATIONS_0_HEADER_VALUE	(set your own)	See flow.events.sink.destinations[0].url. Commented out in the file, as an example.
flow.events.sink.destinations[0].labels	FLOW_EVENTS_SINK_DESTINATIONS_0_LABELS	not set	See flow.events.sink.types. Commented out in the file, as an example: flow.events.sink.destinations[0].labels=team=legal.
flow.events.sink.destinations[0].phases	FLOW_EVENTS_SINK_DESTINATIONS_0_PHASES	not set	See flow.events.sink.types. Commented out in the file, as an example: flow.events.sink.destinations[0].phases=completed.
flow.events.sink.destinations[0].statuses	FLOW_EVENTS_SINK_DESTINATIONS_0_STATUSES	not set	See flow.events.sink.types. Commented out in the file, as an example: flow.events.sink.destinations[0].statuses=failed,timedout.
flow.events.sink.destinations[0].types	FLOW_EVENTS_SINK_DESTINATIONS_0_TYPES	not set	See flow.events.sink.types. Commented out in the file, as an example: flow.events.sink.destinations[0].types=workflowrun,taskrun.
flow.events.sink.destinations[0].url	FLOW_EVENTS_SINK_DESTINATIONS_0_URL	not set	Sinks that authenticate with a request header instead. header-name defaults to Authorization; header-value is a secret and MUST come from the environment, never a checked-in value: Commented out in the file, as an example: flow.events.sink.destinations[0].url=https://receiver.example.com/events.
flow.events.sink.enabled	FLOW_EVENTS_SINK_ENABLED	false	Note: true sends each run and task run status change to every sink as a CloudEvent. See Send status events and traces.
flow.events.sink.payload	FLOW_EVENTS_SINK_PAYLOAD	thin	How much of the run a status CloudEvent carries: thin (default) is identity and lifecycle only - id, refs, status, statusReason, phase, labels, creationDate, startTime, duration - and a consumer reads the run back over the API for params and results; full carries the whole public run model.
flow.events.sink.phases	FLOW_EVENTS_SINK_PHASES	not set	See flow.events.sink.types. Commented out in the file, as an example: flow.events.sink.phases=completed.
flow.events.sink.statuses	FLOW_EVENTS_SINK_STATUSES	not set	See flow.events.sink.types. Commented out in the file, as an example: flow.events.sink.statuses=terminal.
flow.events.sink.types	FLOW_EVENTS_SINK_TYPES	not set	Optional filters, empty = no filter. Top level (every sink) and per destination; a destination with none of its own inherits the top level. statuses matches the status as emitted, so with finally tasks use phases=completed for the true end of a run; labels (key=value, all must match) filter at delivery. Commented out in the file, as an example: flow.events.sink.types=workflowrun.
flow.events.sink.urls	FLOW_EVENTS_SINK_URLS	blank	Sinks as bare URLs (comma separated). Any secret has to ride in the query string (...?token=xyz), where every proxy and access log records it - prefer the header form below.
flow.externalUrl.navigation	FLOW_EXTERNALURL_NAVIGATION	blank
flow.externalUrl.platformNavigation	FLOW_EXTERNALURL_PLATFORMNAVIGATION	${users.base.url}/users/navigation
flow.externalUrl.user	FLOW_EXTERNALURL_USER	blank
flow.migration.reset-unreadable-settings	FLOW_MIGRATION_RESET_UNREADABLE_SETTINGS	false	A v3 settings value that does not decrypt under mongo.encrypt.* stops the upgrade; true blanks each such value instead, logged by setting, to be entered again in Settings.
flow.mongo.collection.prefix	FLOW_MONGO_COLLECTION_PREFIX	flow	Note: Every collection is named <prefix>_<name>.
flow.otc	FLOW_OTC	(set your own)	See flow.activation-code. Warning: Deprecated: use flow.activation-code. Flow reads it only while flow.activation-code is unset, and logs a deprecation warning. If both are set and differ, core doesn't start.
flow.parameters.layer-cache.enabled	FLOW_PARAMETERS_LAYER_CACHE_ENABLED	true	Per-instance cache of the global, workspace and context parameter layers and of revisions (ParamLayerCache): tasks admitted within the TTL share one read of each store. A write clears it on the writing instance; another instance sees the write within ttl. ttl=0s turns it off.
flow.parameters.layer-cache.max-size	FLOW_PARAMETERS_LAYER_CACHE_MAX_SIZE	1000	See flow.parameters.layer-cache.enabled.
flow.parameters.layer-cache.ttl	FLOW_PARAMETERS_LAYER_CACHE_TTL	10s	See flow.parameters.layer-cache.enabled.
flow.queue.enabled	FLOW_QUEUE_ENABLED	true	Kill switch: stops agent queue claiming only; recovery sweeps are never gated.
flow.security.admin-claim.name	FLOW_SECURITY_ADMIN_CLAIM_NAME	blank	An identity provider decides who is an admin: a token whose claim name (a string or an array such as roles or groups) holds any of values (comma-separated) makes its holder an admin on each sign-in, and a holder who no longer matches is demoted. Both unset leaves admin to the first sign-in. A verified OIDC id_token is always read; the unverified JWT an authenticating proxy forwards is read only with trust-forwarded-token=true, when that proxy is the trust boundary. Note: See Let your identity provider decide admins.
flow.security.admin-claim.trust-forwarded-token	FLOW_SECURITY_ADMIN_CLAIM_TRUST_FORWARDED_TOKEN	false	See flow.security.admin-claim.name.
flow.security.admin-claim.values	FLOW_SECURITY_ADMIN_CLAIM_VALUES	blank	See flow.security.admin-claim.name.
flow.security.bootstrap-token	FLOW_SECURITY_BOOTSTRAP_TOKEN	(set your own)	flow.security.bootstrap-token is a secured install's first credential when no person will sign in: a bfg_ token of at least 32 further characters, registered at startup as a global service token (BootstrapTokenService). Supply it as a secret; rotate it by changing the value and restarting. It is registered whether or not security is on; blank registers nothing. Note: Clearing it revokes the bootstrap token at the next start. See Machine tokens.
flow.security.enabled	FLOW_SECURITY_ENABLED	true	Deployment shape. Every bean loads in every deployment; these properties express the shape. flow.security.enabled is the single switch for both security halves (authentication filter chain + endpoint authorization). Default true; with it false every request runs as a synthetic admin (UnauthenticatedGlobalToken) - set it only for a headless embedded engine or local dev. Note: See Choose a deployment shape.
flow.security.token-cache.enabled	FLOW_SECURITY_TOKEN_CACHE_ENABLED	true	Per-instance cache of validated bearer tokens keyed by hash (TokenLookupCache): one Mongo read per token per TTL; revoke evicts locally only, so another instance may honour a revoked token for up to ttl.
flow.security.token-cache.max-size	FLOW_SECURITY_TOKEN_CACHE_MAX_SIZE	10000	See flow.security.token-cache.enabled.
flow.security.token-cache.ttl	FLOW_SECURITY_TOKEN_CACHE_TTL	60s	See flow.security.token-cache.enabled.
flow.security.tokens.dispatcher.hash	FLOW_SECURITY_TOKENS_DISPATCHER_HASH	(set your own)	flow.security.tokens.<name> declares narrower machine tokens, registered at startup beside the bootstrap token (DeclaredTokenService). <name> is 1 to 63 lowercase letters and digits only (not "bootstrap"): an underscore in an environment variable becomes a dot, so no hyphen or underscore survives. Keys: exactly one of hash or value, actor-kind (default SERVICE), permissions (global grants such as workspace/read; leave out for a token that holds none and so reaches only the dispatcher protocol), and optionally description and expiry (ISO-8601 instant or date). hash is the lowercase hex SHA-256 of the raw token, so the environment never holds it: printf %s "$RAW" | sha256sum (macOS: shasum -a 256). The raw token a client sends must start with bfg_. Removing an entry revokes its token; to rotate, declare the new entry, roll the client, then remove the old one. As environment variables the name is part of the variable: FLOW_SECURITY_TOKENS_DISPATCHER_HASH, _PERMISSIONS (comma separated), _ACTORKIND, _EXPIRY. Commented out in the file, as an example. Note: Give every core instance the same flow.security.tokens entries: each instance revokes the declared tokens its own configuration doesn't name. See Machine tokens.
flow.services.workflow.host	FLOW_SERVICES_WORKFLOW_HOST	localhost:7700	Note: Read only through the flow.workflow.*.url properties, which start with it.
flow.signOutUrl	FLOW_SIGNOUTURL	blank
flow.token.max-user-session-duration	FLOW_TOKEN_MAX_USER_SESSION_DURATION	24	Note: Hours a session token lasts.
flow.version	FLOW_VERSION	blank
flow.workflow.event.url	FLOW_WORKFLOW_EVENT_URL	${flow.services.workflow.host}/api/v2/event	Note: Every run gets it as the context parameter event-url: $(context.params.event-url).
flow.workflow.webhook.url	FLOW_WORKFLOW_WEBHOOK_URL	${flow.services.workflow.host}/api/v2/webhook	Note: Every run gets it as the context parameter webhook-url: $(context.params.webhook-url).
flow.workflow.wfe.url	FLOW_WORKFLOW_WFE_URL	${flow.services.workflow.host}/api/v2/callback	Note: The wait-for-event route. Every run gets it as the context parameter wfe-url: $(context.params.wfe-url).
flow.workflowrun.auto-start-on-submit	FLOW_WORKFLOWRUN_AUTO_START_ON_SUBMIT	true	Webhook and CloudEvent triggers start the runs they submit (submit means run; a run with workspaces still waits for dispatcher provisioning). Set false to park trigger-created runs for an external PUT /workflowrun/{id}/start.
flow.workspace.single	FLOW_WORKSPACE_SINGLE	false	flow.workspace.single serves the seeded system workspace alone: any other {workspace} path segment is refused (SingleWorkspaceInterceptor) and workspaces cannot be created or deleted. An embedding product sets it together with flow.security.enabled=false. Note: See Choose a deployment shape.
logging.level.io.boomerang.core	LOGGING_LEVEL_IO_BOOMERANG_CORE	INFO	See logging.level.org.springframework.web.filter.CommonsRequestLoggingFilter.
logging.level.io.boomerang.engine	LOGGING_LEVEL_IO_BOOMERANG_ENGINE	INFO	See logging.level.org.springframework.web.filter.CommonsRequestLoggingFilter.
logging.level.io.boomerang.integrations	LOGGING_LEVEL_IO_BOOMERANG_INTEGRATIONS	INFO	See logging.level.org.springframework.web.filter.CommonsRequestLoggingFilter.
logging.level.io.boomerang.scheduler	LOGGING_LEVEL_IO_BOOMERANG_SCHEDULER	INFO	See logging.level.org.springframework.web.filter.CommonsRequestLoggingFilter.
logging.level.io.boomerang.security	LOGGING_LEVEL_IO_BOOMERANG_SECURITY	INFO	See logging.level.org.springframework.web.filter.CommonsRequestLoggingFilter.
logging.level.io.boomerang.workflow	LOGGING_LEVEL_IO_BOOMERANG_WORKFLOW	INFO	See logging.level.org.springframework.web.filter.CommonsRequestLoggingFilter.
logging.level.org.springframework.data.mongodb.core.MongoTemplate	LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_DATA_MONGODB_CORE_MONGOTEMPLATE	WARN	See logging.level.org.springframework.web.filter.CommonsRequestLoggingFilter.
logging.level.org.springframework.security	LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_SECURITY	WARN	See logging.level.org.springframework.web.filter.CommonsRequestLoggingFilter.
logging.level.org.springframework.web.filter.CommonsRequestLoggingFilter	LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_FILTER_COMMONSREQUESTLOGGINGFILTER	WARN	Spring Logging. io.boomerang.* runs at INFO; DEBUG is opt-in (logging.level.io.boomerang.engine=DEBUG). No level prints a parameter value: logs carry names, and a secret's toString is masked.
management.endpoint.health.probes.enabled	MANAGEMENT_ENDPOINT_HEALTH_PROBES_ENABLED	true	Customising path of Health probe for kubernetes to be /health
management.endpoints.web.base-path	MANAGEMENT_ENDPOINTS_WEB_BASE_PATH	/
management.health.mongodb.enabled	MANAGEMENT_HEALTH_MONGODB_ENABLED	false
management.tracing.export.enabled	MANAGEMENT_TRACING_EXPORT_ENABLED	false	Distributed tracing (Micrometer Tracing + OTel/OTLP). To enable, set to true and point management.opentelemetry.tracing.export.otlp.endpoint at an OTLP collector.
max.concurrent.workflows	MAX_CONCURRENT_WORKFLOWS	4	Note: Not read by Flow at this release. Quotas are settings: see Quotas in All settings.
max.workflow.count	MAX_WORKFLOW_COUNT	10	Note: Not read by Flow at this release. Quotas are settings: see Quotas in All settings.
max.workflow.duration	MAX_WORKFLOW_DURATION	300	Note: Not read by Flow at this release. Quotas are settings: see Quotas in All settings.
max.workflow.execution.monthly	MAX_WORKFLOW_EXECUTION_MONTHLY	100	Note: Not read by Flow at this release. Quotas are settings: see Quotas in All settings.
max.workflow.execution.time	MAX_WORKFLOW_EXECUTION_TIME	30	Note: Not read by Flow at this release. Quotas are settings: see Quotas in All settings.
mongo.encrypt.salt	MONGO_ENCRYPT_SALT	Same as FLOW_ENCRYPT_SALT	See flow.encrypt.secret.
mongo.encrypt.secret	MONGO_ENCRYPT_SECRET	Same as FLOW_ENCRYPT_SECRET	See flow.encrypt.secret. Note: Read once, by the migration that re-encrypts a v3 install's secured settings. See Set the encryption keys.
proxy.host	PROXY_HOST	blank
proxy.port	PROXY_PORT	blank
server.max-http-request-header-size	SERVER_MAX_HTTP_REQUEST_HEADER_SIZE	80KB
server.port	SERVER_PORT	7700
service.name	SERVICE_NAME	Workflow
spring.aop.proxy-target-class	SPRING_AOP_PROXY_TARGET_CLASS	true
spring.application.name	SPRING_APPLICATION_NAME	${service.name}-${flow.environment}
spring.autoconfigure.exclude[0]	SPRING_AUTOCONFIGURE_EXCLUDE_0	org.springframework.boot.security.autoconfigure.web.servlet.ServletWebSecurityAutoConfiguration
spring.data.mongodb.auto-index-creation	SPRING_DATA_MONGODB_AUTO_INDEX_CREATION	false	The change units in io.boomerang.migration are the sole index authority; entity annotations stay inert so no index depends on which replica boots first.
spring.data.mongodb.repositories.type	SPRING_DATA_MONGODB_REPOSITORIES_TYPE	auto
spring.main.allow-circular-references	SPRING_MAIN_ALLOW_CIRCULAR_REFERENCES	true	temporary workaround, until the circualr dependencies are removed
spring.mongodb.representation.uuid	SPRING_MONGODB_REPRESENTATION_UUID	java-legacy	JAVA_LEGACY matches the pre-Boot-4 driver default so existing stored UUIDs keep resolving
spring.mongodb.uri	SPRING_MONGODB_URI	(set your own)	Note: Always set it: the default is a local development sample. See Connect MongoDB.
spring.mvc.async.request-timeout	SPRING_MVC_ASYNC_REQUEST_TIMEOUT	7200000	How long a streamed response (a running task's log, an artifact download) may stay open: two hours, so a live log is followed for a long task rather than cut at the old 10 minutes.
spring.profiles.active	SPRING_PROFILES_ACTIVE	live
spring.threads.virtual.enabled	SPRING_THREADS_VIRTUAL_ENABLED	true	Virtual threads for request handling: the agent long-poll parks one request thread per connected agent for the poll window, so platform threads cap concurrent agents at the pool size. The claim path is measured not to pin virtual threads (see DispatcherPollerVirtualThreadTest), so parked pollers cost a cheap virtual thread and the agent count is no longer thread-bound.
springdoc.api-docs.path	SPRINGDOC_API_DOCS_PATH	/api/docs/spec
springdoc.packages-to-scan	SPRINGDOC_PACKAGES_TO_SCAN	io.boomerang
springdoc.paths-to-exclude	SPRINGDOC_PATHS_TO_EXCLUDE	/internal/**	/internal/** is called by the webapp's server only and is not part of the published API.
springdoc.swagger-ui.disable-swagger-default-url	SPRINGDOC_SWAGGER_UI_DISABLE_SWAGGER_DEFAULT_URL	true
springdoc.swagger-ui.enabled	SPRINGDOC_SWAGGER_UI_ENABLED	true
springdoc.swagger-ui.operationsSorter	SPRINGDOC_SWAGGER_UI_OPERATIONSSORTER	alpha
springdoc.swagger-ui.path	SPRINGDOC_SWAGGER_UI_PATH	/api/docs/swagger-ui
springdoc.swagger-ui.showExtensions	SPRINGDOC_SWAGGER_UI_SHOWEXTENSIONS	true
springdoc.swagger-ui.tagsSorter	SPRINGDOC_SWAGGER_UI_TAGSSORTER	alpha
springdoc.swagger-ui.tryItOutEnabled	SPRINGDOC_SWAGGER_UI_TRYITOUTENABLED	false
users.base.url	USERS_BASE_URL	blank

Dispatcher

Set these on the dispatcher (service-dispatcher). The file is service-dispatcher/src/main/resources/application.properties.

Property	Environment variable	Default	Description
dispatcher.executor	DISPATCHER_EXECUTOR	tekton	Task execution runtime (TaskExecutor SPI): tekton | kube-jobs. Note: See Choose an executor.
dispatcher.logging.host	DISPATCHER_LOGGING_HOST	localhost
dispatcher.logging.port	DISPATCHER_LOGGING_PORT	9200
dispatcher.logging.type	DISPATCHER_LOGGING_TYPE	default	Note: default reads a running task's log from its pod; loki queries Loki at dispatcher.logging.host and dispatcher.logging.port.
dispatcher.tasks.hostaliases	DISPATCHER_TASKS_HOSTALIASES	[]	Note: Applied to every task pod this deployment runs. Empty entries are dropped.
dispatcher.tasks.nodeselector	DISPATCHER_TASKS_NODESELECTOR	{}	Note: Applied to every task pod this deployment runs.
dispatcher.tasks.runtimeClassName	DISPATCHER_TASKS_RUNTIMECLASSNAME	blank	Kubernetes RuntimeClass for Task Pods (kube-jobs executor only); blank leaves it unset.
dispatcher.tasks.serviceaccount	DISPATCHER_TASKS_SERVICEACCOUNT	blank	Note: Set on Jobs only, with the kube-jobs executor.
dispatcher.tasks.tolerations	DISPATCHER_TASKS_TOLERATIONS	[]	Note: Applied to every task pod this deployment runs. Empty entries are dropped.
flow.dispatcher.ai.endpoint	FLOW_DISPATCHER_AI_ENDPOINT	blank	Executor-side credential defaults for every ai task pod: OPENAI_BASE_URL from the endpoint and OPENAI_API_KEY from the token, each injected only when set. A task's own endpoint and token params win.
flow.dispatcher.ai.image-prefixes	FLOW_DISPATCHER_AI_IMAGE_PREFIXES	boomerangio/task-ai	An ai catalogue revision declares its own image and command (boomerangio/task-ai, released from the boomerang-io/tasks repository on its own version line); the image must start with one of these comma-separated prefixes or the task is refused at dispatch (ImageNotAllowed). Add a prefix to run another ai worker image (executor/TaskImageResolver.java).
flow.dispatcher.ai.otel.endpoint	FLOW_DISPATCHER_AI_OTEL_ENDPOINT	blank	The OTLP endpoint ai task pods export their spans to (OTEL_EXPORTER_OTLP_ENDPOINT); blank sends none.
flow.dispatcher.ai.otel.headers	FLOW_DISPATCHER_AI_OTEL_HEADERS	(set your own)	The exporter's headers (OTEL_EXPORTER_OTLP_HEADERS), visible in the pod spec like the token.
flow.dispatcher.ai.otel.protocol	FLOW_DISPATCHER_AI_OTEL_PROTOCOL	http/protobuf	The exporter's protocol (OTEL_EXPORTER_OTLP_PROTOCOL), set only when the endpoint is: task-ai exports over http/protobuf or http/json; grpc is unsupported and logs one warning, exporting nothing.
flow.dispatcher.ai.token	FLOW_DISPATCHER_AI_TOKEN	(set your own)	See flow.dispatcher.ai.endpoint.
flow.dispatcher.artifact.image	FLOW_DISPATCHER_ARTIFACT_IMAGE	boomerangio/task-flow:3.3.0	The default worker image that runs the uploadartifact and downloadartifact tasks (its artifact upload / artifact download commands), released from boomerang-io/tasks (tasks/flow).
flow.dispatcher.lease.beat-ms	FLOW_DISPATCHER_LEASE_BEAT_MS	30000	Batched lease heartbeat: reports every TaskRun this dispatcher holds - from its claim, while it runs, and while its end report is still being retried - so the engine renews their lease rather than reap a task that is merely slow. The engine sets each lease at claim, so it MUST stay well under the engine's flow.dispatcher.lease-ms (90s).
flow.dispatcher.logs.upload	FLOW_DISPATCHER_LOGS_UPLOAD	true	See flow.dispatcher.logs.url.
flow.dispatcher.logs.url	FLOW_DISPATCHER_LOGS_URL	blank	Task logs. flow.dispatcher.logs.url is where the engine reads a running task's log from this dispatcher: this process's /api/v1/logs/stream at an address the engine can reach, e.g. http://service-dispatcher:7702/api/v1/logs/stream. It is sent at registration with a bearer generated at every start, which the engine presents and this process checks (LogAuthFilter). Blank registers no URL: the engine then has no live log for this dispatcher's running tasks, only the stored ones. With flow.dispatcher.logs.upload=true a finished task's pod log is stored with the engine (when it has an artifact store), where it is served first and outlives the pod.
flow.dispatcher.name	FLOW_DISPATCHER_NAME	flow-tekton-dispatcher	Note: The name the dispatcher registers with.
flow.dispatcher.task-types	FLOW_DISPATCHER_TASK_TYPES	template,custom,script,ai,uploadartifact,downloadartifact	The task types this dispatcher registers for; the engine hands it claims for these only. ai is registered by default, so a single-dispatcher install runs AI tasks out of the box; generic is dispatchable but opt-in. A deployment started with flow.dispatcher.task-types=ai is an AI network zone (see README.md).
flow.dispatcher.task.max-in-flight	FLOW_DISPATCHER_TASK_MAX_IN_FLIGHT	25	The most tasks this dispatcher runs at once. A slot is held from the claim until the engine has taken the task's end report, a Pending pod and a retried end included, and each poll asks the engine for no more than the free slots. 0 means no cap.
flow.dispatcher.task.reconcile-ms	FLOW_DISPATCHER_TASK_RECONCILE_MS	3600000	See flow.dispatcher.task.reconcile.enabled.
flow.dispatcher.task.reconcile.enabled	FLOW_DISPATCHER_TASK_RECONCILE_ENABLED	true	Task runtime TTL: runtime objects are removed kube.task.ttlDays days after completion regardless of kube.task.deletion - Jobs natively via ttlSecondsAfterFinished, Tekton TaskRuns via this reconciler (tekton executor only; each tick deletes this dispatcher's own finished TaskRuns that have outlived the TTL).
flow.dispatcher.workspace.reconcile-ms	FLOW_DISPATCHER_WORKSPACE_RECONCILE_MS	60000	See flow.dispatcher.workspace.reconcile.enabled.
flow.dispatcher.workspace.reconcile.enabled	FLOW_DISPATCHER_WORKSPACE_RECONCILE_ENABLED	true	Workspace reconciliation: each tick lists the workspace PVCs this dispatcher holds and asks the engine which owners are finished, then deletes those claims. Nothing on the run records it.
flow.engine.dispatcher.token	FLOW_ENGINE_DISPATCHER_TOKEN	(set your own)	Bearer token sent to the engine on dispatcher calls, and nowhere else. Blank = send nothing. It must be a global Flow token with an actor kind (a machine token), minted via the token API or declared in service-core's flow.security.tokens (no permissions needed). Note: See Machine tokens.
flow.engine.url	FLOW_ENGINE_URL	http://localhost:7700	Engine: the base URL of service-core. The dispatcher routes are fixed by the contract (contracts/dispatcher-v1.yaml) under /dispatcher/v1.
flow.environment	FLOW_ENVIRONMENT	blank
flow.instance	FLOW_INSTANCE	bmrg-flow
flow.product	FLOW_PRODUCT	bmrg-flow
flow.version	FLOW_VERSION	0.0.0	Note: Passed to every task container as FLOW_VERSION.
info.version	INFO_VERSION	@version.name@
kube.image.pullPolicy	KUBE_IMAGE_PULLPOLICY	IfNotPresent
kube.image.pullSecret	KUBE_IMAGE_PULLSECRET	boomerang.registrykey	Note: The image pull secret on every task pod this deployment runs.
kube.namespace	KUBE_NAMESPACE	blank	The namespace every task Job/TaskRun, PVC and ConfigMap is created in. Blank = the kubeconfig context's namespace, or the service-account namespace in-cluster. Note: When neither resolves, the dispatcher doesn't start.
kube.resource.limit.cpu	KUBE_RESOURCE_LIMIT_CPU	blank	CPU is unset by default: a CPU limit throttles a task rather than failing it, so an operator opts in. Kubernetes CPU units - 1 = one core, 500m = half a core.
kube.resource.limit.ephemeral-storage	KUBE_RESOURCE_LIMIT_EPHEMERAL_STORAGE	16Gi	Compute resources applied to every task container this deployment runs - one sizing per deployment, not per task. Blank means that request or limit is not set at all, so a deployment can run with memory limits and no CPU limit, or with none at all. Typically the request is 1/4 to 1/8 of the limit. A memory-backed /data (kube.task.storage.data.memory) is a tmpfs and counts against the memory limit, not ephemeral-storage.
kube.resource.limit.memory	KUBE_RESOURCE_LIMIT_MEMORY	16Gi	See kube.resource.limit.ephemeral-storage.
kube.resource.request.cpu	KUBE_RESOURCE_REQUEST_CPU	blank	See kube.resource.limit.cpu.
kube.resource.request.ephemeral-storage	KUBE_RESOURCE_REQUEST_EPHEMERAL_STORAGE	2Gi	See kube.resource.limit.ephemeral-storage.
kube.resource.request.memory	KUBE_RESOURCE_REQUEST_MEMORY	2Gi	See kube.resource.limit.ephemeral-storage.
kube.task.backOffLimit	KUBE_TASK_BACKOFFLIMIT	0	Note: Set on each Job, with the kube-jobs executor.
kube.task.deletion	KUBE_TASK_DELETION	Never	Note: Never applies: core sends every task with the Tasks › Deletion Policy setting, and this is only its fallback. See Tasks in All settings.
kube.task.restartPolicy	KUBE_TASK_RESTARTPOLICY	Never	Note: Set on each Job, with the kube-jobs executor.
kube.task.storage.data.memory	KUBE_TASK_STORAGE_DATA_MEMORY	false	Note: true backs a task's /data with memory, for a task whose worker.storage.data.memory param is also true.
kube.task.timeout	KUBE_TASK_TIMEOUT	60	Note: Minutes. The per-pod backstop for a task that reaches the dispatcher with no timeout, or 0. A timeout core sets wins.
kube.task.ttlDays	KUBE_TASK_TTLDAYS	7	Note: A finished Job or TaskRun is removed this many days after it completes, whatever the deletion policy. See Clean up finished tasks.
kube.timeout.failedConditionGraceSeconds	KUBE_TIMEOUT_FAILEDCONDITIONGRACESECONDS	60	The Job controller writes status.failed before it writes the Failed condition (and the reason, e.g. DeadlineExceeded), so kube-jobs's JobWatcher waits this long after first observing status.failed >= 1 with no condition yet, before falling back to a generic JobFailed.
kube.timeout.reconcileSeconds	KUBE_TIMEOUT_RECONCILESECONDS	30	How often the executor watch loop reconciles by listing the Job/TaskRun by label, on top of the watch event stream - catches a dropped watch connection or a missed event.
kube.timeout.startFailureGraceSeconds	KUBE_TIMEOUT_STARTFAILUREGRACESECONDS	60	How long a container may be held on an image it cannot pull (ErrImagePull, ImagePullBackOff, InvalidImageName) or a container it cannot create (CreateContainerConfigError) before the task fails. These are mistakes in the task, so they are not retried.
kube.timeout.startMinutes	KUBE_TIMEOUT_STARTMINUTES	15	How long a task's pod may take to START - to leave Pending - apart from how long it may run. A pod still not running by then (unschedulable, held by a quota, never created) is reported as StartTimeout and the engine requeues the task. 0 turns the check off.
kube.timeout.waitUntil	KUBE_TIMEOUT_WAITUNTIL	30	Note: Seconds the dispatcher waits for a new run workspace claim to reach Pending or Bound.
kube.timeout.watchGraceMinutes	KUBE_TIMEOUT_WATCHGRACEMINUTES	2	Backstop grace on the executor watch, added to the task's own budget. The engine owns the deadline and reaps first, so this only releases the thread when the watch never fires. Raise it where image pulls are slow.
kube.workspace.storage.accessMode	KUBE_WORKSPACE_STORAGE_ACCESSMODE	ReadWriteMany	See kube.workspace.storage.size.
kube.workspace.storage.class	KUBE_WORKSPACE_STORAGE_CLASS	blank	See kube.workspace.storage.size.
kube.workspace.storage.size	KUBE_WORKSPACE_STORAGE_SIZE	1Gi	Workspace storage defaults, taken when a run leaves the field blank
logging.level.io.boomerang.dispatcher	LOGGING_LEVEL_IO_BOOMERANG_DISPATCHER	INFO	Log4j Logging (io.boomerang.dispatcher includes the SDK, io.boomerang.dispatcher.sdk)
management.endpoints.web.base-path	MANAGEMENT_ENDPOINTS_WEB_BASE_PATH	/
proxy.enable	PROXY_ENABLE	false	Note: true passes PROXY_HOST, PROXY_PORT, HTTP_PROXY, HTTPS_PROXY and NO_PROXY, and their lower-case forms, to every task container.
proxy.host	PROXY_HOST	blank
proxy.ignore	PROXY_IGNORE	blank
proxy.port	PROXY_PORT	blank
server.port	SERVER_PORT	7702
service.name	SERVICE_NAME	dispatcher
spring.application.name	SPRING_APPLICATION_NAME	${service.name}-${flow.environment}
spring.mvc.async.request-timeout	SPRING_MVC_ASYNC_REQUEST_TIMEOUT	7200000	How long the live log route may stream one running task's log: two hours, matching service-core.
spring.threads.virtual.enabled	SPRING_THREADS_VIRTUAL_ENABLED	true	Request handling on virtual threads: a live log stream parks its request thread for up to that long, and the SDK already runs its polls, tasks and heartbeat on virtual threads.
tekton.results.maxBytes	TEKTON_RESULTS_MAXBYTES	4096	The results limit handed to a Tekton task as RESULTS_MAX_BYTES: 4096 in Tekton's default termination-message mode; raise it to the cluster's max-result-size under sidecar-logs.

Next steps

• Configuring: set up each image step by step.
• Configuration reference: the properties most deployments set, by area.
• All settings: what an admin changes in Admin › Settings, without a restart.