alibaba--nacos/distribution/conf/application.properties

#
# Copyright 1999-2025 Alibaba Group Holding Ltd.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

#--------------- Nacos Common Configurations ---------------#

#*************** Nacos port Related Configurations ***************#
### Nacos Server Main port
nacos.server.main.port=8848

#*************** Network Related Configurations ***************#
### If prefer hostname over ip for Nacos server addresses in cluster.conf:
# nacos.inetutils.prefer-hostname-over-ip=false

### Specify local server's IP:
# nacos.inetutils.ip-address=

#*************** Datasource Related Configurations ***************#
### nacos.plugin.datasource.log.enabled=true
#spring.sql.init.platform=mysql
### Count of DB:
# db.num=1

### Connect URL of DB:
# db.url.0=jdbc:mysql://127.0.0.1:3306/nacos?characterEncoding=utf8&connectTimeout=1000&socketTimeout=3000&autoReconnect=true&useUnicode=true&useSSL=false&serverTimezone=UTC
# db.user=nacos
# db.password=nacos

#*************** Metrics Related Configurations ***************#
### Metrics for prometheus
#management.endpoints.web.exposure.include=prometheus

### Metrics for elastic search
management.metrics.export.elastic.enabled=false
#management.metrics.export.elastic.host=http://localhost:9200

### Metrics for influx
management.metrics.export.influx.enabled=false
#management.metrics.export.influx.db=springboot
#management.metrics.export.influx.uri=http://localhost:8086
#management.metrics.export.influx.auto-create-db=true
#management.metrics.export.influx.consistency=one
#management.metrics.export.influx.compressed=true

#*************** Console Related Configurations ***************#

### Maximum upload file size for console (e.g. skill zip). Default 10MB. Exceeding returns a clear error.
spring.servlet.multipart.max-file-size=10MB
spring.servlet.multipart.max-request-size=10MB

server.servlet.encoding.enabled=true
server.servlet.encoding.force=true
server.servlet.encoding.charset=UTF-8

### CORS (Cross-Origin Resource Sharing) configurations for console
### Whether to allow credentials (cookies, authorization headers, TLS client certificates)
# nacos.console.cors.allow-credentials=true

### Allowed headers, comma separated. Empty means allow all headers (*)
# nacos.console.cors.allowed-headers=

### Maximum age (in seconds) of the CORS preflight request cache
# nacos.console.cors.max-age=18000

### Allowed HTTP methods, comma separated. Empty means allow all methods (*)
# nacos.console.cors.allowed-methods=

### Allowed origins, comma separated. Empty means allow all origin patterns (*)
### Example: nacos.console.cors.allowed-origins=http://localhost:8080,https://example.com
# nacos.console.cors.allowed-origins=

#*************** Core Related Configurations ***************#

### set the WorkerID manually
# nacos.core.snowflake.worker-id=

### Member-MetaData
# nacos.core.member.meta.site=
# nacos.core.member.meta.adweight=
# nacos.core.member.meta.weight=

### MemberLookup
### Addressing pattern category, If set, the priority is highest
# nacos.core.member.lookup.type=[file,address-server]

## Set the cluster list with a configuration file or command-line argument
# nacos.member.list=192.168.16.101:8847?raft_port=8807,192.168.16.101?raft_port=8808,192.168.16.101:8849?raft_port=8809

## for AddressServerMemberLookup
# Maximum number of retries to query the address server upon initialization
# nacos.core.address-server.retry=5
## Server domain name address of [address-server] mode
# address.server.domain=jmenv.tbsite.net
## Server port of [address-server] mode
# address.server.port=8080
## Request address of [address-server] mode
# address.server.url=/nacos/serverlist

#*************** JRaft Related Configurations ***************#

### Sets the Raft cluster election timeout, default value is 5 second
# nacos.core.protocol.raft.data.election_timeout_ms=5000
### Sets the amount of time the Raft snapshot will execute periodically, default is 30 minute
# nacos.core.protocol.raft.data.snapshot_interval_secs=30
### raft internal worker threads
# nacos.core.protocol.raft.data.core_thread_num=8
### Number of threads required for raft business request processing
# nacos.core.protocol.raft.data.cli_service_thread_num=4
### raft linear read strategy. Safe linear reads are used by default, that is, the Leader tenure is confirmed by heartbeat
# nacos.core.protocol.raft.data.read_index_type=ReadOnlySafe
### rpc request timeout, default 5 seconds
# nacos.core.protocol.raft.data.rpc_request_timeout_ms=5000
### enable to support prometheus service discovery
#nacos.prometheus.metrics.enabled=true

#*************** Distro Related Configurations ***************#

### Distro data sync delay time, when sync task delayed, task will be merged for same data key. Default 1 second.
# nacos.core.protocol.distro.data.sync.delayMs=1000
### Distro data sync timeout for one sync data, default 3 seconds.
# nacos.core.protocol.distro.data.sync.timeoutMs=3000
### Distro data sync retry delay time when sync data failed or timeout, same behavior with delayMs, default 3 seconds.
# nacos.core.protocol.distro.data.sync.retryDelayMs=3000
### Distro data verify interval time, verify synced data whether expired for a interval. Default 5 seconds.
# nacos.core.protocol.distro.data.verify.intervalMs=5000
### Distro data verify timeout for one verify, default 3 seconds.
# nacos.core.protocol.distro.data.verify.timeoutMs=3000
### Distro data load retry delay when load snapshot data failed, default 30 seconds.
# nacos.core.protocol.distro.data.load.retryDelayMs=30000
### enable to support prometheus service discovery
#nacos.prometheus.metrics.enabled=true

#*************** Grpc Configurations ***************#

### Sets the maximum message size allowed to be received on the server.
#nacos.remote.server.grpc.sdk.max-inbound-message-size=10485760
### Sets the time(milliseconds) without read activity before sending a keepalive ping. The typical default is two hours.
#nacos.remote.server.grpc.sdk.keep-alive-time=7200000
### Sets a time(milliseconds) waiting for read activity after sending a keepalive ping. Defaults to 20 seconds.
#nacos.remote.server.grpc.sdk.keep-alive-timeout=20000
### Sets a time(milliseconds) that specify the most aggressive keep-alive time clients are permitted to configure. The typical default is 5 minutes
#nacos.remote.server.grpc.sdk.permit-keep-alive-time=300000
### cluster grpc(inside the nacos server) configuration
#nacos.remote.server.grpc.cluster.max-inbound-message-size=10485760
### Sets the time(milliseconds) without read activity before sending a keepalive ping. The typical default is two hours.
#nacos.remote.server.grpc.cluster.keep-alive-time=7200000
### Sets a time(milliseconds) waiting for read activity after sending a keepalive ping. Defaults to 20 seconds.
#nacos.remote.server.grpc.cluster.keep-alive-timeout=20000
### Sets a time(milliseconds) that specify the most aggressive keep-alive time clients are permitted to configure. The typical default is 5 minutes
#nacos.remote.server.grpc.cluster.permit-keep-alive-time=300000

#*************** Config Module Related Configurations ***************#

### the maximum retry times for push
nacos.config.push.maxRetryTime=50

#*************** Naming Module Related Configurations ***************#
### Data dispatch task execution period in milliseconds:

### If enable data warmup. If set to false, the server would accept request without local data preparation:
# nacos.naming.data.warmup=true

### If enable the instance auto expiration, kind like of health check of instance:
# nacos.naming.expireInstance=true

nacos.naming.empty-service.auto-clean=true
nacos.naming.empty-service.clean.initial-delay-ms=50000
nacos.naming.empty-service.clean.period-time-ms=30000


#*************** AI Module Related Configurations ***************#

### Whether nacos ai module is enabled, default true. The ai module need both config module and naming module enabled.
### If false, the new console hides AI registry entries and AI console APIs are disabled.
# nacos.extension.ai.enabled=true

### Whether nacos mcp registry is enabled, default is false.
### When enabled=true, Nacos will start a `mcp registry` server with new port with `nacos.ai.registry.port`
#nacos.ai.mcp.registry.enabled=false

### Whether nacos skill registry is enabled, default is false.
### When enabled=true, Nacos will start a `skill registry` server with new port with `nacos.ai.registry.port`
#nacos.ai.skill.registry.enabled=false

### Nacos AI registry port, default 9080:
### @deprecated: `nacos.ai.mcp.registry.port` is deprecated, use `nacos.ai.registry.port` instead.
nacos.ai.registry.port=9080

#--------------- Nacos Web Server Configurations ---------------#

#*************** Nacos Web Server Related Configurations ***************#
### Nacos Server Web context path:
nacos.server.contextPath=/nacos

#*************** Access Log Related Configurations ***************#
### If turn on the access log:
server.tomcat.accesslog.enabled=true

### accesslog automatic cleaning time
server.tomcat.accesslog.max-days=30

### The access log pattern:
server.tomcat.accesslog.pattern=%h %l %u %t "%r" %s %b %D %{User-Agent}i %{Request-Source}i

### The directory of access log:
server.tomcat.basedir=file:.

#*************** API Related Configurations ***************#
### Include message field
server.error.include-message=ALWAYS

### Enabled for open API compatibility
# nacos.core.api.compatibility.client.enabled=true
### Enabled for admin API compatibility
# nacos.core.api.compatibility.admin.enabled=false
### Enabled for console API compatibility
# nacos.core.api.compatibility.console.enabled=false

#--------------- Nacos Console Configurations ---------------#

#*************** Nacos Console Related Configurations ***************#
### Nacos Console Main port
nacos.console.port=8080
### Nacos Server Web context path:
nacos.console.contextPath=

### Nacos Server context path, which link to nacos server `nacos.server.contextPath`, works when deployment type is `console`
nacos.console.remote.server.context-path=/nacos

#************** Console UI Configuration ***************#

### Turn on/off the nacos console ui.
#nacos.console.ui.enabled=true

### Default console UI version: 'next' (new UI) or 'legacy' (old UI)
#nacos.console.ui.default=next

#--------------- Nacos Plugin Configurations ---------------#

#*************** CMDB Plugin Related Configurations ***************#
### The interval to dump external CMDB in seconds:
# nacos.cmdb.dumpTaskInterval=3600

### The interval of polling data change event in seconds:
# nacos.cmdb.eventTaskInterval=10

### The interval of loading labels in seconds:
# nacos.cmdb.labelTaskInterval=300

### If turn on data loading task:
# nacos.cmdb.loadDataAtStart=false

#*************** Auth Plugin Related Configurations ***************#
### The ignore urls of auth, will be deprecated in the future:
nacos.security.ignore.urls=/,/error,/**/*.css,/**/*.js,/**/*.html,/**/*.map,/**/*.svg,/**/*.png,/**/*.ico,/console-ui/public/**,/next/**,/legacy/**,/v1/auth/**,/v1/console/health/**,/actuator/**,/v1/console/server/**

### The auth system to use, default 'nacos' 'ldap' and 'oidc' is supported, other type should be implemented by yourself:
nacos.core.auth.system.type=nacos

### If turn on auth system:
# Whether open nacos server API auth system. It controls SDK and gRPC request authentication.
# Enable this together with nacos.core.auth.admin.enabled when client-side SDK/gRPC requests also need RBAC checks.
nacos.core.auth.enabled=false
# Whether open nacos admin API auth system. It controls /v3/admin/* HTTP request authentication only.
nacos.core.auth.admin.enabled=true
# Whether open nacos console API auth system. It controls /v3/console/* HTTP request authentication only.
nacos.core.auth.console.enabled=true

### Turn on/off caching of auth information. By turning on this switch, the update of auth information would have a 15 seconds delay.
nacos.core.auth.caching.enabled=true

### worked when nacos.core.auth.enabled=true
### The two properties is the white list for auth and used by identity the request from other server.
nacos.core.auth.server.identity.key=
nacos.core.auth.server.identity.value=

### worked when nacos.core.auth.system.type=nacos or nacos.core.auth.console.enabled=true
### The token expiration in seconds:
nacos.core.auth.plugin.nacos.token.cache.enable=false
nacos.core.auth.plugin.nacos.token.expire.seconds=18000
### The default token (Base64 string):
#nacos.core.auth.plugin.nacos.token.secret.key=VGhpc0lzTXlDdXN0b21TZWNyZXRLZXkwMTIzNDU2Nzg=
nacos.core.auth.plugin.nacos.token.secret.key=

### Allow anonymous read access, default `false`, current only ai(skill, agentspec) supported.
#nacos.core.auth.nacos.anonymous.ai.enabled=true

### worked when nacos.core.auth.system.type=ldap，{0} is Placeholder,replace login username
#nacos.core.auth.ldap.url=ldap://localhost:389
#nacos.core.auth.ldap.basedc=dc=example,dc=org
#nacos.core.auth.ldap.userDn=cn=admin,${nacos.core.auth.ldap.basedc}
#nacos.core.auth.ldap.password=admin
#nacos.core.auth.ldap.userdn=cn={0},dc=example,dc=org
#nacos.core.auth.ldap.filter.prefix=uid
#nacos.core.auth.ldap.case.sensitive=true
#nacos.core.auth.ldap.ignore.partial.result.exception=false

### worked when nacos.core.auth.system.type=oidc
# OIDC issuer URI (for auto-discovery)
#nacos.core.auth.plugin.oidc.issuer-uri=
# OIDC client ID.
#nacos.core.auth.plugin.oidc.client-id=
# OIDC client secret.
#nacos.core.auth.plugin.oidc.client-secret=
# OIDC scopes.
#nacos.core.auth.plugin.oidc.scope=openid
# Token validation method: jwt or introspection.
#nacos.core.auth.plugin.oidc.token-validation-method=
# JWKS cache TTL in seconds.
#nacos.core.auth.plugin.oidc.jwks-cache-ttl-seconds=
# Username claim in ID token.
#nacos.core.auth.plugin.oidc.username-claim=sub
# Roles claim in ID token.
#nacos.core.auth.plugin.oidc.roles-claim=
# Admin role name in OIDC claims.
#nacos.core.auth.plugin.oidc.admin-role=
# Auto create user on first login.
#nacos.core.auth.plugin.oidc.auto-create-user=true
# External authorization endpoint (IdP handles all authorization).
#nacos.core.auth.plugin.oidc.authorization-endpoint=
# Authorization request timeout in milliseconds.
#nacos.core.auth.plugin.authorization-timeout-ms=
# Whether to enforce strict nonce validation.
#nacos.core.auth.plugin.oidc.strict-nonce-validation=false
# Whether to enforce strict audience validation.
#nacos.core.auth.plugin.oidc.strict-audience-validation=false

#*************** Visibility Plugin Related Configurations ***************#
### The default 'nacos' visibility plugin re-use the 'nacos' auth plugin user information, so use this feature should
# enable nacos auth plugin by `nacos.core.auth.enabled`, `nacos.core.auth.admin.enabled`
# and `nacos.core.auth.console.enabled`.
### If turn on visibility plugin:
nacos.plugin.visibility.enabled=true
### The visibility plugin to use, default 'nacos' is supported, other type should be implemented by yourself:
nacos.plugin.visibility.type=nacos

#*************** Control Plugin Related Configurations ***************#
# plugin type
#nacos.plugin.control.manager.type=nacos

# local control rule storage dir, default ${nacos.home}/data/connection and ${nacos.home}/data/tps
#nacos.plugin.control.rule.local.basedir=${nacos.home}

# external control rule storage type, if exist
#nacos.plugin.control.rule.external.storage=

#*************** Config Change Plugin Related Configurations ***************#
# webhook
#nacos.core.config.plugin.webhook.enabled=false
# It is recommended to use EB https://help.aliyun.com/document_detail/413974.html
#nacos.core.config.plugin.webhook.url=http://localhost:8080/webhook/send?token=***
# The content push max capacity ,byte
#nacos.core.config.plugin.webhook.contentMaxCapacity=102400

# whitelist
#nacos.core.config.plugin.whitelist.enabled=false
# The import file suffixs
#nacos.core.config.plugin.whitelist.suffixs=xml,text,properties,yaml,html
# fileformatcheck,which validate the import file of type and content
#nacos.core.config.plugin.fileformatcheck.enabled=false

#*************** Istio Plugin Related Configurations ***************#
### If turn on the MCP server:
nacos.istio.mcp.server.enabled=false

#*************** AI Publish Pipeline Configurations ***************#
# Optional: total switch for ai-pipeline plugin.
#nacos.plugin.ai-pipeline.enabled=true
# Optional: enable pipeline plugins.
#nacos.plugin.ai-pipeline.type=skill-spector,skill-scanner
#nacos.plugin.ai-pipeline.skill-scanner.order=100
# Optional: specify an absolute executable path when PATH resolution differs between shell and server process.
#nacos.plugin.ai-pipeline.skill-scanner.command=/Users/your-user/.local/bin/skill-scanner
# SkillSpector runtime should be installed first with nacos-setup skill-spector install.
# Nacos also checks the default command path: ~/ai-infra/ai-pipeline/bin/skill-spector.
# Configure the command only when the runtime is installed in another path.
#nacos.plugin.ai-pipeline.skill-spector.order=90
#nacos.plugin.ai-pipeline.skill-spector.command=/Users/your-user/ai-infra/ai-pipeline/bin/skill-spector
#nacos.plugin.ai-pipeline.skill-spector.risk-score-threshold=50
# Optional: maximum SkillSpector findings shown in review message, default 20, max 100.
#nacos.plugin.ai-pipeline.skill-spector.max-findings=20
# Optional: SkillSpector runtime log level, default WARNING. Use DEBUG only for troubleshooting.
#nacos.plugin.ai-pipeline.skill-spector.log-level=WARNING
# Optional: enable SkillSpector LLM analysis. Disabled by default; static scan still runs.
#nacos.plugin.ai-pipeline.skill-spector.use-llm=false
# Optional: LLM provider passed to SkillSpector runtime. Use openai for OpenAI-compatible endpoints.
#nacos.plugin.ai-pipeline.skill-spector.provider=openai
# Optional: LLM model override. Leave blank to use the SkillSpector provider default model.
#nacos.plugin.ai-pipeline.skill-spector.model=
# Optional: LLM API key. Do not configure this in shared files when using environment variables.
#nacos.plugin.ai-pipeline.skill-spector.api-key=
# Optional: OpenAI-compatible base URL, mainly used with provider=openai.
#nacos.plugin.ai-pipeline.skill-spector.base-url=
# Optional: auto-publish skill versions after pipeline approval, default false.
#nacos.ai.skill.auto-publish-after-review.enabled=false

#*************** AI Resource Importer Configurations ***************#
# Optional: reopen deprecated legacy MCP import APIs during a compatibility window.
#nacos.ai.resource.import.legacy-mcp-api-enabled=false
# Optional: allow legacy MCP import APIs to fetch user-provided URLs when reopened.
#nacos.ai.resource.import.allow-user-url=false
# Optional: enable the built-in official MCP registry import source. Source id: mcp-official.
nacos.plugin.ai.importer.mcp.official.enabled=true
# Optional: enable the built-in Skill well-known import source. Configure the registry root URL first.
#nacos.plugin.ai.importer.skills.well-known.enabled=true
#nacos.plugin.ai.importer.skills.well-known.url=https://developers.cloudflare.com
# Optional: enable the built-in skills.sh import source. Source id: skills-sh.
nacos.plugin.ai.importer.skills.skills-sh.enabled=true
# Optional: allow non-HTTPS or private-network endpoints only for controlled deployments.
#nacos.plugin.ai.importer.<preset>.allow-http=false
#nacos.plugin.ai.importer.<preset>.allow-private-network=false

#--------------- Nacos Experimental Features Configurations ---------------#

#*************** K8s Related Configurations ***************#
### If turn on the K8s sync:
nacos.k8s.sync.enabled=false

### If use the Java API from an application outside a kubernetes cluster
#nacos.k8s.sync.outsideCluster=false
#nacos.k8s.sync.kubeConfig=/.kube/config