Configuration Parameters for HEAVY.AI Web Server
Following are the parameters for runtime settings on HeavyAI Web Server. The parameter syntax provides both the implied value and the default value as appropriate. Optional arguments are in square brackets, while implied and default values are in parentheses.
| Flag | Description | Default |
|---|---|---|
additional-file-upload-extensions <string> | Denote additional file extensions for uploads. Has no effect if --enable-upload-extension-check is not set. | |
allow-any-origin | Allows for a CORS exception to the same-origin policy. Required to be true if Immerse is hosted on a different domain or subdomain hosting heavy_web_server and heavydb. Allowing any origin is a less secure mode than what heavy_web_server requires by default. | --allow-any-origin = false |
-b | backend-url <string> | URL to http-port on heavydb. Change to avoid collisions with other services. | http://localhost:6278 |
-B | binary-backend-url <string> | URL to http-binary-port on heavydb. | http://localhost:6276 |
cert string | Certificate file for HTTPS. Change for testing and debugging. | cert.pem |
-c | config <string> | Path to HeavyDB configuration file. Change for testing and debugging. | |
-d | data <string> | Path to HeavyDB data directory. Change for testing and debugging. | data |
data-catalog <string> | Path to data catalog directory. | n/a |
docs string | Path to documentation directory. Change if you move your documentation files to another directory. | docs |
enable-binary-thrift | Use the binary thrift protocol. | TRUE[1] |
enable-browser-logs [=arg] | Enable access to current log files via web browser. Only super users (while logged in) can access log files. Log files are available at http[s]://host:port/logs/log_name. The web server log files:
| FALSE[0] |
enable-cert-verification | TLS certificate verification is a security measure that can be disabled for the cases of TLS certificates not issued by a trusted certificate authority. If using a locally or unofficially generated TLS certificate to secure the connection between heavydb and heavy_web_server, this parameter must be set to false. heavy_web_server expects a trusted certificate authority by default. | --enable-cert-verification = true |
enable-cross-domain [=arg] | Enable frontend cross-domain authentication. Cross-domain session cookies require the SameSite = None; Secure headers. Can only be used with HTTPS domains; requires enable-https to be true. | FALSE[0] |
enable-https | Enable HTTPS support. Change to enable secure HTTP. | |
enable-https-authentication | Enable PKI authentication. | |
enable-https-redirect [=arg] | Enable a new port that heavy_web_server listens on for incoming HTTP requests. When received, it returns a redirect response to the HTTPS port and protocol, so that browsers are immediately and transparently redirected. Use to provide an HEAVY.AI front end that can run on both the HTTP protocol (http://my-heavyai-frontend.com) on default HTTP port 80, and on the primary HTTPS protocol (https://my-heavyai-frontend.com) on default https port 443, and have requests to the HTTP protocol automatically redirected to HTTPS. Without this, requests to HTTP fail. Assuming heavy_web_server can attach to ports below 1024, the configuration would be: | FALSE[0] |
enable-non-kernel-time-query-interrupt | Enable non-kernel-time query interrupt. | TRUE[1] |
enable-runtime-query-interrupt | Enbale runtime query interrupt. | TRUE[1] |
enable-upload-extension-check | Disables restrictive file extension upload check. | |
encryption-key-file-path <string> | Path to the file containing the credential payload cipher key. Key must be 256 bits in length. | |
-f | frontend string | Path to frontend directory. Change if you move the location of your frontend UI files. | frontend |
http-to-https-redirect-port = arg | Configures the http (incoming) port used by enable-https-redirect. The port option specifies the redirect port number. Use to provide an HEAVY.AI front end that can run on both the HTTP protocol (http://my-heavyai-frontend.com) on default HTTP port 80, and on the primary HTTPS protocol (https://my-heavyai-frontend.com) on default https port 443, and have requests to the HTTP protocol automatically redirected to HTTPS. Without this, requests to HTTP fail. Assuming heavy_web_server can attach to ports below 1024, the configuration would be: enable-https-redirect = TRUE | 6280 |
idle-session-duration = arg | Idle session default, in minutes. | 60 |
jupyter-prefix-string <string> | Jupyter Hub base_url for Jupyter integration. | /jupyter |
jupyter-url-string <string> | URL for Jupyter integration. | |
-j |jwt-key-file | Path to a key file for client session encryption. The file is expected to be a PEM-formatted ( .pem ) certificate file containing the unencrypted private key in PKCS #1, PCKS #8, or ASN.1 DER form. Example PEM file creation using OpenSSL. Required only if using a high-availability server configuration or another server configuration that requires an instance of Immerse to talk to multiple heavy_web_server instances. Each heavy_web_server instance needs to use the same encryption key to encrypt and decrypt client session information which is used for session persistence (“sessionization”) in Immerse. | |
key <string> | Key file for HTTPS. Change for testing and debugging. | key.pem |
max-tls-version | Refers to the version of TLS encryption used to secure web protocol connections. Specifies a maximum TLS version. | |
min-tls-version | Refers to the version of TLS encryption used to secure web protocol connections. Specifies a minimum TLS version. | --min-tls-version = VersionTLS12 |
peer-cert <string> | Peer CA certificate PKI authentication. | peercert.pem |
-p | port int | Frontend server port. Change to avoid collisions with other services. | 6273 |
-r | read-only | Enable read-only mode. Prevent changes to the data. | |
secure-acao-uri | If set, ensures that all Access-Allow-Origin headers are set to the value provided. | |
servers-json <string> | Path to servers.json. Change for testing and debugging. | |
session-id-header <string> | Session ID header. | immersesid |
ssl-cert <string> | SSL validated public certificate. | sslcert.pem |
ssl-private-key <string> | SSL private key file. | sslprivate.key |
strip-x-headers <strings> | List of custom X http request headers to be removed from incoming requests. Use --strip-x-headers=""to allow all X headers through. | [X-HeavyDB-Username] |
timeout duration | Maximum request duration in | 1h0m0s |
tls-cipher-suites <strings> | Refers to the combination of algorithms used in TLS encryption to secure web protocol connections. All available TLS cipher suites compatible with HTTP/2:
| The following cipher suites are accepted by default:
|
tls-curves <strings> | Refers to the types of Elliptic Curve Cryptography (ECC) used in TLS encryption to secure web protocol connections. All available TLS elliptic Curve IDs:
| The following TLS curves are accepted by default:
|
tmpdir string | Path for temporary file storage. Used as a staging location for file uploads. Consider locating this directory on the same file system as the HEAVY.AI data directory. If not specified on the command line, heavyai_web_server recognizes the standard TMPDIR environment variable as well as a specific HEAVYAI_TMPDIR environment variable, the latter of which takes precedence. If you use neither the command-line argument nor one of the environment variables, the default, /tmp/ is used. | /tmp |
ultra-secure-mode | Enables secure mode that sets Access-Allow-Origin headers to --secure-acao-uriand sets security headers like X-Frame-Options, Content-Security-Policy, and Strict-Transport-Security. | |
-v | verbose | Enable verbose logging. Adds log messages for debugging purposes. | |
version | Return version. |
