enabledIntegrate the JDBC Datasource with the JTA TransactionManager of Quarkus. This is the default., xaSimilarly to enabled, also enables integration with the JTA TransactionManager of Quarkus, but enabling XA transactions as well. Requires a JDBC driver implementing javax.sql.XADataSource, disabledDisables the Agroal integration with the Narayana TransactionManager. This is typically a bad idea, and is only useful in special cases\: make sure to not use this without having a deep understanding of the implications.
enabledIntegrate the JDBC Datasource with the JTA TransactionManager of Quarkus. This is the default.
The initial size of the pool. Usually you will want to set the initial size to match at least the minimal size, but this is not enforced so to allow for architectures which prefer a lazy initialization of the connections on boot, while being able to sustain a minimal pool size after boot.
When enabled, Agroal will be able to produce a warning when a connection is returned to the pool without the application having closed all open statements. This is unrelated with tracking of open connections. Disable for peak performance, but only when there’s high confidence that no leaks are happening.
Forces connection validation prior to acquisition (foreground validation) regardless of the idle status.
Because of the overhead of performing validation on every call, it’s recommended to rely on default idle validation instead, and to leave this to false.
Require an active transaction when acquiring a connection. Recommended for production. WARNING: Some extensions acquire connections without holding a transaction for things like schema updates and schema validation. Setting this setting to STRICT may lead to failures in those cases.
The exception classes expected to be thrown by the handler. Any exception thrown by the handler that is an instance of a class in this list will not be logged, but will otherwise be handled normally by the lambda runtime. This is useful for avoiding unnecessary stack traces while preserving the ability to log unexpected exceptions.
The handler name. Handler names are specified on handler classes using the @jakarta.inject.Named annotation. If this name is unspecified and there is exactly one unnamed implementation of com.amazonaws.services.lambda.runtime.RequestHandler then this unnamed handler will be used. If there is only a single named handler and the name is unspecified then the named handler will be used.
Environment variable: QUARKUS_LAMBDA_HANDLER
Show more
string
Amazon Lambda AWS Gateway REST API
类型
默认
quarkus.lambda-http.enable-security
Enable security mechanisms to process lambda and AWS based security (i.e. Cognito, IAM) from the http event sent from API Gateway
Regular expression to locate role values within a Cognito claim string. By default it looks for space delimited strings enclosed in brackets "[^\[\] \t]+"
Regular expression to locate role values within a Cognito claim string. By default it looks for space delimited strings enclosed in brackets "[^\[\] \t]+"
If set to true @Inject is automatically added to all non-static non-final fields that are annotated with one of the annotations defined by AutoInjectAnnotationBuildItem.
If set to true, the bytecode of unproxyable beans will be transformed. This ensures that a proxy/subclass can be created properly. If the value is set to false, then an exception is thrown at build time indicating that a subclass/proxy could not be created. Quarkus performs the following transformations when this setting is enabled:
Remove 'final' modifier from classes and methods when a proxy is required.
Create a no-args constructor if needed.
Makes private no-args constructors package-private if necessary.
If set to true, the bytecode of private fields that are injection points will be transformed to package private. This ensures that field injection can be performed completely reflection-free. If the value is set to false, then a reflection fallback is used to perform the injection.
If set to true (the default), the build fails if a private method that is neither an observer nor a producer, is annotated with an interceptor binding. An example of this is the use of Transactional on a private method of a bean. If set to false, Quarkus simply logs a warning that the annotation will be ignored.
The list of selected alternatives for an application.
An element value can be:
a fully qualified class name, i.e. org.acme.Foo
a simple class name as defined by Class#getSimpleName(), i.e. Foo
a package name with suffix .*, i.e. org.acme.*, matches a package
a package name with suffix .**, i.e. org.acme.**, matches a package that starts with the value Each element value is used to match an alternative bean class, an alternative stereotype annotation type or a bean class that declares an alternative producer. If any value matches then the priority of Integer#MAX_VALUE is used for the relevant bean. The priority declared via jakarta.annotation.Priority is overridden.
If set to true then jakarta.enterprise.inject.Produces is automatically added to all non-void methods that are annotated with a scope annotation, a stereotype or a qualifier, and are not annotated with Inject or Produces, and no parameter is annotated with Disposes, Observes or ObservesAsync.
The list of types that should be excluded from discovery.
An element value can be:
a fully qualified class name, i.e. org.acme.Foo
a simple class name as defined by Class#getSimpleName(), i.e. Foo
a package name with suffix .*, i.e. org.acme.*, matches a package
a package name with suffix .**, i.e. org.acme.**, matches a package that starts with the value If any element value matches a discovered type then the type is excluded from discovery, i.e. no beans and observer methods are created from this type.
Environment variable: QUARKUS_ARC_EXCLUDE_TYPES
Show more
list of string
quarkus.arc.unremovable-types
List of types that should be considered unremovable regardless of whether they are directly used or not. This is a configuration option equivalent to using io.quarkus.arc.Unremovable annotation.
An element value can be:
a fully qualified class name, i.e. org.acme.Foo
a simple class name as defined by Class#getSimpleName(), i.e. Foo
a package name with suffix .*, i.e. org.acme.*, matches a package
a package name with suffix .**, i.e. org.acme.**, matches a package that starts with the value If any element value matches a discovered bean, then such a bean is considered unremovable.
If set to true then the container attempts to detect "unused removed beans" false positives during programmatic lookup at runtime. You can disable this feature to conserve some memory when running your application in production.
If set to true then the container attempts to detect wrong usages of annotations and eventually fails the build to prevent unexpected behavior of a Quarkus application.
A typical example is @jakarta.ejb.Singleton which is often confused with @jakarta.inject.Singleton. As a result a component annotated with @jakarta.ejb.Singleton would be completely ignored. Another example is an inner class annotated with a scope annotation - this component would be again completely ignored.
If set to true, the container will perform additional validations mandated by the CDI specification. Some improvements on top of the CDI specification may be disabled. Applications that work as expected in the strict mode should work without a change in the default, non-strict mode.
The strict mode is mainly introduced to allow passing the CDI Lite TCK. Applications are recommended to use the default, non-strict mode, which makes CDI more convenient to use. The "strictness" of the strict mode (the set of additional validations and the set of disabled improvements on top of the CDI specification) may change over time.
Note that transform-unproxyable-classes and remove-unused-beans also has effect on specification compatibility. You may want to disable these features to get behavior closer to the specification.
If set to true and the SmallRye Context Propagation extension is present then the CDI contexts will be propagated by means of the MicroProfile Context Propagation API. Specifically, a org.eclipse.microprofile.context.spi.ThreadContextProvider implementation is registered. On the other hand, if set to false then the MicroProfile Context Propagation API will never be used to propagate the CDI contexts. Note that the CDI contexts may be propagated in a different way though. For example with the Vertx duplicated context.
Default configuration applied to all Caffeine caches (lowest precedence)
类型
默认
quarkus.cache.caffeine.initial-capacity
Minimum total size for the internal data structures. Providing a large enough estimate at construction time avoids the need for expensive resizing operations later, but setting this value unnecessarily high wastes memory.
Maximum number of entries the cache may contain. Note that the cache may evict an entry before this limit is exceeded or temporarily exceed the threshold while evicting. As the cache size grows close to the maximum, the cache evicts entries that are less likely to be used again. For example, the cache may evict an entry because it hasn’t been used recently or very often.
Specifies that each entry should be automatically removed from the cache once a fixed duration has elapsed after the entry’s creation, or the most recent replacement of its value.
Specifies that each entry should be automatically removed from the cache once a fixed duration has elapsed after the entry’s creation, the most recent replacement of its value, or its last read.
Whether or not metrics are recorded if the application depends on the Micrometer extension. Setting this value to true will enable the accumulation of cache stats inside Caffeine.
Minimum total size for the internal data structures. Providing a large enough estimate at construction time avoids the need for expensive resizing operations later, but setting this value unnecessarily high wastes memory.
Maximum number of entries the cache may contain. Note that the cache may evict an entry before this limit is exceeded or temporarily exceed the threshold while evicting. As the cache size grows close to the maximum, the cache evicts entries that are less likely to be used again. For example, the cache may evict an entry because it hasn’t been used recently or very often.
Specifies that each entry should be automatically removed from the cache once a fixed duration has elapsed after the entry’s creation, or the most recent replacement of its value.
Specifies that each entry should be automatically removed from the cache once a fixed duration has elapsed after the entry’s creation, the most recent replacement of its value, or its last read.
Whether or not metrics are recorded if the application depends on the Micrometer extension. Setting this value to true will enable the accumulation of cache stats inside Caffeine.
DOCKER_HOST value to use. If not set, the env var DOCKER_HOST is used, if that is not set the value `unix:///var/run/docker.sock' (or 'npipe:///./pipe/docker_engine' for windows) is used.
The base image to be used when a container image is being produced for the jar build. When the application is built against Java 21 or higher, registry.access.redhat.com/ubi8/openjdk-21-runtime:1.20 is used as the default. Otherwise registry.access.redhat.com/ubi8/openjdk-17-runtime:1.20 is used as the default.
Environment variable: QUARKUS_JIB_BASE_JVM_IMAGE
Show more
string
quarkus.jib.base-native-image
The base image to be used when a container image is being produced for the native binary build. The default is "quay.io/quarkus/quarkus-micro-image". You can also use "registry.access.redhat.com/ubi8/ubi-minimal" which is a bigger base image, but provide more built-in utilities such as the microdnf package manager.
If this is set, then it will be used as the entry point of the container image. There are a few things to be aware of when creating an entry point
Entrypoint "INHERIT" means to inherit entrypoint from base image, jvmArguments field is used for arguments
A valid entrypoint is jar package specific (see quarkus.package.jar.type)
A valid entrypoint depends on the location of both the launching scripts and the application jar file. To that end it’s helpful to remember that when fast-jar packaging is used (the default), all necessary application jars are added to the /work directory and that the same directory is also used as the working directory. When legacy-jar or uber-jar are used, the application jars are unpacked under the /app directory and that directory is used as the working directory.
Even if the jvmArguments field is set, it is ignored completely unless entrypoint is "INHERIT" When this is not set, a proper default entrypoint will be constructed. As a final note, a very useful tool for inspecting container image layers that can greatly aid when debugging problems with endpoints is dive
Environment variable: QUARKUS_JIB_JVM_ENTRYPOINT
Show more
list of string
quarkus.jib.native-entrypoint
If this is set, then it will be used as the entry point of the container image. There are a few things to be aware of when creating an entry point
Entrypoint "INHERIT" means to inherit entrypoint from base image, nativeArguments field is used for arguments
A valid entrypoint depends on the location of both the launching scripts and the native binary file. To that end it’s helpful to remember that the native application is added to the /work directory and that and the same directory is also used as the working directory
Even if the nativeArguments field is set, it is ignored completely unless entrypoint is "INHERIT" When this is not set, a proper default entrypoint will be constructed. As a final note, a very useful tool for inspecting container image layers that can greatly aid when debugging problems with endpoints is dive
Controls the optimization which skips downloading base image layers that exist in a target registry. If the user does not set this property, then read as false. If true, base image layers are always pulled and cached. If false, base image layers will not be pulled/cached if they already exist on the target registry.
List of target platforms. Each platform is defined using the pattern:
<os>|<arch>[/variant]|<os>/<arch>[/variant]
for example:
linux/amd64,linux/arm64/v8
If not specified, OS default is linux and architecture default is amd64. If more than one platform is configured, it is important to note that the base image has to be a Docker manifest or an OCI image index containing a version of each chosen platform. The feature does not work with native images, as cross-compilation is not supported. This configuration is based on an incubating feature of Jib. See Jib FAQ for more information.
Environment variable: QUARKUS_JIB_PLATFORMS
Show more
list of string
quarkus.jib.image-digest-file
The path of a file in which the digest of the generated image will be written. If the path is relative, the base path is the output directory of the build tool.
The path of a file in which the id of the generated image will be written. If the path is relative, the base path is the output directory of the build tool.
Environment variable: QUARKUS_JIB_IMAGE_ID_FILE
Show more
string
jib-image.id
quarkus.jib.offline-mode
Whether or not to operate offline.
Environment variable: QUARKUS_JIB_OFFLINE_MODE
Show more
boolean
false
quarkus.jib.docker-executable-name
Name of binary used to execute the docker commands. This is only used by Jib when the container image is being built locally.
Whether to set the creation time to the actual build time. Otherwise, the creation time will be set to the Unix epoch (00:00:00, January 1st, 1970 in UTC). See Jib FAQ for more information
Whether to set the modification time (last modified time) of the files put by Jib in the image to the actual build time. Otherwise, the modification time will be set to the Unix epoch (00:00:00, January 1st, 1970 in UTC). If the modification time is constant (flag is set to false so Unix epoch is used) across two consecutive builds, the docker layer sha256 digest will be different only if the actual files added by Jib to the docker layer were changed. More exactly, having 2 consecutive builds will generate different docker layers only if the actual content of the files within the docker layer was changed. If the current timestamp is used the sha256 digest of the docker layer will always be different even if the content of the files didn’t change.
The base image to be used when a container image is being produced for the jar build. The value of this property is used to create an ImageStream for the builder image used in the Openshift build. When it references images already available in the internal Openshift registry, the corresponding streams are used instead. When the application is built against Java 21 or higher, registry.access.redhat.com/ubi8/openjdk-21:1.20 is used as the default. Otherwise registry.access.redhat.com/ubi8/openjdk-17:1.20 is used as the default.
The base image to be used when a container image is being produced for the native binary build. The value of this property is used to create an ImageStream for the builder image used in the Openshift build. When it references images already available in the internal Openshift registry, the corresponding streams are used instead.
The directory where the jar is added during the assemble phase. This is dependent on the S2I image and should be supplied if a non default image is used.
The directory where the native binary is added during the assemble phase. This is dependent on the S2I image and should be supplied if a non-default image is used.
The resulting filename of the native binary in the S2I image. This option may be used if the selected S2I image uses a fixed name for the native binary.
The base image to be used when a container image is being produced for the jar build. When the application is built against Java 21 or higher, registry.access.redhat.com/ubi8/openjdk-21:1.20 is used as the default. Otherwise registry.access.redhat.com/ubi8/openjdk-17:1.20 is used as the default.
Environment variable: QUARKUS_S2I_BASE_JVM_IMAGE
Show more
string
quarkus.s2i.base-native-image
The base image to be used when a container image is being produced for the native binary build
The directory where the jar is added during the assemble phase. This is dependent on the S2I image and should be supplied if a non default image is used.
Environment variable: QUARKUS_S2I_JAR_DIRECTORY
Show more
string
/deployments/target/
quarkus.s2i.jar-file-name
The resulting filename of the jar in the S2I image. This option may be used if the selected S2I image uses a fixed name for the jar.
Environment variable: QUARKUS_S2I_JAR_FILE_NAME
Show more
string
quarkus.s2i.native-binary-directory
The directory where the native binary is added during the assemble phase. This is dependent on the S2I image and should be supplied if a non-default image is used.
The resulting filename of the native binary in the S2I image. This option may be used if the selected S2I image uses a fixed name for the native binary.
The default value for java.awt.headless JVM option. Switching this option affects linking of awt libraries.
Environment variable: QUARKUS_NATIVE_HEADLESS
Show more
boolean
true
quarkus.native.file-encoding
Defines the file encoding as in -Dfile.encoding=…. Native image runtime uses the host’s (i.e. build time) value of file.encoding system property. We intentionally default this to UTF-8 to avoid platform specific defaults to be picked up which can then result in inconsistent behavior in the generated native executable.
If the native image build should wait for a debugger to be attached before running. This is an advanced option and is generally only intended for those familiar with GraalVM internals
If a JVM based 'fallback image' should be created if native image fails. This is not recommended, as this is functionally the same as just running the application in a JVM
If the bytecode of all proxies should be dumped for inspection
Environment variable: QUARKUS_NATIVE_DUMP_PROXIES
Show more
boolean
false
quarkus.native.container-build
If this build should be done using a container runtime. Unless container-runtime is also set, docker will be used by default. If docker is not available or is an alias to podman, podman will be used instead as the default.
Explicit configuration option to generate a native Position Independent Executable (PIE) for Linux. If the system supports PIE generation, the default behaviour is to disable it for performance reasons. However, some systems can only run position-independent executables, so this option enables the generation of such native executables.
Environment variable: QUARKUS_NATIVE_PIE
Show more
boolean
quarkus.native.march
Generate instructions for a specific machine type. Defaults to x86-64-v3 on AMD64 and armv8-a on AArch64. Use compatibility for best compatibility, or native for best performance if a native executable is deployed on the same machine or on a machine with the same CPU features. A list of all available machine types is available by executing native-image -march=list
Environment variable: QUARKUS_NATIVE_MARCH
Show more
string
quarkus.native.remote-container-build
If this build is done using a remote docker daemon.
The docker image to use to do the image build. It can be one of graalvm, mandrel, or the full image path, e.g. quay.io/quarkus/ubi-quarkus-mandrel-builder-image:jdk-21.
The strategy for pulling the builder image during the build.
Defaults to 'always', which will always pull the most up-to-date image; useful to keep up with fixes when a (floating) tag is updated.
Use 'missing' to only pull if there is no image locally; useful on development environments where building with out-of-date images is acceptable and bandwidth may be limited.
Use 'never' to fail the build if there is no image locally.
alwaysAlways pull the most recent image., missingOnly pull the image if it’s missing locally., neverNever pull any image; fail if the image is missing locally.
alwaysAlways pull the most recent image.
quarkus.native.container-runtime
The container runtime (e.g. docker) that is used to do an image based build. If this is set then a container build is always done.
If errors should be reported at runtime. This is a more relaxed setting, however it is not recommended as it means your application may fail at runtime if an unsupported feature is used by accident.
Don’t build a native image if it already exists. This is useful if you have already built an image and you want to use Quarkus to deploy it somewhere. Note that this is not able to detect if the existing image is outdated, if you have modified source or config and want a new image you must not use this flag.
A comma separated list of globs to match resource paths that should be added to the native image.
Use slash (/) as a path separator on all platforms. Globs must not start with slash.
By default, no resources are included.
Example: Given that you have src/main/resources/ignored.png and src/main/resources/foo/selected.png in your source tree and one of your dependency JARs contains bar/some.txt file, with the following configuration
the files src/main/resources/foo/selected.png and bar/some.txt will be included in the native image, while src/main/resources/ignored.png will not be included.
Supported glob features Feature Description * Matches a (possibly empty) sequence of characters that does not contain slash (/) ** Matches a (possibly empty) sequence of characters that may contain slash (/) ? Matches one character, but not slash [abc] Matches one character given in the bracket, but not slash [a-z] Matches one character from the range given in the bracket, but not slash [!abc] Matches one character not named in the bracket; does not match slash [a-z] Matches one character outside the range given in the bracket; does not match slash {one,two,three} Matches any of the alternating tokens separated by comma; the tokens may contain wildcards, nested alternations and ranges \ The escape character
Note that there are three levels of escaping when passing this option via application.properties:
application.properties parser
MicroProfile Config list converter that splits the comma separated list
Glob parser All three levels use backslash (\) as the escaping character. So you need to use an appropriate number of backslashes depending on which level you want to escape.
Note that Quarkus extensions typically include the resources they require by themselves. This option is useful in situations when the built-in functionality is not sufficient.
A comma separated list of globs to match resource paths that should not be added to the native image.
Use slash (/) as a path separator on all platforms. Globs must not start with slash.
Please refer to includes for details about the glob syntax.
By default, no resources are excluded.
Example: Given that you have src/main/resources/red.png and src/main/resources/foo/green.png in your source tree and one of your dependency JARs contains bar/blue.png file, with the following configuration
the resource red.png will be available in the native image while the resources foo/green.png and bar/blue.png will not be available in the native image.
Allows passing extra arguments to the UPX command line (like --brute). The arguments are comma-separated. The exhaustive list of parameters can be found in https://github.com/upx/upx/blob/devel/doc/upx.pod.
Configuration files generated by the Quarkus build, using native image agent, are informative by default. In other words, the generated configuration files are presented in the build log but are not applied. When this option is set to true, generated configuration files are applied to the native executable building process.
Enabling this option should be done with care, because it can make native image configuration and/or behaviour dependant on other non-obvious factors. For example, if the native image agent generated configuration was generated from running JVM unit tests, disabling test(s) can result in a different native image configuration being generated, which in turn can misconfigure the native executable or affect its behaviour in unintended ways.
If set to true, the workspace initialization will be based on the effective POMs (i.e. properly interpolated, including support for profiles) instead of the raw ones.
If set to true, workspace discovery will be enabled for all launch modes. Usually, workspace discovery is enabled by default only for dev and test modes.
By default, the bootstrap mechanism will create a shared cache of open JARs for Quarkus classloaders to reduce the total number of opened ZIP FileSystems in dev and test modes. Setting system property quarkus.bootstrap.disable-jar-cache to true will make Quarkus classloaders create a new ZIP FileSystem for each JAR classpath element every time it is added to a Quarkus classloader.
A temporary option introduced to avoid a logging warning when ``-Dquarkus.bootstrap.incubating-model-resolver} is added to the build command line. This option enables an incubating implementation of the Quarkus Application Model resolver. This option will be removed as soon as the incubating implementation becomes the default one.
Prefill core thread pool. The core thread pool will be initialised with the core number of threads at startup
Environment variable: QUARKUS_THREAD_POOL_PREFILL
Show more
boolean
true
quarkus.thread-pool.max-threads
The maximum number of threads. If this is not specified then it will be automatically sized to the greatest of 8 * the number of available processors and 200. For example if there are 4 processors the max threads will be 200. If there are 48 processors it will be 384.
The executor growth resistance. A resistance factor applied after the core pool is full; values applied here will cause that fraction of submissions to create new threads when no idle thread is available. A value of 0.0f implies that threads beyond the core size should be created as aggressively as threads within it; a value of 1.0f implies that threads beyond the core size should never be created.
The shutdown timeout. If all pending work has not been completed by this time then additional threads will be spawned to attempt to finish any pending tasks, and the shutdown process will continue
The amount of time to wait for thread pool shutdown before tasks should be interrupted. If this value is greater than or equal to the value for shutdown-timeout, then tasks will not be interrupted before the shutdown timeout occurs.
The frequency at which the status of the thread pool should be checked during shutdown. Information about waiting tasks and threads will be checked and possibly logged at this interval. Setting this key to an empty value disables the shutdown check interval.
Whether the live-reload feature should be enabled.
Environment variable: QUARKUS_LIVE_RELOAD_ENABLED
Show more
boolean
true
quarkus.live-reload.instrumentation
Whether Quarkus should enable its ability to not do a full restart when changes to classes are compatible with JVM instrumentation. If this is set to true, Quarkus will perform class redefinition when possible.
By default, Quarkus will install a non-functional JNDI initial context, to help mitigate against Log4Shell style attacks. If your application does need to use JNDI you can change this flag.
fast-jarThe "fast JAR" packaging type., uber-jarThe "Uber-JAR" packaging type., mutable-jarThe "mutable JAR" packaging type (for remote development mode)., legacy-jarThe "legacy JAR" packaging type. This corresponds to the packaging type used in Quarkus before version 1.12.
fast-jarThe "fast JAR" packaging type.
quarkus.package.jar.compress
Whether the created jar will be compressed. This setting is not used when building a native image
Custom manifest attributes to be added to the main section of the MANIFEST.MF file. An example of the user defined property: quarkus.package.jar.manifest.attributes."Entry-key1"=Value1 quarkus.package.jar.manifest.attributes."Entry-key2"=Value2
Custom manifest sections to be added to the MANIFEST.MF file. An example of the user defined property: quarkus.package.jar.manifest.sections."Section-Name"."Entry-Key1"=Value1 quarkus.package.jar.manifest.sections."Section-Name"."Entry-Key2"=Value2
List of all the dependencies that have been defined as optional to include into the final package of the application. Each optional dependency needs to be expressed in the following format:
groupId:artifactId[:[classifier][:[type]]]
With the classifier and type being optional (note that the brackets ([]) denote optionality and are not a part of the syntax specification). The group ID and artifact ID must be present and non-empty.
If the type is missing, the artifact is assumed to be of type jar.
This parameter is optional; if absent, no optional dependencies will be included into the final package of the application.
For backward compatibility reasons, this parameter is ignored by default and can be enabled by setting the parameter quarkus.package.jar.filter-optional-dependencies to true.
This parameter is meant to be used in modules where multi-builds have been configured to avoid getting a final package with unused dependencies.
Indicates whether the generated JAR file should have the runner suffix appended. Only applicable to the JarType#UBER_JAR uber-JAR output type. If disabled, the JAR built by the original build system (Maven, Gradle, etc.) will be replaced with the Quarkus-built uber-JAR.
Whether to automate the creation of AppCDS. Furthermore, this option only works for Java 11+ and is considered experimental for the time being. Finally, care must be taken to use the same exact JVM version when building and running the application.
When AppCDS generation is enabled, if this property is set, then the JVM used to generate the AppCDS file will be the JVM present in the container image. The builder image is expected to have the 'java' binary on its PATH. This flag is useful when the JVM to be used at runtime is not the same exact JVM version as the one used to build the jar. Note that this property is consulted only when quarkus.package.jar.appcds.enabled=true and it requires having docker available during the build.
Whether creation of the AppCDS archive should run in a container if available.
Normally, if either a suitable container image to use to create the AppCDS archive can be determined automatically or if one is explicitly set using the quarkus.<package-type>.appcds.builder-image setting, the AppCDS archive is generated by running the JDK contained in the image as a container.
If this option is set to false, a container will not be used to generate the AppCDS archive. Instead, the JDK used to build the application is also used to create the archive. Note that the exact same JDK version must be used to run the application in this case.
Ignored if quarkus.package.jar.appcds.enabled is set to false.
This is an advanced option that only takes effect for development mode.
If this is specified a directory of this name will be created in the jar distribution. Users can place jar files in this directory, and when re-augmentation is performed these will be processed and added to the class-path.
Note that before reaugmentation has been performed these jars will be ignored, and if they are updated the app should be reaugmented again.
If this option is true then a list of all the coordinates of the artifacts that made up this image will be included in the quarkus-app directory. This list can be used by vulnerability scanners to determine if your application has any vulnerable dependencies. Only supported for the JarType#FAST_JAR fast JAR and JarType#MUTABLE_JAR mutable JAR output types.
The entry point of the application. This can either be a fully qualified name of a standard Java class with a main method, or io.quarkus.runtime.QuarkusApplication.
If your application has main classes annotated with io.quarkus.runtime.annotations.QuarkusMain then this can also reference the name given in the annotation, to avoid the need to specify fully qualified names in the config.
Environment variable: QUARKUS_PACKAGE_MAIN_CLASS
Show more
string
quarkus.package.output-directory
The directory into which the output package(s) should be written. Relative paths are resolved from the build systems target directory.
Setting this switch to true will cause Quarkus to write the transformed application bytecode to the build tool’s output directory. This is useful for post-build tools that need to scan the application bytecode (for example, offline code-coverage tools).
For example, if using Maven, enabling this feature will result in the classes in target/classes being replaced with classes that have been transformed by Quarkus.
Setting this to true, however, should be done with a lot of caution and only if subsequent builds are done in a clean environment (i.e. the build tool’s output directory has been completely cleaned).
What should happen if the application is started with a different build time configuration than it was compiled against. This may be useful to prevent misconfiguration.
If this is set to warn the application will warn at start up.
If this is set to fail the application will fail at start up.
Native tests leveraging`@io.quarkus.test.junit.TestProfile` are always run with quarkus.configuration.build-time-mismatch-at-runtime = fail.
If continuous testing is enabled. The default value is 'paused', which will allow you to start testing from the console or the Dev UI, but will not run tests on startup. If this is set to 'enabled' then testing will start as soon as the application has started. If this is 'disabled' then continuous testing is not enabled, and can’t be enabled without restarting the application.
Tags that should be included for continuous testing. This supports JUnit Tag Expressions.
Environment variable: QUARKUS_TEST_INCLUDE_TAGS
Show more
list of string
quarkus.test.exclude-tags
Tags that should be excluded by default with continuous testing. This is ignored if include-tags has been set. Defaults to 'slow'. This supports JUnit Tag Expressions.
Environment variable: QUARKUS_TEST_EXCLUDE_TAGS
Show more
list of string
slow
quarkus.test.include-pattern
Tests that should be included for continuous testing. This is a regular expression and is matched against the test class name (not the file name).
Tests that should be excluded with continuous testing. This is a regular expression and is matched against the test class name (not the file name). This is ignored if include-pattern has been set.
Changes tests to use the 'flat' ClassPath used in Quarkus 1.x versions. This means all Quarkus and test classes are loaded in the same ClassLoader, however it means you cannot use continuous testing. Note that if you find this necessary for your application then you may also have problems running in development mode, which cannot use a flat class path.
A comma separated list of profiles (dev, test, prod or custom profiles) to use when testing using @QuarkusTest
Environment variable: QUARKUS_TEST_PROFILE
Show more
list of string
test
quarkus.test.profile.tags
The tags this profile is associated with. When the quarkus.test.profile.tags System property is set (its value is a comma separated list of strings) then Quarkus will only execute tests that are annotated with a @TestProfile that has at least one of the supplied (via the aforementioned system property) tags.
Environment variable: QUARKUS_TEST_PROFILE_TAGS
Show more
list of string
quarkus.test.container.network
Controls the container network to be used when @QuarkusIntegration needs to launch the application in a container. This setting only applies if Quarkus does not need to use a shared network - which is the case if DevServices are used when running the test.
Additional launch parameters to be used when Quarkus launches the produced artifact for @QuarkusIntegrationTest When the artifact is a jar, this string is passed right after the java command. When the artifact is a container, this string is passed right after the docker run command. When the artifact is a native binary, this string is passed right after the native binary name.
Environment variable: QUARKUS_TEST_ARG_LINE
Show more
list of string
quarkus.test.env."environment-variable-name"
Additional environment variables to be set in the process that @QuarkusIntegrationTest launches.
Configures the hang detection in @QuarkusTest. If no activity happens (i.e. no test callbacks are called) over this period then QuarkusTest will dump all threads stack traces, to help diagnose a potential hang. Note that the initial timeout (before Quarkus has started) will only apply if provided by a system property, as it is not possible to read all config sources until Quarkus has booted.
The type of test to run, this can be either: quarkus-test: Only runs @QuarkusTest annotated test classes unit: Only runs classes that are not annotated with @QuarkusTest all: Runs both, running the unit tests first
Environment variable: QUARKUS_TEST_TYPE
Show more
unit, quarkus-test, all
all
quarkus.test.only-test-application-module
If this is true then only the tests from the main application module will be run (i.e. the module that is currently running mvn quarkus:dev). If this is false then tests from all dependency modules will be run as well.
Modules that should be excluded for continuous testing. This is a regular expression and is matched against the module groupId:artifactId. This is ignored if include-module-pattern has been set.
Detection mode of invalid usage of execution model annotations.
An execution model annotation is @Blocking, @NonBlocking and @RunOnVirtualThread. These annotations may only be used on "entrypoint" methods (methods invoked by various frameworks in Quarkus); using them on methods that can only be invoked by application code is invalid.
failInvalid usage of execution model annotations causes build failure., warnInvalid usage of execution model annotations causes warning during build., disabledNo detection of invalid usage of execution model annotations.
failInvalid usage of execution model annotations causes build failure.
quarkus.analytics.disabled
If Build time analytics are disabled.
Environment variable: QUARKUS_ANALYTICS_DISABLED
Show more
boolean
quarkus.analytics.uri.base
The Segment base URI.
Environment variable: QUARKUS_ANALYTICS_URI_BASE
Show more
string
quarkus.analytics.timeout
The Timeout to send the build time analytics to segment.
Environment variable: QUARKUS_ANALYTICS_TIMEOUT
Show more
int
3000
quarkus.snapstart.enable
Enable/Disable SnapStart integration
Default value is dependent on extensions deployed (i.e. when using AWS Lambda extensions, this will be set to true by default)
Environment variable: QUARKUS_SNAPSTART_ENABLE
Show more
boolean
quarkus.snapstart.preload-classes
Will do a classpath search for all META-INF/quarkus-preload-classes.txt files These files contain fully qualified classnames that should be loaded in the SnapStart/CRaC beforeCheckpoint() phase.
Start the full application during the snapshotting process. In other words, when enabled, it performs Application.start() within SnapStart/CRaC beforeCheckpoint() phase.
File in which the configuration dump should be stored. If not configured, the file-prefix and file-suffix will be used to generate the final file name. If the configured file path is absolute, the directory option will be ignored. Otherwise, the path will be considered relative to the directory.
A list of config properties whose values should be hashed in the report. The values will be hashed using SHA-512 algorithm. GLOB patterns could be used instead of property names.
If console logging should go to System#err instead of System#out.
Environment variable: QUARKUS_LOG_CONSOLE_STDERR
Show more
boolean
false
quarkus.log.console.format
The log format. Note that this value is ignored if an extension is present that takes control of console formatting (e.g., an XML or JSON-format extension).
Specify how much the colors should be darkened. Note that this value is ignored if an extension is present that takes control of console formatting (e.g., an XML or JSON-format extension).
Environment variable: QUARKUS_LOG_CONSOLE_DARKEN
Show more
int
0
quarkus.log.console.filter
The name of the filter to link to the console handler.
Set to true to truncate the message if it exceeds maximum length
Environment variable: QUARKUS_LOG_SYSLOG_TRUNCATE
Show more
boolean
true
quarkus.log.syslog.block-on-reconnect
Enables or disables blocking when attempting to reconnect a org.jboss.logmanager.handlers.SyslogHandler.Protocol#TCP
TCP or org.jboss.logmanager.handlers.SyslogHandler.Protocol#SSL_TCP SSL TCP protocol
The log format. Note that this value is ignored if an extension is present that takes control of console formatting (e.g., an XML or JSON-format extension).
Specify how much the colors should be darkened. Note that this value is ignored if an extension is present that takes control of console formatting (e.g., an XML or JSON-format extension).
Enables or disables blocking when attempting to reconnect a org.jboss.logmanager.handlers.SyslogHandler.Protocol#TCP
TCP or org.jboss.logmanager.handlers.SyslogHandler.Protocol#SSL_TCP SSL TCP protocol
Artifacts that are loaded in a parent first manner. This can be used to work around issues where a given class needs to be loaded by the system ClassLoader. Note that if you make a library parent first all its dependencies should generally also be parent first.
Artifacts should be configured as a comma separated list of artifact ids, with the group, artifact-id and optional classifier separated by a colon.
This config property can only be set in application.properties
Artifacts that are loaded in the runtime ClassLoader in dev mode, so they will be dropped and recreated on change.
This is an advanced option, it should only be used if you have a problem with libraries holding stale state between reloads. Note that if you use this any library that depends on the listed libraries will also need to be reloadable.
This setting has no impact on production builds.
Artifacts should be configured as a comma separated list of artifact ids, with the group, artifact-id and optional classifier separated by a colon.
This config property can only be set in application.properties
Artifacts that will never be loaded by the class loader, and will not be packed into the final application. This allows you to explicitly remove artifacts from your application even though they may be present on the class path.
Resources that should be removed/hidden from dependencies.
This allows for classes and other resources to be removed from dependencies, so they are not accessible to the application. This is a map of artifact id (in the form group:artifact) to a list of resources to be removed.
When running in dev and test mode these resources are hidden from the ClassLoader, when running in production mode these files are removed from the jars that contain them.
Note that if you want to remove a class you need to specify the class file name. e.g. to remove com.acme.Foo you would specify com/acme/Foo.class.
Note that for technical reasons this is not supported when running with JBang.
A comma separated list of profiles that will be active when Quarkus launches.
Environment variable: QUARKUS_PROFILE
Show more
list of string
quarkus.config.profile.parent
Accepts a single configuration profile name. If a configuration property cannot be found in the current active profile, the config performs the same lookup in the profile set by this configuration.
Additional config locations to be loaded with the Config. The configuration support multiple locations separated by a comma and each must represent a valid java.net.URI.
Enable logging of configuration values lookup in DEBUG log level.
The log of configuration values require the category set to DEBUG in the io.smallrye.config category: quarkus.log.category."io.smallrye.config".level=DEBUG.
Environment variable: QUARKUS_CONFIG_LOG_VALUES
Show more
boolean
quarkus.uuid
A property that allows accessing a generated UUID. It generates that UUID at startup time. So it changes between two starts including in dev mode.
Access this generated UUID using expressions: ${quarkus.uuid}.
Environment variable: QUARKUS_UUID
Show more
string
quarkus.shutdown.delay-enabled
Whether Quarkus should wait between shutdown being requested and actually initiated. This delay gives the infrastructure time to detect that the application instance is shutting down and stop routing traffic to it.
The timeout to wait for running requests to finish. If this is not set then the application will exit immediately. Setting this timeout will incur a small performance penalty, as it requires active requests to be tracked.
Delay between shutdown being requested and actually initiated. Also called the pre-shutdown phase. In pre-shutdown, the server continues working as usual, except a readiness probe starts reporting "down" (if the smallrye-health extension is present). This gives the infrastructure time to detect that the application instance is shutting down and stop routing traffic to it. Notice that this property will only take effect if quarkus.shutdown.delay-enabled is explicitly set to true.
Whether or not datasource metrics are published in case a metrics extension is present.
This is a global setting and is not specific to a datasource.
This is different from the "jdbc.enable-metrics" property that needs to be set on the JDBC datasource level to enable collection of metrics for that datasource.
The kind of database we will connect to (e.g. h2, postgresql…).
Environment variable: QUARKUS_DATASOURCE_DB_KIND
Show more
string
quarkus.datasource.db-version
quarkus.datasource."datasource-name".db-version
The version of the database we will connect to (e.g. '10.0').
The version number set here should follow the same numbering scheme
as the string returned by java.sql.DatabaseMetaData#getDatabaseProductVersion()
for your database’s JDBC driver.
This numbering scheme may be different from the most popular one for your database;
for example Microsoft SQL Server 2016 would be version 13.
As a rule, the version set here should be as high as possible,
but must be lower than or equal to the version of any database your application will connect to.
A high version will allow better performance and using more features
(e.g. Hibernate ORM may generate more efficient SQL,
avoid workarounds and take advantage of more database features),
but if it is higher than the version of the database you want to connect to,
it may lead to runtime exceptions
(e.g. Hibernate ORM may generate invalid SQL that your database will reject).
Some extensions (like the Hibernate ORM extension)
will try to check this version against the actual database version on startup,
leading to a startup failure when the actual version is lower
or simply a warning in case the database cannot be reached.
The default for this property is specific to each extension;
the Hibernate ORM extension will default to the oldest version it supports.
If the datasource is not active, it won’t start with the application,
and accessing the corresponding Datasource CDI bean will fail,
meaning in particular that consumers of this datasource
(e.g. Hibernate ORM persistence units) will fail to start unless they are inactive too.
This is a bean name (as in @Named) of a bean that implements CredentialsProvider. It is used to select the credentials provider bean when multiple exist. This is unnecessary when there is only one credentials provider available.
For Vault, the credentials provider bean name is vault-credentials-provider.
The map key corresponds to the host location; the map value is the container location. If the host location starts with "classpath:", the mapping loads the resource from the classpath with read-only permission.
When using a file system location, the volume will be generated with read-write permission, potentially leading to data loss or modification in your file system.
This has no effect if the provider is not a container-based database, such as H2 or Derby.
Whether to keep Dev Service containers running after a dev mode session or test suite execution
to reuse them in the next dev mode session or test suite execution.
Within a dev mode session or test suite execution,
Quarkus will always reuse Dev Services as long as their configuration
(username, password, environment, port bindings, …) did not change.
This feature is specifically about keeping containers running
when Quarkus is not running to reuse them across runs.
This feature needs to be enabled explicitly in testcontainers.properties,
may require changes to how you configure data initialization in dev mode and tests,
and may leave containers running indefinitely, forcing you to stop and remove them manually.
See this section of the documentation for more information.
This configuration property is set to true by default,
so it is mostly useful to disable reuse,
if you enabled it in testcontainers.properties
but only want to use it for some of your Quarkus applications or datasources.
The HTTP root path. All web content will be served relative to this root path.
Environment variable: QUARKUS_HTTP_ROOT_PATH
Show more
string
/
quarkus.http.auth.basic
If basic auth should be enabled. If both basic and form auth is enabled then basic auth will be enabled in silent mode. The basic auth is enabled by default if no authentication mechanisms are configured or Quarkus can safely determine that basic authentication is required.
If this is true and credentials are present then a user will always be authenticated before the request progresses. If this is false then an attempt will only be made to authenticate the user if a permission check is performed or the current user is required for some other reason.
Environment variable: QUARKUS_HTTP_AUTH_PROACTIVE
Show more
boolean
true
quarkus.http.ssl.client-auth
Configures the engine to require/request client authentication. NONE, REQUEST, REQUIRED.
When set to REQUIRED, it’s recommended to also set quarkus.http.insecure-requests=disabled to disable the plain HTTP port. If quarkus.http.insecure-requests is not set, but this parameter is set to REQUIRED, then, quarkus.http.insecure-requests is automatically set to disabled.
If this is true then only a virtual channel will be set up for vertx web. We have this switch for testing purposes.
Environment variable: QUARKUS_HTTP_VIRTUAL
Show more
boolean
false
quarkus.http.non-application-root-path
A common root path for non-application endpoints. Various extension-provided endpoints such as metrics, health,
and openapi are deployed under this path by default.
<p>
* Relative path (Default, q) →
Non-application endpoints will be served from
${quarkus.http.root-path}/${quarkus.http.non-application-root-path}.
* Absolute path (/q) →
Non-application endpoints will be served from the specified path.
* ${quarkus.http.root-path} → Setting this path to the same value as HTTP root path disables
this root path. All extension-provided endpoints will be served from ${quarkus.http.root-path}.
<p>
If the management interface is enabled, the root path for the endpoints exposed on the management interface
is configured using the quarkus.management.root-path property instead of this property.
If enabled then the response body is compressed if the Content-Type header is set and the value is a compressed media type as configured via compress-media-types.
Note that the RESTEasy Reactive and Reactive Routes extensions also make it possible to enable/disable compression declaratively using the annotations io.quarkus.vertx.http.Compressed and io.quarkus.vertx.http.Uncompressed.
If user adds br, then brotli will be added to the list of supported compression algorithms. It implies loading libbrotli native library via JNI and in case of native image, packing the native library into the native image as a resource thus inflating its size. Note that a native shared object library must be available for your platform in Brotli4J project.
Client expresses its capability by sending Accept-Encoding header, e.g. Accept-Encoding: deflate, gzip, br Server chooses the compression algorithm based on the client’s capabilities and marks it in a response header, e.g.: content-encoding: gzip
Environment variable: QUARKUS_HTTP_COMPRESSORS
Show more
list of string
gzip,deflate
quarkus.http.compress-media-types
List of media types for which the compression should be enabled automatically, unless declared explicitly via Compressed or Uncompressed.
In dev/test mode this defaults to localhost, in prod mode this defaults to 0.0.0.0
Defaulting to 0.0.0.0 makes it easier to deploy Quarkus to container, however it is not suitable for dev/test mode as other people on the network can connect to your development machine.
As an exception, when running in Windows Subsystem for Linux (WSL), the HTTP host defaults to 0.0.0.0 even in dev/test mode since using localhost makes the application inaccessible.
Environment variable: QUARKUS_HTTP_HOST
Show more
string
required
quarkus.http.test-host
Used when QuarkusIntegrationTest is meant to execute against an application that is already running and listening on the host specified by this property.
Environment variable: QUARKUS_HTTP_TEST_HOST
Show more
string
quarkus.http.host-enabled
Enable listening to host:port
Environment variable: QUARKUS_HTTP_HOST_ENABLED
Show more
boolean
true
quarkus.http.ssl-port
The HTTPS port
Environment variable: QUARKUS_HTTP_SSL_PORT
Show more
int
8443
quarkus.http.test-ssl-port
The HTTPS port used to run tests
Environment variable: QUARKUS_HTTP_TEST_SSL_PORT
Show more
int
8444
quarkus.http.test-ssl-enabled
Used when QuarkusIntegrationTest is meant to execute against an application that is already running to configure the test to use SSL.
If insecure (i.e. http rather than https) requests are allowed. If this is enabled then http works as normal. redirect will still open the http port, but all requests will be redirected to the HTTPS port. disabled will prevent the HTTP port from opening at all.
Default is enabled except when client auth is set to required (configured using quarkus.http.ssl.client-auth=required). In this case, the default is disabled.
If this is true (the default) then HTTP/2 will be enabled.
Note that for browsers to be able to use it HTTPS must be enabled, and you must be running on JDK11 or above, as JDK8 does not support ALPN.
Environment variable: QUARKUS_HTTP_HTTP2
Show more
boolean
true
quarkus.http.http2-push-enabled
Enables or Disable the HTTP/2 Push feature. This setting can be used to disable server push. The server will not send a PUSH_PROMISE frame if it receives this parameter set to @{code false}.
The CredentialsProvider. If this property is configured, then a matching 'CredentialsProvider' will be used to get the keystore, keystore key, and truststore passwords unless these passwords have already been configured.
Please note that using MicroProfile ConfigSource which is directly supported by Quarkus Configuration should be preferred unless using CredentialsProvider provides for some additional security and dynamism.
This is a bean name (as in @Named) of a bean that implements CredentialsProvider. It is used to select the credentials provider bean when multiple exist. This is unnecessary when there is only one credentials provider available.
For Vault, the credentials provider bean name is vault-credentials-provider.
An optional parameter to specify a provider of the keystore file. If not given, the provider is automatically detected based on the keystore file type.
An optional parameter to select a specific key in the keystore. When SNI is disabled, and the keystore contains multiple keys and no alias is specified; the behavior is undefined.
An optional parameter to define the password for the key, in case it is different from key-store-password If not given, it might be retrieved from CredentialsProvider.
An optional parameter to specify a provider of the trust store file. If not given, the provider is automatically detected based on the trust store file type.
When set, the configured certificate will be reloaded after the given period. Note that the certificate will be reloaded only if the file has been modified.
Also, the update can also occur when the TLS certificate is configured using paths (and not in-memory).
The reload period must be equal or greater than 30 seconds. If not set, the certificate will not be reloaded.
It’s recommended to use the TLS registry to handle the certificate reloading.
Sets the ordered list of enabled SSL/TLS protocols.
If not set, it defaults to "TLSv1.3, TLSv1.2". The following list of protocols are supported: TLSv1, TLSv1.1, TLSv1.2, TLSv1.3. To only enable TLSv1.3, set the value to to "TLSv1.3".
Note that setting an empty list, and enabling SSL/TLS is invalid. You must at least have one protocol.
Environment variable: QUARKUS_HTTP_SSL_PROTOCOLS
Show more
list of string
TLSv1.3,TLSv1.2
quarkus.http.ssl.sni
Enables Server Name Indication (SNI), an TLS extension allowing the server to use multiple certificates. The client indicate the server name during the TLS handshake, allowing the server to select the right certificate.
Environment variable: QUARKUS_HTTP_SSL_SNI
Show more
boolean
false
quarkus.http.tls-configuration-name
The name of the TLS configuration to use.
If not set and the default TLS configuration is configured (quarkus.tls.*) then that will be used. If a name is configured, it uses the configuration from quarkus.tls.<name>.* If a name is configured, but no TLS configuration is found with that name then an error will be thrown.
If no TLS configuration is set, and quarkus.tls.* is not configured, then, quarkus.http.ssl will be used.
The number if IO threads used to perform IO. This will be automatically set to a reasonable value based on the number of CPU cores if it is not provided. If this is set to a higher value than the number of Vert.x event loops then it will be capped at the number of event loops.
In general this should be controlled by setting quarkus.vertx.event-loops-pool-size, this setting should only be used if you want to limit the number of HTTP io threads to a smaller number than the total number of IO threads.
Http connection read timeout for blocking IO. This is the maximum amount of time a thread will wait for data, before an IOException will be thrown and the connection closed.
Whether the files sent using multipart/form-data will be stored locally.
If true, they will be stored in quarkus.http.body-handler.uploads-directory and will be made available via io.vertx.ext.web.RoutingContext.fileUploads(). Otherwise, the files sent using multipart/form-data will not be stored locally, and io.vertx.ext.web.RoutingContext.fileUploads() will always return an empty collection. Note that even with this option being set to false, the multipart/form-data requests will be accepted.
Whether the uploaded files should be removed after serving the request.
If true the uploaded files stored in quarkus.http.body-handler.uploads-directory will be removed after handling the request. Otherwise, the files will be left there forever.
Whether the body buffer should pre-allocated based on the Content-Length header value.
If true the body buffer is pre-allocated according to the size read from the Content-Length header. Otherwise, the body buffer is pre-allocated to 1KB, and is resized dynamically
A comma-separated list of ContentType to indicate whether a given multipart field should be handled as a file part. You can use this setting to force HTTP-based extensions to parse a message part as a file based on its content type. For now, this setting only works when using RESTEasy Reactive.
The encryption key that is used to store persistent logins (e.g. for form auth). Logins are stored in a persistent cookie that is encrypted with AES-256 using a key derived from a SHA-256 hash of the key that is provided here.
If no key is provided then an in-memory one will be generated, this will change on every restart though so it is not suitable for production environments. This must be more than 16 characters long for security reasons
Enable socket reuse port (linux/macOs native transport only)
Environment variable: QUARKUS_HTTP_SO_REUSE_PORT
Show more
boolean
false
quarkus.http.tcp-quick-ack
Enable tcp quick ack (linux native transport only)
Environment variable: QUARKUS_HTTP_TCP_QUICK_ACK
Show more
boolean
false
quarkus.http.tcp-cork
Enable tcp cork (linux native transport only)
Environment variable: QUARKUS_HTTP_TCP_CORK
Show more
boolean
false
quarkus.http.tcp-fast-open
Enable tcp fast open (linux native transport only)
Environment variable: QUARKUS_HTTP_TCP_FAST_OPEN
Show more
boolean
false
quarkus.http.accept-backlog
The accept backlog, this is how many connections can be waiting to be accepted before connections start being rejected
Environment variable: QUARKUS_HTTP_ACCEPT_BACKLOG
Show more
int
-1
quarkus.http.initial-window-size
Set the SETTINGS_INITIAL_WINDOW_SIZE HTTP/2 setting. Indicates the sender’s initial window size (in octets) for stream-level flow control. The initial value is 2^16-1 (65,535) octets.
Provides a hint (optional) for the default content type of responses generated for the errors not handled by the application.
If the client requested a supported content-type in request headers (e.g. "Accept: application/json", "Accept: text/html"), Quarkus will use that content type.
Otherwise, it will default to the content type configured here.
The HTTP policy that this permission set is linked to. There are three built-in policies: permit, deny and authenticated. Role based policies can be defined, and extensions can add their own policies.
The methods that this permission set applies to. If this is not set then they apply to all methods. Note that if a request matches any path from any permission set, but does not match the constraint due to the method not being listed then the request will be denied. Method specific permissions take precedence over matches that do not have any methods set. This means that for example if Quarkus is configured to allow GET and POST requests to /admin to and no other permissions are configured PUT requests to /admin will be denied.
The paths that this permission check applies to. If the path ends in /* then this is treated as a path prefix, otherwise it is treated as an exact match. Matches are done on a length basis, so the most specific path match takes precedence. If multiple permission sets match the same path then explicit methods matches take precedence over matches without methods set, otherwise the most restrictive permissions are applied.
Path specific authentication mechanism which must be used to authenticate a user. It needs to match HttpCredentialTransport authentication scheme such as 'basic', 'bearer', 'form', etc.
Indicates that this policy always applies to the matched paths in addition to the policy with a winning path. Avoid creating more than one shared policy to minimize the performance impact.
allApply on all matching paths., jaxrsDeclares that a permission check must only be applied on the Jakarta REST request paths. Use this option to delay the permission check if an authentication mechanism is chosen with an annotation on the matching Jakarta REST endpoint. This option must be set if the following REST endpoint annotations are used\: - io.quarkus.oidc.Tenant annotation which selects an OIDC authentication mechanism with a tenant identifier - io.quarkus.vertx.http.runtime.security.annotation.BasicAuthentication which selects the Basic authentication mechanism - io.quarkus.vertx.http.runtime.security.annotation.FormAuthentication which selects the Form-based authentication mechanism - io.quarkus.vertx.http.runtime.security.annotation.MTLSAuthentication which selects the mTLS authentication mechanism - io.quarkus.security.webauthn.WebAuthn which selects the WebAuth authentication mechanism - io.quarkus.oidc.BearerTokenAuthentication which selects the OpenID Connect Bearer token authentication mechanism - io.quarkus.oidc.AuthorizationCodeFlow which selects the OpenID Connect Code authentication mechanism
Add roles granted to the SecurityIdentity based on the roles that the SecurityIdentity already have. For example, the Quarkus OIDC extension can map roles from the verified JWT access token, and you may want to remap them to a deployment specific roles.
Permissions granted to the SecurityIdentity if this policy is applied successfully (the policy allows request to proceed) and the authenticated request has required role. For example, you can map permission perm1 with actions action1 and action2 to role admin by setting quarkus.http.auth.policy.role-policy1.permissions.admin=perm1:action1,perm1:action2 configuration property. Granted permissions are used for authorization with the @PermissionsAllowed annotation.
Permissions granted by this policy will be created with a java.security.Permission implementation specified by this configuration property. The permission class must declare exactly one constructor that accepts permission name (String) or permission name and actions (String, String[]). Permission class must be registered for reflection if you run your application in a native mode.
Map the SecurityIdentity roles to deployment specific roles and add the matching roles to SecurityIdentity.
For example, if SecurityIdentity has a user role and the endpoint is secured with a 'UserRole' role, use this property to map the user role to the UserRole role, and have SecurityIdentity to have both user and UserRole roles.
Client certificate attribute whose values are going to be mapped to the 'SecurityIdentity' roles according to the roles mapping specified in the certificate properties file. The attribute must be either one of the Relative Distinguished Names (RDNs) or Subject Alternative Names (SANs). By default, the Common Name (CN) attribute value is used for roles mapping. Supported values are:
RDN type - Distinguished Name field. For example 'CN' represents Common Name field. Multivalued RNDs and multiple instances of the same attributes are currently not supported.
'SAN_RFC822' - Subject Alternative Name field RFC 822 Name.
'SAN_URI' - Subject Alternative Name field Uniform Resource Identifier (URI).
'SAN_ANY' - Subject Alternative Name field Other Name. Please note that only simple case of UTF8 identifier mapping is supported. For example, you can map 'other-identifier' to the SecurityIdentity roles. If you use 'openssl' tool, supported Other name definition would look like this: subjectAltName=otherName:1.2.3.4;UTF8:other-identifier
Properties file containing the client certificate attribute value to role mappings. Use it only if the mTLS authentication mechanism is enabled with either quarkus.http.ssl.client-auth=required or quarkus.http.ssl.client-auth=request.
Properties file is expected to have the CN_VALUE=role1,role,…,roleN format and should be encoded using UTF-8.
The landing page to redirect to if there is no saved page to redirect back to. Redirect to landing page can be disabled by setting quarkus.http.auth.form.landing-page=.
How old a cookie can get before it will be replaced with a new cookie with an updated timeout, also referred to as "renewal-timeout". Note that smaller values will result in slightly more server load (as new encrypted cookies will be generated more often); however, larger values affect the inactivity timeout because the timeout is set when a cookie is generated. For example if this is set to 10 minutes, and the inactivity timeout is 30m, if a user’s last request is when the cookie is 9m old then the actual timeout will happen 21m after the last request because the timeout is only refreshed when a new cookie is generated. That is, no timeout is tracked on the server side; the timestamp is encoded and encrypted in the cookie itself, and it is decrypted and parsed with each request.
Origins allowed for CORS Comma separated list of valid URLs, e.g.: http://www.quarkus.io,http://localhost:3000 In case an entry of the list is surrounded by forward slashes, it is interpreted as a regular expression.
Environment variable: QUARKUS_HTTP_CORS_ORIGINS
Show more
list of string
quarkus.http.cors.methods
HTTP methods allowed for CORS Comma separated list of valid methods. ex: GET,PUT,POST The filter allows any method if this is not set. default: returns any requested method as valid
Environment variable: QUARKUS_HTTP_CORS_METHODS
Show more
list of string
quarkus.http.cors.headers
HTTP headers allowed for CORS Comma separated list of valid headers. ex: X-Custom,Content-Disposition The filter allows any header if this is not set. default: returns any requested header as valid
Environment variable: QUARKUS_HTTP_CORS_HEADERS
Show more
list of string
quarkus.http.cors.exposed-headers
HTTP headers exposed in CORS Comma separated list of valid headers. ex: X-Custom,Content-Disposition default: empty
The Access-Control-Allow-Credentials header is used to tell the browsers to expose the response to front-end JavaScript code when the request’s credentials mode Request.credentials is “include”. The value of this header will default to true if quarkus.http.cors.origins property is set and there is a match with the precise Origin header.
Set the SETTINGS_HEADER_TABLE_SIZE HTTP/2 setting.
Allows the sender to inform the remote endpoint of the maximum size of the header compression table used to decode header blocks, in octets. The encoder can select any size equal to or less than this value by using signaling specific to the header compression format inside a header block. The initial value is 4,096 octets.
Set SETTINGS_MAX_CONCURRENT_STREAMS HTTP/2 setting.
Indicates the maximum number of concurrent streams that the sender will allow. This limit is directional: it applies to the number of streams that the sender permits the receiver to create. Initially, there is no limit to this value. It is recommended that this value be no smaller than 100, to not unnecessarily limit parallelism.
Set the SETTINGS_MAX_FRAME_SIZE HTTP/2 setting. Indicates the size of the largest frame payload that the sender is willing to receive, in octets. The initial value is 2^14 (16,384) octets.
Set the SETTINGS_MAX_HEADER_LIST_SIZE HTTP/2 setting. This advisory setting informs a peer of the maximum size of header list that the sender is prepared to accept, in octets. The value is based on the uncompressed size of header fields, including the length of the name and value in octets plus an overhead of 32 octets for each header field. The default value is 8192
Set the max number of RST frame allowed per time window, this is used to prevent HTTP/2 RST frame flood DDOS attacks. The default value is 200, setting zero or a negative value, disables flood protection.
Set the duration of the time window when checking the max number of RST frames, this is used to prevent HTTP/2 RST frame flood DDOS attacks.. The default value is 30 s, setting zero or a negative value, disables flood protection.
Set the delay between two computations of performances for channels. If set to 0, no stats are computed. Despite 0 is accepted (no accounting), it is recommended to set a positive value for the check interval, even if it is high since the precision of the traffic shaping depends on the period where the traffic is computed. In this case, a suggested value is something close to 5 or 10 minutes.
Set the maximum global write size in bytes per second allowed in the buffer globally for all channels before write are suspended. The default value is 400 MB.
Set whether the server should use the HA PROXY protocol when serving requests from behind a proxy. (see the PROXY Protocol). When set to true, the remote address returned will be the one from the actual connecting client. If it is set to false (default), the remote address returned will be the one from the proxy.
If this is true then the address, scheme etc. will be set from headers forwarded by the proxy server, such as X-Forwarded-For. This should only be set if you are behind a proxy that sets these headers.
If this is true and proxy address forwarding is enabled then the standard Forwarded header will be used. In case the not standard X-Forwarded-For header is enabled and detected on HTTP requests, the standard header has the precedence. Activating this together with quarkus.http.proxy.allow-x-forwarded has security implications as clients can forge requests with a forwarded header that is not overwritten by the proxy. Therefore, proxies should strip unexpected X-Forwarded or X-Forwarded-* headers from the client.
If either this or allow-forwarded are true and proxy address forwarding is enabled then the not standard Forwarded header will be used. In case the standard Forwarded header is enabled and detected on HTTP requests, the standard header has the precedence. Activating this together with quarkus.http.proxy.allow-forwarded has security implications as clients can forge requests with a forwarded header that is not overwritten by the proxy. Therefore, proxies should strip unexpected X-Forwarded or X-Forwarded-* headers from the client.
Configure the list of trusted proxy addresses. Received Forwarded, X-Forwarded or X-Forwarded-* headers from any other proxy address will be ignored. The trusted proxy address should be specified as the IP address (IPv4 or IPv6), hostname or Classless Inter-Domain Routing (CIDR) notation. Please note that Quarkus needs to perform DNS lookup for all hostnames during the request. For that reason, using hostnames is not recommended.
Examples of a socket address in the form of host or host:port:
127.0.0.1:8084
[0:0:0:0:0:0:0:1]
[0:0:0:0:0:0:0:1]:8084
[::]
localhost
localhost:8084
Examples of a CIDR notation:
::/128
::/0
127.0.0.0/8
Please bear in mind that IPv4 CIDR won’t match request sent from the IPv6 address and the other way around.
More hosts allowed for Dev UI Comma separated list of valid URLs, e.g.: www.quarkus.io, myhost.com By default localhost and 127.0.0.1 will always be allowed
Environment variable: QUARKUS_DEV_UI_HOSTS
Show more
list of string
quarkus.dev-ui.cors.enabled
Enable CORS filter.
Environment variable: QUARKUS_DEV_UI_CORS_ENABLED
Show more
boolean
true
quarkus.management.enabled
Enables / Disables the usage of a separate interface/port to expose the management endpoints. If sets to true, the management endpoints will be exposed to a different HTTP server. This avoids exposing the management endpoints on a publicly available server.
If this is true and credentials are present then a user will always be authenticated before the request progresses. If this is false then an attempt will only be made to authenticate the user if a permission check is performed or the current user is required for some other reason.
A common root path for management endpoints. Various extension-provided management endpoints such as metrics and health are deployed under this path by default.
Note that this will attempt to compress all responses, to avoid compressing already compressed content (such as images) you need to set the following header:
Content-Encoding: identity
Which will tell vert.x not to compress the response.
Map the SecurityIdentity roles to deployment specific roles and add the matching roles to SecurityIdentity.
For example, if SecurityIdentity has a user role and the endpoint is secured with a 'UserRole' role, use this property to map the user role to the UserRole role, and have SecurityIdentity to have both user and UserRole roles.
Defaulting to 0.0.0.0 makes it easier to deploy Quarkus to container, however it is not suitable for dev/test mode as other people on the network can connect to your development machine.
The CredentialsProvider. If this property is configured, then a matching 'CredentialsProvider' will be used to get the keystore, keystore key, and truststore passwords unless these passwords have already been configured.
Please note that using MicroProfile ConfigSource which is directly supported by Quarkus Configuration should be preferred unless using CredentialsProvider provides for some additional security and dynamism.
This is a bean name (as in @Named) of a bean that implements CredentialsProvider. It is used to select the credentials provider bean when multiple exist. This is unnecessary when there is only one credentials provider available.
For Vault, the credentials provider bean name is vault-credentials-provider.
An optional parameter to specify a provider of the keystore file. If not given, the provider is automatically detected based on the keystore file type.
An optional parameter to select a specific key in the keystore. When SNI is disabled, and the keystore contains multiple keys and no alias is specified; the behavior is undefined.
An optional parameter to define the password for the key, in case it is different from key-store-password If not given, it might be retrieved from CredentialsProvider.
An optional parameter to specify a provider of the trust store file. If not given, the provider is automatically detected based on the trust store file type.
When set, the configured certificate will be reloaded after the given period. Note that the certificate will be reloaded only if the file has been modified.
Also, the update can also occur when the TLS certificate is configured using paths (and not in-memory).
The reload period must be equal or greater than 30 seconds. If not set, the certificate will not be reloaded.
It’s recommended to use the TLS registry to handle the certificate reloading.
Sets the ordered list of enabled SSL/TLS protocols.
If not set, it defaults to "TLSv1.3, TLSv1.2". The following list of protocols are supported: TLSv1, TLSv1.1, TLSv1.2, TLSv1.3. To only enable TLSv1.3, set the value to to "TLSv1.3".
Note that setting an empty list, and enabling SSL/TLS is invalid. You must at least have one protocol.
Enables Server Name Indication (SNI), an TLS extension allowing the server to use multiple certificates. The client indicate the server name during the TLS handshake, allowing the server to select the right certificate.
Environment variable: QUARKUS_MANAGEMENT_SSL_SNI
Show more
boolean
false
quarkus.management.tls-configuration-name
The name of the TLS configuration to use.
If not set and the default TLS configuration is configured (quarkus.tls.*) then that will be used. If a name is configured, it uses the configuration from quarkus.tls.<name>.* If a name is configured, but no TLS configuration is found with that name then an error will be thrown.
If no TLS configuration is set, and quarkus.tls.* is not configured, then, quarkus.management.ssl will be used.
Set the SETTINGS_HEADER_TABLE_SIZE HTTP/2 setting.
Allows the sender to inform the remote endpoint of the maximum size of the header compression table used to decode header blocks, in octets. The encoder can select any size equal to or less than this value by using signaling specific to the header compression format inside a header block. The initial value is 4,096 octets.
Set SETTINGS_MAX_CONCURRENT_STREAMS HTTP/2 setting.
Indicates the maximum number of concurrent streams that the sender will allow. This limit is directional: it applies to the number of streams that the sender permits the receiver to create. Initially, there is no limit to this value. It is recommended that this value be no smaller than 100, to not unnecessarily limit parallelism.
Set the SETTINGS_MAX_FRAME_SIZE HTTP/2 setting. Indicates the size of the largest frame payload that the sender is willing to receive, in octets. The initial value is 2^14 (16,384) octets.
Set the SETTINGS_MAX_HEADER_LIST_SIZE HTTP/2 setting. This advisory setting informs a peer of the maximum size of header list that the sender is prepared to accept, in octets. The value is based on the uncompressed size of header fields, including the length of the name and value in octets plus an overhead of 32 octets for each header field. The default value is 8192
Set the max number of RST frame allowed per time window, this is used to prevent HTTP/2 RST frame flood DDOS attacks. The default value is 200, setting zero or a negative value, disables flood protection.
Set the duration of the time window when checking the max number of RST frames, this is used to prevent HTTP/2 RST frame flood DDOS attacks.. The default value is 30 s, setting zero or a negative value, disables flood protection.
Whether the files sent using multipart/form-data will be stored locally.
If true, they will be stored in quarkus.http.body-handler.uploads-directory and will be made available via io.vertx.ext.web.RoutingContext.fileUploads(). Otherwise, the files sent using multipart/form-data will not be stored locally, and io.vertx.ext.web.RoutingContext.fileUploads() will always return an empty collection. Note that even with this option being set to false, the multipart/form-data requests will be accepted.
Whether the uploaded files should be removed after serving the request.
If true the uploaded files stored in quarkus.http.body-handler.uploads-directory will be removed after handling the request. Otherwise, the files will be left there forever.
Whether the body buffer should pre-allocated based on the Content-Length header value.
If true the body buffer is pre-allocated according to the size read from the Content-Length header. Otherwise, the body buffer is pre-allocated to 1KB, and is resized dynamically
A comma-separated list of ContentType to indicate whether a given multipart field should be handled as a file part. You can use this setting to force HTTP-based extensions to parse a message part as a file based on its content type. For now, this setting only works when using RESTEasy Reactive.
Set whether the server should use the HA PROXY protocol when serving requests from behind a proxy. (see the PROXY Protocol). When set to true, the remote address returned will be the one from the actual connecting client. If it is set to false (default), the remote address returned will be the one from the proxy.
If this is true then the address, scheme etc. will be set from headers forwarded by the proxy server, such as X-Forwarded-For. This should only be set if you are behind a proxy that sets these headers.
If this is true and proxy address forwarding is enabled then the standard Forwarded header will be used. In case the not standard X-Forwarded-For header is enabled and detected on HTTP requests, the standard header has the precedence. Activating this together with quarkus.http.proxy.allow-x-forwarded has security implications as clients can forge requests with a forwarded header that is not overwritten by the proxy. Therefore, proxies should strip unexpected X-Forwarded or X-Forwarded-* headers from the client.
If either this or allow-forwarded are true and proxy address forwarding is enabled then the not standard Forwarded header will be used. In case the standard Forwarded header is enabled and detected on HTTP requests, the standard header has the precedence. Activating this together with quarkus.http.proxy.allow-forwarded has security implications as clients can forge requests with a forwarded header that is not overwritten by the proxy. Therefore, proxies should strip unexpected X-Forwarded or X-Forwarded-* headers from the client.
Configure the list of trusted proxy addresses. Received Forwarded, X-Forwarded or X-Forwarded-* headers from any other proxy address will be ignored. The trusted proxy address should be specified as the IP address (IPv4 or IPv6), hostname or Classless Inter-Domain Routing (CIDR) notation. Please note that Quarkus needs to perform DNS lookup for all hostnames during the request. For that reason, using hostnames is not recommended.
Examples of a socket address in the form of host or host:port:
127.0.0.1:8084
[0:0:0:0:0:0:0:1]
[0:0:0:0:0:0:0:1]:8084
[::]
localhost
localhost:8084
Examples of a CIDR notation:
::/128
::/0
127.0.0.0/8
Please bear in mind that IPv4 CIDR won’t match request sent from the IPv6 address and the other way around.
The HTTP policy that this permission set is linked to. There are three built-in policies: permit, deny and authenticated. Role based policies can be defined, and extensions can add their own policies.
The methods that this permission set applies to. If this is not set then they apply to all methods. Note that if a request matches any path from any permission set, but does not match the constraint due to the method not being listed then the request will be denied. Method specific permissions take precedence over matches that do not have any methods set. This means that for example if Quarkus is configured to allow GET and POST requests to /admin to and no other permissions are configured PUT requests to /admin will be denied.
The paths that this permission check applies to. If the path ends in /* then this is treated as a path prefix, otherwise it is treated as an exact match. Matches are done on a length basis, so the most specific path match takes precedence. If multiple permission sets match the same path then explicit methods matches take precedence over matches without methods set, otherwise the most restrictive permissions are applied.
Path specific authentication mechanism which must be used to authenticate a user. It needs to match HttpCredentialTransport authentication scheme such as 'basic', 'bearer', 'form', etc.
Indicates that this policy always applies to the matched paths in addition to the policy with a winning path. Avoid creating more than one shared policy to minimize the performance impact.
allApply on all matching paths., jaxrsDeclares that a permission check must only be applied on the Jakarta REST request paths. Use this option to delay the permission check if an authentication mechanism is chosen with an annotation on the matching Jakarta REST endpoint. This option must be set if the following REST endpoint annotations are used\: - io.quarkus.oidc.Tenant annotation which selects an OIDC authentication mechanism with a tenant identifier - io.quarkus.vertx.http.runtime.security.annotation.BasicAuthentication which selects the Basic authentication mechanism - io.quarkus.vertx.http.runtime.security.annotation.FormAuthentication which selects the Form-based authentication mechanism - io.quarkus.vertx.http.runtime.security.annotation.MTLSAuthentication which selects the mTLS authentication mechanism - io.quarkus.security.webauthn.WebAuthn which selects the WebAuth authentication mechanism - io.quarkus.oidc.BearerTokenAuthentication which selects the OpenID Connect Bearer token authentication mechanism - io.quarkus.oidc.AuthorizationCodeFlow which selects the OpenID Connect Code authentication mechanism
Add roles granted to the SecurityIdentity based on the roles that the SecurityIdentity already have. For example, the Quarkus OIDC extension can map roles from the verified JWT access token, and you may want to remap them to a deployment specific roles.
Permissions granted to the SecurityIdentity if this policy is applied successfully (the policy allows request to proceed) and the authenticated request has required role. For example, you can map permission perm1 with actions action1 and action2 to role admin by setting quarkus.http.auth.policy.role-policy1.permissions.admin=perm1:action1,perm1:action2 configuration property. Granted permissions are used for authorization with the @PermissionsAllowed annotation.
Permissions granted by this policy will be created with a java.security.Permission implementation specified by this configuration property. The permission class must declare exactly one constructor that accepts permission name (String) or permission name and actions (String, String[]). Permission class must be registered for reflection if you run your application in a native mode.
The number of IO thread. By default, this is the number of locally detected processors.
Thread counts higher than the number of processors should not be necessary because the I/O threads rely on non-blocking operations, but you may want to use a thread count lower than the number of processors.