diff --git a/website/.editorconfig b/website/.editorconfig deleted file mode 100644 index 36bf83fdb..000000000 --- a/website/.editorconfig +++ /dev/null @@ -1,18 +0,0 @@ -# This file is for unifying the coding style for different editors and IDEs -# editorconfig.org - -root = true - -[*] -end_of_line = lf -charset = utf-8 -insert_final_newline = true -trim_trailing_whitespace = true -indent_style = space -indent_size = 2 - -[Makefile] -indent_style = tab - -[{*.md,*.json}] -max_line_length = null diff --git a/website/.env b/website/.env deleted file mode 100644 index e50ad5d30..000000000 --- a/website/.env +++ /dev/null @@ -1,3 +0,0 @@ -NEXT_PUBLIC_ALGOLIA_APP_ID=YY0FFNI7MF -NEXT_PUBLIC_ALGOLIA_INDEX=product_BOUNDARY -NEXT_PUBLIC_ALGOLIA_SEARCH_ONLY_API_KEY=8308498decdf72e11590fc6356e5fdde diff --git a/website/.env.production b/website/.env.production deleted file mode 100644 index 83825a896..000000000 --- a/website/.env.production +++ /dev/null @@ -1 +0,0 @@ -HASHI_ENV=production diff --git a/website/.eslintrc.js b/website/.eslintrc.js deleted file mode 100644 index 266f4d5fa..000000000 --- a/website/.eslintrc.js +++ /dev/null @@ -1,4 +0,0 @@ -module.exports = { - ...require('@hashicorp/platform-cli/config/.eslintrc'), - ignorePatterns: ['public/'], -} diff --git a/website/.gitignore b/website/.gitignore deleted file mode 100644 index 6415d25eb..000000000 --- a/website/.gitignore +++ /dev/null @@ -1,6 +0,0 @@ -node_modules -.DS_Store -.next -out -.mdx-data -website-preview/ diff --git a/website/.nvmrc b/website/.nvmrc deleted file mode 100644 index 53d1c14db..000000000 --- a/website/.nvmrc +++ /dev/null @@ -1 +0,0 @@ -v22 diff --git a/website/.stylelintrc.js b/website/.stylelintrc.js deleted file mode 100644 index 80af883b1..000000000 --- a/website/.stylelintrc.js +++ /dev/null @@ -1,9 +0,0 @@ -/** - * Copyright IBM Corp. 2020, 2025 - * SPDX-License-Identifier: BUSL-1.1 - */ - -module.exports = { - ...require('@hashicorp/platform-cli/config/stylelint.config'), - /* Specify overrides here */ -} diff --git a/website/LICENSE b/website/LICENSE deleted file mode 100644 index 3189f43a6..000000000 --- a/website/LICENSE +++ /dev/null @@ -1,10 +0,0 @@ -# Proprietary License - -This license is temporary while a more official one is drafted. However, -this should make it clear: - -The text contents of this website are MPL 2.0 licensed. - -The design contents of this website are proprietary and may not be reproduced -or reused in any way other than to run the website locally. The license for -the design is owned solely by HashiCorp, Inc. diff --git a/website/Makefile b/website/Makefile deleted file mode 100644 index e45434abf..000000000 --- a/website/Makefile +++ /dev/null @@ -1,61 +0,0 @@ -###################################################### -# NOTE: This file is managed by the Digital Team's # -# Terraform configuration @ hashicorp/mktg-terraform # -###################################################### - -.DEFAULT_GOAL := website - -# Set the preview mode for the website shell to "developer" or "io" -PREVIEW_MODE ?= developer -REPO ?= boundary - -# Enable setting alternate docker tool, e.g. 'make DOCKER_CMD=podman' -DOCKER_CMD ?= docker - -CURRENT_GIT_BRANCH=$$(git rev-parse --abbrev-ref HEAD) -LOCAL_CONTENT_DIR= -PWD=$$(pwd) - -DOCKER_IMAGE="hashicorp/dev-portal" -DOCKER_IMAGE_LOCAL="dev-portal-local" -DOCKER_RUN_FLAGS=-it \ - --publish "3000:3000" \ - --rm \ - --tty \ - --volume "$(PWD)/content:/app/content" \ - --volume "$(PWD)/public:/app/public" \ - --volume "$(PWD)/data:/app/data" \ - --volume "$(PWD)/redirects.js:/app/redirects.js" \ - --volume "$(PWD)/../internal/gen:/internal/gen" \ - --volume "next-dir:/app/website-preview/.next" \ - --volume "$(PWD)/.env:/app/.env" \ - --volume "$(PWD)/.env.development:/app/website-preview/.env.development" \ - --volume "$(PWD)/.env.local:/app/website-preview/.env.local" \ - -e "REPO=$(REPO)" \ - -e "PREVIEW_FROM_REPO=$(REPO)" \ - -e "IS_CONTENT_PREVIEW=true" \ - -e "LOCAL_CONTENT_DIR=$(LOCAL_CONTENT_DIR)" \ - -e "CURRENT_GIT_BRANCH=$(CURRENT_GIT_BRANCH)" \ - -e "PREVIEW_MODE=$(PREVIEW_MODE)" - -# Default: run this if working on the website locally to run in watch mode. -.PHONY: website -website: - @echo "==> Downloading latest Docker image..." - @$(DOCKER_CMD) pull $(DOCKER_IMAGE) - @echo "==> Starting website..." - @$(DOCKER_CMD) run $(DOCKER_RUN_FLAGS) $(DOCKER_IMAGE) - -# Use this if you have run `website/build-local` to use the locally built image. -.PHONY: website/local -website/local: - @echo "==> Starting website from local image..." - @$(DOCKER_CMD) run $(DOCKER_RUN_FLAGS) $(DOCKER_IMAGE_LOCAL) - -# Run this to generate a new local Docker image. -.PHONY: website/build-local -website/build-local: - @echo "==> Building local Docker image" - @$(DOCKER_CMD) build https://github.com/hashicorp/dev-portal.git\#main \ - -t $(DOCKER_IMAGE_LOCAL) - diff --git a/website/README.md b/website/README.md deleted file mode 100644 index 39850251f..000000000 --- a/website/README.md +++ /dev/null @@ -1,538 +0,0 @@ -# Boundary Documentation Website - -[!IMPORTANT] -> **Documentation Update:** Product documentation, which were located in this repository under `/website`, are now located in [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs), colocated with all other product documentation. Contributions to this content should be done in the `web-unified-docs` repo, and not this one. Changes made to `/website` content in this repo will not be reflected on the developer.hashicorp.com website. - -This subdirectory contains the content for the [Boundary Website](https://developer.hashicorp.com/boundary/). - - - -## Table of Contents - -- [Boundary Documentation Website](#boundary-documentation-website) - - [Table of Contents](#table-of-contents) - - [Contributions Welcome!](#contributions-welcome) - - [Running the Site Locally](#running-the-site-locally) - - [Editing Markdown Content](#editing-markdown-content) - - [Creating New Pages](#creating-new-pages) - - [Markdown Enhancements](#markdown-enhancements) - - [Custom Components](#custom-components) - - [Tabs](#tabs) - - [Enterprise Alert](#enterprise-alert) - - [Other Components](#other-components) - - [Syntax Highlighting](#syntax-highlighting) - - [Editing Navigation Sidebars](#editing-navigation-sidebars) - - [Index-less Categories](#index-less-categories) - - [Custom or External Links](#custom-or-external-links) - - [Editing/Enabling the Alert Banner](#editingenabling-the-alert-banner) - - [Changing the Release Version](#changing-the-release-version) - - [Displaying a Prerelease](#displaying-a-prerelease) - - [Redirects](#redirects) - - [Browser Support](#browser-support) - - [Deployment](#deployment) - - - - -## Contributions Welcome! - -If you find a typo or you feel like you can improve the HTML, CSS, or JavaScript, we welcome contributions. Feel free to open issues or pull requests like any normal GitHub project, and we'll merge it in 🚀 - - - -## Running the Site Locally - -The website can be run locally through [node.js](https://nodejs.org). It works with any supported version. Node.js [can be installed quickly and easily via universal binary](https://nodejs.org). - -The first time you are running the site, you will need to run the command `npm install` to install dependencies. Any time after this, `npm start` can be used to run the site locally. It can be seen at `http://localhost:3000`. We also provide a Docker-based workflow to run the site locally. Just run `make`! As you change content, the website will automatically reload to show the latest content. - - - - -## Editing Markdown Content - -Documentation content is written in [Markdown](https://www.markdownguide.org/cheat-sheet/) and you'll find all files listed under the `/content` directory. - -To create a new page with Markdown, create a file ending in `.mdx` in a `content/`. The path in the content directory will be the URL route. For example, `content/docs/hello.mdx` will be served from the `/docs/hello` URL. - -> **Important**: Files and directories will only be rendered and published to the website if they are [included in sidebar data](#editing-navigation-sidebars). Any file not included in sidebar data will not be rendered or published. - -This file can be standard Markdown and also supports [YAML frontmatter](https://middlemanapp.com/basics/frontmatter/). YAML frontmatter is optional, there are defaults for all keys. - -```yaml ---- -title: 'My Title' -description: "A thorough, yet succinct description of the page's contents" ---- -``` - -The significant keys in the YAML frontmatter are: - -- `title` `(string)` - This is the title of the page that will be set in the HTML title. -- `description` `(string)` - This is a description of the page that will be set in the HTML description. - -> ⚠️ If there is a need for a `/api/*` url on this website, the url will be changed to `/api-docs/*`, as the `api` folder is reserved by next.js. - -### Validating Content - -Content changes are automatically validated against a set of rules as part of the pull request process. If you want to run these checks locally to validate your content before comitting your changes, you can run the following command: - -``` -npm run content-check -``` - -If the validation fails, actionable error messages will be displayed to help you address detected issues. - -### Creating New Pages - -There is currently a small bug with new page creation - if you create a new page and link it up via subnav data while the server is running, it will report an error saying the page was not found. This can be resolved by restarting the server. - -### Markdown Enhancements - -There are several custom markdown plugins that are available by default that enhance [standard markdown](https://commonmark.org/) to fit our use cases. This set of plugins introduces a couple instances of custom syntax, and a couple specific pitfalls that are not present by default with markdown, detailed below: - -- > **Warning**: We are deprecating the current [paragraph alerts](https://github.com/hashicorp/remark-plugins/tree/master/plugins/paragraph-custom-alerts#paragraph-custom-alerts), in favor of the newer [MDX Inline Alert](#inline-alerts) components. The legacy paragraph alerts are represented by the symbols `~>`, `->`, `=>`, or `!>`. -- If you see `@include '/some/path.mdx'`, this is a [markdown include](https://github.com/hashicorp/remark-plugins/tree/master/plugins/include-markdown#include-markdown-plugin). It's worth noting as well that all includes resolve from `website/content/partials` by default, and that changes to partials will not live-reload the website. -- If you see `# Headline ((#slug))`, this is an example of an [anchor link alias](https://github.com/hashicorp/remark-plugins/tree/je.anchor-link-adjustments/plugins/anchor-links#anchor-link-aliases). It adds an extra permalink to a headline for compatibility and is removed from the output. -- Due to [automatically generated permalinks](https://github.com/hashicorp/remark-plugins/tree/je.anchor-link-adjustments/plugins/anchor-links#anchor-links), any text changes to _headlines_ or _list items that begin with inline code_ can and will break existing permalinks. Be very cautious when changing either of these two text items. - - Headlines are fairly self-explanatory, but here's an example of how to list items that begin with inline code look. - - ```markdown - - this is a normal list item - - `this` is a list item that begins with inline code - ``` - - Its worth noting that _only the inline code at the beginning of the list item_ will cause problems if changed. So if you changed the above markup to... - - ```markdown - - lsdhfhksdjf - - `this` jsdhfkdsjhkdsfjh - ``` - - ...while it perhaps would not be an improved user experience, no links would break because of it. The best approach is to **avoid changing headlines and inline code at the start of a list item**. If you must change one of these items, make sure to tag someone from the digital marketing development team on your pull request, they will help to ensure as much compatibility as possible. - -### Custom Components - -A number of custom [mdx components](https://mdxjs.com/) are available for use within any `.mdx` file. Each one is documented below: - -#### Inline Alerts - -There are custom MDX components available to author alert data. [See the full documentation here](https://developer.hashicorp.com/swingset/components/mdxinlinealert). They render as colored boxes to draw the user's attention to some type of aside. - -```mdx -## Alert types - -### Tip - - - To provide general information to the user regarding the current context or - relevant actions. - - -### Highlight - - - To provide general or promotional information to the user prominently. - - -### Note - - - To help users avoid an issue. Provide guidance and actions if possible. - - -### Warning - - - To indicate critical issues that need immediate action or help users - understand something critical. - - -## Title override prop - -To provide general information. -``` - -#### Tabs - -The `Tabs` component creates tabbed content of any type, but is often used for code examples given in different languages. Here's an example of how it looks from the Vagrant documentation website: - -![Tabs Component](https://p176.p0.n0.cdn.getcloudapp.com/items/WnubALZ4/Screen%20Recording%202020-06-11%20at%2006.03%20PM.gif?v=1de81ea720a8cc8ade83ca64fb0b9edd) - -> Please refer to the [Swingset](https://react-components.vercel.app/?component=Tabs) documentation for the latest examples and API reference. - -It can be used as such within a markdown file: - -````mdx -Normal **markdown** content. - - - - -```shell-session -$ command ... -``` - - - - -```shell-session -$ curl ... -``` - - - - -Continued normal markdown content -```` - -The intentionally skipped line is a limitation of the mdx parser which is being actively worked on. All tabs must have a heading, and there is no limit to the number of tabs, though it is recommended to go for a maximum of three or four. - -#### Enterprise Alert - -This component provides a standard way to call out functionality as being present only in the enterprise version of the software. It can be presented in two contexts, inline or standalone. Here's an example of standalone usage from the Consul docs website: - -![Enterprise Alert Component - Standalone](https://p176.p0.n0.cdn.getcloudapp.com/items/WnubALp8/Screen%20Shot%202020-06-11%20at%206.06.03%20PM.png?v=d1505b90bdcbde6ed664831a885ea5fb) - -The standalone component can be used as such in markdown files: - -```mdx -# Page Headline - - - -Continued markdown content... -``` - -It can also receive custom text contents if you need to change the messaging but wish to retain the style. This will replace the text `This feature is available in all versions of Consul Enterprise.` with whatever you add. For example: - -```mdx -# Page Headline - - - My custom text here, and a link! - - -Continued markdown content... -``` - -It's important to note that once you are adding custom content, it must be html and can not be markdown, as demonstrated above with the link. - -Now let's look at inline usage, here's an example: - -![Enterprise Alert Component - Inline](https://p176.p0.n0.cdn.getcloudapp.com/items/L1upYLEJ/Screen%20Shot%202020-06-11%20at%206.07.50%20PM.png?v=013ba439263de8292befbc851d31dd78) - -And here's how it could be used in your markdown document: - -```mdx -### Some Enterprise Feature - -Continued markdown content... -``` - -It's also worth noting that this component will automatically adjust to the correct product colors depending on the context. - -#### Other Components - -Other custom components can be made available on a per-site basis, the above are the standards. If you have questions about custom components that are not documented here, or have a request for a new custom component, please reach out to @hashicorp/digital-marketing. - -### Syntax Highlighting - -When using fenced code blocks, the recommendation is to tag the code block with a language so that it can be syntax highlighted. For example: - -```` -``` -// BAD: Code block with no language tag -``` - -```javascript -// GOOD: Code block with a language tag -``` -```` - -Check out the [supported languages list](https://prismjs.com/#supported-languages) for the syntax highlighter we use if you want to double check the language name. - -It is also worth noting specifically that if you are using a code block that is an example of a terminal command, the correct language tag is `shell-session`. For example: - -🚫**BAD**: Using `shell`, `sh`, `bash`, or `plaintext` to represent a terminal command - -```` -```shell -$ terraform apply -``` -```` - -✅**GOOD**: Using `shell-session` to represent a terminal command - -```` -```shell-session -$ terraform apply -``` -```` - - - - - - -## Editing Navigation Sidebars - -The structure of the sidebars are controlled by files in the [`/data` directory](data). For example, [data/docs-nav-data.json](data/docs-nav-data.json) controls the **docs** sidebar. Within the `data` folder, any file with `-nav-data` after it controls the navigation for the given section. - -The sidebar uses a simple recursive data structure to represent _files_ and _directories_. The sidebar is meant to reflect the structure of the docs within the filesystem while also allowing custom ordering. Let's look at an example. First, here's our example folder structure: - -```text -. -├── docs -│   └── directory -│   ├── index.mdx -│   ├── file.mdx -│   ├── another-file.mdx -│   └── nested-directory -│   ├── index.mdx -│   └── nested-file.mdx -``` - -Here's how this folder structure could be represented as a sidebar navigation, in this example it would be the file `website/data/docs-nav-data.json`: - -```json -[ - { - "title": "Directory", - "routes": [ - { - "title": "Overview", - "path": "directory" - }, - { - "title": "File", - "path": "directory/file" - }, - { - "title": "Another File", - "path": "directory/another-file" - }, - { - "title": "Nested Directory", - "routes": [ - { - "title": "Overview", - "path": "directory/nested-directory" - }, - { - "title": "Nested File", - "path": "directory/nested-directory/nested-file" - } - ] - } - ] - } -] -``` - -A couple more important notes: - -- Within this data structure, ordering is flexible, but hierarchy is not. The structure of the sidebar must correspond to the structure of the content directory. So while you could put `file` and `another-file` in any order in the sidebar, or even leave one or both of them out, you could not decide to un-nest the `nested-directory` object without also un-nesting it in the filesystem. -- The `title` property on each node in the `nav-data` tree is the human-readable name in the navigation. -- The `path` property on each leaf node in the `nav-data` tree is the URL path where the `.mdx` document will be rendered, and the -- Note that "index" files must be explicitly added. These will be automatically resolved, so the `path` value should be, as above, `directory` rather than `directory/index`. A common convention is to set the `title` of an "index" node to be `"Overview"`. - -Below we will discuss a couple of more unusual but still helpful patterns. - -### Index-less Categories - -Sometimes you may want to include a category but not have a need for an index page for the category. This can be accomplished, but as with other branch and leaf nodes, a human-readable `title` needs to be set manually. Here's an example of how an index-less category might look: - -```text -. -├── docs -│   └── indexless-category -│   └── file.mdx -``` - -```json -// website/data/docs-nav-data.json -[ - { - "title": "Indexless Category", - "routes": [ - { - "title": "File", - "path": "indexless-category/file" - } - ] - } -] -``` - -### Custom or External Links - -Sometimes you may have a need to include a link that is not directly to a file within the docs hierarchy. This can also be supported using a different pattern. For example: - -```json -[ - { - "name": "Directory", - "routes": [ - { - "title": "File", - "path": "directory/file" - }, - { - "title": "Another File", - "path": "directory/another-file" - }, - { - "title": "Tao of HashiCorp", - "href": "https://www.hashicorp.com/tao-of-hashicorp" - } - ] - } -] -``` - -If the link provided in the `href` property is external, it will display a small icon indicating this. If it's internal, it will appear the same way as any other direct file link. - - - -## Editing/Enabling the Alert Banner - -The data and visibility of the alert banner are controlled by the `alert-banner.js` file in the [`/data` directory](data). The following data can be edited in this file: - -- `ALERT_BANNER_ACTIVE`: Determines if the banner is visible (when set to `true`) or not (when set to `false`). -- `tag`: Copy for the bordered text on the left side of the alert. -- `text`: Copy for the center text of the alert. -- `url`: Where the alert links to when clicked. - - - - -## Changing the Release Version - -To change the version displayed for download on the website, head over to `data/version.js` and change the number there. It's important to note that the version number must match a version that has been released and is live on `releases.hashicorp.com` -- if it does not, the website will be unable to fetch links to the binaries and will not compile. So this version number should be changed _only after a release_. - -### Displaying a Prerelease - -If there is a prerelease of any type that should be displayed on the downloads page, this can be done by editing `pages/downloads/index.jsx`. By default, the download component might look something like this: - -```jsx - -``` - -To add a prerelease, an extra `prerelease` property can be added to the component as such: - -```jsx - -``` - -This configuration would display something like the following text on the website, emphasis added to the configurable parameters: - -``` -A {{ release candidate }} for {{ v1.0.0 }} is available! The release can be downloaded here. -``` - -You may customize the parameters in any way you'd like. To remove a prerelease from the website, simply delete the `prerelease` parameter from the above component. - - - - - - -## Redirects - -This website structures URLs based on the filesystem layout. This means that if a file is moved, removed, or a folder is re-organized, links will break. If a path change is necessary, it can be mitigated using redirects. It's important to note that redirects should only be used to cover for external links -- if you are moving a path which internal links point to, the internal links should also be adjusted to point to the correct page, rather than relying on a redirect. - -To add a redirect, head over to the `redirects.js` file - the format is fairly simple - there's a `source` and a `destination` - fill them both in, indicate that it's a permanent redirect or not using the `permanent` key, and that's it. Let's look at an example: - -``` -{ - source: '/foo', - destination: '/bar', - permanent: true -} -``` - -This redirect rule will send all incoming links to `/foo` to `/bar`. For more details on the redirects file format, [check out the docs on vercel](https://vercel.com/docs/configuration#project/redirects). All redirects will work both locally and in production exactly the same way, so feel free to test and verify your redirects locally. In the past testing redirects has required a preview deployment -- this is no longer the case. Please note however that if you add a redirect while the local server is running, you will need to restart it in order to see the effects of the redirect. - -There is still one caveat though: redirects do not apply to client-side navigation. By default, all links in the navigation and docs sidebar will navigate purely on the client side, which makes navigation through the docs significantly faster, especially for those with low-end devices and/or weak internet connections. In the future, we plan to convert all internal links within docs pages to behave this way as well. This means that if there is a link on this website to a given piece of content that has changed locations in some way, we need to also _directly change existing links to the content_. This way, if a user clicks a link that navigates on the client side, or if they hit the url directly and the page renders from the server side, either one will work perfectly. - -Let's look at an example. Say you have a page called `/docs/foo` which needs to be moved to `/docs/nested/foo`. Additionally, this is a page that has been around for a while and we know there are links into `/docs/foo.html` left over from our previous website structure. First, we move the page, then adjust the docs sidenav, in `data/docs-navigation.js`. Find the category the page is in, and move it into the appropriate subcategory. Next, we add to `_redirects` as such. The `.html` version is covered automatically. - -```js -{ source: '/foo', destination: '/nested/foo', permanent: true } -``` - -Next, we run a global search for internal links to `/foo`, and make sure to adjust them to be `/nested/foo` - this is to ensure that client-side navigation still works correctly. _Adding a redirect alone is not enough_. - -One more example - let's say that content is being moved to an external website. A common example is guides moving to `learn.hashicorp.com`. In this case, we take all the same steps, except that we need to make a different type of change to the `docs-navigation` file. If previously the structure looked like: - -```js -{ - category: 'docs', - content: [ - 'foo' - ] -} -``` - -If we no longer want the link to be in the side nav, we can simply remove it. If we do still want the link in the side nav, but pointing to an external destination, we need to slightly change the structure as such: - -```js -{ - category: 'docs', - content: [ - { title: 'Foo Title', href: 'https://learn.hashicorp.com//foo' } - ] -} -``` - -As the majority of items in the side nav are internal links, the structure makes it as easy as possible to represent these links. This alternate syntax is the most concise manner than an external link can be represented. External links can be used anywhere within the docs sidenav. - -It's also worth noting that it is possible to do glob-based redirects, for example matching `/docs/*`, and you may see this pattern in the redirects file. This type of redirect is much higher risk and the behavior is a bit more nuanced, so if you need to add a glob redirect, please reach out to the website maintainers and ask about it first. - - - - - - -## Browser Support - -We support the following browsers targeting roughly the versions specified. - -| ![Chrome](https://raw.githubusercontent.com/alrra/browser-logos/main/src/chrome/chrome.svg) | ![Edge](https://raw.githubusercontent.com/alrra/browser-logos/main/src/edge/edge.svg) | ![Opera](https://raw.githubusercontent.com/alrra/browser-logos/main/src/opera/opera.svg) | ![Firefox](https://raw.githubusercontent.com/alrra/browser-logos/main/src/firefox/firefox.svg) | ![Safari](https://raw.githubusercontent.com/alrra/browser-logos/main/src/safari/safari.svg) | -| ------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | -| **Latest** | **Latest** | **Latest** | **Latest** | **Latest** | - - - - - - -## Deployment - -This website is hosted on Vercel and configured to automatically deploy anytime you push code to the `stable-website` branch. Any time a pull request is submitted that changes files within the `website` folder, a deployment preview will appear in the github checks which can be used to validate the way docs changes will look live. Deployments from `stable-website` will look and behave the same way as deployment previews. - - diff --git a/website/content/docs/api-clients/desktop.mdx b/website/content/docs/api-clients/desktop.mdx deleted file mode 100644 index 82bc2355d..000000000 --- a/website/content/docs/api-clients/desktop.mdx +++ /dev/null @@ -1,207 +0,0 @@ ---- -layout: docs -page_title: Boundary Desktop overview -description: >- - Learn how to install the Boundary Desktop application to browse and connect to targets. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary Desktop - -Boundary Desktop is a standalone application that provides a simple interface -for browsing and connecting to targets on your local computer (macOS and Windows -currently supported). Launch a session in Boundary Desktop and then make a connection -using your favorite tooling. - -## Get started - --> If you're running Boundary for the first time, [download the latest binary](/boundary/downloads) -and run it in `dev` mode locally so you can have a server to run against: - -```shell-session -$ boundary dev -``` - -### Install Boundary Desktop - -1. Download the latest .dmg installer or .exe archive from our [releases page](https://releases.hashicorp.com/boundary-desktop). Alternatively, if you're a homebrew user, you can run `brew install hashicorp-boundary-desktop` -1. In macOS, double-click the downloaded .dmg to run the installer by draggin and dropping Boundary into the applications folder - ![](/img/desktop/macos/boundary-desktop-drag-to-install.png) -1. In Windows, extract downloaded archive and find .exe to launch - -### Run Boundary Desktop - -1. Open the Boundary Desktop application - - - - - -![](/img/desktop/macos/boundary-desktop-open.png) - - - - - -![](/img/desktop/windows/boundary-desktop-open.png) - - - - - -1. You'll be prompted for the Boundary server origin, this is the URL for the client - to connect to the Boundary API. If you are running a local `dev` mode server, this - URL will be `http://localhost:9200` - - - - - -![](/img/desktop/macos/boundary-desktop-origin.png) - - - - - -![](/img/desktop/windows/boundary-desktop-origin.png) - - - - - -1. You can now login to Boundary. We're using a `dev` mode server in this example with the - username `admin` and the password `password` - - - - - -![](/img/desktop/macos/boundary-desktop-login.png) - - - - - -![](/img/desktop/windows/boundary-desktop-login.png) - - - - - -1. After logging in, you should see the targets your user is authorized to connect to. Since - we are using a `dev` mode server we see the default generated target for `127.0.0.1:22` - - - - - -![](/img/desktop/macos/boundary-desktop-landing.png) - - - - - -![](/img/desktop/windows/boundary-desktop-landing.png) - - - - - -### Connect! - --> The rest of this example assumes you're running Boundary in `dev` mode. - -1. Click on `connect` next to the default target. A pop-up window will display the local - address of the proxy and the ephemeral port for the session - - - - - -![](/img/desktop/macos/boundary-desktop-connect.png) - - - - - -![](/img/desktop/windows/boundary-desktop-connect.png) - - - - - -1. Navigate to the `Sessions` pane and you'll see this session is in `pending` state because we - haven't made a connection to it yet (but will!) - - - - - -![](/img/desktop/macos/boundary-desktop-pending.png) - - - - - -![](/img/desktop/windows/boundary-desktop-pending.png) - - - - - --> The next step assumes you have a SSH server running that the default target will connect to. - -1. On the CLI, `ssh` to the target using the local ephemeral port created in the previous step - -```shell-session -$ ssh -p 49250 127.0.0.1 -The authenticity of host '[127.0.0.1]:49250 ([127.0.0.1]:49250)' can't be established. -ECDSA key fingerprint is SHA256:glO05n2iT8Roqak5G63gMKnW8qsE0lxy0MPWcWC7iqg. -Are you sure you want to continue connecting (yes/no/[fingerprint])? yes -Warning: Permanently added '[127.0.0.1]:49250' (ECDSA) to the list of known hosts. -Password: -Last login: Thu Feb 11 17:49:09 2021 -$ -``` - -1. Navigate back to the sessions view and you'll see this session is now active - - - - - -![](/img/desktop/macos/boundary-desktop-active.png) - - - - - -![](/img/desktop/windows/boundary-desktop-active.png) - - - - - -1. Click `Cancel` to cancel the session and you'll see the status go to `canceling` briefly, then `terminated` - - - - - -![](/img/desktop/macos/boundary-desktop-terminated.png) - - - - - -![](/img/desktop/windows/boundary-desktop-terminated.png) - - - - - -1. Navigate back to the CLI and you'll see your SSH session has closed diff --git a/website/content/docs/api-clients/index.mdx b/website/content/docs/api-clients/index.mdx deleted file mode 100644 index 84e40c11e..000000000 --- a/website/content/docs/api-clients/index.mdx +++ /dev/null @@ -1,17 +0,0 @@ ---- -layout: docs -page_title: API/Clients -description: >- - Discover resources to learn more about Boundary's API and clients. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# API and clients - -Boundary is a purely-API-driven system. This section contains information -describing its API norms and the clients that HashiCorp provide (apart from the -web UI), which include a Go SDK and a Desktop client. diff --git a/website/content/docs/api/index.mdx b/website/content/docs/api/index.mdx deleted file mode 100644 index 4f38bbe0c..000000000 --- a/website/content/docs/api/index.mdx +++ /dev/null @@ -1,115 +0,0 @@ ---- -layout: docs -page_title: API overview -description: >- - Learn about Boundary's HTTP API standards, status codes, path layout, methods, and headers. Understand how rate limiting helps manage system resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary API overview - -Boundary's API is a JSON-based HTTP API that adheres to a set of standards that are rigidly followed. At its core, it is a standards-compliant JSON API for both input and output. - -Before reading this page, it is useful to understand Boundary's [domain model](/boundary/docs/domain-model) to be aware of the terminology used here. - -Boundary's API is also described via OpenAPI v2; the version corresponding to any tag of Boundary's source code can be found in Boundary's [GitHub repository](https://github.com/hashicorp/boundary/blob/main/internal/gen/controller.swagger.json). - - - -Refer to the [API page](/boundary/api-docs) for a rendered version of this generated API definition. - - - -Boundary's current API version is 1; all API paths begin with `/v1/`. - -## Status codes - -- `2XX`: Boundary returns a code between `200` and `299` on success. Generally this is `200`, but implementations should be prepared to accept any `2XX` status code as indicating success. If a call returns a `2XX` code that is not `200`, it will follow well-understood semantics for those status codes. Any `delete` actions return `204` on success. -- `400`: Boundary returns `400` when a command cannot be completed due to invalid user input, except for a properly-formatted identifier that does not map to an existing resource, which will return a `404` as discussed below. -- `401`: Boundary returns `401` if no authentication token is provided or if the provided token is invalid. A valid token that simply does not have permission for a resource will return a `403` instead. A token that is invalid or missing, but where the anonymous user (`u_anon`) is able to successfully perform the action, will not return a `401` but instead will return the result of the action. -- `403`: Boundary returns `403` if a provided token was valid but does not have the grants required to perform the requested action. -- `404`: Boundary returns `404` if a resource cannot be found. Note that this happens _prior_ to authentication/authorization checking in nearly all cases as the resource information (such as its scope, available actions, etc.) is a required part of that check. As a result, an action against a resource that does not exist will return a `404` instead of a `401` or `403`. While this could be considered an information leak, since IDs are randomly generated and this only discloses whether an ID is valid, it's tolerable as it allows for far simpler and more robust client implementation. -- `405`: Boundary returns a `405` to indicate that the method (HTTP verb or custom action) is not implemented for the given resource. -- `429`: Boundary returns a `429` if any of the API rate limit quotas have been exhausted for the resource and action. It includes the `Retry-After` header so that the client knows how long to wait before making a new request. -- `500`: Boundary returns `500` if an error occurred that is not (directly) tied to invalid user input. If a `500` is generated, information about the error will be logged to Boundary's server log but is not generally provided to the client. -- `503`: Boundary returns a `503` if it is unable to store a quota due to the API rate limit being exceeded. It includes the `Retry-After` header so that the client knows how long to wait before making a new request. - -## Path layout - -Boundary follows a predictable path layout. There are two fundamental types of URL paths, each supporting a different set of operations. - -### Collections - -Collections of resources are top level paths with plural English names for the resource, e.g. `/roles` and `/hosts`. Collections support the following operations: - -- Creation of new resources within that collection -- Listing of resources within that collection - -All collection operations require supplying the enclosing resource. Depending on the collection type, this will be one of the following: - -- A scope, indicating the scope in which an operation should take place. For instance, a POST to `/roles` would need to indicate whether the role should be created within the `global` scope or an org-level scope like `o_1234567890`. -- A parent resource of the appropriate type. For instance, hosts and host sets are child resources of host catalogs. When creating a new host set within a host catalog, a POST to `/host-sets` would need to indicate the host catalog ID with which the host-set should be associated. - -### Resources - -Resources themselves are defined by ID specifiers within a collection path, e.g. `/roles/r_1234567890`. Resources support the following operations: - -- Reading a resource's properties -- Updating a resource's properties -- Deleting a resource -- Custom methods specific to a resource type - -Depending on the resource type, various parameters may be available. Some are common across all resource types (e.g. `name` and `description`); others are available only for specific types. Further, some concrete-types of abstract resources include an opaque `attributes` JSON object with type-specific values. - -For instance, an auth method is an abstract type; a `password` auth method is a concrete implementation of that type. When creating such an auth method, a `type` parameter will indicate that it should be the `password` type, while values specific to the `password` type auth method, such as minimum password length, will be contained within an `attributes` object. - -## Methods - -The following method conventions are used within Boundary's API: - -### GET - -`GET` is used for reading a resource or listing resources in a collection. The behavior depends on whether the `GET` is issued against a collection (`/roles`) or a singular resource (`/roles/r_1234567890`). In the former case it lists resources within the collection; in the latter it performs a read on that particular resource. - -### POST - -`POST` is used for creating a resource or performing custom actions against a resource. When creating a resource, `POST` is used against a collection (`/roles`). When performing a custom action, `POST` is used against a particular resource (`/roles/r_1234567890:set-principals`). - -### PATCH - -`PATCH` is used to update a resource's parameters. The following are behaviors to be aware of when using `PATCH`: - -- In nearly all cases, a `version` parameter is required. This is used for check-and-set, to ensure that the update operation is being performed against a known resource. The version parameter is returned from a `GET` operation on the resource so the current version, along with the resource's other current values, can be looked up at any time. -- Passing a JSON `null` for a parameter has the effect of reverting that parameter to its default. For some parameters (e.g. `name`) this will simply clear the value (as the default `name` for a resource is empty); for other parameters this will revert to the current defaults within Boundary. -- All parameters specified as part of a `PATCH` operation will be considered to be parameters that should be updated. - -### DELETE - -`DELETE` is used for deleting a specific resource, and is only used against a particular resource path. - -## HTTP headers - -Clients that make requests to the controller API can inspect HTTP response headers to understand the configured limits and current usage. -Responses may contain the following headers: - -- `RateLimit` - Provides the current limit, number of remaining requests, and the time at which the quota will reset for the limit that is closest to being exhausted for the requested resource and action. -- `RateLimit-Policy` - Describes the limits for the requested resource and action. -- `X-Correlation-ID` - Identifies a transaction over a series of requests and responses. -The `X-Correlation-ID` header is a universally unique identifier (UUIDv4). -If you provide an `X-Correlation-ID` header in an HTTP request, Boundary logs that value for all audit events related to the request. -It then uses that value as the header when it makes related requests to an external system, such as Vault, so that you can correlate the event between the product logs. -If you do not provide an `X-Correlation-ID` header, Boundary generates a unique value for each incoming request. - -## Manage system resources - -If your controllers try to process every API request, they may either run out of resources or overwhelm the database server. -Boundary features API rate limiting to help prevent system resources from being overwhlemed by too many simultaneous requests. -For more information, refer to [API rate limiting](/boundary/docs/api/rate-limiting). - -When you search for Boundary resources using the `list` operation, you could potentially receive a very large number of results. -Boundary uses an API pagination feature to enable you to search and filter large lists of search results without overwhelming your system resources. -Refer to [API list pagination](/boundary/docs/api/pagination) for more information about pagination and using the local cache for searches. \ No newline at end of file diff --git a/website/content/docs/api/pagination.mdx b/website/content/docs/api/pagination.mdx deleted file mode 100644 index 555281b5b..000000000 --- a/website/content/docs/api/pagination.mdx +++ /dev/null @@ -1,109 +0,0 @@ ---- -layout: docs -page_title: API list pagination -description: >- - Learn about API pagination and how the cache works in Boundary to prevent system resources from being overwhelmed and to help you find resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# API list pagination - -Boundary uses an API pagination feature to support searching and filtering large lists of results without overwhelming your system resources. - -## Introduction - -When you perform a `list` operation on a resource, the API request returns the first 1000 results, by default. -You can request the next page of results by repeating the `list` command and including a parameter with a token provided by Boundary. - -## Initial pagination - -When you run a `list` operation on a resource, the initial results are sorted in descending order by creation time and public ID (most recently created first). -Boundary returns the maximum number of responses along with the top-level fields `response_type` and `list_token`. -If the `response_type` is `delta`, it means there are more items available in the list. - -List tokens contain general metadata associated with the ongoing pagination. -To request the next page of results, run the `list` operation again and include the `list_token` that Boundary provided in the last response. -Boundary returns the next page of results with new `response_type` and `list_token` values. - -![API pagination workflow](/img/api-pagination/pagination-workflow.png) - -You can continue viewing new pages of results using the `list_token` values until the `response_type` reads `complete`. -If you compose an invalid token, you receive an invalid token error. - -## Request updated and deleted resources - -When the `response_type` reads `complete`, you have viewed all the results that were available when you ran the initial `list` operation. -You can now request any resources that were updated or deleted since you started paginating. - -To refresh the cached list results, make another `list` request using the `list_token` from the previous response. -Boundary returns a `response_type` and `list_token` as part of the response, similarly to when you ran the initial operation. -If the `response_type` is `delta`, it means there are more items available in the list. -You can use the `list_token` as a parameter to continue viewing new pages of results until the `response_type` reads `complete`. - -Boundary also includes the top-level response `removed_ids` as part of the refresh operation. -The `removed_ids` response contains the IDs of any resources that were deleted since you began paginating the results of the previous `list` operation. -Any resources that have been deleted are included on the first page of results. - -After 30 days, the `list_token` expires and you must make a new `list` request without the token to regenerate the full list of results. -If you make a `list` request using a token that has a `create_time` older than 30 days, Boundary treats it as an invalid token and returns an error. - -## Response structure - -All `list` endpoints support the following parameters: - -- `list_token` (optional) - An opaque token that is returned from the previous `list` response. -If you do not supply a value, pagination starts from the beginning. -- `page_size` (optional) - An unsigned integer that indicates the number of items that should be included on the page of search results. -If you do not include a value, or if you include a value of `0`, Boundary uses the default page size of 1000 items. -If you configure it, the `page_size` value overrides the default page size. -Controller administrators can also configure a `max_page_size` option that constrains the maximum page size a user can request. - -Boundary returns the following response parameters: - -- `response_type` - Defines whether the response is a `delta` or `complete` listing. -The value is `delta` until the last page is returned, at which point it will be `complete`. -- `list_token` - An opaque token which is included in subsequent listing requests after the initial one, so that the client can continue to paginate the results. -- `sort_by` - The column name that the returned items should be sorted on. -This attribute is included in the response, so that the sort order for each endpoint is explicit. -- `sort_dir` - The direction in which the returned items are sorted. -Responses can include `desc` for descending, or `asc` for ascending. -- `items` - The list of items. -- `est_item_count` - An unsigned integer that indicates the total number of items that are available in the list of results. -This number may be an estimate, since the number of items may change during the pagination process. - -### Example response - -```json -{ - "response_type": "", - "list_token": "", - "sort_by": "created_time", - "sort_dir": "desc", - "est_item_count": 1000, - "items": [ - { - "id": "ttcp_1234567890", - "scope_id": "p_1234567890" - }, - { - "id": "ttcp_2234567890", - "scope_id": "p_1234567890" - } - ] -} -``` - -## Constraints and limitations - -In scenarios where updates are so frequent that the results may change while the refresh operation runs, those updates may not appear at all in the refreshed list. -If you make frequent updates to a resource, or if you are updating data while you run a `list` operation, HashiCorp recommends that you generate the full list of results instead of performing a refresh. - -Workers are not included in refresh operations because the updates they send to the controller are too frequent to be captured in a refresh. -To update a list of worker resources, you must regenerate the full list of results. - -When you refresh the list of results, you may notice duplicate items in the list. -This is a fundamental tradeoff when you search across multiple database transactions. \ No newline at end of file diff --git a/website/content/docs/api/rate-limiting.mdx b/website/content/docs/api/rate-limiting.mdx deleted file mode 100644 index 7c3b5ef4d..000000000 --- a/website/content/docs/api/rate-limiting.mdx +++ /dev/null @@ -1,204 +0,0 @@ ---- -layout: docs -page_title: API rate limiting -description: >- - Learn how API rate limiting lets you configure limits on the rates of API requests in Boundary to help manage resources and prevent them from being overwhelmed. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Rate limiting - -If your controllers try to process every API request, it can lead to situations when the controllers are overwhelmed with requests. -The controllers may either run out of resources or overwhelm the database server and exhaust its resources. -API rate limiting lets you configure limits on the rate of API requests to help manage your resources and prevent them from being overwhelmed. - -## Quotas - -Boundary creates quotas to track the number of requests in a given time period. -By default, Boundary tracks the number of requests by auth token, IP address, and the overall total. -Boundary reserves a portion of its memory for tracking quotas to ensure that it does not consume too much memory if there is a sudden burst of requests. - -If Boundary is unable to store a quota, it limits the request with a 503 HTTP status code. -You can configure the maximum number of quotas Boundary allows using the `api_rate_limit_max_quotas` variable. -There are also two metrics that allow you to monitor quota tracking: - -- `boundary_controller_api_ratelimiter_quota_storage_capacity` -- `boundary_controller_api_ratelimiter_quota_storage_usage` - -## Default limits - -API rate limiting is enforced on the controllers. -There are separate configurable limits for each combination of resource and action. -By default, the limits for `list` actions are: - -- 150 requests per 30 seconds per auth token -- 1,500 requests per 30 seconds per IP address -- 1,500 requests per 30 seconds in total - -The default limits for all other actions are: - -- 3,000 requests per 30 seconds per auth token -- 30,000 requests per 30 seconds per IP address -- 30,000 requests per 30 seconds in total - -You can override the default settings and configure other specific limitations using the `api_rate_limit` stanza in the controller configuration. - -## Rate limiting HTTP headers - -Clients that make requests to the controller API can inspect HTTP response headers to understand the configured limits and current usage. -Each response contains the `RateLimit` and `RateLimit-Policy` headers. - -If the request is rate limited, Boundary sends the client a 429 HTTP status code with a `Retry-After` header. -The `Retry-After` header contains the number of seconds the client should wait before it sends the request again. - -For more information, refer to [HTTP headers](/boundary/docs/api#http-headers). - -## More information - -Refer to the [controller stanza](/boundary/docs/configuration/controller#api_rate_limit) documentation for the specific `api_rate_limit` configuration options. -Some example configurations are listed below. - -### Rate limiting configuration examples - -The following example shows a simple configuration where the same limits are applied to all resources and examples: - -```hcl -controller { - # Total limit for all resources and actions - api_rate_limit { - resources = ["*"] - actions = ["*"] - per = "total" - limit = 500 - period = "1s" - } - - # Limit for all IP addresses to all resources and actions to prevent a - # malicious host that is fabricating tokens or spamming unauthed endpoints - api_rate_limit { - resources = ["*"] - actions = ["*"] - per = "ip-address" - limit = 100 - period = "1s" - } - - # Limit for all authed requests to prevent one user - # from consuming all of the total limit - api_rate_limit { - resources = ["*"] - actions = ["*"] - per = "auth-token" - limit = 100 - period = "1s" - } -} -``` - -The following example shows a configuration that disables rate limiting. -You may want to disable rate limiting if you already use an external system like a reverse proxy to apply rate limiting: - -```hcl -controller { - api_rate_limit_disable = true -} -``` - -The following example uses the default settings for most endpoints, but configures a single override: - -```hcl -controller { - api_rate_limit { - resources = ["target"] - actions = ["list"] - per = "auth-token" - limit = 10 - period = "1s" - } -} -``` - -The following example is more complex. -Initially it sets some defaults to apply to all resources and actions. -Then it configures some specific endpoints with different limits. - -```hcl -controller { - # Total limit for all resources and actions - api_rate_limit { - resources = ["*"] - actions = ["*"] - per = "total" - limit = 500 - period = "1s" - } - - # Total limit for all list operations, - # sets an overall cap on the list action since it is relatively expensive - api_rate_limit { - resources = ["*"] - actions = ["list"] - per = "total" - limit = 200 - period = "1s" - } - - # Limit for IP address to all resources and actions - # to prevent a malicious host that is fabricating tokens - # or spamming unauthed endpoints - api_rate_limit { - resources = ["*"] - actions = ["*"] - per = "ip-address" - limit = 50 - period = "1s" - } - - # Limit of all authed requests, this essentially sets a default - # for all authed requests to prevent one user from consuming - # all of the total list limit set above. Any limits that follow - # can override the default for specific sets of resources and actions - api_rate_limit { - resources = ["*"] - actions = ["*"] - per = "auth-token" - limit = 100 - period = "1s" - } - - # Limit of all list operations by auth token to set a sane default - # since they are generally more expensive - api_rate_limit { - resources = ["*"] - actions = ["list"] - per = "auth-token" - limit = 50 - period = "1s" - } - - # Limit for targets and sessions list by auth token. These are resources - # that clients will want to list frequently, but might be more expensive - # if there is a large number of them for each user. Having a lower limit - # encourages the use of refresh tokens and caching. - api_rate_limit { - resources = ["target", "session"] - actions = ["list"] - per = "auth-token" - limit = 20 - period = "1s" - } - - #Limit for authorize session by auth token - api_rate_limit { - resources = ["target"] - actions = ["authorize-session"] - per = "auth-token" - limit = 150 - period = "1s" - } -} -``` \ No newline at end of file diff --git a/website/content/docs/architecture/fault-tolerance.mdx b/website/content/docs/architecture/fault-tolerance.mdx deleted file mode 100644 index 794a971c2..000000000 --- a/website/content/docs/architecture/fault-tolerance.mdx +++ /dev/null @@ -1,46 +0,0 @@ ---- -layout: docs -page_title: Fault tolerance recommendations -description: >- - Understand Boundary fault tolerance recommendations to increase availability, reduce risk. Minimize the impact of node, availability zone, and regional failures. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Fault tolerance recommendations - -Review the following fault tolerance recommendations to ensure increased availability and reduced risk. - -## Node failure - -Boundary controllers store all state and configuration within a PostgreSQL database that must not be deployed on the controller nodes. -When a controller node fails, users are still able to interact with other Boundary controllers, assuming the presence of additional nodes behind a load balancer. - -Boundary workers are used as either proxies or reverse proxies. -Boundary workers routinely communicate with Boundary controllers to report their health. -In the event of a Boundary worker node failure, it is a best practice to have at least three Boundary workers per network boundary, per type (ingress and egress). -Therefore, the controller assigns a user's proxy session to an active Boundary worker node. - -## Availability zone failure - -By deploying Boundary controllers in the recommended architecture across three availability zones with load balancing in front of them, the Boundary control plane can survive outages in up to two availability zones. - -The best practice for deploying Boundary workers is to have at least one worker deployed per availability zone. -In the case of an availability zone outage, if the networking service is still up, users will have their attempted session connection proxied through a worker in a different availability zone and then onto the target, granted the proper security rules are in place to allow for cross subnet/availability zone communication. - -## Regional failures - -Generally speaking, when there is a failure in an entire cloud region, the resources running in that region are most likely inaccessible, especially if the networking service is affected. - -To continue to serve Boundary controller requests in the event of a regional outage, there must be a deployment like the one outlined in this guide in a different region. -The nodes in the secondary region must be able to communicate with the PostgreSQL database, which can be accomplished with multi-regional database technologies from the various cloud providers (for example AWS RDS Read Replicas, where a read replica can be promoted to a primary in the event the primary resides in a failed region). - -Another point of consideration is how to handle load balancing Boundary controller requests to regions that are not in a failed state. -Services like AWS Global Accelerator for AWS, Cross-Region Load Balancer for Azure, and GCP Cloud Load Balancer for GCP all provide this level of functionality with some configuration. - -Refer to your cloud provider's documentation for additional information regarding multi-region disaster recovery strategies for PostgreSQL. - -In the case of a regional outage, if a Boundary worker cannot reach its upstream worker, cannot reach a controller, a user cannot reach the worker, or any combination of the above, the user is not able to establish a proxied session to the target. diff --git a/website/content/docs/architecture/high-availability.mdx b/website/content/docs/architecture/high-availability.mdx deleted file mode 100644 index e06b3be61..000000000 --- a/website/content/docs/architecture/high-availability.mdx +++ /dev/null @@ -1,63 +0,0 @@ ---- -layout: docs -page_title: High availability installation -description: >- - Learn about network requirements and architecture to set up Boundary for high availability, including database, load balancer, and configuration best practices. - ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# High availability installation - -Installing Boundary as a high availability service requires certain infrastructure considerations. At the most basic level, running 3 controller and 3 worker instances gives a fundamental level of high availability for the control plane (controller), as well as bandwidth for a number of sessions on the data plane (worker). Both server types should be run in a fault-tolerant configuration, that is, in a self-healing environment such as an auto-scaling group. The documentation here does not cover self-healing infrastructure and assumes the operator has their preferred scheduling methods for these environments. - -## Network requirements - -The following ports should be available: - -- Clients must have access to the Controller's `api` port (default 9200) -- Clients must have access to the Worker's port (default 9202) -- Workers must have access to the Controller's `cluster` port (default 9201) -- Workers must have a route and port access to the hosts defined within the system to provide connectivity - -## Architecture - -The general architecture for the server infrastructure requires 3 controllers and 3 workers. Note that it is possible to run a controller and worker within the same process, but the guide here assumes separate deployments. The documentation here uses virtual machines running on Amazon EC2 as the example environment, but this use case can be extrapolated to almost any cloud platform to suit operator needs: - -![](/img/boundary-network.png) -![Boundary network diagram](/img/boundary-network_light.png#light-theme-only) -![Boundary network diagram](/img/boundary-network_dark.png#dark-theme-only) - -As shown above, Boundary is broken up into its controller and worker server components across 3 [EC2 instances](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance), in -3 separate [subnets](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet), in three separate availability zones, with the controller API and UI being publically exposed by an [application load balancer (ALB)](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb). The worker and controller VM's are in independent [auto-scaling groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/autoscaling_group), allowing them to maintain their exact capacity. - -The workers must be able to establish a connection to the hosts with which they interact. In the architecture above, we place them in the public subnet so our remote client can establish a session between them and the target VM. - -Boundary requires an external [Postgres](https://www.postgresql.org/) and [KMS](https://aws.amazon.com/kms/). In the example above, we're using AWS managed services for these components. For Postgres, we're using [RDS](https://aws.amazon.com/rds/) and for KMS we're using Amazon's [Key Management Service](https://aws.amazon.com/kms/). - -### Database - -Boundary controllers must be able to reach the PostgreSQL database. -If you use a high availability (HA) configuration, then the controllers must have access to the PostgreSQL server infrastructure. - -For more information about configuring the Postgres database for HA, refer to the [Postgres high availability, load balancing, and replication documentation](https://www.postgresql.org/docs/current/high-availability.html). -If you use a managed service, refer to your provider's PostgreSQL high availability documentation. - -### API and console load balancer - -Load balancing the controller allows operators to secure the ingress to the Boundary system. We recommend placing all Boundary servers in private networks and using load balancing techniques to expose services such as the API and administrative console to public networks. In the high availability architecture, we recommend load balancing using a layer 7 load balancer and further constraining ingress to that load balancer with layer 4 constraints such as [security groups](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html) or [IP tables](https://wiki.archlinux.org/index.php/Iptables). - -For general configuration, we recommend the following: - -- HTTPS listener with valid TLS certificate for the domain it's serving or TLS passthrough -- Health checks should use TCP port 9200 - -### Controller configuration - -When running Boundary controller as a service we recommend storing the file at `/etc/boundary.d/boundary-controller.hcl`. A `boundary` user and group should exist to manage this configuration file and to further restrict who can read and modify it. - -For detailed configuration options, see our [configuration docs](/boundary/docs/configuration). diff --git a/website/content/docs/architecture/recommended-architecture.mdx b/website/content/docs/architecture/recommended-architecture.mdx deleted file mode 100644 index 6c2837e7f..000000000 --- a/website/content/docs/architecture/recommended-architecture.mdx +++ /dev/null @@ -1,58 +0,0 @@ ---- -layout: docs -page_title: Recommended architecture -description: >- - Learn about the recommended architectures for two main Boundary user workflows: an administrator configuring Boundary and an end user connecting to a target. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Recommended architecture - -Boundary has two main user workflows to consider when you deploy it to production. - -## Administrative workflow - -The first is the Boundary administration workflow, where an administrator uses either the Boundary CLI or GUI to configure Boundary. -In this scenario, the administrator interfaces solely with the Boundary controllers, and a load balancer can be used to balance requests across multiple controllers. -The Boundary controllers do not directly communicate with one another, all configuration and state is managed through an RDBMS, in this case PostgreSQL. - -The following diagram shows the recommended architecture for deploying Boundary controller nodes within a single region: - -![Single region deployment](/img/single-region.png) - -Boundary controllers are stateless and do not operate using consensus protocols such as Raft. -They are therefore able to withstand failure scenarios where only one node is accessible. - -If deploying Boundary to three availability zones is not possible, you can use the same architecture across one or two availability zones, at the expense of reliability risk in case of an availability zone outage. - -## Connect to a target workflow - -The second workflow is a user connecting to a Boundary target. -In this scenario, the user initiates a session connecting to a target they have been granted access to using either the Boundary CLI or desktop application. - -1. If the user is not authenticated, they must first authenticate by communicating with the Boundary controllers and any relied-upon OIDC IdP, if necessary. -1. Once authenticated, the user's session can be initiated and a tunnel is built from their client to an ingress worker. -If there are multiple layers of network boundaries, a tunnel is built from the ingress worker to an egress worker. -1. The last step is traffic being proxied through the egress worker to the target. - -It is ideal to have multiple ingress and egress workers with the same configurations within each network boundary to provide high availability. -Load balancing the Boundary workers is not recommended, as the Boundary control plane handles session scaling and balancing when users start sessions. - -The following diagram shows the recommended architecture for deploying Boundary workers: - -![Worker deployment](/img/worker-deployment.png) - -The Boundary controllers also depend on a PostgreSQL database. -This database should be deployed in a fashion where it is reachable by all Boundary controller nodes. - -## Community reference architectures - -A number of community-supported reference architectures for non-dev deployments can be found in Boundary's dedicated [reference architecture repo](https://github.com/hashicorp/boundary-reference-architecture). - -While some initial reference deployments have been seeded by the Boundary team, the seeded examples are for demonstration purposes only and are intended convey how to get Boundary up and running on popular cloud and container platforms. - -We highly encourage organizations who use Boundary in production environments to contribute configurations to the repo so that the community may benefit from them. diff --git a/website/content/docs/architecture/system-requirements.mdx b/website/content/docs/architecture/system-requirements.mdx deleted file mode 100644 index 3df95971c..000000000 --- a/website/content/docs/architecture/system-requirements.mdx +++ /dev/null @@ -1,234 +0,0 @@ ---- -layout: docs -page_title: System requirements -description: >- - Learn about Boundary system requirements including recommendations for hardware sizing, network connectivity, traffic encryption, databases, and load balancers. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# System requirements - -This topic contains specific recommendations for system requirements. - - - -All specifications outlined in this topic are minimum recommendations without -any reservations towards vertical scaling, redundancy, or other site reliability -needs. - -All resource requirements are directly proportional to the operations -performed by the Boundary cluster, and the end users' level of usage. - - - -To match your requirements and maximize the stability of your Boundary -controller and worker instances, perform load tests and monitor -resource usage including reported matrices from Boundary's telemetry. - -Refer to [Monitor Boundary](/boundary/docs/monitor) for -more information. - -## Hardware sizing for Boundary servers - -Refer to the tables below for sizing recommendations for controller nodes and -worker nodes, as well as small and large use cases based on expected usage. - -Controller nodes - -| Size | CPU | Memory | Disk capacity | Network throughput | -|-------|------------|----------------|---------------|--------------------| -| Small | 2 - 4 core | 8 - 16 GB RAM | 50+ GB | Minimum 5 Gbps | -| Large | 4 - 8 core | 32 - 64 GB RAM | 100+ GB | Minimum 10 Gbps | - -Worker nodes - -| Size | CPU | Memory | Disk capacity | Network throughput | -|-------|------------|----------------|---------------|--------------------| -| Small | 2 - 4 core | 8 - 16 GB RAM | 50+ GB | Minimum 10 Gbps | -| Large | 4 - 8 core | 32 - 64 GB RAM | 100+ GB | Minimum 10 Gbps | - -To ensure predictable performance, we recommend that you -avoid "burstable" CPU and storage options whose performance may degrade -under continuous load. - -## Hardware considerations - -The Boundary controller and worker nodes perform two different tasks. -The Boundary controller nodes handle requests for authentication and -configuration. -The Boundary worker nodes proxy client connections to Boundary -targets which may require additional resources. - -Depending on the number of clients connecting to Boundary targets at any given -time, Boundary workers can become memory or file descriptor constrained. -As your users create new sessions, the Boundary worker node opens more sockets and -ultimately creates additional file descriptors. Monitor both the -file descriptor usage and the memory consumption of each Boundary worker node. - -## Network considerations - -The amount of network bandwidth used by the Boundary controllers and workers -depends on your specific usage patterns. -For the Boundary controller, even a high request volume does not -translate to a large amount of network bandwidth consumption. - -Boundary worker nodes proxy client sessions to Boundary targets. The -bandwidth consumption depends on the amount of potential clients, -the number of sessions created, and the amount of data transferred -between the user and the Boundary targets. - -It is also important to consider bandwidth requirements to other external -systems such as monitoring and logging collectors. -It may be necessary to increase the size of the virtual machine to take -advantage of additional throughput in certain circumstances. - -Refer to the following pages for provider-specific virtual machine networking -limitations: - -- [AWS](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-network-bandwidth.html) -- [Azure](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-machine-network-throughput/) -- [GCP](https://cloud.google.com/compute/docs/network-bandwidth/) - -## Network connectivity - -The following table outlines the default ingress network connectivity -requirements for Boundary cluster nodes. - -If you restrict network egress, ensure you allow outgoing access from: - -- The Boundary controllers to any external integration providers (for example, - OIDC authentication providers) as well as external log handlers, metrics - collection, and security and configuration management providers. - -- The Boundary workers to controllers and any upstream workers. - - - -If any of the default port mappings do not meet your organization's -requirements, you can update the default listening ports using the resource's -[listener](/boundary/docs/monitor/listeners) stanza. - - - -![Boundary network](/img/boundary-network.png) - -| Source | Destination | Default destination port | protocol | Purpose | -| --------------- | --------------------------- | ------------------------ | --------- | -------------------------------------- | -| Client machines | Controller load balancer | 443 | tcp | Request distribution | -| Load balancer | Controller servers | 9200 | tcp | Boundary API | -| Load balancer | Controller servers | 9203 | tcp | Health checks | -| Worker servers | Controller load balancer | 9201 | tcp | Session authorization, credentials, etc | -| Controllers | PostgreSQL | 5432 | tcp | Storing system state | -| Client machines | Worker servers \* | 9202 | tcp | Session proxying | -| Worker servers | Boundary targets\* | various | tcp | Session proxying | -| Client machines | Ingress worker servers \*\* | 9202 | tcp | Multi-hop session proxying | -| Egress workers | Ingress worker servers \*\* | 9202 | tcp | Multi-hop session proxying | -| Egress workers | Boundary targets \*\* | various | tcp | Multi-hop session proxying | - -\* In this scenario, the client connects directly to one worker, which then -proxies the connection to the Boundary target. - -** Multi-hop sessions start reverse proxy tunnels when the downstream workers -start and connect to upstream workers. - -There are four steps when a client requests to connect to a target that requires -a multi-hop path: - -1. The client connects to an ingress worker. - -1. The ingress worker connects with the next-downstream or egress worker through - that worker's established reverse-proxy tunnel. This step may be repeated - multiple times if there are multiple worker connections in the middle of the - tunnel chain. - -1. The final downstream egress worker connects to the Boundary target. - -1. The client can now send data through the tunnel chain. - -A multi-hop worker that acts as a downstream can start a tunnel to one or -more upstream workers, specified in the `initial_upstreams` list in the -worker configuration. - -## Network traffic encryption - -You should encrypt connections to the Boundary control plane at the controller -nodes using standard PKI HTTPS TLS. - -You can use either a layer 4 load balancer to pass through traffic to the -Boundary controllers, or a layer 7 load balancer with no configured TLS -termination. - -## Database recommendations - -Boundary clusters depend on a PostgreSQL database for managing state and -configuration. -Ensure you are using a version of PostgreSQL covered under [Boundary's supported -version -policy](https://developer.hashicorp.com/boundary/docs/enterprise/supported-versions#postgresql-support-policy). - -Each major cloud provider offers a managed PostgreSQL database service: - -| Cloud provider | Managed database service | -|----------------|-----------------------------------------------------------------------------------------| -| AWS | [Amazon RDS for PostgreSQL](https://aws.amazon.com/rds/postgresql/) | -| Azure | [Azure database for PostgreSQL](https://azure.microsoft.com/en-us/products/postgresql/) | -| GCP | [Cloud SQL for PostgreSQL](https://cloud.google.com/sql/postgresql) | - -### Database network requirements - -Boundary controllers must be able to reach the PostgreSQL database. -Worker nodes do not need access to the database. - -### Database users and roles - -Database initialization requires elevated privileges. -When you initialize the database with the `boundary database init` command, the -Boundary database user requires the `superuser` role plus `all privileges` on -the Boundary database. - -Once the database initialization is complete, the database user for a Boundary -controller requires permissions for [data -manipulation](https://www.postgresql.org/docs/current/dml.html) operations -(select, insert, update, and delete). - -### Required PostgreSQL modules - -Boundary has a dependency on the PostgreSQL -[pgcrypto](https://www.postgresql.org/docs/11/pgcrypto.html) module and -[citext](https://www.postgresql.org/docs/11/citext.html), which are part of the -standard modules supplied with PostgreSQL. Refer to the PostgreSQL documentation -for more information. - -## Load balancer recommendations - -For the highest levels of reliability and stability, we recommend that you use -some load balancing technology to distribute requests to your Boundary -controller nodes. - -Boundary workers do not require any load balancing. -The Boundary controller manages load balancing for the Boundary workers when -clients initiate sessions to Boundary targets. - -To monitor the health of Boundary controller nodes, configure the load balancer -to poll the `/health` API endpoint to detect the status of the node and direct -traffic accordingly. - -Each major cloud provider offers one or more managed load balancing services: - -| Cloud | Layer | Layer | Managing load balancing service | -|-------|---------------------|-------|----------------------------------------------------------------------------------------------------------------| -| AWS | Network | 4 | [Network load balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html) | -| AWS | Application | 7 | [Application load balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html) | -| Azure | Network | 4 | [Azure load balancer](https://learn.microsoft.com/en-us/azure/load-balancer/) | -| Azure | Application | 7 | [Azure application gateway](https://learn.microsoft.com/en-us/azure/application-gateway/) | -| GCP | Network/Application | 4/7 | [Cloud load balancing](https://cloud.google.com/load-balancing/docs/load-balancing-overview) | - -There are also a number of self-hosted options, as well as service discovery -systems like Consul. - -Refer to the [listener stanza -documentation](/boundary/docs/monitor/listeners/) for more information. \ No newline at end of file diff --git a/website/content/docs/client-agent/configuration.mdx b/website/content/docs/client-agent/configuration.mdx deleted file mode 100644 index 353526de3..000000000 --- a/website/content/docs/client-agent/configuration.mdx +++ /dev/null @@ -1,164 +0,0 @@ ---- -layout: docs -page_title: Configure the Client Agent -description: >- - Learn how to configure the Boundary Client Agent to intercept DNS requests, allowing Boundary to proxy connections transparently. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Configure the Client Agent - -@include 'alerts/enterprise-only.mdx' - -The default configuration included with the Boundary Client Agent upon installation will be suitable for most users. If you want to make changes to the configuration, the configuration file is located in the following directory: - - - - - `/Library/Application Support/HashiCorp/Boundary/boundary-client-agent.hcl` - - - - - `C:\Program Files\Hashicorp Boundary\boundary-client-agent.hcl` - - - - -## Configuration settings - -The configuration file contains the following fields: - -- `alias_refresh_interval` - Specifies how often to refresh the alias cache. The default value is 1 minute. - - Example: - ```hcl - alias_refresh_interval="60s" - ``` - -- `dns_request_timeout` - Specifies for how long the Client Agent DNS request handling, including any recursion, is allowed to run before it is canceled. - - Example: - ```hcl - dns_request_timeout="300s" - ``` - -- `interface_to_use` - Specifies the interface to use instead of the default. - - Example: - ```hcl - interface_to_use="en1" - ``` - -- `log_file` - Specifies where to write the Boundary Client Agent log file to. - - Example: - ```hcl - log_file="/Library/Application\ /Support/HashiCorp/Boundary/boundary-client-agent.log" - ``` - -- `log_level` - Specifies the verbosity of the Client Agent logs. - - Example: - ```hcl - log_level="DEBUG" - ``` - -- `log_to_stdout` - Logs to STDOUT in addition to the `boundary-client-agent.log` file. - - Example: - ```hcl - log_to_stdout=false - ``` - -- `override_upstream_dns_servers` - Lists the DNS servers that should be used for recursing non-Boundary requests, overriding those configured on the system. - - Example: - ```hcl - override_upstream_dns_servers = ["8.8.8.8", "8.8.4.4"] - ``` - -- `state_file` - Specifies where to write the Boundary Client Agent state file to. This is an ephemeral file which is removed on successful shutdown. - - Example: - ```hcl - state_file="/Library/Application\ /Support/HashiCorp/Boundary/boundary-client-agent-state.json" - ``` - -- `v4_prefix` - Specifies an alternate prefix to use for generating IPs. Currently must be between /8 and /16 - - Example: - ```hcl - v4_prefix=1.1.1.1/8 - ``` - -## Change the configuration - -Complete the following steps to change the configuration of the Client Agent: - - - - -1. As a privileged user, open the Boundary Client Agent configuration file in the editor of your choice. -By default, it is located in the following directory: - - `/Library/Application Support/HashiCorp/Boundary/boundary-client-agent.hcl` - -1. Change the configuration settings, and save the file. - - - - You must restart the Client Agent to update some configuration settings. - However, when you restart the Client Agent, it closes any existing sessions. - Other configuration settings can be updated by only reloading the configuration file, which does not affect any existing sessions. - - - -1. Either reload the configuration file or restart the Client Agent. - - You can change the following configuration values by reloading the configuration file, which will not disrupt any existing sessions: - - - `dns_request_timeout` - - `log_file` - - `log_level` - - `state_file` - - `override_upstream_dns_servers` - - `v4_prefix` - - Run the following command to reload the configuration file: - - ```shell-session - $ sudo pkill -1 boundary-client-agent - ``` - - If you want to update another configuration value, you can restart the Client Agent using the following commands, however it will close any existing sessions: - - ```shell-session - $ sudo launchctl stop com.hashicorp.boundary.boundary-client-agent - $ sudo launchctl start com.hashicorp.boundary.boundary-client-agent - ``` - - - - -1. As a privileged user, open the Boundary Client Agent configuration file in the editor of your choice. -By default, it is located in the following directory: - - `C:\Program Files\Hashicorp Boundary\boundary-client-agent.hcl` - -1. Change the configuration settings, and save the file. -1. Run the following commands to restart the Client Agent. - - ```shell-session - net stop BoundaryClientAgent - net start BoundaryClientAgent - ``` - - Note that when you restart the Client Agent, it closes any existing sessions. - - - \ No newline at end of file diff --git a/website/content/docs/client-agent/conflicting-software.mdx b/website/content/docs/client-agent/conflicting-software.mdx deleted file mode 100644 index fd14f78c0..000000000 --- a/website/content/docs/client-agent/conflicting-software.mdx +++ /dev/null @@ -1,237 +0,0 @@ ---- -layout: docs -page_title: Client Agent conflicting software -description: >- - Learn how possible conflicts that third-party tools may have with the Boundary Client Agent. Explore possible solutions and workarounds. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Client Agent software conflicts - -Some software is known to cause conflicts with the Boundary Client Agent. -Refer to the [transparent sessions interoperability matrix](/boundary/docs/interoperability-matrix) for a list of the third-party products that have been tested for use with the Boundary Client Agent. - -The following sections are an incomplete list of potential conflicts and any available workarounds for issues. - -## Cloudflare WARP client - -The Cloudflare WARP client uses a local DNS server to direct traffic. -It has built-in checks to prevent it from being run alongside other software that uses the same mechanism. -This includes the Boundary Client Agent. -If you try to use the Client Agent with the Cloudflare WARP client, it may work, or you may see an error like this one: - -``` -Status: Unable to Connect -Error reason: DNS Proxy Failure -Error code: CF_DNS_PROXY_FAILURE -Error description: The WARP Agent must be the only process responsible for DNS resolution on the device. One or more processes are already bound to port 53: boundary-client-agent. -Learn more: https://cfl.re/CF_DNS_PROXY_FAILURE -``` - -You can still install both the Cloudflare WARP client and the Boundary Client Agent on the same machine. -The two products can coexist as long as the WARP client starts first. -Starting the WARP client first binds it to alternate IPs and leaves the domain available for Boundary. - -## Docker Desktop (MacOS) - -Docker Desktop sometimes creates a local DNS listener that prevents the Client Agent from running. -If you run Docker Desktop 4.26 or later, you must clear the `Use kernel networking for UDP` option. -Otherwise, the Client Agent refuses to start. - -## Huntress EDR client (Windows) - -Host isolation and release do not work as expected in Windows when you use the Huntress EDR client with the Boundary Client Agent. -The Huntress EDR client for Windows uses the Windows Filtering Platform (WFP) to isolate devices by blocking all non-essential traffic. This behavior conflicts with the Boundary Client Agent during device isolation. -Specifically, the Boundary Client Agent replaces the default DNS resolver with its own, which can prevent fallback to a secondary DNS when the primary (Boundary) DNS fails during isolation. -As a result, Huntress is unable to maintain server communication, leaving the device stuck in an isolated state. Huntress cannot isolate and release devices properly in Windows under these conditions. - -As a temporary workaround, you can manually configure a secondary DNS (e.g., 8.8.8.8). However, this secondary DNS setting is overwritten when you pause or resume the Boundary Client Agent, so you must configure it again each time. - -This issue does not affect macOS devices, where Boundary and Huntress coexist without additional configuration. - -## Internet Sharing (MacOS) - -Enabling **Internet Sharing** on MacOS causes the system's DNS resolver (`mDNSResponder`) to bind to all interfaces on port 53, preventing the Client Agent from starting. Disable **Internet Sharing** before you run the Client Agent. - -## OpenVPN - -When you run OpenVPN at the same time as the Client Agent, it can create a DNS conflict. -If you are unable to establish a transparent session while using OpenVPN, you may need to explicitly specify a network interface and upstream DNS server(s) to use. - -To configure the DNS server(s) to use, use the `override_upstream_dns_servers` configuration option: - -```hcl -# The DNS servers must be specified as an IP, or an IP:Port. -# If no port is provided, port 53 is assumed. -# The order of the entries specifies the priority. -# We recommended providing both the VPN DNS servers -# and the default DNS servers, so that DNS requests can -# be resolved even when the VPN is not active. -override_upstream_dns_servers = [ - "10.0.0.1", # Example primary VPN DNS server - "10.0.0.2", # Example secondary VPN DNS server - "8.8.8.8", # Fallback default DNS server - "8.8.4.4:53", # Fallback default DNS server with a custom port -] -``` - - - -The `override_upstream_dns_servers` is used for all non-Boundary DNS requests. -If you only provide the VPN DNS servers, the Client Agent will not be able to resolve any DNS requests when the VPN is not active. - - - -If you configured OpenVPN to push DNS servers to the client, it may create additional conflicts. -Refer to the sections below for more information about how this configuration affects MacOS and Windows systems. - -### MacOS - -When OpenVPN is configured to push DNS servers to the client, the client-side service monitors and updates the system DNS settings. -As a result, OpenVPN may attempt to override the Client Agent's configuration. -This scenario can create an unstable network environment and lead to disruptions in user connectivity and service access. -There is no workaround for this scenario at this time. - -### Windows - -When OpenVPN is configured to push DNS servers to the client, it creates `DNSClientNrptRule` entries in Windows that control DNS routing independently of the interface priority. -Although the Client Agent updates the interface's DNS settings, it does not manage the Name Resolution Policy Table (NRPT). -As a result, the OpenVPN rules may override the Client Agent's configuration. -This scenario may lead to conflicts, and there is no supported workaround at this time. - -## Palo Alto Networking Global Protect VPN - -If you are unable to establish a transparent session while using the Palo Alto Networking Global Protect VPN, you may need to explicitly specify a network interface and the upstream DNS server(s) to use. - -By default, the Client Agent reads the primary network interface's DNS server configuration and uses that information to resolve domains that are not configured as aliases in Boundary. -If the VPN configuration includes custom DNS servers, this information may not be available to the Client Agent, so you must explicitly specify the DNS server(s) to use. - -To configure the DNS server(s) to use, use the `override_upstream_dns_servers` configuration option: - -```hcl -# The DNS servers must be specified as an IP, or an IP:Port. -# If no port is provided, port 53 is assumed. -# The order of the entries specifies the priority. -# We recommended providing both the VPN DNS servers -# and the default DNS servers, so that DNS requests can -# be resolved even when the VPN is not active. -override_upstream_dns_servers = [ - "10.0.0.1", # Example primary VPN DNS server - "10.0.0.2", # Example secondary VPN DNS server - "8.8.8.8", # Fallback default DNS server - "8.8.4.4:53", # Fallback default DNS server with a custom port -] -``` - - - -The `override_upstream_dns_servers` is used for all non-Boundary DNS requests. -If you only provide the VPN DNS servers, the Client Agent will not be able to resolve any DNS requests when the VPN is not active. - - - -### Primary network interfaces - -By default, the Client Agent creates IPs on the primary network interface to serve its DNS server. -Refer to the tabs below for possible conflicts for each supported operating system. - - - - -When you run the Client Agent alongside the PAN-GP VPN, the primary network interface will likely be set to a `tun` type interface, which the Client Agent cannot use for its IP addresses. -You may see errors such as the following in the `boundary-client-agent.log` file or the `boundary client-agent status` command response: - -``` -[ERROR] macos.addIP: error adding ipv4 address: ifconfig: ioctl (SIOCAIFADDR): Destination address required -``` - -To work around the default `tun` interface, you must provide an explicit network interface using the `interface_to_use` configuration option. For example: - -```hcl -interface_to_use=en0 -``` - -The `interface_to_use` option allows the Client Agent to create the IPs it needs to serve the DNS server and proxy traffic. -You must restart the Client Agent for it to update its configuration with the new setting. - - - - -On Windows, the Client Agent may be able to create the IPs that it needs on the primary network interface, but it fails to establish any transparent sessions. You may see the following message: - -``` -[INFO] default route change detected, restarting -``` - -You must explicitly specify a network interface to use other than the primary one. You can list available network interfaces using the Powershell command `Get-NetAdapter`, or the older `route print` command. You must find the index of the interface you would normally use to connect to the internet. In this example, the interface index is `11`: - -``` -PS C:\> Get-NetAdapter -Name InterfaceDescription ifIndex Status MacAddress LinkSpeed ----- -------------------- ------- ------ ---------- --------- -Ethernet Parallels VirtIO Ethernet Adapter 11 Up 00-1C-42-B3-F2-75 10 Gbps -Ethernet 2 PANGP Virtual Ethernet Adapter Secure 24 Up 02-50-41-00-00-01 2 Gbps -``` - -Alternatively, if you use `route print`, refer to the following example: - -``` -PS C:\> route print -=========================================================================== -Interface List - 24...02 50 41 00 00 01 ......PANGP Virtual Ethernet Adapter Secure - 11...00 1c 42 b3 f2 75 ......Parallels VirtIO Ethernet Adapter - 1...........................Software Loopback Interface 1 -=========================================================================== -```` - -Your configuration should look like this: - -```hcl -interface_to_use=11 -``` - -You must restart the Client Agent for it to update its configuration with the new setting. - - - - -## Parallels Desktop (MacOS VM on MacOS Host) - -Running a MacOS VM in Parallels Desktop with shared networking causes the system's DNS resolver (`mDNSResponder`) to bind to all interfaces, blocking port 53 and preventing the Client Agent from starting. - -As a workaround, you can configure Parallels Desktop to use a different network mode. -Select an alternative network configuration such as **Host-Only**, **Default Adapter**, or **Wi-Fi** instead of **Shared Network**. -Refer to the Parallels Desktop documentation for more information. - -## Cisco AnyConnect VPN - -When the Cisco AnyConnect VPN is active at the same time as the Boundary Client Agent, DNS resolution may fail for Boundary aliases. - -The Boundary Client Agent by default uses the IPv4 range `100.x.x.x` for its local proxies. The Cisco AnyConnect VPN treats this range as a **secured range**, which forces DNS queries to resolve through the VPN instead of the Boundary Client Agent. As a result, Boundary aliases cannot be resolved. - -You can configure the Boundary Client Agent to use a different IPv4 prefix by setting the `v4_prefix` option in the client configuration file. This setting overrides the default `100.x.x.x` range and avoids the conflict with Cisco AnyConnect VPN. - -For example: -```hcl -v4_prefix = "172.16.0.0/12" -``` - - -You can set the `v4_prefix` to any valid RFC1918 private IPv4 range, as long as it does not overlap with ranges secured by the VPN. Common options include: - -- `10.0.0.0/8` -- `172.16.0.0/12` - -Choose a range that best fits your environment. - - - -## Uninstall the Client Agent on Mac - -If you used the Mac installer, you can run `/Library/Application Support/HashiCorp/Boundary Uninstaller.app` to uninstall Boundary. -The uninstaller removes any installed components, including the Desktop client, CLI, and the Boundary Client Agent. diff --git a/website/content/docs/client-agent/index.mdx b/website/content/docs/client-agent/index.mdx deleted file mode 100644 index 5b2acf699..000000000 --- a/website/content/docs/client-agent/index.mdx +++ /dev/null @@ -1,118 +0,0 @@ ---- -layout: docs -page_title: Client Agent overview -description: >- - Learn how the Boundary Client Agent intercepts DNS requests as the primary resolver on the system, allowing Boundary to proxy connections transparently. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary Client Agent - -@include 'alerts/enterprise-only.mdx' - -The Boundary Client Agent is Boundary's DNS daemon. -When the Boundary Client Agent runs alongside an authenticated Boundary client, the agent establishes itself as the primary resolver on the system and intercepts DNS requests. - -If you enter a hostname that matches a Boundary alias that the client is authorized to establish a session to, Boundary automatically generates the session and transparently proxies the connection on your behalf. -If the Boundary Client Agent cannot find an alias, or if there are any issues with authentication, network connectivity, or latency, the Client Agent defers DNS resolution to the previously configured DNS resolvers. - - - -You must enable both IPv4 and IPv6 protocols for your environment to ensure the Client Agent can start and perform DNS lookups. - - - -## Security - -When you successfully authorize a session on a Boundary controller, the response includes a list of any brokered credentials, which include the decoded secrets. -When the Boundary Client Agent receives a DNS request, Boundary creates a new session. -An OS user can only connect to an authorized session managed by the Boundary Client Agent daemon if they are the same OS user that added the Boundary auth token used for authorizing the session. - - - -Currently, you cannot authenticate to multiple Boundary controllers at once. -If you authenticate to a different Boundary controller, any existing sessions are terminated and any new transparent sessions would be established with the new controller. - - - -The Boundary Client Agent stores the credentials and some other information related to the session in memory. -The in-memory store removes the session information: - -- when the session ends. -- if the auth token stored in the Boundary expires. -- if the current OS user authenticates with a different Boundary user. -- if the current OS user authenticates to a new Boundary controller. -- if the Boundary Client Agent is paused. -- if the Boundary Client Agent is terminated. - -API requests are authenticated in the same way as session proxy access. - -Credential brokering is supported for transparent sessions. -A notification appears when you establish a session against a target that is configured with credential brokering. -You can retrieve the credentials later using the following command: - -```shell-session -$ boundary client-agent sessions -``` - -### Grants - -In a production environment, you may want to provide the least amount of privileges necessary for users. -For a Boundary user to be able to use the Client Agent to establish a transparent session, they must: - -- be able to authenticate using an auth method. -- have read permissions for their auth token. -- have permission to establish a session to one or more targets. - -You can use the following grant strings to grant those permissions: - -``` -type=auth-method;ids=*;actions=authorize -type=target;ids=*;actions=authorize-session -type=auth-token;ids=*;actions=read:self -``` - -HashiCorp highly recommends that you also grant users the permission to list resolvable aliases, as the Client Agent periodically fetches a list of aliases to match incoming DNS requests against. -Without that permission, every DNS request on the system is sent to the Boundary controller, which can easily overwhelm it. - -You can use the following grant string to grant the permission to list resolvable aliases: - -``` -type=user;ids=*;actions=list-resolvable-aliases -``` - - - -A known issue regarding how grants were previously created in HCP Boundary may cause you to receive a 500 error when you attempt to list resolvable aliases. -Clusters created before April 26, 2025 may be missing the following grants: - - `ids={{.User.Id}};type=user;actions=list-resolvable-aliases` - - `ids=*;type=target;actions=list,read` - -If your cluster is missing these grants, HashiCorp recommends adding them. - -For more information, refer to the [known issue](/boundary/docs/release-notes/v0_19_0#hcp-grants). - - - -## More information - -Refer to the following topics for more information: - -- [Aliases](/boundary/docs/concepts/aliases) -- [Transparent sessions](/boundary/docs/concepts/transparent-sessions) - -## Next steps - -Refer to the following topics for more information about installing, configuring, and using the Client Agent: - -- [Install Boundary clients](/boundary/docs/deploy/self-managed/install-clients) -- [Configure the Client Agent](/boundary/docs/client-agent/configuration) -- [Manage the Client Agent](/boundary/docs/client-agent/manage) -- [Troubleshoot issues with the Client Agent](/boundary/docs/client-agent/troubleshoot) -- [Client Agent software conflicts](/boundary/docs/client-agent/conflicting-software) \ No newline at end of file diff --git a/website/content/docs/client-agent/manage.mdx b/website/content/docs/client-agent/manage.mdx deleted file mode 100644 index 9182390d1..000000000 --- a/website/content/docs/client-agent/manage.mdx +++ /dev/null @@ -1,79 +0,0 @@ ---- -layout: docs -page_title: Manage the Client Agent -description: >- - Learn how to manage the Boundary Client Agent to intercept DNS requests, allowing Boundary to proxy connections transparently. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Manage the Client Agent - -Refer to the following sections for more information about managing the Client Agent. -You can monitor the Client Agent's status and retrieve information about any transparent sessions. -If you want to temporarily defer DNS resolution to any previously configured DNS resolvers, you can pause the Client Agent. -You can also disable the Client Agent, if you no longer want to use it for DNS resolution. - -## Monitor status and sessions - -You can check the status of the Client Agent to ensure it is running. -Use the following command to check the Client Agent's status: - -```shell-session -$ boundary client-agent status -``` - -You can retrieve information about the sessions that the Client Agent is managing. -Use the following command to list any sessions currently being managed by the Client Agent, as well as any brokered credentials for those sessions: - -```shell-session -$ boundary client-agent sessions -``` - -Note that this command does not list sessions that are not managed by the Client Agent. Use `boundary sessions list -recursive` to see all sessions. - -## Pause the Client Agent - -You can temporarily disable the Boundary Client Agent by pausing it with the following command: - -```shell-session -$ boundary client-agent pause -``` - -When the Client Agent is paused, it does not intercept any DNS requests, and you are unable to use transparent sessions. - -To resume the Client Agent, use the following command: - -```shell-session -$ boundary client-agent resume -``` - -## Disable the Client Agent - -If you want to disable the Boundary Client Agent, you can stop it with the following commands: - - - - -```shell-session -$ sudo launchctl bootout system /Library/LaunchDaemons/com.hashicorp.boundary.boundary-client-agent.plist -``` - -Unloading the Boundary Client Agent removes its launch daemon configuration. To restart the Client Agent, use: - -```shell-session -$ sudo launchctl bootstrap system /Library/LaunchDaemons/com.hashicorp.boundary.boundary-client-agent.plist -``` - - - - -```shell-session -net stop BoundaryClientAgent -``` - - - diff --git a/website/content/docs/client-agent/troubleshoot.mdx b/website/content/docs/client-agent/troubleshoot.mdx deleted file mode 100644 index 004e7679a..000000000 --- a/website/content/docs/client-agent/troubleshoot.mdx +++ /dev/null @@ -1,288 +0,0 @@ ---- -layout: docs -page_title: Troubleshoot the Client Agent -description: >- - Troubleshoot issues with the Boundary Client Agent to ensure it is functioning properly. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Troubleshoot issues with the Client Agent - -The following sections can help you to troubleshoot the Client Agent's behavior. You should proceed through these steps from top to bottom. - -## Check the status of the Client Agent - -If you experience unexpected behavior, you should first check on the status of the Client Agent. -You can check the status using the Boundary CLI or the Desktop Client. To check the Client Agent status through the Boundary CLI, use the following command: - -```shell-session -$ boundary client-agent status - -Status: - Address: - https://boundary.corp.com - Auth Token Expiration: 167h58m9s - Auth Token Id: at_GBqZUK2ihv - Status: running - Version: 0.0.1-e561e69839cce148ee5045684bce5b7168c65026 -``` - -In the Desktop Client, you can find the status of the Client Agent by navigating to **Settings**, and then scrolling to the **Boundary Client Agent** section. - -The status command includes various information about the Client Agent, including the runtime status. -In this example, the runtime status is "running". -If the status is "paused", the Client Agent is not currently intercepting DNS requests and must be resumed. -Users can pause the Client Agent, and it will also pause itself if it detects a large number of network failures in a short period of time. - -The status also allows you to see whether the current user is authenticated. -If the response looks like the example above, including showing an auth token ID and expiration, your current user is authenticated. -If not, you may need to first authenticate to the Client Agent using the CLI or Desktop Client. - -The status also sometimes contains a list of errors that have been encountered by the Client Agent. -The list is ordered by most recent first. -These errors can help you understand why the Client Agent may not be behaving as expected. -Please see the section below on common error messages to help diagnose specific errors. -Note that this list of errors will not be cleared until the next reboot, so it may not necessarily be a sign of something being wrong. - -If the status command returns an error, the Client Agent may not be running. -You can attempt to start the Client Agent using the following commands: - - - - - ```shell-session - $ sudo launchctl start com.hashicorp.boundary.boundary-client-agent - ``` - - - - - ```shell-session - net start BoundaryClientAgent - ``` - - - -## Resume the Client Agent - -You can resume the Client Agent using either the Boundary CLI or the Desktop Client. In the CLI, run the following command to resume the Client Agent: - -```shell-session -$ boundary client-agent resume -The Client Agent has been successfully resumed. -``` - -In the Desktop Client, you can resume the Client Agent by selecting the **Resume** button in the **Boundary Client Agent** section of the settings. -Once the Client Agent has resumed, test if it has started working as expected again. - -## Inspect the log file - -If you are not able to diagnose the problem by looking at the status or resuming the Client Agent, another step can be to inspect the log file produced by the Client Agent. - - - - -The log file should be located in `/Library/Application Support/HashiCorp/Boundary/boundary-client-agent.log`. - - - - -The log file should be located in `C:\Windows\Logs\boundary-client-agent.log`. - - - - -Once you have found the log file, you can look through it to see if you can understand why the Client Agent is not working as expected. -The list below provides some common errors and explanations. - -It may be necessary to increase the logging verbosity of the Client Agent. -You can increase the verbosity by setting the `log_level` option in the configuration file to `"DEBUG"`. -See the section on changing the configuration for more information. - -## Establish the behavior of the local DNS configuration - -The Client Agent works by intercepting DNS requests before they are sent to your regular DNS server. -If the DNS requests on your system are not sent to the right place, or they are not being answered appropriately, transparent sessions will not work. - -You can use the `nslookup` command to understand where the DNS requests are being sent. -Start by sending a DNS request for `hashicorp.com`: - -```shell-session -$ nslookup hashicorp.com -;; Truncated, retrying in TCP mode. -Server: 100.88.241.86 -Address: 100.88.241.86#53 - -Non-authoritative answer: -Name: hashicorp.com -Address: 76.76.21.21 -``` - -The important part here is the `Server` field, which contains an IP in the CGNAT range (from `100.64.0.0` to `100.127.255.255`). -This is a good indication that the Client Agent DNS server is being used as expected. - -Next, you can try to make a DNS request to an alias that you expect to work. The following example makes a DNS request to an alias with a value of `mytarget.boundary.dev`: - -```shell-session -$ nslookup mytarget.boundary.dev -;; Truncated, retrying in TCP mode. -Server: fc00:a20a::d7bf:c059 -Address: fc00:a20a::d7bf:c059#53 - -Name: mytarget.boundary.dev -Address: 100.84.164.9 -``` - -You can tell two things from this: -1. The Client Agent is likely able to intercept the DNS request, because the server is a local IPv6 address in the [ULA](https://en.wikipedia.org/wiki/Unique_local_address) range. - Both an IPv4 CGNAT range or IPv6 ULA range IP address are indications of this. -2. The Client Agent is able to identify `mytarget.boundary.dev` as an alias with a target that the requesting user is authorized to connect to, because it responded with a valid DNS response pointing to a local IPv4 address in the CGNAT range. - Similarly to above, the IP address in the response may also be an IPv6 address in the ULA range. - -If you do not see this kind of response, it may be that the alias you are trying to connect to doesn't exist, or your user is not authorized to connect to it. -Double check that you are using the correct alias and that your user is authorized to connect to it. - -## Flush OS DNS cache - -If you still do not see the expected behavior, it can be useful to flush the operating system's DNS cache. -The exact steps depend on the operating system you use: - - - - -```shell-session -$ sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder -``` - - - - -```shell-session -ipconfig /flushdns -``` - - - - -After you flush the DNS cache, try connecting to the alias again, or repeat the steps above. - -If you are still not able to understand what is wrong, submit a support ticket. Include the `boundary client-agent status` output and the log file in the ticket. - -## Common error messages - -Refer to the following common error messages for more information about their possible causes and resolutions. - -### nodename nor servname provided, or not known / No such host is known - -This is a generic error for a failed DNS resolution. -It can mean a number of different things: -- The alias doesn't exist or is misspelled. -- Your user isn't authenticated or doesn't have permission to connect to the target. -- The Client Agent is not able to intercept DNS requests, it could shut down or paused. -- The OS DNS cache is interfering with the operation of the Client Agent. -- The Client Agent may not yet know about the alias. - It takes around 2 minutes for the Client Agent to learn about new aliases. - -Follow the troubleshooting steps above to resolve the issue. - -### failed to listen for DNS on either IPv4 or IPv6 - -This error happens when some other application on the local machine occupies the ports used by the Boundary Client Agent. -The Client Agent requires access to port 53 for IPv4 and IPv6, both UDP and TCP. -Diagnosing what causes the error differs per operating system: - - - - -As a privileged user, you can use the `lsof` program to find what applications are occupying a port, for example: - -```shell-session -$ sudo lsof -nP | grep ":53" -``` - -If anything is occupying port 53, you may need to terminate the application before the Client Agent is able to start. - -Applications that make use of the Apple Virtualization Framework are known to sometimes occupy this port under -the name `_mdnsresponder`. If you have any virtualization software, you may need to turn it off before using -the Client Agent. - - - - -As a privileged user, you can open the **Resource Monitor** and inspect the **Network** > **Listening Ports** section to find any applications that use port 53. - - - - -Once you have identified which other software is using the port, you can stop it and try to start the Client Agent again. - -### failed to refresh alias cache: error="fetching resolvable aliases: error performing client request during List call" - -This usually implies that there is a problem reaching the internet or the Boundary controller. -The error is related to the periodic updating of aliases used by the Client Agent to know whether a DNS request matches an alias or not. - -HashiCorp recommends that you pause the Client Agent and examine the status and logs for further errors: - -```shell-session -$ boundary client-agent pause -``` - -Follow the troubleshooting steps to understand why the Client Agent is not able to reach the controller. - -### sendmsg: broken pipe - -On MacOS versions 15.1 and 15.2, the firewall may incorrectly block the Client Agent from sending DNS responses. To resolve this issue, -upgrade to MacOS version 15.3 or later. - -It may be neccessary to explicitly allow the `boundary-client-agent` process access to incoming network connections. - -From the Firewall options in System Settings, toggle the `boundary-client-agent` to **Allow incoming connections**. - -### WARNING! Remote host indentification has changed! It is possible that someone is doing something nasty! - -This error arises when you use an alias to connect to an SSH target after the first successful connection using that alias. The issue occurs because Boundary workers generate a new host key on every new SSH connection. You can safely ignore the warning using the `StrictHostKeyChecking=no` command line option: - -```shell-session -$ ssh -o StrictHostKeyChecking=no targetalias.boundary.dev -``` - -You can also remove the existing server host key from the `~/.ssh/known_hosts` file to avoid the error. - -### This site can't be reached... DNS_PROBE_FINISHED_NXDOMAIN - -This error occurs when you have authenticated to Boundary and have a target that is configured with an alias. -When you copy the alias from the **Target** page and paste it in the browser, you receive the error. -The Client Agent is not running, and if you attempt to resume it, you receive a message that says "bind address already in use." - -A conflicting service may be preventing the Client Agent from receiving DNS requests. -The service may be bound to port 53. -Restarting your computer may resolve the conflict. - -### error when attempting to resume... bind address already in use: invalid state transition - -This error occurs when you have authenticated to Boundary and have a target that is configured with an alias. -When you attempt to use the alias to connect to the target, you receive the error message in Boundary Desktop. -The Client Agent is not running, and if you attempt to resume it, you receive a message that says "bind address already in use." - -A conflicting service may be preventing the Client Agent from receiving DNS requests. -The service may be bound to port 53. -Restarting your computer may resolve the conflict. - -## Transparent sessions known issues - -Refer to the following table for known issues with the Client Agent that may affect transparent sessions: - -| Issue | Description | -| ----- | ----------- | -| SSH connection fails with man-in-the-middle warning | On Linux systems, the initial transparent session may be successful, but any subsequent connections prompt a warning that you may be experiencing a man-in-the-middle attack.

For more information, refer to [WARNING! Remote host indentification has changed! It is possible that someone is doing something nasty!](/boundary/docs/client-agent/troubleshoot#warning-remote-host-indentification-has-changed-it-is-possible-that-someone-is-doing-something-nasty) in the **Common error messages** section.| -| Boundary Client Agent authentication does not persist across restarts | When you reboot, you are required to re-authenticate to the Client Agent before you can use transparent sessions. | -| Windows installer prompts for restart | When you install Boundary, the Windows installer occasionally prompts you to restart your computer, however it is not necessary. | -| Boundary Client Agent resumes on reboot | If the Client Agent is paused and the machine is rebooted, the Client Agent will be resumed after the reboot. | -| Single-word aliases do not work on Windows | If you create an alias consisting of a single word without a dot (`.`), the alias will not work on Windows. | -| Windows installer does not support partial installations | The Windows installer fails to start the Client Agent if the Desktop client is not installed at the same time. | -| Alias connection failures inside containers/VMs | Using transparent sessions rely on network access to the local network of the computer the Client Agent is running on. Network enclaves such as those created by Docker containers and VMs cannot reach this network. | -| DNS lookup is broken on MacOS 15.1 and 15.2 | MacOS 15.1 and 15.2 may incorrectly block DNS lookups for the Client Agent. This issue is resolved in MacOS 15.3 and later. | diff --git a/website/content/docs/client-cache/index.mdx b/website/content/docs/client-cache/index.mdx deleted file mode 100644 index 96ccbb4f8..000000000 --- a/website/content/docs/client-cache/index.mdx +++ /dev/null @@ -1,84 +0,0 @@ ---- -layout: docs -page_title: Client cache overview -description: >- - Learn how the client cache enables Boundary to quickly retrieve local information about session and target resources. Manage startup and other cache functions. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Client cache - -The Boundary client cache runs on end users' computers and locally caches session and target resource information from Boundary instances. -The cache helps expedite searches. - -## Boundary `list` vs. `search` - -You can use the Boundary API or CLI to `list` resources like targets, sessions, hosts, and users. -When you use the `list` command, Boundary searches the control plane to provide a current total of resources when it produces the list of results. -Some Boundary resources can provide a significant number of items in the response. - -Because large lists of results may overwhelm your system resources, the client cache caches the results of the `list` operation. -You can search the local cache instead of the control plane to help protect your system resources. -The Boundary `search` command also produces a list of Boundary resources. -When you use the `search` command, however, Boundary searches the local cache to create the list. - -For more information, refer to the [`search`](/boundary/docs/commands/search) command documentation. - - - -The `search` operation only displays the resources that you have read permissions to view. -If you are logged in as a user who does not have the permissions to view a resource, it does not display in the list of results. - -For more information, refer to [Identity and access management (IAM)](/boundary/docs/concepts/iam). - - - -## Client cache management - -The Boundary client cache starts automatically in the background when a user runs a CLI command that interacts with a Boundary instance. -If you do not want the cache to automatically start, you can include the `-skip-cache-daemon` flag or set the **BOUNDARY_SKIP_CACHE_DAEMON** environment variable when you use the Boundary CLI to interact with a Boundary instance. - -### Startup and customization - -You can start the cache manually using the `boundary cache start` command. -By default, the cache starts in the foreground. -You can start it in the background by adding the `-background` flag. - -If you start the cache manually, you can customize the caching behavior. -Include any of the following options to customize the behavior: - -- `max-search-staleness` - The amount of time that can pass since the last refresh before calling `boundary search` results in a blocking refresh from the Boundary instance of the resources being searched. -- `max-search-refresh-timeout` - The amount of time the `boundary search` blocking refresh can take before it times out. -In the event of a timeout, Boundary uses the stale data that is currently in the cache. -- `refresh-interval` - A duration that specifies how frequently the client cache should query Boundary for changes to sessions and targets. -Note that Boundary only searches sessions and targets that the user who ran the command has access to. - -For more information, refer to the [`cache start`](/boundary/docs/commands/cache/start) command documentation. - -### Logging - -The client cache stores a log file in the **~/.boundary** directory. -Boundary automatically rotates the log once it reaches 5 MB. -It compresses and keeps the last 3 rotated logs before deleting a log. - -### Status - -You can check the status of the cache using the `boundary cache status` command. -The command returns information about the cache including the uptime, user count, user information, and which Boundary resources the cache is tracking. - -For more information, refer to the [`cache status`](/boundary/docs/commands/cache/status) command documentation. - - -### Auth tokens - -By default, the Boundary CLI tries to use a keyring to store and receive auth tokens. -Whenever you use an auth token to interact with Boundary, the client cache stores the auth token and syncs the data associated with it. -If you authenticate to multiple Boundary instances, the client cache stores multiple auth tokens and syncs the data associated with each token. - -To search the client cache for a specific Boundary instance, you can specify the appropriate auth token using the `boundary cache add-token` command. - -For more information, refer to the [`cache add-token`](/boundary/docs/commands/cache/add-token) command documentation. diff --git a/website/content/docs/commands/accounts/change-password.mdx b/website/content/docs/commands/accounts/change-password.mdx deleted file mode 100644 index 2dcb313ab..000000000 --- a/website/content/docs/commands/accounts/change-password.mdx +++ /dev/null @@ -1,87 +0,0 @@ ---- -layout: docs -page_title: accounts change-password - Command -description: >- - The "accounts change-password" command resets the password on account resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# accounts change-password - -Command: `boundary accounts change-password` - -The `accounts change-password` command resets the password on account resources, if the types match and the operation is allowed by the given account type. -You must verify the current password to complete the password reset. - -## Examples - -The following example changes the password on a password-type account. If you execute the command without the `-current-password` and ` -new-password` parameters, you are -prompted to enter the password values. - -```shell-session -$ boundary accounts change-password -id acctpw_1234567890 -Please enter the current password (it will be hidden): -Please enter the new password (it will be hidden): -Please enter it one more time for confirmation: -``` - -**Example output:** - - - -```plaintext -Account information: - Auth Method ID: ampw_1234567890 - Created Time: Wed, 12 Jul 2023 12:20:54 PDT - ID: acctpw_1234567890 - Type: password - Updated Time: Wed, 12 Jul 2023 22:29:59 PDT - Version: 5 - - Scope: - ID: global - Name: global - Type: global - - Authorized Actions: - no-op - read - update - delete - set-password - change-password - - Attributes: - Login Name: admin -``` - - - - -## Usage - - - -```shell-session -$ boundary accounts change-password [options] [args] -``` - - - - -### Command options - -- `-current-password` `(string: "")` - The current password for the account. If - you do not specify the current password, the command prompts you to enter the password in a non-echoing way. - -- `-id` `(string: "")` - The ID of the account for which to change the password. - -- `-new-password` `(string: "")` - The new account password. If you do not specify a new password, the command prompts you to enter the password in a non-echoing way. - -- `-version` `(int: 0)` The version of the account against which to perform the password reset operation. If you do not specify a version, the command automatically performs a check-and-set. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/accounts/create.mdx b/website/content/docs/commands/accounts/create.mdx deleted file mode 100644 index eca6b4924..000000000 --- a/website/content/docs/commands/accounts/create.mdx +++ /dev/null @@ -1,195 +0,0 @@ ---- -layout: docs -page_title: accounts create - Command -description: >- - The "accounts create" command creates a new account resource and associates it with an auth method. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# accounts create - -Command: `boundary accounts create` - -The `accounts create` command lets you create an account associated with one of the following auth methods: - -- LDAP -- OIDC -- Password - -## Example - -The following example creates an account named `test_account`. In this example, you provide a password when prompted: - -```shell-session -$ boundary accounts create password \ - -auth-method-id=ampw_1234567890 \ - -login-name="tester01" \ - -name=test_account \ - -description="Test password account" -``` - -**Example output:** - - - -```plaintext -Please enter the password (it will be hidden): - -Account information: - Auth Method ID: ampw_ZbB6UXpW3B - Created Time: Fri, 27 May 2022 11:16:47 MDT - Description: Test password account - ID: acctpw_A8R1escktO - Name: test_account - Type: password - Updated Time: Fri, 27 May 2022 11:16:47 MDT - Version: 1 - - Scope: - ID: o_u54jrD6ydN - Name: IT_Support - Parent Scope ID: global - Type: org - - Authorized Actions: - no-op - read - update - delete - set-password - change-password - - Attributes: - Login Name: tester01 -``` - - - - -## Usage - - - -```shell-session -$ boundary accounts create [type] [options] [args] -``` - - - -### Command options - -- `-auth-method-id` `(string: "")` - The auth-method resource to use for the - operation. You can also specify the auth-method using the **BOUNDARY_AUTH_METHOD_ID** - environment variable. -- `-description` `(string: "")` - The description to set for the account. -- `-name` `(string: "")` - The name to set on the account. - - -### Usages by type - -You can create `ldap`, `oidc`, and `password` type accounts. - - - - -The `boundary accounts create ldap` command creates an account of `ldap` type. - -#### Example - -The example below creates an LDAP account with the login name `prodops` and the description `ldap account for ProdOps`: - -```shell-session -$ boundary accounts create ldap -login-name prodops \ - -description "ldap account for ProdOps" -``` - -#### Usage - - - -```shell-session -$ boundary accounts create ldap [options] [args] -``` - - - -#### LDAP account option - -The following option is LDAP-specific, in addition to the command options: - -- `-login-name` `(string: "")` - The login name for the account. - - - - -The `boundary accounts create oidc` command creates an account of `oidc` type. - -#### Example - -The following example creates an OIDC account with the subject `prodops` and the description `Oidc account for ProdOps`: - -```shell-session -$ boundary accounts create oidc -subject "prodops" \ - -description "Oidc account for ProdOps" -``` - -#### Usage - - - -```shell-session -$ boundary accounts create oidc [options] [args] -``` - - - -#### OIDC account options - -The following options are OIDC-specific, in addition to the command options: - -- `-issuer` `(string: "")` - The issuer for the account. -- `-subject` `(string: "")` - The subject for this account on the OIDC provider. - - - - -The `boundary accounts create password` command creates an account of `password` type. - -#### Example - -The following example creates a password-type account with the login name `prodops` and the description `Password account for ProdOps`: - -```shell-session -$ boundary accounts create password -login-name prodops \ - -description "Password account for ProdOps" -``` - -#### Usage - - - -```shell-session -$ boundary accounts create password [options] [args] -``` - - - -#### Password account options - -The following options are password-specific, in addition to the command -options: - -- `-login-name` `(string: "")` - The login name for the account -- `-password` `(string: "")` - The password for the account. If blank, the - command prompts you to enter the password interactively in a - non-echoing way. Otherwise, this value can refer to a file on disk (`file://`) or an environment variable (`env://`) from which the password is read. - - - - - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/accounts/delete.mdx b/website/content/docs/commands/accounts/delete.mdx deleted file mode 100644 index d5c2d122a..000000000 --- a/website/content/docs/commands/accounts/delete.mdx +++ /dev/null @@ -1,44 +0,0 @@ ---- -layout: docs -page_title: accounts delete - Command -description: >- - The "accounts delete" command deletes an existing account resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# accounts delete - -Command: `boundary accounts delete` - -The `accounts delete` command lets you delete an existing account. - - -## Examples - -The following example deletes an account with the ID `acctpw_0987654321`. - -```shell-session -$ boundary accounts delete -id=acctpw_0987654321 -The delete operation completed successfully. -``` - -## Usage - - - -```shell-session -$ boundary accounts delete [options] [args] -``` - - - - -### Command options - -- `-id` `(string: "")` - The ID of the account you want to delete. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/accounts/index.mdx b/website/content/docs/commands/accounts/index.mdx deleted file mode 100644 index 194c6f821..000000000 --- a/website/content/docs/commands/accounts/index.mdx +++ /dev/null @@ -1,92 +0,0 @@ ---- -layout: docs -page_title: accounts - Command -description: >- - The "accounts" command performs operations on account resources. You can associate users with accounts using auth methods. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# accounts - -Command: `boundary accounts` - -The `accounts` command lets you create and manage accounts resources in Boundary. -You can associate Boundary users with one or more account resources using auth methods. -Accounts represent external notions of a particular entity. -Among other use cases, accounts provide an easy way to switch users to new IdPs within the organization that deploys Boundary. - -## Examples - -The following example retrieves account information for a given account ID, `acctpw_1234567890`: - -```shell-session -$ boundary accounts read -id acctpw_1234567890 -``` - -**Example output:** - - - -```plaintext -Account information: - Auth Method ID: ampw_1234567890 - Created Time: Wed, 12 Jul 2023 12:20:54 PDT - ID: acctpw_1234567890 - Type: password - Updated Time: Wed, 12 Jul 2023 12:20:54 PDT - Version: 1 - - Scope: - ID: global - Name: global - Type: global - - Authorized Actions: - no-op - read - update - delete - set-password - change-password - - Attributes: - Login Name: admin -``` - - - -## Usage - - - -```shell-session -Usage: boundary accounts [sub command] [options] [args] - - # ... - -Subcommands: - change-password Change the password on an account - create Create an account - delete Delete an account - list List an account - read Read an account - set-password Directly set the password on an account - update Update an account -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [create](/boundary/docs/commands/accounts/create) -- [delete](/boundary/docs/commands/accounts/delete) -- [read](/boundary/docs/commands/accounts/read) -- [update](/boundary/docs/commands/accounts/update) -- [list](/boundary/docs/commands/accounts/list) -- [set-password](/boundary/docs/commands/accounts/set-password) -- [change-password](/boundary/docs/commands/accounts/change-password) diff --git a/website/content/docs/commands/accounts/list.mdx b/website/content/docs/commands/accounts/list.mdx deleted file mode 100644 index 1583d8b3b..000000000 --- a/website/content/docs/commands/accounts/list.mdx +++ /dev/null @@ -1,82 +0,0 @@ ---- -layout: docs -page_title: accounts list - Command -description: >- - The "accounts list" command lists the available accounts that were created for an auth method. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# accounts list - -Command: `boundary accounts list` - -The `accounts list` command lists all accounts created for a given auth method. - -## Example - -The following example lists all accounts for an auth method with ID, `ampw_1234567890`: - -```shell-session -$ boundary accounts list -auth-method-id ampw_1234567890 -``` - -**Example output:** - - - -```plaintext -Account information: - ID: acctpw_0987654321 - Version: 1 - Type: password - Authorized Actions: - no-op - read - update - delete - set-password - change-password - - ID: acctpw_1234567890 - Version: 5 - Type: password - Authorized Actions: - no-op - read - update - delete - set-password - change-password -``` - - - -## Usage - - - -```shell-session -$ boundary accounts list [options] [args] -``` - - - -### Command options - -- `-auth-method-id` `(string: "")` - The auth-method resource from which to list accounts. You can also specify the auth-method resource using the **BOUNDARY_AUTH_METHOD_ID** - environment variable. -- `-filter` `(string: "")` - If set, the list operation is filtered before - being returned. The filter operates against each item in the list. We recommend using - single quotes, because filters contain double quotes. -- `list_token` (optional) - An opaque token that is returned from the previous `list` response. -If you do not supply a value, pagination starts from the beginning. -- `page_size` (optional) - An unsigned integer that indicates the number of items that should be included on the page of search results. -If you do not provide a value, or if you provide a value of `0`, Boundary uses the default page size of 1000 items. -If you configure it, the `page_size` value overrides the default page size. -Controller administrators can also configure a `max_page_size` option that constrains the maximum page size a user can request. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/accounts/read.mdx b/website/content/docs/commands/accounts/read.mdx deleted file mode 100644 index a8b30978d..000000000 --- a/website/content/docs/commands/accounts/read.mdx +++ /dev/null @@ -1,75 +0,0 @@ ---- -layout: docs -page_title: accounts read - Command -description: >- - The "accounts read" command retrieves the account details for an account. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# accounts read - -Command: `boundary accounts read` - -The `accounts read` command retrieves the account details for a given account ID. - - -## Examples - -The following example reads any account information with the ID `acctpw_1234567890`: - -```shell-session -$ boundary accounts read -id acctpw_1234567890 -``` - -**Example output:** - - - -```plaintext -Account information: - Auth Method ID: ampw_1234567890 - Created Time: Wed, 12 Jul 2023 12:20:54 PDT - ID: acctpw_1234567890 - Type: password - Updated Time: Wed, 12 Jul 2023 22:29:59 PDT - Version: 5 - - Scope: - ID: global - Name: global - Type: global - - Authorized Actions: - no-op - read - update - delete - set-password - change-password - - Attributes: - Login Name: admin -``` - - - -## Usage - - - -```shell-session -$ boundary accounts read [options] [args] -``` - - - - -### Command options - -- `-id` `(string: "")` - The ID of the account to read. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/accounts/set-password.mdx b/website/content/docs/commands/accounts/set-password.mdx deleted file mode 100644 index 340dcde8c..000000000 --- a/website/content/docs/commands/accounts/set-password.mdx +++ /dev/null @@ -1,85 +0,0 @@ ---- -layout: docs -page_title: accounts set-password - Command -description: >- - The "accounts set-password" command sets the password for account resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# accounts set-password - -Command: `boundary accounts set-password` - -The `accounts set-password` command lets you set the password on account-type -resources, if the types match and the operation is allowed by the given account -type. - -## Examples - -The following example sets the password on a password-type account. If you execute the command -without the `-password` parameter, you are prompted to enter the password -value. - -```shell-session -$ boundary accounts set-password -id acctpw_1234567890 -Please enter the password (it will be hidden): -Please enter it one more time for confirmation: -``` - -**Example output:** - - - -```plaintext -Account information: - Auth Method ID: ampw_1234567890 - Created Time: Wed, 12 Jul 2023 12:20:54 PDT - ID: acctpw_1234567890 - Type: password - Updated Time: Wed, 12 Jul 2023 22:08:12 PDT - Version: 2 - - Scope: - ID: global - Name: global - Type: global - - Authorized Actions: - no-op - read - update - delete - set-password - change-password - - Attributes: - Login Name: admin -``` - - - -The output displays the account information. - -## Usage - - - -```shell-session -$ boundary accounts set-password [options] [args] -``` - - - -### Command options - -- `-id` `(string: "")` - The ID of the account on which to set a password. -- `-password` `(string: "")` - The password for the account. Use this value with `env://` or `file://` syntax. If you do not specify a password, the command prompts you to enter the password in a non-echoing way. -- `-version` `(int: 0)` - The version of the account against which to perform an - update operation. If you do no specify a version, the command performs a check-and-set - automatically. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/accounts/update.mdx b/website/content/docs/commands/accounts/update.mdx deleted file mode 100644 index d8376f72f..000000000 --- a/website/content/docs/commands/accounts/update.mdx +++ /dev/null @@ -1,193 +0,0 @@ ---- -layout: docs -page_title: accounts update - Command -description: >- - The "accounts update" command updates an existing account resource's LDAP, OIDC, or password authentication information. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# accounts update - -Command: `boundary accounts update` - -The `accounts update` command updates an existing account's information for -the LDAP, OIDC, or password auth method. - -## Examples - -The following example updates an existing password-type account with the ID `acctpw_w3N3PlV34D`: - -```plaintext -ID: acctpw_w3N3PlV34D - Version: 1 - Type: password - Name: test_account - Description: Test password account - Authorized Actions: - no-op - read - update - delete - set-password - change-password - - Attributes: - Login Name: tester01 -``` - -This command updates the name, login name, and description: - -```shell-session -$ boundary accounts update password -id=acctpw_w3N3PlV34D \ - -name="tester" \ - -login-name="test-engineer" \ - -description="Only to be used for testing" -``` - -**Example output:** - - - -```plaintext -Account information: - Auth Method ID: ampw_1234567890 - Created Time: Thu, 13 Jul 2023 22:30:53 PDT - Description: Only to be used for testing - ID: acctpw_w3N3PlV34D - Name: tester - Type: password - Updated Time: Thu, 13 Jul 2023 22:40:48 PDT - Version: 3 - - Scope: - ID: global - Name: global - Type: global - - Authorized Actions: - no-op - read - update - delete - set-password - change-password - - Attributes: - Login Name: test-engineer -``` - - - -## Usage - - - -```shell-session -$ boundary accounts update [type] [options] [args] -``` - - - -### Command options - -- `-description` `(string: "")` - The description to set on the account. -- `-id` `(string: "")` - The ID of the account to update. -- `-name` `(string: "")` - The name to set on the account. -- `-version` `(string: "")` - The version of the account against which to - perform an update operation. If you do not specify a version, the command performs a - check-and-set automatically. - -### Usages by type - -The available types are: `ldap`, `oidc`, and `password`. - - - - -The `boundary accounts update ldap` command updates an LDAP account. - -#### Example - -The following example updates an LDAP account with the ID `acctldap_1234567890` to add the name `devops` and the description `ldap account for DevOps`: - -```shell-session -$ boundary accounts update ldap -id acctldap_1234567890 \ - -name "devops" \ - -description "ldap account for DevOps" -``` -#### Usage - - - -```shell-session -$ boundary accounts update ldap [options] [args] -``` - - - - - - -The `boundary accounts update oidc` command updates an OIDC account. - -#### Example - -The following example updates an OIDC account with the ID `acctoidc_1234567890` to add the name `devops` and the description `Oidc account for DevOps`: - -```shell-session -$ boundary accounts update oidc -id acctoidc_1234567890 \ - -name "devops" \ - -description "Oidc account for DevOps" -``` - -#### Usage - - - -```shell-session -$ boundary accounts update oidc [options] [args] -``` - - - - - - - -The `boundary accounts update password` command updates a Password type account. - -#### Example - -The following example updates a password account with the ID `acctpw_1234567890` to add the name `devops` and the description `Password account for DevOps`: - -```shell-session -$ boundary accounts update password -id acctpw_1234567890 \ - -name "devops" \ - -description "Password account for DevOps" -``` - -#### Usage - - - -```shell-session -$ boundary accounts update password [options] [args] -``` - - - -#### Password account option - -The following option is specific to password accounts, in addition to the command -options: - -- `-login-name` `(string: "")` - The login name for the account. - - - - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/aliases/create.mdx b/website/content/docs/commands/aliases/create.mdx deleted file mode 100644 index 1848e7853..000000000 --- a/website/content/docs/commands/aliases/create.mdx +++ /dev/null @@ -1,83 +0,0 @@ ---- -layout: docs -page_title: aliases create - Command -description: >- - The "aliases create" command creates a new alias resource for a target. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# aliases create - -Command: `aliases create` - -The `aliases create` command lets you create a new alias. - -## Example - -This example creates an alias for the target `prod-ops.example` with the name `prodops` and the description `Target alias for ProdOps`: - -```shell-session -$ boundary aliases create target -value prod-ops.example -name prodops - -description "Target alias for ProdOps" -``` - -## Usage - - - -```shell-session -$ boundary aliases create [type] [sub command] [options] [args] - -Please see the typed subcommand help for detailed usage information. - -Subcommands: - target Create a target type alias -``` - - - -### Usages by type - -At this time, you can only create aliases for targets. - -The `aliases create target` command lets you create aliases for targets. - -#### Example - -This example creates an alias for the target `-prod-ops.example` with the name `prodops` and the description `Target alias for ProdOps`: - -```shell-session -$ boundary aliases create target -value prod-ops.example -name prodops - -description "Target alias for ProdOps" -``` - -#### Usage - - - -```shell-session -$ boundary aliases create target [options] [args] -``` - - - -#### Command options - -- `-description=` - Specifies the optional description you want to use to describe the alias for identification purposes. -- `-destination-id=` - Specifies the ID of the target that the alias points to. -- `-name=` - Specifies the optional name you want to use to describe the alias for identification purposes. -- `-scope-id=` - Scope in which to create the alias. The default is `global`. -You can also specify the scope using the BOUNDARY_SCOPE_ID environment variable. -At this time, aliases are only supported for the global scope. -- `-value=` - The string that you want to use as the alias to represent the target. -The `value` must comply with DNS naming rules. - -#### Target alias options - -- `-authorize-session-host-id=` - Indicates the host ID to use when you use the alias to authorize a session. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/aliases/delete.mdx b/website/content/docs/commands/aliases/delete.mdx deleted file mode 100644 index e4e94c06e..000000000 --- a/website/content/docs/commands/aliases/delete.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: aliases delete - Command -description: >- - The "aliases delete" command deletes an existing alias resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# aliases delete - -Command: `aliases delete` - -The `aliases delete` command lets you delete an alias. - -## Example - -This example deletes an alias with the ID `alt_1234567890`: - -```shell-session -$ boundary aliases delete -id alt_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary aliases delete [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the alias you want to delete. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/aliases/index.mdx b/website/content/docs/commands/aliases/index.mdx deleted file mode 100644 index e8777de15..000000000 --- a/website/content/docs/commands/aliases/index.mdx +++ /dev/null @@ -1,54 +0,0 @@ ---- -layout: docs -page_title: aliases - Command -description: >- - The "aliases" command performs operations on alias resources. An alias is a globally unique, DNS-like string that is associated with a destination resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# aliases - -Command: `boundary aliases` - -The `aliases` command lets you create and manage alias resources in Boundary. - - -## Examples - -The following example retrieves alias information for a given alias ID, `alt_1234567890`: - -```shell-session -$ boundary aliases read -id alt_1234567890 -``` - -## Usage - - - -```shell-session -Usage: boundary aliases [sub command] [options] [args] - - # ... - -Subcommands: - create Create an alias - delete Delete an alias - list List an alias - read Read an alias - update Update an alias -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [create](/boundary/docs/commands/aliases/create) -- [delete](/boundary/docs/commands/aliases/delete) -- [list](/boundary/docs/commands/aliases/list) -- [read](/boundary/docs/commands/aliases/read) -- [update](/boundary/docs/commands/aliases/update) \ No newline at end of file diff --git a/website/content/docs/commands/aliases/list.mdx b/website/content/docs/commands/aliases/list.mdx deleted file mode 100644 index a5f41347d..000000000 --- a/website/content/docs/commands/aliases/list.mdx +++ /dev/null @@ -1,50 +0,0 @@ ---- -layout: docs -page_title: aliases list - Command -description: >- - The "aliases list" command lists the available alias resources within a scope or resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# aliases list - -Command: `aliases list` - -The `aliases list` command lets you list the aliases within a given scope or resource. - -## Example - -This example lists all aliases within the global scope. -At this time, you can only create aliases in the global scope. - -```shell-session -$ boundary aliases list -``` - -## Usage - - - -```shell-session -$ boundary aliases list [options] [args] -``` - - - -### Command options - -- `-filter=` - If set, Boundary filters the list operation before the results are returned. -The filter operates against each item in the list. -We recommend that you use single quotes, because the filters contain double quotes. -Refer to the [Filtering and listing resources documentation](/boundary/docs/filtering) for more details. -- `recursive` - If set, runs the list operation recursively on any child scopes, if the type supports it. -The default value is `false`. -- `scope-id=` - The scope from which to list the aliases. -The default value is `global`. -You can also specify this value using the **BOUNDARY_SCOPE_ID** environment variable. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/aliases/read.mdx b/website/content/docs/commands/aliases/read.mdx deleted file mode 100644 index aa0923d8e..000000000 --- a/website/content/docs/commands/aliases/read.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: aliases read - Command -description: >- - The "aliases read" command retrieves the details of an alias resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# aliases read - -Command: `aliases read` - -The `aliases read` command lets you read the details of an alias with a given ID. - -## Example - -This example reads the details of an alias with the ID `alt_1234567890`: - -```shell-session -$ boundary aliases read -id alt_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary aliases read [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the alias you want to read. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/aliases/update.mdx b/website/content/docs/commands/aliases/update.mdx deleted file mode 100644 index 39bd6e0b2..000000000 --- a/website/content/docs/commands/aliases/update.mdx +++ /dev/null @@ -1,81 +0,0 @@ ---- -layout: docs -page_title: aliases update - Command -description: >- - The "aliases update" command updates an existing alias resource with new information. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# aliases update - -Command: `aliases update` - -The `aliases update` command lets you update an alias. - -## Example - -This example updates a target-type alias with the ID `alt_1234567890` to add the name `devops`: - -```shell-session -$ boundary aliases update target -id alt_1234567890 -name devops -``` - -## Usage - - - -```shell-session -$ boundary aliases update [type] [sub command] [options] [args] - -Please see the typed subcommand help for detailed usage information. - -Subcommands: - target Update a target type alias -``` - - - -### Usages by type - -At this time, you can only create aliases for targets. - -The `aliases update target` command lets you update aliases for targets. - -#### Example - -This example updates a target-type alias with the ID `alt_1234567890` to add the name `devops`: - -```shell-session -$ boundary aliases update target -id alt_1234567890 -name devops -``` - -#### Usage - - - -```shell-session -$ boundary aliases update target [options] [args] -``` - - - -#### Command options - -- `-description=` - Specifies the optional description you want to use to describe the alias for identification purposes. -- `-destination-id=` - Specifies the ID of the target that the alias points to. -- `-name=` - Specifies the optional name you want to use to describe the alias for identification purposes. -- `-scope-id=` - Scope in which the alias resides. The default is `global`. -You can also specify the scope using the BOUNDARY_SCOPE_ID environment variable. -At this time, aliases are only supported for the global scope. -- `-value=` - The string that you want to use as the alias to represent the target. -The `value` must comply with DNS naming rules. - -#### Target alias options - -- `-authorize-session-host-id=` - Indicates the host ID to use when you use the alias to authorize a session. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/auth-methods/change-state.mdx b/website/content/docs/commands/auth-methods/change-state.mdx deleted file mode 100644 index e1094fff1..000000000 --- a/website/content/docs/commands/auth-methods/change-state.mdx +++ /dev/null @@ -1,138 +0,0 @@ ---- -layout: docs -page_title: auth-methods change-state - Command -description: >- - The "auth-methods change-state" command changes the active and visibility state of an OIDC-type auth method resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# auth-methods change-state - -Command: `boundary auth-methods change-state` - -The `auth-methods change-state` command changes the active and visibility state -of an OIDC-type auth method given its ID. - -An OIDC auth method can be in one of several different states: Inactive, Active -Private, and Active Public. The current state of an OIDC auth method -affects how endpoints respond to requests and, sometimes, whether access to -an endpoint requires authentication. - -- **MakeInactive** transitions an OIDC auth method from either the **Active Private** - or the **Active Public** state into the **Inactive** state. -- **MakePrivate** transitions an OIDC auth method from either the **Inactive** or the - **Active Public** state into the **Active Private** state. If the transition is from the - **Inactive** state, it will only succeed if the configuration is - valid. -- **MakePublic** transitions an OIDC auth method from either the **Inactive** or the - **Active Private** state into the **Active Public** state. If the transition is from the - **Inactive** state, it will only succeed if the configuration is - valid. - -Before you change the state of an auth-method, Boundary retrieves the provider’s discovery document for the auth method’s issuer and attempts to -validate the auth-method’s configuration against this published information. If -Boundary is unable to validate the configuration, an error is returned and the -state change is not successful. - -## Examples - -The following example changes the OIDC auth method's state to `active-public`: - -```shell-session -$ boundary auth-methods change-state oidc -id amoidc_oHt4HQFCrN \ - -state active-public -``` - -**Example output:** - - - -```plaintext -Auth Method information: - Created Time: Fri, 09 Sep 2022 11:11:55 MDT - ID: amoidc_oHt4HQFCrN - Name: auth0 - Type: oidc - Updated Time: Fri, 09 Sep 2022 11:41:33 MDT - Version: 3 - - Scope: - ID: global - Name: global - Type: global - - Authorized Actions: - no-op - read - update - delete - change-state - authenticate - - Authorized Actions on Auth Method's Collections: - accounts: - create - list - managed-groups: - create - list - - Attributes: - api_url_prefix: https://e58fe114-7624-431c-994d-b6670e90b03J.boundary.hashicorp.cloud - callback_url: https://e58fe114-7624-431c-994d-b6670e90b03J.boundary.hashicorp.cloud/v1/auth-methods/oidc:authenticate:callback - client_id: zbaJLTZh3n14WqSV7qQ9onuIVRDaZdzx - client_secret_hmac: Qc3i8NdnTP6rl4JANIg-a2GXgRW5rEKTp2ReIK_BOng - issuer: https://dev-1vdl8c0q.us.auth0.com/ - max_age: 0 - signing_algorithms: [RS256] - state: active-public -``` - - - -## Usage - - - -```shell-session -$ boundary auth-methods change-state oidc [options] [args] -``` - - - -### Command options - -- `-id` `(string: "")` - The ID of the oidc-type auth method on which to operate. - -### OIDC auth method options - -- `-disable-discovered-config-validation` - Disables validating - the given auth method against configuration from the authorization server's - discovery URL. You must specify this value every time an auth method that cannot be validated - is updated or state changed. Not specifying a value is equivalent to setting the value to - `false`. The default is `false`. - -- `-state` `(string: "")` - The desired operational state of the auth method. - Three different states exist for an authentication method: - - - `inactive` users can not authenticate with inactive auth methods and the - inactive auth methods are not listed for unauthenticated users. - - `active-private` users can authenticate with active-private auth methods - and active-private auth methods are not listed for unauthenticated users. - - `active-public` users can authenticate with active-public auth methods and - active-public auth methods are listed for unauthenticated users. - -If you change an auth method from `active-public` or `active-private` to `inactive`, all -in-flight authentications will succeed unless the auth method’s configuration is -modified while the request is in-flight. - -When you change an auth method's state using `boundary auth-methods change-state`, -Boundary uses the `-disable-discovered-config-validation` flag to disable validation -against the provider’s published discovery document. This allows for the very -rare occurrence when the Provider has published an invalid discovery document. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/auth-methods/create.mdx b/website/content/docs/commands/auth-methods/create.mdx deleted file mode 100644 index 87667497f..000000000 --- a/website/content/docs/commands/auth-methods/create.mdx +++ /dev/null @@ -1,298 +0,0 @@ ---- -layout: docs -page_title: auth-methods create - Command -description: >- - The "auth-methods create" command creates new auth method resources. You can create LDAP, OIDC, and password auth method types. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# auth-methods create - -Command: `boundary auth-methods create` - -The `auth-methods create` command lets you create Boundary auth -method resources. The available auth method types are: LDAP, OIDC, and password. - -## Examples - -The following example creates an OIDC auth method by passing the OIDC provider's domain (`-issuer`), client ID, and client secret: - -```shell-session -$ boundary auth-methods create oidc \ - -issuer "https://dev-1sdl8c0z.us.auth0.com" \ - -client-id "zaxJLTZh3n14WqSQ7qQ9onuIVRDaZdzz;" \ - -client-secret "t35c9NNw1aZ8haEKFJbJF0lauMOSp5UNPovUJXo8Ea2sPZAR1DszEowX-6-lg-Xr" \ - -signing-algorithm RS256 \ - -api-url-prefix "http://localhost:9200" \ - -name "auth0" -``` - -**Example output:** - - - -```plaintext -Auth Method information: - Created Time: Thu, 06 May 2021 16:39:33 MDT - ID: amoidc_oHt4HQFCrN - Name: auth0 - Type: oidc - Updated Time: Thu, 06 May 2021 16:39:33 MDT - Version: 1 - - Scope: - ID: global - Name: global - Type: global - - Authorized Actions: - no-op - read - update - delete - change-state - authenticate - - Authorized Actions on Auth Method's Collections: - accounts: - create - list - - Attributes: - api_url_prefix: http://localhost:9200 - callback_url: http://localhost:9200/v1/auth-methods/oidc:authenticate:callback - client_id: zbaJLTZh3n14WqSV7qQ9onuIVRDaZdzx - client_secret_hmac: ayJRYSCphzxcHiKJvBrnDVtz1yiR958ejQuRGdQJMeM - issuer: https://dev-1vdl8c0q.us.auth0.com - signing_algorithms: [RS256] - state: inactive -``` - - - - -## Usage - - - -```shell-session -$ boundary auth-methods create [type] [sub command] [options] [args] -``` - - - -### Command options: - -- `-description` `(string: "")` - The description to set on the auth method. -- `-name` `(string: "")` - The name to set on the auth method. -- `-scope-id` `(string: "")` - The scope in which to make the request. The default - is `global`. You can also specify the scope using the **BOUNDARY_SCOPE_ID** environment variable. - -@include 'cmd-option-note.mdx' - -### Usages by type - -The available types are: `ldap`, `oidc`, and `password`. - - - - -The `boundary auth-methods create ldap` command creates an LDAP auth method. - -#### Example - -The following example creates an LDAP auth method with the name `prodops` and the description `LDAP auth-method for ProdOps`: - -```shell-session -$ boundary auth-methods create ldap -name prodops \ - -description "LDAP auth-method for ProdOps" -``` - -#### Usage - - - -```shell-session -$ boundary auth-methods create ldap [options] [args] -``` - - - -#### LDAP auth method options - -The following are LDAP-specific options in addition to the command -options: - -- `-anon-group-search` - Uses anon bind when performing LDAP - group searches (optional). The default is `false`. - -- `-bind-dn` `(string: "")` - Uses the distinguished name of entry to bind when - performing user and group searches (optional). - -- `-bind-password` `(string: "")` - Indicates the password to use along with bind-dn - performing user and group searches (optional). - -- `-certificate` `(string: "")` - Specifies a PEM-encoded X.509 CA certificate in ASN.1 DER - form that can be used as a trust anchor when connecting to an LDAP - server(optional). You can specify this value multiple times. - -- `-client-certificate` `(string: "")` - Specifies a PEM-encoded X.509 client certificate in - ASN.1 DER form that can be used to authenticate against an LDAP server - (optional). - -- `-client-certificate-key` `(string: "")` - Specifies a PEM-encoded X.509 client - certificate key in PKCS #8, ASN.1 DER form used with the client certificate - (optional). - -- `-discover-dn` - Uses anon bind to discover the bind DN of a - user (optional). The default value is `false`. - -- `-enable-groups` - Finds the authenticated user's groups during - authentication (optional). The default is `false`. - -- `-group-attr` `(string: "")` - Indicates the attribute that enumerates a user's group - membership from entries returned by a group search (optional). - -- `-group-dn` `(string: "")` - Specifies the base DN under which to perform group search. - -- `-group-filter` `(string: "")` - Indicates a go template used to construct a LDAP group - search filter (optional). - -- `-insecure-tls` - Skips the LDAP server SSL certificate - validation (optional). Use this option with caution; it is insecure. The default value is `false`. - -- `-start-tls` - Issues the StartTLS command after connecting - (optional). The default value is `false`. - -- `-state` `(string: "")` - Indicates the desired operational state of the auth method. - -- `-upn-domain` `(string: "")` - Specifies the userPrincipalDomain used to construct the - UPN string for the authenticating user (optional). - -- `-urls` `(string: "")` - Indicates the LDAP URLs that specify LDAP servers to connect to - (required). You can specify this value multiple times. - -- `-use-token-groups` - Uses the Active Directory tokenGroups - constructed attribute of the user to find the group memberships (optional). - The default value is `false`. - -- `-user-attr` `(string: "")` - Specifies the attribute on user entry that matches the - username that is passed during authentication (optional). - -- `-user-dn` `(string: "")` - Indicates the base DN under which to perform user search -(optional). - -- `-user-filter` `(string: "")` - Specifies a go template used to construct a LDAP user -search filter (optional). - - - - -The `boundary auth-methods create oidc` command creates an OIDC auth method. - -#### Example - -The following example creates an OIDC auth method with the name `prodops` and the description `Oidc auth-method for ProdOps`: - -```shell-session -$ boundary auth-methods create oidc -name prodops \ - -description "Oidc auth-method for ProdOps" -``` - -#### Usage - - - -```shell-session -$ boundary auth-methods create oidc [options] [args] -``` - - - -#### OIDC auth method options - -The following are OIDC-specific options in addition to the command options: - -- `-account-claim-maps` `(string: "")` - Specifies the optional account claim maps from - custom claims to the standard claims of sub, name and email. These maps are - represented as key=value where the key equals the Provider from-claim and the - value equals the Boundary to-claim. For example "oid=sub". You may specify this value - multiple times for different to-claims. - -- `-allowed-audience` `(string: "")` - Indicates the acceptable audience ("aud") claim. - You may specify this value multiple times. - -- `-api-url-prefix` `(string: "")` - Specifies the URL prefix used by the OIDC provider in - the authentication flow. - -- `-claims-scopes` `(tring: "")` - Indicates the optional claims scope requested. You may specify this value multiple times. - -- `-client-id` `(string: "")` - Specifies the OAuth 2.0 Client Identifier this auth method - should use with the provider. - -- `-client-secret` `(string: "")` - Indicates the corresponding client secret. - -- `-idp-ca-cert` `(string: "")` - Specifies an optional PEM-encoded X.509 CA certificate that - can be used as trust anchors when connecting to an OIDC provider. You may specify this value multiple times. - -- `-issuer` `(string: "")` - Indicates the provider's issuer URL. - -- `-max-age` `(string: "")` - Indicates the OIDC "max_age" parameter that is sent to the provider. - -- `prompts` `(string: "")` - Indicates whether the OIDC authorization server should display reauthentication, account selection, or consent user interface prompts. -You can optionally configure one or more of the following types of prompts to customize the behavior of the authentication process: - - `none` - The authorization server does not display any authentication or consent prompts. - - `login` - The authorization server prompts users for reauthentication before allowing them to log in. - - `consent` - The authorization server prompts users for consent before returning any information to Boundary. - - `select_account` - The authorization server prompts users to select a user account. - The `select_account` option can be helpful if your users have multiple accounts. - - - -Cloud providers implement `prompts` in different ways. -You may notice differences in behavior if you configure OIDC authentication on multiple cloud providers. - - - -- `-signing-algorithm` `(string: "")` - Indicates the allowed signing algorithm. You may specify this multiple times for multiple values. - - - - - - -The `boundary auth-methods create password` command creates a Password type auth method. - -#### Example - -The following example creates a Password type auth method with the name `prodops` and the description `Password auth-method for ProdOps`: - -```shell-session -$ boundary auth-methods create password -name prodops \ - -description "Password auth-method for ProdOps" -``` -#### Usage - - - -```shell-session -$ boundary accounts create password [options] [args] -``` - - - -#### Password auth method options - -The following are password auth method specific options in addition to the -command options: - -- `-min-login-name-length` `(string: "")` - The minimum length of login names. - -- `-min-password-length` `(string: "")` - The minimum length of passwords. - - - diff --git a/website/content/docs/commands/auth-methods/delete.mdx b/website/content/docs/commands/auth-methods/delete.mdx deleted file mode 100644 index 311752b27..000000000 --- a/website/content/docs/commands/auth-methods/delete.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: auth-methods delete - Command -description: >- - The "auth-methods delete" command deletes an existing auth method resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# auth-methods delete - -Command: `boundary auth-methods delete` - -The `auth-methods delete` command deletes an auth method given its ID. - -## Example - -The following example deletes an auth method with the ID, `moidc_oHt4HQFCrN`. - -```shell-session -$ boundary auth-methods delete -id amoidc_oHt4HQFCrN -``` - -## Usage - - - -```shell-session -$ boundary auth-methods delete [options] [args] -``` - - - -### Command options - -- `-id` `(string: "")` - The ID of the auth method to delete. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/auth-methods/index.mdx b/website/content/docs/commands/auth-methods/index.mdx deleted file mode 100644 index 811e2db3c..000000000 --- a/website/content/docs/commands/auth-methods/index.mdx +++ /dev/null @@ -1,114 +0,0 @@ ---- -layout: docs -page_title: auth-methods - Command -description: >- - The "auth-methods" command performs operations on Boundary authentication method resources. Auth methods let users authenticate to Boundary. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# auth-methods - -Command: `boundary auth-methods` - -The `auth-methods` command lets you manage the auth method resource in Boundary. The auth -method resource provides a mechanism for users to authenticate to -Boundary. An auth method contains accounts which link an individual user to a -set of credentials. They also contain managed groups which group accounts that satisfy -specific criteria, and can be used as principals in roles. - -## Examples - -The following example configures an OIDC auth method where the Boundary cluster -address is stored in the `BOUNDARY_ADDR`, the OIDC provider's client ID is -stored in the `CLIENT_ID`, and the client secret is stored in the -`CLIENT_SECRET` environment variables. - -```shell-session -$ boundary auth-methods create oidc \ - -issuer "https://dev-1sdl8c0z.us.auth0.com" \ - -client-id "$CLIENT_ID" \ - -client-secret "$CLIENT_SECRET" \ - -signing-algorithm RS256 \ - -api-url-prefix "$BOUNDARY_ADDR" \ - -name "auth0" -``` - -**Example output:** - - - -```plaintext -Auth Method information: - Created Time: Fri, 09 Sep 2022 11:11:55 MDT - ID: amoidc_40fr5jkLpk - Name: auth0 - Type: oidc - Updated Time: Fri, 09 Sep 2022 11:11:55 MDT - Version: 1 - - Scope: - ID: global - Name: global - Type: global - - Authorized Actions: - no-op - read - update - delete - change-state - authenticate - - Authorized Actions on Auth Method's Collections: - accounts: - create - list - managed-groups: - create - list - - Attributes: - api_url_prefix: https://e58fe114-7624-431c-994d-b6670e90b03J.boundary.hashicorp.cloud - callback_url: https://e58fe114-7624-431c-994d-b6670e90b03J.boundary.hashicorp.cloud/v1/auth-methods/oidc:authenticate:callback - client_id: zaxJLTZh3n14WqSQ7qQ9onuIVRDaZdzz - client_secret_hmac: Qc3i8NdnTP6rl4JANIg-a2GXgRW5rEKTp2ReIK_BOng - issuer: https://dev-1sdl8c0z.us.auth0.com - signing_algorithms: [RS256] - state: inactive -``` - - - -## Usage - - - -```shell-session -Usage: boundary auth-methods [sub command] [options] [args] - - # ... - -Subcommands: - change-state - create Create an auth method - delete Delete an auth method - list List an auth method - read Read an auth method - update Update an auth method -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [change-state](/boundary/docs/commands/auth-methods/change-state) -- [create](/boundary/docs/commands/auth-methods/create) -- [delete](/boundary/docs/commands/auth-methods/delete) -- [list](/boundary/docs/commands/auth-methods/list) -- [read](/boundary/docs/commands/auth-methods/read) -- [update](/boundary/docs/commands/auth-methods/update) diff --git a/website/content/docs/commands/auth-methods/list.mdx b/website/content/docs/commands/auth-methods/list.mdx deleted file mode 100644 index cc390990e..000000000 --- a/website/content/docs/commands/auth-methods/list.mdx +++ /dev/null @@ -1,110 +0,0 @@ ---- -layout: docs -page_title: auth-methods list - Command -description: >- - The "auth-methods list" command lists the available auth method resources within a scope or resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# auth-methods list - -Command: `boundary auth-methods list` - -The `auth-methods list` command lists auth methods within an enclosing scope or -resource. - - -## Examples - -The following example lists auth methods from the default `global` scope recursively from any child scopes, if applicable: - -```shell-session -$ boundary auth-methods list -recursive -``` - -**Example output:** - - - -```plaintext -Auth Method information: - ID: amoidc_1234567890 - Scope ID: global - Version: 1 - Type: oidc - Name: Generated global scope initial oidc auth method - Description: Provides initial administrative and unprivileged authentication into Boundary - Authorized Actions: - no-op - read - update - delete - change-state - authenticate - - ID: ampw_1234567890 - Scope ID: global - Version: 1 - Type: password - Name: Generated global scope initial password auth method - Description: Provides initial administrative and unprivileged authentication into Boundary - Is Primary For Scope: true - Authorized Actions: - no-op - read - update - delete - authenticate - - ID: ampw_ZbB6UXpW3B - Scope ID: o_u54jrD6ydN - Version: 1 - Type: password - Name: org_auth_method - Description: Org auth method - Authorized Actions: - no-op - read - update - delete - authenticate -``` - - - -## Usage - - - -```shell-session -$ boundary auth-methods list [options] [args] -``` - - - - -### Command options - -- `-filter` `(string: "")` - If set, the list operation is filtered before - being returned. The filter operates against each item in the list. We recommend using - single quotes, because filters contain double quotes. - -- `-recursive` - If set, the list operation is applied - recursively into child scopes, if supported by the type. The default value is - `false`. - -- `-scope-id` `(string: "")` - The scope in which to make the request. The default - scope is `global`. You can also specify a scope using the **BOUNDARY_SCOPE_ID** environment - variable. - -- `list_token` (optional) - An opaque token that is returned from the previous `list` response. -If you do not supply a value, pagination starts from the beginning. -- `page_size` (optional) - An unsigned integer that indicates the number of items that should be included on the page of search results. -If you do not provide a value, or if you provide a value of `0`, Boundary uses the default page size of 1000 items. -If you configure it, the `page_size` value overrides the default page size. -Controller administrators can also configure a `max_page_size` option that constrains the maximum page size a user can request. -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/auth-methods/read.mdx b/website/content/docs/commands/auth-methods/read.mdx deleted file mode 100644 index 7175a5450..000000000 --- a/website/content/docs/commands/auth-methods/read.mdx +++ /dev/null @@ -1,86 +0,0 @@ ---- -layout: docs -page_title: auth-methods read - Command -description: >- - The "auth-methods read" command retrieves the details for an auth method resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# auth-methods read - -Command: `boundary auth-methods read` - -The `auth-methods read` command reads an auth method given its ID. - -## Examples - -The following example reads the auth method details for an auth method with the ID `amoidc_AliCbVihqv`. - -```shell-session -$ boundary auth-methods read -id amoidc_AliCbVihqv -``` - -**Example output:** - - - -```plaintext -Auth Method information: - Created Time: Thu, 13 May 2021 17:01:02 MDT - Description: OIDC auth method for Auth0 - ID: amoidc_AliCbVihqv - Name: Auth0 - Type: oidc - Updated Time: Thu, 13 May 2021 17:01:02 MDT - Version: 2 - - Scope: - ID: o_1234567890 - Name: Generated org scope - Parent Scope ID: global - Type: org - - Authorized Actions: - no-op - read - update - delete - change-state - authenticate - - Authorized Actions on Auth Method's Collections: - accounts: - create - list - - Attributes: - api_url_prefix: http://localhost:9200 - callback_url: http://localhost:9200/v1/auth-methods/oidc:authenticate:callback - client_id: zbaJLTZh3n14WqSV7qQ9onuIVRDaZdzx - client_secret_hmac: AhyxTBqlZpnny78iA9M7QHKAKocI17bjwvS70B1ccg0 - issuer: https://dev-1vdl8c0q.us.auth0.com/ - signing_algorithms: [RS256] - state: active-public -``` - - - -## Usage - - - -```shell-session -$ boundary auth-methods read [options] [args] -``` - - - -### Command options - -- `-id` `(string: "")` - The ID of the auth method to read. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/auth-methods/update.mdx b/website/content/docs/commands/auth-methods/update.mdx deleted file mode 100644 index 834d1a838..000000000 --- a/website/content/docs/commands/auth-methods/update.mdx +++ /dev/null @@ -1,313 +0,0 @@ ---- -layout: docs -page_title: auth-methods update - Command -description: >- - The "auth-methods update" command updates existing auth method resources. You can update LDAP, OIDC, and password auth method types. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# auth-methods update - -Command: `boundary auth-methods update` - -The `auth-methods update` command lets you update Boundary auth method resources. - -## Examples - -The following example updates an auth method to set the `-max-age` option to `0`. -This update forces the user to reauthenticate, if they are already logged in with the current browser session: - -```shell-session -$ boundary auth-methods update oidc -id amoidc_oHt4HQFCrN \ - -issuer "https://dev-1vdl8c0q.us.auth0.com/" \ - -max-age 0 -``` - -**Example output:** - - - -```plaintext -Auth Method information: - Created Time: Thu, 06 May 2021 16:39:33 MDT - ID: amoidc_oHt4HQFCrN - Name: auth0 - Type: oidc - Updated Time: Thu, 06 May 2021 16:58:21 MDT - Version: 2 - - Scope: - ID: global - Name: global - Type: global - - Authorized Actions: - no-op - read - update - delete - change-state - authenticate - - Authorized Actions on Auth Method's Collections: - accounts: - create - list - - Attributes: - api_url_prefix: https://e58fe114-7624-431c-994d-b6670e90b03J.boundary.hashicorp.cloud - callback_url: https://e58fe114-7624-431c-994d-b6670e90b03J.boundary.hashicorp.cloud/v1/auth-methods/oidc:authenticate:callback - client_id: zbaJLTZh3n14WqSV7qQ9onuIVRDaZdzx - client_secret_hmac: ayJRYSCphzxcHiKJvBrnDVtz1yiR958ejQuRGdQJMeM - issuer: https://dev-1vdl8c0q.us.auth0.com/ - max_age: 0 - signing_algorithms: [RS256] - state: inactive -``` - - - - -## Usage - - - -```shell-session -$ boundary auth-methods update [type] [sub command] [options] [args] -``` - - - -### Command options: - -- `-description` `(string: "")` - The description to set on the auth method. -- `-id` `(string: "")` - The ID of the auth method to update. -- `-name` `(string: "")` - The name to set on the auth method. -- `-version` `(int: 0)` - The version of the auth method to update. - If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' - -### Usages by type - -The available types are: `ldap`, `oidc`, and `password`. - - - - -The `boundary auth-methods update ldap` command lets you update an LDAP auth method. - -#### Example - -The following example updates an LDAP auth method with the ID `amldap_1234567890` to add the name `devops` and the description `LDAP auth-method for DevOps`: - -```shell-session -$ boundary auth-methods update ldap -id amldap_1234567890 \ - -name "devops" \ - -description "LDAP auth-method for DevOps" -``` - -#### Usage - - - -```shell-session -$ boundary auth-methods update ldap [options] [args] -``` - - - -#### LDAP auth method options - -The following are LDAP-specific options in addition to the command -options. - -- `-anon-group-search` - Uses anon bind when performing LDAP - group searches (optional). The default value is `false`. - -- `-bind-dn` `(string: "")` - Uses the distinguished name of entry to bind when - performing user and group searches (optional). - -- `-bind-password` `(string: "")` - Indicates the password to use along with bind-dn - when performing user and group searches (optional). - -- `-certificate` `(string: "")` - Specifies a PEM-encoded X.509 CA certificate in ASN.1 DER - form that can be used as a trust anchor when connecting to an LDAP - server(optional). You can specify this value multiple times. - -- `-client-certificate` `(string: "")` - Specifies a PEM-encoded X.509 client certificate in - ASN.1 DER form that can be used to authenticate against an LDAP server - (optional). - -- `-client-certificate-key` `(string: "")` - Specifies a PEM-encoded X.509 client - certificate key in PKCS #8, ASN.1 DER form used with the client certificate - (optional). - -- `-discover-dn` - Uses anon bind to discover the bind DN of a - user (optional). The default value is `false`. - -- `-enable-groups` - Finds the authenticated user's groups during - authentication (optional). The default is `false`. - -- `-group-attr` `(string: "")` - Specifies the attribute that enumerates a user's group - membership from entries returned by a group search (optional). - -- `-group-dn` `(string: "")` - Specifies the base DN under which to perform group search. - -- `-group-filter` `(string: "")` - Indicates a go template used to construct a LDAP group - search filter (optional). - -- `-insecure-tls` - Skips the LDAP server SSL certificate - validation (optional). Use this option with caution, it is insecure. The default value is `false`. - -- `-start-tls` - Issues the StartTLS command after connecting - (optional). The default is `false`. - -- `-state` `(string: "")` - Indicates the desired operational state of the auth method. - -- `-upn-domain` `(string: "")` - Indicates the userPrincipalDomain used to construct the - UPN string for the authenticating user (optional). - -- `-urls` `(string: "")` - Indicates the LDAP URLs that specify LDAP servers to connect to - (required). You may specify this value multiple times. - -- `-use-token-groups` - Uses the Active Directory tokenGroups - constructed attribute of the user to find the group memberships (optional). - The default value is `false`. - -- `-user-attr` `(string: "")` - Indicates the attribute on user entry matching the - username that is passed during authentication (optional). - -- `-user-dn` `(string: "")` - Specifies the base DN under which to perform user search - (optional). - -- `-user-filter` `(string: "")` - Specifies a go template used to construct a LDAP user - search filter (optional). - - - - -The `boundary auth-methods update oidc` command lets you update OIDC auth methods. - -#### Example - -The following example updates an OIDC auth method with the ID `amoidc_1234567890` to add the name `devops` and the description `Oidc auth-method for DevOps`: - -```shell-session -$ boundary auth-methods update oidc -id amoidc_1234567890 \ - -name "devops" \ - -description "Oidc auth-method for DevOps" -``` -#### Usage - - - -```shell-session -$ boundary auth-methods update oidc [options] [args] -``` - - - -#### OIDC auth method options - -The following are options are specific to OIDC auth-methods in addition to the command options. - -- `-account-claim-maps` `(string: "")` - Indicates the optional account claim maps from - custom claims to the standard claims of sub, name and email. These maps are - represented as key=value where the key equals the Provider from-claim and the - value equals the Boundary to-claim. For example "oid=sub". You may specify this value - multiple times for different to-claims. - -- `-allowed-audience` `(string: "")` - Indicates the acceptable audience ("aud") claim. - You may specify this value multiple times. - -- `-api-url-prefix` `(string: "")` - Indicates the URL prefix used by the OIDC provider in - the authentication flow. - -- `-claims-scopes` `(tring: "")` - Specifies the optional claims scope requested. You may specify this value multiple times. - -- `-client-id` `(string: "")` - Indicates the OAuth 2.0 Client Identifier this auth method - should use with the provider. - -- `-client-secret` `(string: "")` - Indicates the corresponding client secret. - -- `-idp-ca-cert` `(string: "")` - Specifies an optional PEM-encoded X.509 CA certificate that - can be used as trust anchors when connecting to an OIDC provider. May be - specified multiple times. - -- `-disable-discovered-config-validation` - Disables validating - the given auth method against configuration from the authorization server's - discovery URL. This must be specified every time an unvalidatable auth method - is updated or state changed; not specifying it is equivalent to setting it to - false. The default is false. - -- `-dry-run` - Performs all completeness and validation checks - with any newly-provided values without persisting the changes. The default is - false. - -- `-idp-ca-cert` `(tring: "")` - Indicates an optional PEM-encoded X.509 CA certificate that - can be used as trust anchors when connecting to an OIDC provider. You may specify this value multiple times. - -- `-issuer` `(string: "")` - Indicates the provider's Issuer URL. - -- `-max-age` `(string: "")` - Indicates the OIDC "max_age" parameter sent to the provider. - -- `prompts` `(string: "")` - Indicates whether the OIDC authorization server should display reauthentication, account selection, or consent user interface prompts. -You can optionally configure one or more of the following types of prompts to customize the behavior of the authentication process: - - `none` - The authorization server does not display any authentication or consent prompts. - - `login` - The authorization server prompts users for reauthentication before allowing them to log in. - - `consent` - The authorization server prompts users for consent before returning any information to Boundary. - - `select_account` - The authorization server prompts users to select a user account. - The `select_account` option can be helpful if your users have multiple accounts. - - - -Cloud providers implement `prompts` in different ways. -You may notice differences in behavior if you configure OIDC authentication on multiple cloud providers. - - - -- `-signing-algorithm` `(string: "")` - Indicates the allowed signing algorithm. You may specify this value multiple times for multiple values. - - - - - - -The `boundary auth-methods update password` command lets you update a Password-type auth method. - -#### Example - -The following example updates a Password-type auth method with the ID `ampw_1234567890` to add the name `devops` and the description `Password auth-method for DevOps`: - -```shell-session -$ boundary auth-methods update password -id ampw_1234567890 \ - -name "devops" \ - -description "Password auth-method for DevOps" -``` - -#### Usage - - - -```shell-session -$ boundary auth-methods update password [options] [args] -``` - - - -### Password auth method options - -The following options are specific to the Passwor-type auth method in addition to the -command options. - -- `-min-login-name-length` `(string: "")` - The minimum length of login names. - -- `-min-password-length` `(string: "")` - The minimum length of passwords. - - - diff --git a/website/content/docs/commands/auth-tokens/delete.mdx b/website/content/docs/commands/auth-tokens/delete.mdx deleted file mode 100644 index a65c342be..000000000 --- a/website/content/docs/commands/auth-tokens/delete.mdx +++ /dev/null @@ -1,43 +0,0 @@ ---- -layout: docs -page_title: auth-tokens delete - Command -description: >- - The "auth-tokens delete" command deletes an existing auth token resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# auth-tokens delete - -Command: `boundary auth-tokens delete` - -The `auth-tokens delete` command deletes an auth token given its ID. - -## Example - -The following command deletes an auth token with the ID `at_LvUqeYz80B`: - -```shell-session -$ boundary auth-tokens delete -id at_LvUqeYz80B -The delete operation completed successfully. -``` - -## Usage - - - -```shell-session -$ boundary auth-tokens delete [options] [args] -``` - - - - -### Command options - -- `-id` `(string: "")` - The ID of the auth token to delete. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/auth-tokens/index.mdx b/website/content/docs/commands/auth-tokens/index.mdx deleted file mode 100644 index 2eca67c55..000000000 --- a/website/content/docs/commands/auth-tokens/index.mdx +++ /dev/null @@ -1,80 +0,0 @@ ---- -layout: docs -page_title: auth-tokens - Command -description: >- - The "auth-tokens" command peforms operations on auth token resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# auth-tokens - -Command: `boundary auth-tokens` - -The `auth-tokens` command lets you manage auth token resources in Boundary. - -## Example - -The following example command lists existing auth tokens recursively: - -```shell-session -$ boundary auth-tokens list -recursive - -Auth Token information: - ID: at_LvUqeYz80B - Scope ID: global - Approximate Last Used Time: Sun, 13 Aug 2023 17:22:59 PDT - Auth Method ID: ampw_1234567890 - Created Time: Sun, 13 Aug 2023 17:22:59 PDT - Expiration Time: Sun, 20 Aug 2023 17:22:59 PDT - Updated Time: Sun, 13 Aug 2023 17:22:59 PDT - User ID: u_1234567890 - Authorized Actions: - no-op - read - read:self - delete - delete:self - - ID: at_TXmYwSqnnO - Scope ID: global - Approximate Last Used Time: Sun, 13 Aug 2023 17:23:16 PDT - Auth Method ID: ampw_1234567890 - Created Time: Sun, 13 Aug 2023 17:23:16 PDT - Expiration Time: Sun, 20 Aug 2023 17:23:16 PDT - Updated Time: Sun, 13 Aug 2023 17:23:16 PDT - User ID: u_1234567890 - Authorized Actions: - no-op - read - read:self - delete - delete:self -``` - -## Usage - - - -```shell-session -Usage: boundary auth-tokens [sub command] [options] [args] - - # ... - -Subcommands: - delete Delete an auth tokn - list List an auth token - read Read an auth token -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [delete](/boundary/docs/commands/auth-tokens/delete) -- [list](/boundary/docs/commands/auth-tokens/list) -- [read](/boundary/docs/commands/auth-tokens/read) diff --git a/website/content/docs/commands/auth-tokens/list.mdx b/website/content/docs/commands/auth-tokens/list.mdx deleted file mode 100644 index 8e124bffb..000000000 --- a/website/content/docs/commands/auth-tokens/list.mdx +++ /dev/null @@ -1,99 +0,0 @@ ---- -layout: docs -page_title: auth-tokens list - Command -description: >- - The "auth-tokens list" command lists the available auth token resources within an enclosing scope or resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# auth-tokens list - -Command: `boundary auth-tokens list` - -The `auth-tokens list` command lists all auth tokens within an enclosing scope or -resource. - - -## Examples - -The following command lists all auth tokens recursively from any child scopes, if applicable: - -```shell-session -$ boundary auth-tokens list -``` - -**Example output:** - - - -```plaintext -Auth Token information: - ID: at_TXmYwSqnnO - Approximate Last Used Time: Sun, 13 Aug 2023 18:03:51 PDT - Auth Method ID: ampw_1234567890 - Created Time: Sun, 13 Aug 2023 17:23:16 PDT - Expiration Time: Sun, 20 Aug 2023 17:23:16 PDT - Updated Time: Sun, 13 Aug 2023 18:03:51 PDT - User ID: u_1234567890 - Authorized Actions: - no-op - read - read:self - delete - delete:self - - ID: at_Gvd3jsqSO2 - Approximate Last Used Time: Sun, 13 Aug 2023 18:04:34 PDT - Auth Method ID: ampw_1234567890 - Created Time: Sun, 13 Aug 2023 18:04:34 PDT - Expiration Time: Sun, 20 Aug 2023 18:04:34 PDT - Updated Time: Sun, 13 Aug 2023 18:04:34 PDT - User ID: u_1234567890 - Authorized Actions: - no-op - read - read:self - delete - delete:self -``` - - - - -## Usage - - - -```shell-session -$ boundary auth-tokens list [options] [args] -``` - - - - -### Command options - -- `-filter` `(string: "")` - If set, the list operation is filtered before it is returned. -The filter operates against each item in the list. -We recommend that you use single quotes, as filters contain double quotes. -Refer to the [Filtering and listing resources documentation](/boundary/docs/filtering) for more details. - -- `-recursive` - If set, the list operation is applied recursively into child scopes, if the type supports it. -The default value is `false`. - -- `-scope-id` `(string: "")` - The scope from which to list the auth tokens. -The default value is `global`. -You can also specify this value using the **BOUNDARY_SCOPE_ID** environment variable. - -- `list_token` (optional) - An opaque token that is returned from the previous `list` response. -If you do not supply a value, pagination starts from the beginning. -- `page_size` (optional) - An unsigned integer that indicates the number of items that should be included on the page of search results. -If you do not provide a value, or if you provide a value of `0`, Boundary uses the default page size of 1000 items. -If you configure it, the `page_size` value overrides the default page size. -Controller administrators can also configure a `max_page_size` option that constrains the maximum page size a user can request. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/auth-tokens/read.mdx b/website/content/docs/commands/auth-tokens/read.mdx deleted file mode 100644 index 2a14c1bf7..000000000 --- a/website/content/docs/commands/auth-tokens/read.mdx +++ /dev/null @@ -1,70 +0,0 @@ ---- -layout: docs -page_title: auth-tokens read - Command -description: >- - The "auth-tokens read" command retrieves the details for an auth token resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# auth-tokens read - -Command: `boundary auth-tokens read` - -The `auth-tokens read` command reads an auth token given its ID. - -## Examples - -The following example reads the auth token details for an auth token with the ID `at_Gvd3jsqSO2`: - -```shell-session -$ boundary auth-tokens read -id at_Gvd3jsqSO2 -``` - -**Example output:** - - - -```plaintext -Auth Token information: - Approximate Last Used Time: Sun, 13 Aug 2023 18:04:34 PDT - Auth Method ID: ampw_1234567890 - Created Time: Sun, 13 Aug 2023 18:04:34 PDT - Expiration Time: Sun, 20 Aug 2023 18:04:34 PDT - ID: at_Gvd3jsqSO2 - Updated Time: Sun, 13 Aug 2023 18:04:34 PDT - User ID: u_1234567890 - - Scope: - ID: global - Name: global - Type: global - - Authorized Actions: - no-op - read - read:self - delete - delete:self -``` - - - -## Usage - - - -```shell-session -$ boundary auth-tokens read [options] [args] -``` - - - -### Command options - -- `-id` `(string: "")` - The ID of the auth token to read. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/authenticate/index.mdx b/website/content/docs/commands/authenticate/index.mdx deleted file mode 100644 index b41869585..000000000 --- a/website/content/docs/commands/authenticate/index.mdx +++ /dev/null @@ -1,69 +0,0 @@ ---- -layout: docs -page_title: authenticate - Command -description: >- - The "authenticate" command authenticates the CLI client using the specified auth method. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# authenticate - -Command: `boundary authenticate` - -The `authenticate` command authenticates the Boundary command line client using the auth method that you specify. - - -## Examples - -The following example authenticates the Boundary CLI using a configured OIDC auth method where the auth method ID is `amoidc_q7jAdI1QgA`: - - -```shell-session -$ boundary authenticate oidc -auth-method-id amoidc_q7jAdI1QgA -``` - -**Example output:** - - - -```plaintext -Opening returned authentication URL in your browser... - -Authentication information: - Account ID: acctoidc_oztPFBFesH - Auth Method ID: amoidc_oHt4HQFCrN - Expiration Time: Thu, 13 May 2021 17:01:11 MDT - User ID: u_JCRQP3ID7l - -The token was successfully stored in the chosen keyring and is not displayed here. -``` - - - -## Usage - - - -```shell-session -Usage: boundary authenticate [sub command] [options] [args] - - # ... - -Subcommands: - ldap Invoke the ldap auth method to authenticate with Boundary - oidc Invoke the OIDC auth method to authenticate with Boundary - password Invoke the password auth method to authenticate with Boundary -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [ldap](/boundary/docs/commands/authenticate/ldap) -- [oidc](/boundary/docs/commands/authenticate/oidc) -- [password](/boundary/docs/commands/authenticate/password) diff --git a/website/content/docs/commands/authenticate/ldap.mdx b/website/content/docs/commands/authenticate/ldap.mdx deleted file mode 100644 index 7f159b735..000000000 --- a/website/content/docs/commands/authenticate/ldap.mdx +++ /dev/null @@ -1,53 +0,0 @@ ---- -layout: docs -page_title: authenticate ldap - Command -description: >- - The "authenticate ldap" command invokes the LDAP auth method to authenticate the CLI client. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# authenticate ldap - -Command: `boundary authenticate ldap` - -The `authenticate ldap` command lets you invokes the LDAP auth method to authenticate the -Boundary CLI. - -## Example - -The following example uses an LDAP auth method with the ID `amldap_1234567890` and the login name `foo` to authenticate the Boundary CLI: - -```shell-session -$ boundary authenticate ldap -auth-method-id amldap_1234567890 -login-name foo -``` - -## Usage - - - -```shell-session -$ boundary authenticate ldap [options] [args] -``` - - - -### Command options - -- `-auth-method-id` `(string: "")` - The auth-method resource you want to use for authentication. -You can also specify the auth method resource using the **BOUNDARY_AUTH_METHOD_ID** environment variable. - -- `-login-name` `(string: "")` - A login name that corresponds to an account within the given auth method. -You can also specify a login name using the **BOUNDARY_AUTHENTICATE_PASSWORD_LOGIN_NAME** environment variable. - -- `-password` `(string: "")` - The password that is associated with the login name. -If this value is blank, the command prompts you to enter the password interactively in a non-echoing way. -Otherwise, this value can refer to a file on disk (`file://`) from which a password is read or an environment variable (`env://`) from which the password is read. You can also specify the password using the **BOUNDARY_AUTHENTICATE_PASSWORD_PASSWORD** environment variable. - -- `-scope-id` `(string: "")` - The scope ID to use for the operation. -You can also specify the scope ID using the **BOUNDARY_SCOPE_ID** environment variable. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/authenticate/oidc.mdx b/website/content/docs/commands/authenticate/oidc.mdx deleted file mode 100644 index 411881eb2..000000000 --- a/website/content/docs/commands/authenticate/oidc.mdx +++ /dev/null @@ -1,68 +0,0 @@ ---- -layout: docs -page_title: authenticate oidc - Command -description: >- - The "authenticate oidc" command invokes the OIDC auth method to authenticate the CLI client. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# authenticate oidc - -Command: `boundary authenticate oidc` - -The `authenticate oidc` command lets you invoke the OIDC auth method to authenticate the -Boundary CLI. - -The OIDC authentication method lets Boundary users delegate authentication -to an OIDC provider. OIDC authentication allows Boundary to integrate with widely -adopted identity providers like Okta, cloud-hosted active directory services -with an OIDC frontend, and cloud identity management systems such as AWS IAM. - -## Examples - -The following command authenticates the Boundary CLI using an OIDC auth method with the ID `amoidc_q7jAdI1QgA`: - -```shell-session -$ boundary authenticate oidc -auth-method-id amoidc_q7jAdI1QgA -Opening returned authentication URL in your browser... -``` - -**Example output:** - - - -```plaintext -Authentication information: - Account ID: acctoidc_f0wWsno9jQ - Auth Method ID: amoidc_q7jAdI1QgA - Expiration Time: Wed, 21 Apr 2021 15:02:38 MDT - User ID: u_zAfnbL9b7y - -The token was successfully stored in the chosen keyring and is not displayed here. -``` - - - -## Usage - - - -```shell-session -$ boundary authenticate oidc [options] [args] -``` - - - -### Command options - -- `-auth-method-id` `(string: "")` - The auth method resource you want to use for the authentication. -You can also specify the auth method resource using the **BOUNDARY_AUTH_METHOD_ID** environment variable. - -- `-scope-id` `(string: "")` - The scope ID to use for the operation. -You can also specify the scope ID using the **BOUNDARY_SCOPE_ID** environment variable. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/authenticate/password.mdx b/website/content/docs/commands/authenticate/password.mdx deleted file mode 100644 index a3cd95637..000000000 --- a/website/content/docs/commands/authenticate/password.mdx +++ /dev/null @@ -1,69 +0,0 @@ ---- -layout: docs -page_title: authenticate password - Command -description: >- - The "authenticate password" command invokes the password auth method to authenticate the CLI client. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# authenticate password - -Command: `boundary authenticate password` - -The `authenticate password` command lets you invoke the password auth method to -authenticate the Boundary CLI. - - -## Examples - -The following example authenticates the Boundary CLI using the password auth method and specifying the username: - -```shell-session -$ boundary authenticate password -login-name user1 -Please enter the password (it will be hidden): - -Authentication information: - Account ID: acctpw_JQXp0QHxQL - Auth Method ID: ampw_xxF3EIBn4k - Expiration Time: Thu, 26 May 2022 11:36:27 MDT - User ID: u_RlkqMP6jUv - -The token was successfully stored in the chosen keyring and is not displayed here. -``` - -## Usage - - - -```shell-session -$ boundary authenticate password [options] [args] -``` - - - - -### Command options - -- `-auth-method-id` `(string: "")` - The auth-method resource you want to use for the - authentication. - You can also specify the auth method resource using the **BOUNDARY_AUTH_METHOD_ID** environment variable. - -- `-login-name` `(string: "")` - A login name that corresponds to an account - within the given auth method. - You can also specify a login name using the **BOUNDARY_AUTHENTICATE_PASSWORD_LOGIN_NAME** environment variable. - -- `-password` `(string: "")` - The password that is associated with the login name. - If this value is blank, the command prompts you to enter the password interactively - in a non-echoing way. Otherwise, this value can refer to a file on disk (`file://`) - from which a password is read or an environment variable (`env://`) from which the - password is read. You can also specify the password using the - **BOUNDARY_AUTHENTICATE_PASSWORD_PASSWORD** environment variable. - -- `-scope-id` `(string: "")` - The scope ID to use for the operation. You can also specify the scope ID using the **BOUNDARY_SCOPE_ID** environment variable. - - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/billing/index.mdx b/website/content/docs/commands/billing/index.mdx deleted file mode 100644 index 9bfc569d4..000000000 --- a/website/content/docs/commands/billing/index.mdx +++ /dev/null @@ -1,50 +0,0 @@ ---- -layout: docs -page_title: billing - Command -description: >- - The "billing" command retrieves the number of active users to help you predict user-based pricing. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# billing - -Command: `boundary billing` - -The `billing` command retrieves the number of active Boundary users in your organization to help you predict billing information. - -An active user is any unique Boundary user resource that has performed at least one authenticated action during the relevant billing period. -Users perform authenticated actions when they call API endpoints that require a valid auth token. -Boundary provides auth tokens to users when they authenticate using an auth method. - -## Examples - -The following command retrieves the number of monthly active users between September 2023 and February 2024: - -```shell-session -$ boundary billing monthly-active-users / - -start-time="2023-09" / - -end-time="2024-02" -``` - -## Usage - - - -```shell-session -Usage: boundary billing [sub command] [options] [args] - - # ... - -Subcommand: - monthly-active-users Display the number of monthly active users -``` - - - -For more information, examples, and usage, click on the name of the subcommand in the sidebar or the link below: - -- [monthly-active-users](/boundary/docs/commands/billing/monthly-active-users) \ No newline at end of file diff --git a/website/content/docs/commands/billing/monthly-active-users.mdx b/website/content/docs/commands/billing/monthly-active-users.mdx deleted file mode 100644 index fe99ba347..000000000 --- a/website/content/docs/commands/billing/monthly-active-users.mdx +++ /dev/null @@ -1,51 +0,0 @@ ---- -layout: docs -page_title: billing monthly-active-users - Command -description: >- - The "billing monthly-active-users" command retrieves the number of monthly active users during a specified time period to help you predict user-based pricing. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# billing monthly-active-users - -Command: `boundary billing monthly-active-users` - -The `billing monthly-active-users` command retrieves the number of monthly active Boundary users in your organization during a specific time to help predict billing information. - -## Example - -The following command retrieves the number of monthly active users between September 2023 and February 2024: - -```shell-session -$ boundary billing monthly-active-users / - -start-time="2023-09" / - -end-time="2024-02" -``` - -## Usage - - - -```shell-session -$ boundary billing monthly-active-users [options] [args] -``` - - - -### Command options - -- `end-time=` - The end date for which you want to view monthly active users in YYYY-MM format. -If you do not include an end time, the command retrieves active users from the start time through the current month. - - The end time is exclusive, so the command returns monthly active users up to, but not including, the month you enter. - If the end time is **2024-07**, for example, the results include all active users from June (2024-06), but they would not include any users from July (2024-07). -- `start-time=` - The start date for which you want to view monthly active users in YYYY-MM format. - - The start time is inclusive, so any active users from the month you enter are included in the results. - If the start time is **2024-06**, for example, the command returns all users from June (2024-06) through the specified end time. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/cache/add-token.mdx b/website/content/docs/commands/cache/add-token.mdx deleted file mode 100644 index 23b7928a1..000000000 --- a/website/content/docs/commands/cache/add-token.mdx +++ /dev/null @@ -1,79 +0,0 @@ ---- -layout: docs -page_title: cache add-token - Command -description: >- - The "cache add-token" command adds an auth token resource to the Boundary cache. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# cache add-token - -Command: `boundary cache add-token` - -The `boundary cache add-token` command lets you add an auth token from your keyring to a Boundary cache that is running. - -By default, the Boundary CLI tries to use a keyring to store and receive auth tokens. -Whenever you use an auth token to interact with Boundary, the client cache stores the auth token and syncs the data associated with it. -If you authenticate to multiple Boundary instances, the client cache stores multiple auth tokens and syncs the data associated with each token. - -By adding auth tokens to your client cache, you can select which specific Boundary instance you want to search. - - - -The `search` operation only displays the resources that you have permissions to view. -You must have the `read` or `read:self` grant on the auth token to successfully add it. -If you are logged in as a user who does not have the permissions to view a resource, it does not display in the list of results. - -For more information, refer to [Identity and access management (IAM)](/boundary/docs/concepts/iam). - - - -## Examples - -The following command adds an auth token to the client cache from your keyring: - -```shell-session -$ boundary cache add-token -``` - -The following command specifies the name of the keyring `development` from which you want to add the token: - -```shell-session -$ boundary cache add-token -token-name development -``` - -## Usage - - - -```shell-session -$ boundary cache add-token [options] -``` - - - -### Command options - -- `keyring-type=` - Specifies the type of keyring to use. -The default value is `auto` which uses the Windows credential manager, OS X keychain, or cross-platform password store, depending on your platform. -Use the value `none` to disable keyring functionality. -Depending on your platform, available values include: - - `wincred` - - `keychain` - - `pass` - - `secret-service` - - You can also specify the keyring type using the **BOUNDARY_KEYRING_TYPE** environment variable. -- `output-curl-string` - Specifies that Boundary should print an equivalent cURL command string and exit, instead of executing the request. -The default value is `false`. -- `token` = A URL that points to a file on disk (file://) from which Boundary reads a token or an environment variable (env://) from which the token will be read. -If you set this parameter, it overrides the `token-name` parameter. -- `token-name` - If specified, Boundary uses the value in this parameter as the name when it stores the token in the system credential store. -You can use this value to switch user identities for different commands. -You can also specify a token name using the **BOUNDARY_TOKEN_NAME** environment variable. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/cache/index.mdx b/website/content/docs/commands/cache/index.mdx deleted file mode 100644 index a349d5798..000000000 --- a/website/content/docs/commands/cache/index.mdx +++ /dev/null @@ -1,48 +0,0 @@ ---- -layout: docs -page_title: cache - Command -description: >- - The "cache" command performs operations on a local cache that facilitates searches and protects your system resources from being overwhelmed. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# cache - -Command: `boundary cache` - -The `cache` command lets you manage the Boundary cache and perform operations on the local cache of information. - -## Example - -The following command starts the Boundary cache in the background: - -```shell-session -$ boundary cache start -background -``` - -## Usage - - - -```shell-session -Usage: boundary cache [options] [args] - # ... -Subcommands: - add-token Add an auth token to a Boundary cache that is currently running. - start Starts the Boundary cache. - status Gets the status information of a Boundary cache that is currently running. - stop Stops the Boundary cache. -``` - - - -For more information, examples, and usage, click on the name of the subcommand in the sidebar or one of the links below: - -- [add-token](/boundary/docs/commands/cache/add-token) -- [start](/boundary/docs/commands/cache/start) -- [status](/boundary/docs/commands/cache/status) -- [stop](/boundary/docs/commands/cache/stop) diff --git a/website/content/docs/commands/cache/start.mdx b/website/content/docs/commands/cache/start.mdx deleted file mode 100644 index 4796f30b7..000000000 --- a/website/content/docs/commands/cache/start.mdx +++ /dev/null @@ -1,54 +0,0 @@ ---- -layout: docs -page_title: cache start - Command -description: >- - The "cache start" command starts the Boundary cache and determines the behavior of the local cache. You can customize log, search, and refresh settings. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# cache start - -Command: `boundary cache start` - -The `boundary cache start` command lets you manually start the Boundary cache and customize the behavior of the local cache. - -## Example - -The following command starts the Boundary cache in the background: - -```shell-session -$ boundary cache start -background -``` - -## Usage - - - -```shell-session -$ boundary cache start [options] [args] -``` - - - -### Command options - -- `background` - Starts the Boundary cache in the background. -The default value is `false`. -By default, the cache starts in the foreground. -- `log-format=` - Specifies the log format, mostly as a fallback for events. -Supported values are `standard` and `json`. -- `max-search-refresh-timeout=` - If a search request triggers a best effort refresh, this value specifies how long the refresh should run before time out. -In the event of a timeout, Boundary uses the stale data that is currently in the cache. -The default value is 7 seconds. -- `max-search-staleness=` - The amount of time that can pass since the last refresh before the client cache causes a blocking refresh. -The blocking refresh occurs when you perform the `boundary search` command. -It requires Boundary to refresh the local cache using the control plane. -The default value is 30 seconds. -- `refresh-interval` - A duration that specifies how frequently the client cache should query Boundary for changes to sessions and targets. -Note that Boundary only searches sessions and targets that the user who ran the command has access to. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/cache/status.mdx b/website/content/docs/commands/cache/status.mdx deleted file mode 100644 index e5bc0cc5e..000000000 --- a/website/content/docs/commands/cache/status.mdx +++ /dev/null @@ -1,57 +0,0 @@ ---- -layout: docs -page_title: cache status - Command -description: >- - The "cache status" command checks the status of the Boundary cache and reports on configuration, user, and resource information. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# cache status - -Command: `boundary cache status` - -The `boundary cache status` command lets you manually check the status of the Boundary cache. -Boundary prints out a status report that includes configuration, user, and resource information. - -## Example - -The following command checks the status of the Boundary cache: - -```shell-session -$ boundary cache status -``` - -**Example output:** - - - -```plaintext -Status: - Domain Socket: /home/my_user/.boundary/socket/daemon.sock - Log Location: /home/my_user/.boundary/cache.log - Uptime: 15m22s - User Count: 1 -``` - - - -## Usage - - - -```shell-session -$ boundary cache status [options] [args] -``` - - - -### Command options - -- `output-curl-string` - Specifies that Boundary should print an equivalent cURL command string and exit, instead of executing the request. -The default value is `false`. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/cache/stop.mdx b/website/content/docs/commands/cache/stop.mdx deleted file mode 100644 index 5e76b2c5b..000000000 --- a/website/content/docs/commands/cache/stop.mdx +++ /dev/null @@ -1,37 +0,0 @@ ---- -layout: docs -page_title: cache stop - Command -description: >- - The "cache stop" command stops the Boundary cache. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# cache stop - -Command: `boundary cache stop` - -The `boundary cache stop` command lets you manually stop the Boundary cache. - -## Example - -The following command stops the Boundary cache: - -```shell-session -$ boundary cache stop -``` - -## Usage - - - -```shell-session -$ boundary cache stop [options] [args] -``` - - - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/client-agent/index.mdx b/website/content/docs/commands/client-agent/index.mdx deleted file mode 100644 index 5671c6cb8..000000000 --- a/website/content/docs/commands/client-agent/index.mdx +++ /dev/null @@ -1,64 +0,0 @@ ---- -layout: docs -page_title: client-agent - Command -description: >- - The "client-agent" command lets you interact with the Boundary Client Agent. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# client-agent - -Command: `boundary client-agent` - -The `client-agent` command lets you interact with the Boundary Client Agent. -You can check the Client Agent's status, pause it, resume it, or list the active transparent sessions the Client Agent is managing. - -## Examples - -The following command lets you check the status of the Client Agent to ensure it is running: - -```shell-session -$ boundary client-agent status -``` - -The following command retrieves information about any sessions that the Client Agent is managing: - -```shell-session -$ boundary client-agent sessions -``` - -You can temporarily disable the Client Agent by pausing it with the following command: - -```shell-session -$ boundary client-agent pause -``` - -## Usage - - - -```shell-session -Usage: boundary client-agent [options] [args] - - # ... - -Subcommands: - pause Pauses the running boundary client agent - resume Resumes the paused boundary client agent - sessions List active transparent sessions managed by the client agent. - status Get the status information of the running boundary client agent -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [pause](/boundary/docs/commands/client-agent/pause) -- [resume](/boundary/docs/commands/client-agent/resume) -- [sessions](/boundary/docs/commands/client-agent/sessions) -- [status](/boundary/docs/commands/client-agent/status) diff --git a/website/content/docs/commands/client-agent/pause.mdx b/website/content/docs/commands/client-agent/pause.mdx deleted file mode 100644 index 8b4081371..000000000 --- a/website/content/docs/commands/client-agent/pause.mdx +++ /dev/null @@ -1,43 +0,0 @@ ---- -layout: docs -page_title: client-agent pause - Command -description: >- - The "client-agent pause" command pauses the Client Agent so that it does not intercept DNS requests. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# client-agent pause - -Command: `boundary client-agent pause` - -The `boundary client-agent pause` command lets you temporarily stop the Client Agent. -When the Client Agent is paused, it does not intercept DNS requests and you cannot use transparent sessions. - -## Example - -The following command pauses the Client Agent: - -```shell-session -$ boundary client-agent pause -``` - -## Usage - - - -```shell-session -$ boundary client-agent pause [options] [args] -``` - - - -### Command options - -- `client-agent-port=` - Specifies the port on which the Client Agent listens. -You can also specify the port using the **BOUNDARY_CLIENT_AGENT_LISTENING_PORT** environment variable. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/client-agent/resume.mdx b/website/content/docs/commands/client-agent/resume.mdx deleted file mode 100644 index 02729de60..000000000 --- a/website/content/docs/commands/client-agent/resume.mdx +++ /dev/null @@ -1,44 +0,0 @@ ---- -layout: docs -page_title: client-agent resume - Command -description: >- - The "client-agent resume" command resumes running the Client Agent when it is paused. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# client-agent resume - -Command: `boundary client-agent resume` - -The `boundary client-agent resume` command lets you resume the Client Agent when it is paused. -When the Client Agent is paused, it does not intercept DNS requests and you cannot use transparent sessions. -You must resume the Client Agent to use transparent sessions again after you pause it. - -## Example - -The following command resumes the Client Agent: - -```shell-session -$ boundary client-agent resume -``` - -## Usage - - - -```shell-session -$ boundary client-agent resume [options] [args] -``` - - - -### Command options - -- `client-agent-port=` - Specifies the port on which the Client Agent listens. -You can also specify the port using the **BOUNDARY_CLIENT_AGENT_LISTENING_PORT** environment variable. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/client-agent/sessions.mdx b/website/content/docs/commands/client-agent/sessions.mdx deleted file mode 100644 index e2731b24a..000000000 --- a/website/content/docs/commands/client-agent/sessions.mdx +++ /dev/null @@ -1,42 +0,0 @@ ---- -layout: docs -page_title: client-agent sessions - Command -description: >- - The "client-agent sessions" command lists any active sessions that the Client Agent is managing. It also lists any associated brokered credentials. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# client-agent sessions - -Command: `boundary client-agent sessions` - -The `boundary client-agent sessions` command lists any sessions that the Client Agent is managing as well as any brokered credentials that are associated with those sessions. - -## Example - -The following command lists any sessions that the Client Agent is managing: - -```shell-session -$ boundary client-agent sessions -``` - -## Usage - - - -```shell-session -$ boundary client-agent sessions [options] [args] -``` - - - -### Command options - -- `client-agent-port=` - Specifies the port on which the Client Agent listens. -You can also specify the port using the **BOUNDARY_CLIENT_AGENT_LISTENING_PORT** environment variable. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/client-agent/status.mdx b/website/content/docs/commands/client-agent/status.mdx deleted file mode 100644 index f2f16dc2d..000000000 --- a/website/content/docs/commands/client-agent/status.mdx +++ /dev/null @@ -1,44 +0,0 @@ ---- -layout: docs -page_title: client-agent status - Command -description: >- - The "client-agent status" command provides the status of the Client Agent so you can ensure that it is running. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# client-agent status - -Command: `boundary client-agent status` - -You can use the `boundary client-agent status` command to ensure that the Client Agent is running. -The command provides the runtime status and information about whether the current user is authenticated. -It may also include a list of errors, if the Client Agent has encountered any. - -## Example - -The following command provides the current status of the Client Agent: - -```shell-session -$ boundary client-agent status -``` - -## Usage - - - -```shell-session -$ boundary client-agent status [options] [args] -``` - - - -### Command options - -- `client-agent-port=` - Specifies the port on which the Client Agent listens. -You can also specify the port using the **BOUNDARY_CLIENT_AGENT_LISTENING_PORT** environment variable. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/config/autocomplete.mdx b/website/content/docs/commands/config/autocomplete.mdx deleted file mode 100644 index a7413e6e2..000000000 --- a/website/content/docs/commands/config/autocomplete.mdx +++ /dev/null @@ -1,58 +0,0 @@ ---- -layout: docs -page_title: config autocomplete - Command -description: >- - The "config autocomplete" command installs or uninstalls autocompletion support for Boundary's CLI. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# config autocomplete - -Command: `boundary config autocomplete` - -The `config autocomplete` command lets you install or uninstall autocompletion support -for Boundary's CLI. - - -## Examples - -The following command installs autocompletion support for Boundary's CLI: - -```shell-session -$ boundary config autocomplete install -``` - -The following command uninstalls autocompletion support from Boundary's CLI: - -```shell-session -$ boundary config autocomplete uninstall -``` - -## Usage - -**Install:** - - - -```shell-session -$ boundary config autocomplete install [options] [args] -``` - - - -**Uninstall:** - - - -```shell-session -$ boundary config autocomplete uninstall [options] [args] -``` - - - - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/config/decrypt.mdx b/website/content/docs/commands/config/decrypt.mdx deleted file mode 100644 index f6833673a..000000000 --- a/website/content/docs/commands/config/decrypt.mdx +++ /dev/null @@ -1,70 +0,0 @@ ---- -layout: docs -page_title: config decrypt - Command -description: >- - The "config decrypt" command decrypts sensitive values in configuration files. You must mark sensitive values with {{decrypt()}} as appropriate. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# config decrypt - -Command: `boundary config decrypt` - -The `config decrypt` command decrypts sensitive values in a Boundary -configuration file. You must mark these values with `{{decrypt()}}` as -appropriate, for example: `key = {{decrypt(encrypted_value)}}`. - -## Examples - -The following command overwrites the existing configuration file using the `-overwrite` flag: - -```shell-session -$ boundary config decrypt -overwrite config.hcl -``` - -In order for this command to perform its task, you must define a "kms" block within the configuration file: - -```hcl -kms "aead" { - purpose = "config" - aead_type = "aes-gcm" - key = "7xtkEoS5EXPbgynwd+dDLHopaCqK8cq0Rpep4eooaTs=" -} -``` - -You can define the "kms" block in the configuration file or using the `-config` -flag. If you define it in the configuration file, only string parameters are -supported, and the markers must be inside the quotation marks that delimit the string. -Additionally, if you define the block inline, do not use an "aead" block with -the key defined in the configuration file, as it provides no protection. - -## Usage - - - -```shell-session -$ boundary config decrypt [options] [args] -``` - - - - -### Command options - -- `-config` `(string: "")` - The configuration file to decrypt. - -- `-config-kms` `(string: "")` - If set, the given file is parsed for - a "kms" block with purpose `config` to determine whether it should be used to perform the command. - If you do not configure this value, the command expects a block to be defined inline with the configuration file, and will only be able to support quoted string parameters. - -- `-overwrite` - If set, overwrites the existing file. The default value is - `false`. - -- `-strip` - If set, strips the declarations from the file afterwards. - The default value is `false`. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/config/encrypt.mdx b/website/content/docs/commands/config/encrypt.mdx deleted file mode 100644 index 4aad1334a..000000000 --- a/website/content/docs/commands/config/encrypt.mdx +++ /dev/null @@ -1,71 +0,0 @@ ---- -layout: docs -page_title: config encrypt - Command -description: >- - The "config encrypt" command encrypts sensitive values in configuration files. You must mark sensitive values with {{encrypt()}} as appropriate. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# config encrypt - -Command: `boundary config encrypt` - -The `config encrypt` command encrypts sensitive values in a Boundary -configuration file. You must mark these values with `{{encrypt()}}` as -appropriate, for example: `key = {{encrypt(key_value)}}`. - - -## Examples - -The following command overwrites the existing configuration file use the `-overwrite` flag: - -```shell-session -$ boundary config encrypt -overwrite config.hcl -``` - -In order for this command to perform its task, you must define a "kms" block within a configuration file: - -```hcl -kms "aead" { - purpose = "config" - aead_type = "aes-gcm" - key = "7xtkEoS5EXPbgynwd+dDLHopaCqK8cq0Rpep4eooaTs=" -} -``` - -You can define the "kms" block in the configuration file or using the `-config` -flag. If you define it in the configuration file, only string parameters are -supported, and the markers must be inside the quotation marks that delimit the string. -Additionally, if you define the block inline, do not use an "aead" block with -the key defined in the configuration file as it provides no protection. - -## Usage - - - -```shell-session -$ boundary config encrypt [options] [args] -``` - - - - -### Command options - -- `-config` `(string: "")` - The configuration file to encrypt. - -- `-config-kms` `(string: "")` - If set, the given file is parsed for - a "kms" block with purpose `config` to determine whether it should be used to perform the command. - If you do not configure this value, the command expects a block to be defined inline with the configuration file, and will only be able to support quoted string parameters. - -- `-overwrite` - If set, overwrites the existing file. The default value is - `false`. - -- `-strip` - If set, strips the declarations from the file afterwards. - The default value is `false`. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/config/get-token.mdx b/website/content/docs/commands/config/get-token.mdx deleted file mode 100644 index 3ce025f00..000000000 --- a/website/content/docs/commands/config/get-token.mdx +++ /dev/null @@ -1,97 +0,0 @@ ---- -layout: docs -page_title: config get-token - Command -description: >- - The "config get-token" command fetches a token stored by the Boundary CLI. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# config get-token - -Command: `boundary config get-token` - -The `config get-token` command fetches a token stored by the Boundary CLI. - -## Examples - -The following command gets the token stored by the Boundary CLI: - -```shell-session -$ boundary config get-token -``` - -**Example output:** - - - -```plaintext -at_yczA5UPS7Y_s13B5PWh7KENvtKQKgDxaEvP682FMfq5eXrpzKNTpmaHgLS2ucRexrTQ7ueMhDFY5MdFvNuzuTWzUzYgacitnSBaPo75b3XZU4Zp6wmdsXqmkPNY3U -``` - - - -This command can be useful in various situations. For example, developers could share a line such as the following in a shell script, such that each -developer on their own machine executes the script using their own -Boundary token: - - - -```shell-session -$ curl --header "Authorization: Bearer $(boundary config get-token)" \ - --header "Content-Type: application/json" \ - http://127.0.0.1:9200/v1/roles/r_1234567890 -``` - - - -This command keeps parity with the behavior of other Boundary commands; if you set the -`BOUNDARY_TOKEN` environment variable, it overrides the value loaded -from the system store. Not only does this keep parity, but it also allows -examples such as the one above to work even if there is no stored token, but you specified -an environment variable. - -## Usage - - - -```shell-session -$ boundary config get-token [options] [args] -``` - - - -### Command options - -- `-account-id` - Prints out the account ID - associated with the token instead of the token itself, if specified. The default value is - `false`. - -- `-auth-method-id` - Prints out the auth method ID - associated with the token instead of the token itself, if specified. The default value is `false`. - -- `-keyring-type` `(string: "")` - Indicates the type of keyring to use. This value defaults to - `auto` which uses the Windows credential manager, OSX keychain, or - cross-platform password store depending on the platform. Set this value to `none` to disable - keyring functionality. The following keyring types are available, depending on platform: - - - `wincred` - - `keychain` - - `pass` - - `secret-service` - - You can also specify the keyring type using the **BOUNDARY_KEYRING_TYPE** environment - variable. - -- `-token-name` `(string: "")` - Indicates whether the given value should be used as - the name when loading the token from the system credential store. This value must - correspond to a name used when authenticating. You can also specify the token name using - the **BOUNDARY_TOKEN_NAME** environment variable. - -- `-user-id` - Prints out the user ID associated - with the token instead of the token itself, if specified. The default value is `false`. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/config/index.mdx b/website/content/docs/commands/config/index.mdx deleted file mode 100644 index 7e2263d86..000000000 --- a/website/content/docs/commands/config/index.mdx +++ /dev/null @@ -1,65 +0,0 @@ ---- -layout: docs -page_title: config - Command -description: >- - The "config" command groups subcommands that interact with Boundary's configuration files. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# config - -Command: `boundary config` - -The `config` command groups subcommands for operators to interact with -Boundary's configuration files. - -## Examples - -The following command encrypts sensitive values in a configuration file: - -```shell-session -$ boundary config encrypt config.hcl -``` - -The following command decrypts sensitive values in a configuration file: - -```shell-session -$ boundary config decrypt config.hcl -``` - -The following command reads a stored token's output. - -```shell-session -$ boundary config get-token -``` - - -## Usage - - - -```shell-session -Usage: boundary config [options] [args] - - # ... - -Subcommands: - autocomplete Install or uninstall autocompletion for Boundary's CLI - decrypt Decrypt sensitive values in Boundary's configuration file - encrypt Encrypt sensitive values in Boundary's configuration file - get-token Get the stored token, or its properties -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [autocomplete](/boundary/docs/commands/config/autocomplete) -- [decrypt](/boundary/docs/commands/config/decrypt) -- [encrypt](/boundary/docs/commands/config/encrypt) -- [get-token](/boundary/docs/commands/config/get-token) diff --git a/website/content/docs/commands/connect/cassandra.mdx b/website/content/docs/commands/connect/cassandra.mdx deleted file mode 100644 index e02950eb9..000000000 --- a/website/content/docs/commands/connect/cassandra.mdx +++ /dev/null @@ -1,74 +0,0 @@ ---- -layout: docs -page_title: connect cassandra - Command -description: >- - The "connect cassandra" command performs a target authorization or consumes an existing authorization token, and then launches a proxied Cassandra (CQL) connection. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# connect cassandra - -Command: `boundary connect cassandra` -The `connect cassandra` command authorizes a session against a target and invokes a Cassandra client for the connection. -The command fills in the local address and port. - -> **Note:** Currently, only configurations using Cassandra's `PasswordAuthenticator` are supported. - -@include 'cmd-connect-env-vars.mdx' - - -## Examples - -The following example shows how to connect to a target with the ID `ttcp_eTcZMueUYv` using a Cassandra helper: - -```shell-session -$ boundary connect cassandra -target-id=ttcp_eTcZMueUYv \ - -keyspace=mykeyspace \ - -username=superuser -``` - -When prompted, you must enter the password for the user, "superuser": - - - -```plaintext -Password: -Connected to example-cluster at localhost:9042 -[cqlsh 6.2.0 | Cassandra 5.0.4 | CQL spec 3.4.7 | Native protocol v5] -Use HELP for help. -superuser@cqlsh:mykeyspace> -``` - - - -## Usage - - - -```shell-session -$ boundary connect cassandra [options] [args] -``` - - - -@include 'cmd-connect-command-options.mdx' - -### Cassandra options: - -- `-keyspace` `(string: "")` - The keyspace name you want to pass through to the client. -You can also specify the keyspace name using the **BOUNDARY_CONNECT_KEYSPACE** environment variable. - -- `-style` `(string: "")` - How the CLI attempts to invoke a Cassandra client. -This value also sets a suitable default for `-exec`, if you did not specify a value. -The default and currently-understood value is `cqlsh`. -You can also specify how the CLI attempts to invoke a Cassandra client using the **BOUNDARY_CONNECT_CASSANDRA_STYLE** environment variable. - -- `-username` `(string: "")` - The username you want to pass through to the client. -This value may be overridden by credentials sourced from a credential store. -You can also specify a username using the **BOUNDARY_CONNECT_USERNAME** environment variable. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/connect/http.mdx b/website/content/docs/commands/connect/http.mdx deleted file mode 100644 index cbe4d996d..000000000 --- a/website/content/docs/commands/connect/http.mdx +++ /dev/null @@ -1,69 +0,0 @@ ---- -layout: docs -page_title: connect http - Command -description: >- - The "connect http" command command performs a target authorization or consumes an existing authorization token, and then launches a proxied http connection. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# connect http - -Command: `boundary connect http` - -The `connect http` command authorizes a session against a target and invokes an -HTTP client for the connection. -The command fills in the local address and port. - -@include 'cmd-connect-env-vars.mdx' - -## Example - -The following example authorizes a session to a target with the ID `ttcp_1234567890` and invokes the default HTTP client, `curl`: - -```shell-session -$ boundary connect http -target-id=ttcp_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary connect http [options] [args] -``` - - - -This command performs a target authorization or consumes an existing authorization token, and launches a proxied HTTP connection. - -@include 'cmd-connect-command-options.mdx' - -### HTTP options: - -- `-host` `(string: "")` - The host value to use. - This setting overrides the endpoint address from the session information. - Boundary passes the specified host name through to the client for use in the host header and TLS SNI value, if supported. - You can also specify the host value using the **BOUNDARY_CONNECT_HTTP_HOST** environment variable. - -- `-method` `(string: "")` - The HTTP method to use. -If you don't set a method, Boundary uses the client's default. -You can also specify a method using a the **BOUNDARY_CONNECT_HTTP_METHOD** environment variable. - -- `-path` `(string: "")` - The path that is appended to the - generated URL. - You can also specify a path using the **BOUNDARY_CONNECT_HTTP_PATH** environment variable. - -- `-scheme` `(string: "")` - The scheme to use. -The default scheme is `https`. -You can also specify the scheme using the **BOUNDARY_CONNECT_HTTP_SCHEME** environment variable. - -- `-style` `(string: "")` - How the CLI attempts to invoke an HTTP client. -This value also sets a suitable default for `-exec`, if you did not specify a value. -The default and currently-understood value is `curl`. -You can also specify how the CLI attempts to invoke the HTTP client using the **BOUNDARY_CONNECT_HTTP_STYLE** environment variable. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/connect/index.mdx b/website/content/docs/commands/connect/index.mdx deleted file mode 100644 index e19675015..000000000 --- a/website/content/docs/commands/connect/index.mdx +++ /dev/null @@ -1,104 +0,0 @@ ---- -layout: docs -page_title: connect - Command -description: >- - The "connect" command authorizes a target resource and launches a proxied connection. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# connect - -Command: `boundary connect` - -Every command that results in an API call contains a set of flags that control connection options, which include TLS and other settings. -Boundary provides connect helpers that can facilitate access to certain protocols like HTTP, RDP, and SSH. -One example is the Boundary helper for SSH that automatically accepts host SSH key prompts for you. -You run these connect helpers using the command `boundary connect `. -You can run `boundary connect -h` to see the available helpers, options, and arguments. - -## Examples - -The following example connects to a target `ttcP_INY0BCD2VF` and shows the use of the -[`-listen-addr`](/boundary/docs/commands//connect#-listen-port) and -[`-listen-port`](/boundary/docs/commands//connect#-listen-addr) flags -to specify the listening address and port used that Boundary will attempt to use -for every connection. This example uses the address `127.0.0.1` and -the port `8872`: - -```shell-session -$ boundary connect ssh \ - -listen-addr=127.0.0.1 \ - -listen-port=8872 - -target_id=ttcp_INY0BCD2VF -``` - -## Usage - - - -```text -Usage: boundary connect [options] [args] - # ... -Subcommands: - http Authorize a session against a target and invoke an HTTP client to connect - kube Authorize a session against a target and invoke a Kubernetes client to connect - cassandra Authorize a session against a target and invoke a Cassandra client to connect - mysql Authorize a session against a target and invoke a MySQL client to connect - mongo Authorize a session against a target and invoke a MongoDB client to connect - postgres Authorize a session against a target and invoke a Postgres client to connect - rdp Authorize a session against a target and invoke an RDP client to connect - redis Authorize a session against a target and invoke a redis client to connect - ssh Authorize a session against a target and invoke an SSH client to connect -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [http](/boundary/docs/commands/connect/http) -- [kube](/boundary/docs/commands/connect/kube) -- [cassandra](/boundary/docs/commands/connect/cassandra) -- [mysql](/boundary/docs/commands/connect/mysql) -- [mongo](/boundary/docs/commands/connect/mongo) -- [postgres](/boundary/docs/commands/connect/postgres) -- [rdp](/boundary/docs/commands/connect/rdp) -- [redis] (/boundary/docs/commands/connect/redis) -- [ssh](/boundary/docs/commands/connect/ssh) - -### Command options - -- `-addr` `(string: "")` - The address of the Boundary controller as a complete URL, for example https://boundary.example.com:9200. - Instead of passing the `-addr` argument with every command, you can configure the **BOUNDARY_ADDR** environment variable. - In both cases, the value denotes the address of the Boundary environment you want to send CLI commands to. -- `-ca-cert` `(string: "")` - The path on the local disk to a single PEM-encoded CA certificate that should be used to verify the controller or worker server's SSL certificate. - This value takes precedence over `-ca-path`. - You can also specify the path using the **BOUNDARY_CACERT** environment variable. -- `-ca-path` `(string: "")` - The path on the local disk to a directory of PEM-encoded CA certificates that should be used to verify the controller's SSL certificate. - You can also specify the path using the **BOUNDARY_CAPATH** environment variable. -- `-client-cert` `(string: "")` - The path on the local disk to a single PEM-encoded CA certificate that should be used for TLS authentication to the Boundary controller. - If you configure this flag, the `-client-key` value is also required. - You can also specify the path using the **BOUNDARY_CLIENT_CERT** environment variable. -- `-client-key` `(string: "")` - The path on the local disk to a single PEM-encoded private key that matches the client certificate you referenced with `-client-cert`. - You can also specify the path using the **BOUNDARY_CLIENT_KEY** environment variable. -- `-listen-addr` `(string: "")` - If set, the CLI attempts to bind its listening address to the given value, which must be an IP address. - If it cannot bind the listening address, the command produces an error. - If you do not set this value, Boundary defaults to the most common IPv4 loopback address, 127.0.0.1. - You can also specify a listening address using the **BOUNDARY_CONNECT_LISTEN_ADDR** environment variable. -- `-listen-port` `(string: "")` - If set, the CLI attempts to bind its listening port to the given value. - If it cannot bind the listening port, the command produces error. - You can also specify a listening address using the **BOUNDARY_CONNECT_LISTEN_PORT** environment variable. -- `-tls-insecure` - If set, this option disables verification of TLS certificates. - We highly discourage using this option as it decreases the security of data transmissions to - and from the Boundary server. - The default value is `false`. - You can also disable TLS certificate validation using the **BOUNDARY_TLS_INSECURE** environment variable. -- `-tls-server-name` `(string: "")` - A name to use as the SNI host when you connect to the Boundary server using TLS. - You can also specify the SNI host using the **BOUNDARY_TLS_SERVER_NAME** environment variable. - - -@include 'cmd-connect-command-options.mdx' diff --git a/website/content/docs/commands/connect/kube.mdx b/website/content/docs/commands/connect/kube.mdx deleted file mode 100644 index 15ea8f3a6..000000000 --- a/website/content/docs/commands/connect/kube.mdx +++ /dev/null @@ -1,63 +0,0 @@ ---- -layout: docs -page_title: connect kube - Command -description: >- - The "connect kube" command command performs a target authorization or consumes an existing authorization token, and then launches a proxied kube connection. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# connect kube - -Command: `boundary connect kube` - -The `connect kube` command authorizes a session against a target and invokes a -Kubernetes client for the connection. -The command fills in the local address and port. - -@include 'cmd-connect-env-vars.mdx' - -## Examples - -The following example authorizes a session to a target with the ID `ttcp_1234567890` and runs the `get nodes` command using the default `kubectl` client: - -```shell-session -$ boundary connect kube \ - -target-id ttcp_t12345 \ - -- get nodes -``` - -## Usage - - - -```shell-session -$ boundary connect kube [options] [args] -``` - - - -This command performs a target authorization or consumes an existing authorization token, and launches a proxied Kube connection. - -@include 'cmd-connect-command-options.mdx' - -### Kubernetes options: - -- `-host` `(string: "")` - The host value to use. - If set, this value overrides the endpoint address from the session information. - Boundary passes the specified host name through to the client for use in the TLS SNI value, if supported. - You can also specify the host value using the **BOUNDARY_CONNECT_KUBE_HOST** environment variable. - -- `-scheme` `(string: "")` - The scheme to use. -The default value is `https`. -You can also specify the scheme using the **BOUNDARY_CONNECT_KUBE_SCHEME** environment variable. - -- `-style` `(string: "")` - How the CLI attempts to invoke a Kubernetes client. -This value also sets a suitable default for `-exec`, if you did not specify a value. -The default and currently-understood value is `kubectl`. -You can also specify how the CLI attempts to invoke a Kubernetes client using the `BOUNDARY_CONNECT_KUBE_STYLE` environment variable. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/connect/mongo.mdx b/website/content/docs/commands/connect/mongo.mdx deleted file mode 100644 index e29202b72..000000000 --- a/website/content/docs/commands/connect/mongo.mdx +++ /dev/null @@ -1,90 +0,0 @@ ---- -layout: docs -page_title: connect mongo - Command -description: >- - The "connect mongo" command performs a target authorization or consumes an existing authorization token, and then launches a proxied MongoDB connection. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# connect mongo - -Command: `boundary connect mongo` - -The `connect mongo` command authorizes a session against a target and invokes a MongoDB client for the connection. -The command fills in the local address and port. - -@include 'cmd-connect-env-vars.mdx' - - -## Examples - -The following example shows how to connect to a target with the ID `ttcp_eTcMueUYv` using a MongoDB helper: - -```shell-session -$ boundary connect mongo -target-id=ttcp_eTcZMueUYv \ - -dbname=northwind \ - -username=superuser \ - -authentication-database=admin \ - -format=table -``` - -When prompted, you must enter the password for the user, "superuser": - - - -```plaintext -Enter password: -Current Mongosh Log ID: 64a1b2c3d4e5f6789012345 -Connecting to: mongodb://127.0.0.1:12345/northwind?authSource=admin -Using MongoDB: 7.0.0 -Using Mongosh: 2.0.0 - -northwind> show collections -orders -products -customers - -northwind> db.products.count() -77 - -northwind> -``` - - - -## Usage - - - -```shell-session -$ boundary connect mongo [options] [args] -``` - - - -@include 'cmd-connect-command-options.mdx' - -### MongoDB options: - -- `-dbname` `(string: "")` - The database name you want to pass through to the client. -You can also specify the database name using the **BOUNDARY_CONNECT_DBNAME** environment variable. - -- `-style` `(string: "mongosh")` - How the CLI attempts to invoke a MongoDB client. -This value also sets a suitable default for `-exec`, if you did not specify a value. -The default and currently-understood value is `mongosh`. -You can also specify how the CLI attempts to invoke a MongoDB client using the **BOUNDARY_CONNECT_MONGO_STYLE** environment variable. - -- `-username` `(string: "")` - The username you want to pass through to the client. -This value may be overridden by credentials sourced from a credential store. -You can also specify a username using the **BOUNDARY_CONNECT_USERNAME** environment variable. - -- `-authentication-database` `(string: "")` - The authentication database for MongoDB. -If omitted, mongosh defaults `authSource` to the database name (`-dbname`). If no database is specified, it defaults to `admin`. -You can also specify the authentication database using the **BOUNDARY_CONNECT_MONGO_AUTHENTICATION_DATABASE** environment variable. - - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/connect/mysql.mdx b/website/content/docs/commands/connect/mysql.mdx deleted file mode 100644 index 0620f6505..000000000 --- a/website/content/docs/commands/connect/mysql.mdx +++ /dev/null @@ -1,79 +0,0 @@ ---- -layout: docs -page_title: connect mysql - Command -description: >- - The "connect mysql" command performs a target authorization or consumes an existing authorization token, and then launches a proxied MySQL connection. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# connect mysql - -Command: `boundary connect mysql` - -The `connect mysql` command authorizes a session against a target and invokes a MySQL client for the connection. -The command fills in the local address and port. - -@include 'cmd-connect-env-vars.mdx' - - -## Examples - -The following example shows how to connect to a target with the ID `ttcp_eTcMueUYv` using a MySQL helper: - -```shell-session -$ boundary connect mysql -target-id=ttcp_eTcZMueUYv \ - -dbname=northwind \ - -username=superuser \ - -format=table -``` - -When prompted, you must enter the password for the user, "superuser": - - - -```plaintext -Enter password: -Welcome to the MySQL monitor. Commands end with ; or \g. -Your MySQL connection id is 8 -Server version: 8.0.30 MySQL Community Server - GPL - -Copyright (c) 2000, 2022, Oracle and/or its affiliates. - -Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. - -mysql> -``` - - - -## Usage - - - -```shell-session -$ boundary connect mysql [options] [args] -``` - - - -@include 'cmd-connect-command-options.mdx' - -### MySQL options: - -- `-dbname` `(string: "")` - The database name you want to pass through to the client. -You can also specify the database name using the **BOUNDARY_CONNECT_DBNAME** environment variable. - -- `-style` `(string: "")` - How the CLI attempts to invoke a MySQL client. -This value also sets a suitable default for `-exec`, if you did not specify a value. -The default and currently-understood value is `mysql`. -You can also specify how the CLI attempts to invoke a MySQL client using the **BOUNDARY_CONNECT_MYSQL_STYLE** environment variable. - -- `-username` `(string: "")` - The username you want to pass through to the client. -This value may be overridden by credentials sourced from a credential store. -You can also specfiy a username using the **BOUNDARY_CONNECT_USERNAME** environment variable. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/connect/postgres.mdx b/website/content/docs/commands/connect/postgres.mdx deleted file mode 100644 index 4e7117f57..000000000 --- a/website/content/docs/commands/connect/postgres.mdx +++ /dev/null @@ -1,74 +0,0 @@ ---- -layout: docs -page_title: connect postgres - Command -description: >- - The "connect postgres" command performs a target authorization or consumes an existing authorization token, and then launches a proxied PostgreSQL connection. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# connect postgres - -Command: `boundary connect postgres` - -The `connect postgres` command authorizes a session against a target and invokes a Postgres client for the connection. -The command fills in the local address and port. - -@include 'cmd-connect-env-vars.mdx' - - -## Examples - -The following example shows how to connect to a target with the ID `ttcp_eTcMueUYv` using a Postgres helper: - -```shell-session -$ boundary connect postgres -target-id=ttcp_eTcZMueUYv \ - -dbname=northwind \ - -username=superuser \ - -format=table -``` - -When prompted, you must enter the password for the user, "superuser": - - - -```plaintext -Password for user superuser: -psql (14.2, server 13.2 (Debian 13.2-1.pgdg100+1)) -Type "help" for help. - -postgres=# -``` - - - -## Usage - - - -```shell-session -$ boundary connect postgres [options] [args] -``` - - - -@include 'cmd-connect-command-options.mdx' - -### Postgres options: - -- `-dbname` `(string: "")` - The database name you want to pass through to the client. -You can also specify the database name using the **BOUNDARY_CONNECT_DBNAME** environment variable. - -- `-style` `(string: "")` - How the CLI attempts to invoke a Postgres client. -This value also sets a suitable default for `-exec`, if you did not specify a value. -The default and currently-understood value is `psql`. -You can also specify how the CLI attempts to invoke a Postgres client using the **BOUNDARY_CONNECT_POSTGRES_STYLE** environment variable. - -- `-username` `(string: "")` - The username you want to pass through to the client. -This value may be overridden by credentials sourced from a credential store. -You can also specfiy a username using the **BOUNDARY_CONNECT_USERNAME** environment variable. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/connect/rdp.mdx b/website/content/docs/commands/connect/rdp.mdx deleted file mode 100644 index 646c8be23..000000000 --- a/website/content/docs/commands/connect/rdp.mdx +++ /dev/null @@ -1,62 +0,0 @@ ---- -layout: docs -page_title: connect rdp - Command -description: >- - The "connect rdp" command command performs a target authorization or consumes an existing authorization token, and then launches a proxied RDP connection. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# connect rdp - -Command: `boundary connect rdp` - -The `connect rdp` command authorizes a session against a target and invokes an RDP client for the connection. -The command fills in the local address and port. - -@include 'cmd-connect-env-vars.mdx' - -## Examples - -The following example authorizes a session to a target with the ID `ttcp_1234567890` and invokes an RDP session with the built-in Windows RDP client, `mstsc`: - -```shell-session -$ boundary connect rdp \ - -target-id ttcp_1234567890 -``` - -The following example authorizes a session to a target with the ID `ttcp_123457890` and invokes a custom command for the RDP macOS client: - -```shell-session -$ boundary connect rdp \ - -target-id ttcp_1234567890 - -exec bash \ - -- -c "open rdp://full%20address=s={{boundary.addr}} && sleep 600" -``` - -## Usage - - - -```shell-session -$ boundary connect rdp [options] [args] -``` - - - -This command performs a target authorization or consumes an existing authorization token, and launches a proxied RDP connection. - -@include 'cmd-connect-command-options.mdx' - -### RDP options: - -- `-style` `(string: "")` - How the CLI attempts to invoke an RDP client. -This value also sets a suitable default for `-exec`, if you did not specify a value. -The currently-understood value is `mstsc`, which is the default on Windows and launches the Windows client. -It is also the default on Mac, and launches an rdp://URL. -You can also specify how the CLI attempts to invoke an RDP client using the **BOUNDARY_CONNECT_RDP_STYLE** environment variable. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/connect/redis.mdx b/website/content/docs/commands/connect/redis.mdx deleted file mode 100644 index e65c303c5..000000000 --- a/website/content/docs/commands/connect/redis.mdx +++ /dev/null @@ -1,66 +0,0 @@ ---- -layout: docs -page_title: connect redis - Command -description: >- - The "connect redis" command performs a target authorization or consumes an existing authorization token, and then launches a proxied redis (redis-cli) connection. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# connect redis - -Command: `boundary connect redis` -The `connect redis` command authorizes a session against a target and invokes a Redis client for the connection. -The command fills in the local address and port. - -@include 'cmd-connect-env-vars.mdx' - - -## Examples - -The following example shows how to connect to a target with the ID `ttcp_eTcZMueUYv` using a Redis helper: - -```shell-session -$ boundary connect redis -target-id=ttcp_eTcZMueUYv \ - -username=superuser -``` - -When prompted, you must enter the password for the user, "superuser": - - - - -```plaintext -Please input password: -127.0.0.1:60835> -``` - - - -## Usage - - - -```shell-session -$ boundary connect redis [options] [args] -``` - - - -@include 'cmd-connect-command-options.mdx' - -### Redis options: - -- `-style` `(string: "")` - How the CLI attempts to invoke a Redis client. -This value also sets a suitable default for `-exec`, if you did not specify a value. -The default and currently-understood value is `redis-cli`. -You can also specify how the CLI attempts to invoke a Redis client using the **BOUNDARY_CONNECT_REDIS_STYLE** environment variable. - -- `-username` `(string: "")` - The username you want to pass through to the client. -This value may be overridden by credentials sourced from a credential store. -You can also specify a username using the **BOUNDARY_CONNECT_USERNAME** environment variable. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/connect/ssh.mdx b/website/content/docs/commands/connect/ssh.mdx deleted file mode 100644 index 30b9e00ad..000000000 --- a/website/content/docs/commands/connect/ssh.mdx +++ /dev/null @@ -1,99 +0,0 @@ ---- -layout: docs -page_title: connect ssh - Command -description: >- - The "connect ssh" command command performs a target authorization or consumes an existing authorization token, and then launches a proxied SSH connection. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# connect ssh - -Command: `boundary connect ssh` - -The `connect ssh` command authorizes a session against a target and invokes an SSH client for the connection. -The command fills in the local address and port. -You can specify your SSH client of choice using the `-style` option. - -@include 'cmd-connect-env-vars.mdx' - -The SSH helper command sets the host key `Alias`. -When an `Alias` is set, SSH does not use `localhost:` for host key validation, but instead uses one of the following: - -- For connections to a target that has an attached host set, the SSH helper command sets the `HostID` as the alias. -- For connections directly to a host, the SSH helper command sets the `HostID` as the alias. -- For connections to a target that has an address field configured, the SSH helper command sets the `TargetID` as the alias. - -## Examples - -The following example authorizes a session to a target with the ID `ttcp_eTcZMueUYv` and invokes the default SSH client without any additional options: - - - -```shell-session -$ boundary connect ssh -target-id ttcp_eTcZMueUYv -``` - - - -The following example authorizes a session to a target with the ID `ttcp_eTcZMueUYv`, and pipes arguments directly to the invoked SSH binary. -Any SSH arguments after the double hyphen are sent directly to the binary: - - - -```shell-session -$ boundary connect ssh -target-id ttcp_eTcZMueUYv -- -A -``` - - - - - -```shell-session -$ boundary connect ssh -target-scope-name Helpdesk -target-name ubuntu-server -- -A -``` - - - - - -```shell-session -$ boundary connect ssh -target-id=ttcp_Gymo7Vcq7Y \ - -host-id=hst_FrdNPd9Zm9 -- -l ubuntu -i private_key.pem -``` - - - -## Usage - - - -```shell-session -$ boundary connect ssh [options] [args] -``` - - - -This command performs a target authorization or consumes an existing authorization token, and launches a proxied SSH connection. - -@include 'cmd-connect-command-options.mdx' - -### SSH options: - -- `style` `(string: "")` - How the CLI attempts to invoke an SSH - client. - This value also sets a suitable default for `-exec`, if you did not specify a value. - Currently understood values are `ssh` and `putty`. - The default is `ssh`. - You can also specify how the CLI attempts to invoke the SSH client using the **BOUNDARY_CONNECT_SSH_STYLE** environment variable. - -- `username` `(string: "")` - The username you want to pass through to the - client. - You can also specify a username using the **BOUNDARY_CONNECT_USERNAME** environment variable. - -- `remote-command` `(string: "")` - A command that you want to run on the remote host. -You can specify a complete command line, or you may include additional arguments. -If you include additional arguments, you must append them to the command and separate them using spaces. diff --git a/website/content/docs/commands/credential-libraries/create.mdx b/website/content/docs/commands/credential-libraries/create.mdx deleted file mode 100644 index df9b96050..000000000 --- a/website/content/docs/commands/credential-libraries/create.mdx +++ /dev/null @@ -1,202 +0,0 @@ ---- -layout: docs -page_title: credential-libraries create - Command -description: >- - The "credential-libraries create" command creates new credential library resources. You can create a generic Vault or Vault SSH certificate credential library. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# credential-libraries create - -Command: `boundary credential-libraries create` - -The `credential-libraries create` command lets you create a credential library resource in Boundary. - -## Examples - -The following example creates a credential library for database credentials where Vault's database secrets engine provides dynamic credentials: - -```shell-session -$ boundary credential-libraries create vault-generic \ - -credential-store-id csvlt_5fvkRjCjou \ - -vault-path "database/creds/dba" \ - -name "northwind dba" -``` - -**Example output:** - - - -```plaintext -Credential Library information: - Created Time: Wed, 28 Sep 2022 08:50:32 MDT - Credential Store ID: csvlt_Xqa6V6QwfM - ID: clvlt_Ex17uiP7FO - Name: northwind dba - Type: vault - Updated Time: Wed, 28 Sep 2022 08:50:32 MDT - Version: 1 - - Scope: - ID: p_EZaXO0OZPX - Name: db-project - Parent Scope ID: o_R1QFYcO743 - Type: project - - Authorized Actions: - no-op - read - update - delete - - Attributes: - HTTP Method: GET - Path: database/creds/dba -``` - - - - -## Usage - - - -```shell-session -$ boundary credential-libraries create [type] [sub command] [options] [args] -``` - - - -### Command options - -- `-credential-store-id` `(string: "")` - The credential store resource to use - for the operation. You can also specify the credential store using the - **BOUNDARY_CREDENTIAL_STORE_ID** environment variable. -- `-description` `(string: "")` - A description of the credential library. -- `-name` `(string: "")` - The name of the credential library. - - -### Usages by type - -The available types are `vault-generic` and `vault-ssh-certificate`. - - - -A credential library type, `vault` is deprecated, so use `vault-generic` type instead. - - - - - - - -The `credential-libraries create vault-generic` command lets you create a generic Vault credential library. - -#### Example - -The following example creates a generic Vault credential library using a credential store with the ID `csvlt_1234567890`: - -```shell-session -$ boundary credential-libraries create vault-generic \ - -credential-store-id csvlt_1234567890 \ - -vault-path "database/creds/dba" -``` - -#### Usage - - - -```shell-session -$ boundary credential-libraries create vault-generic [options] [args] -``` - - - -#### Vault credential library options - -The following are specific Vault credential library options in addition to the command options: - -- `-credential-mapping-override` - An override for credential mapping. -- `-credential-type` `(string: "")` - The type of credential this library issues. -The default value is `Unspecified`. -- `-vault-http-method` `(string: "")` - The HTTP method the library should use when it communicates with Vault. -- `-vault-http-request-body` `(string: "")` - The HTTP request body the credential library uses to communicate with Vault. -This value can be the HTTP request body value itself, it can refer to a file on disk (`file://`) from which the value is read, or it can refer to an environment variable (`env://`) from which the value is read. -- `-vault-path` `(string: "")` - The path in Vault to request credentials from. - - - - - -The `credential-libraries create vault-ssh-certificate` command lets you create a Vault SSH certificate credential library. - -#### Example - -The following example creates a Vault SSH certificate credential library with the ID `csvlt_1234567890`: - -```shell-session -$ boundary credential-libraries create vault-ssh-certificate \ - -credential-store-id csvlt_1234567890 \ - -vault-path "/ssh/sign/role" \ - -username user -``` - -#### Usage - - - -```shell-session -$ boundary credential-libraries create vault-ssh-certificate [options] [args] -``` - - - -#### Vault SSH certificate credential library options - -The following are options are specific to the Vault SSH certificate credential library, in addition to the command options: - -- `-additional-valid-principal` - Any additional users or groups that you want to configure as valid principals. -By default, Boundary only passes the username to Vault to sign as a valid principal. -Use this option when you want to configure additional users or groups as valid principals that the certificate should be signed for in Vault. - - For more information, refer to OpenSSH's definition of [valid principals](https://github.com/openssh/openssh-portable/blob/5f93c4836527d9fda05de8944a1c7b4a205080c7/PROTOCOL.certkeys#L176-L181) and Vault's [SSH secrets engine](https://developer.hashicorp.com/vault/api-docs/secret/ssh#valid_principals) documentation. -- `-critical-option` - A key=value pair to add to the request's - critical-options map. - It can also be a key value only which sets a JSON null as the value. - If you provide a value, Boundary infers the type automatically. - You can use `-string-critical-option`, `-bool-critical-option`, or `-num-critical-option` to override the type. - You can specify values for this option multiple times. - This option supports sourcing values from files using `file://` and environment variables using `env://`. -- `-critical-options` `(string: "")` - A JSON map value to use as the entirety of the request's critical-options map. -Usually this value is sourced from a file using the `file://` syntax. -This value is exclusive with the other critical-option flags. -- `-extension` - A key=value pair to add to the request's extensions map. -It can also be a key value only which will set a JSON null as the value. -If you provide a value, Boundary automatically infers the type. -You can use `-string-extension`, `-bool-extension`, or `-num-extension` to override the type. -You can specify values for this option multiple times. -This option supports sourcing values from files using `file://` and environment variables using `env://`. -- `-extensions` `(string: "")` - A JSON map value to use as the entirety of - the request's extensions map. - Usually this value is sourced from a file using the `file://` syntax. - This option is exclusive with the other extension flags. -- `-key-bits` `(string: "")` - The number of bits to use when the SSH private key is generated. -The value depends on the `key_type`. -If you use a `ed25519` key, you should not set a value or set the value to `0`. -If you use a `ecdsa` key, you should set the value to `256`, `384`, or `521`. -If you use an `rsa` key, you should set the value to `2048`, `3072`, or `4096`. -- `-key-id` `(string: "")` - Specifies the created certificate's key id. -- `-key-type` `(string: "")` - Specifies the key type for the generated ssh private key. -Supported values include `ed25519`, `ecdsa`, and `rsa`. -- `-ttl` `(string: "")` - The generated certificate's time-to-live. -- `-username` `(string: "")` - The username to use with the SSH certificate. -- `-vault-path` `(string: "")` - The path in Vault to request credentials from. - - - - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/credential-libraries/delete.mdx b/website/content/docs/commands/credential-libraries/delete.mdx deleted file mode 100644 index 53bd56d1d..000000000 --- a/website/content/docs/commands/credential-libraries/delete.mdx +++ /dev/null @@ -1,42 +0,0 @@ ---- -layout: docs -page_title: credential-libraries delete - Command -description: >- - The "credential-libraries delete" command deletes an existing credential library resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# credential-libraries delete - -Command: `boundary credential-libraries delete` - -The `credential-libraries delete` command lets you delete an existing credential library resource. - -## Example - -The following example deletes a credential library with the ID `csvlt_5fvkRjCjou`: - -```shell-session -$ boundary credential-libraries delete -id csvlt_5fvkRjCjou -``` - -## Usage - - - -```shell-session -$ boundary credential-libraries delete [options] [args] -``` - - - - -### Command options - -- `-id` `(string: "")` - The ID of the credential library to delete. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/credential-libraries/index.mdx b/website/content/docs/commands/credential-libraries/index.mdx deleted file mode 100644 index 410858084..000000000 --- a/website/content/docs/commands/credential-libraries/index.mdx +++ /dev/null @@ -1,94 +0,0 @@ ---- -layout: docs -page_title: credential-libraries - Command -description: >- - The "credential-libraries" command performs operations on credential library resources. Credential libraries provide credentials of the same type and access level. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# credential-libraries - -Command: `boundary credential-libraries` - -The `credential-libraries` command lets you perform operations on Boundary credential library resources. -A credential library provides credentials for sessions. -All credentials returned by a library must be equivalent from an access control perspective. - -A credential library is responsible for managing the lifecycle of the credentials it returns. -For dynamic secrets, this includes creation, renewal, and revocation. -For rotating credentials, this includes check-out, check-in, and rotation of secrets. -The system retrieves credentials from a library for a session and notifies the library when the session has been terminated. -A credential library belongs to a single credential store. - -## Examples - -The following example retrieves information for a credential library with the ID, `clvlt_QYnQPAjA24`: - -```shell-session -$ boundary credential-libraries read -id clvlt_QYnQPAjA24 -``` - -**Example output:** - - - -```plaintext -Credential Library information: - Created Time: Fri, 18 Aug 2023 16:22:29 PDT - Credential Store ID: csvlt_5fvkRjCjou - ID: clvlt_QYnQPAjA24 - Name: northwind dba - Type: vault-generic - Updated Time: Fri, 18 Aug 2023 16:22:29 PDT - Version: 1 - - Scope: - ID: p_tnqESc86qE - Name: db-project - Parent Scope ID: o_4VUR6ZATqW - Type: project - - Authorized Actions: - no-op - read - update - delete - - Attributes: - HTTP Method: GET - Path: database/creds/dba -``` - - - -## Usage - - - -```shell-session -Usage: boundary credential-libraries [sub command] [options] [args] - - # ... - -Subcommands: - create Create a credential library - delete Delete a credential library - list List a credential library - read Read a credential library - update Update a credential library -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [create](/boundary/docs/commands/credential-libraries/create) -- [delete](/boundary/docs/commands/credential-libraries/delete) -- [list](/boundary/docs/commands/credential-libraries/list) -- [read](/boundary/docs/commands/credential-libraries/read) -- [update](/boundary/docs/commands/credential-libraries/update) diff --git a/website/content/docs/commands/credential-libraries/list.mdx b/website/content/docs/commands/credential-libraries/list.mdx deleted file mode 100644 index ad14b9ee9..000000000 --- a/website/content/docs/commands/credential-libraries/list.mdx +++ /dev/null @@ -1,73 +0,0 @@ ---- -layout: docs -page_title: credential-libraries list - Command -description: >- - The "credential-libraries list" command lists the available credential library resources within an enclosing scope or resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# credential-libraries list - -Command: `boundary credential-libraries list` - -The `credential-libraries list` command lists credential libraries within an enclosing scope or resource. - -## Examples - -The following example lists all credential libraries for a credential store with the ID `clvlt_QYnQPAjA24`: - -```shell-session -$ boundary credential-libraries list \ - -credential-store-id -``` - -**Example output:** - - - -```plaintext -Credential Library information: - ID: clvlt_QYnQPAjA24 - Version: 1 - Type: vault-generic - Name: northwind dba - Authorized Actions: - no-op - read - update - delete -``` - - - -## Usage - - - -```shell-session -$ boundary credential-libraries list [options] [args] -``` - - - - -### Command options - -- `-credential-store-id` `(string: "")` - The credential store resource to list credential libraries for. -You can also specify the credential store using the **BOUNDARY_CREDENTIAL_STORE_ID** environment variable. -- `-filter` `(string: "")` - If set, Boundary filters the list operation before the results are returned. -The filter operates against each item in the list. -We recommend that you use single quotes, because the filters contain double quotes. -Refer to the [Filtering and listing resources documentation](/boundary/docs/filtering) for more details. -- `list_token` (optional) - An opaque token that is returned from the previous `list` response. -If you do not supply a value, pagination starts from the beginning. -- `page_size` (optional) - An unsigned integer that indicates the number of items that should be included on the page of search results. -If you do not provide a value, or if you provide a value of `0`, Boundary uses the default page size of 1000 items. -If you configure it, the `page_size` value overrides the default page size. -Controller administrators can also configure a `max_page_size` option that constrains the maximum page size a user can request. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/credential-libraries/read.mdx b/website/content/docs/commands/credential-libraries/read.mdx deleted file mode 100644 index cdaabe174..000000000 --- a/website/content/docs/commands/credential-libraries/read.mdx +++ /dev/null @@ -1,76 +0,0 @@ ---- -layout: docs -page_title: credential-libraries read - Command -description: >- - The "credential-libraries read" command retrieves the details of a credential library. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# credential-libraries read - -Command: `boundary credential-libraries read` - -The `credential-libraries read` command reads the credential library information for a specific credential library ID. - - -## Examples - -The following example retrieves credential library information for a credential library with the ID `clvlt_QYnQPAjA24`: - -```shell-session -$ boundary credential-libraries read -id clvlt_QYnQPAjA24 -``` - -**Example output:** - - - -```plaintext -Credential Library information: - Created Time: Fri, 18 Aug 2023 16:22:29 PDT - Credential Store ID: csvlt_5fvkRjCjou - ID: clvlt_QYnQPAjA24 - Name: northwind dba - Type: vault-generic - Updated Time: Fri, 18 Aug 2023 16:22:29 PDT - Version: 1 - - Scope: - ID: p_tnqESc86qE - Name: db-project - Parent Scope ID: o_4VUR6ZATqW - Type: project - - Authorized Actions: - no-op - read - update - delete - - Attributes: - HTTP Method: GET - Path: database/creds/dba -``` - - - -## Usage - - - -```shell-session -$ boundary credential-libraries read [options] [args] -``` - - - - -### Command options - -- `-id` `(string: "")` - The ID of the credential library from which to read information. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/credential-libraries/update.mdx b/website/content/docs/commands/credential-libraries/update.mdx deleted file mode 100644 index 6766da9b1..000000000 --- a/website/content/docs/commands/credential-libraries/update.mdx +++ /dev/null @@ -1,200 +0,0 @@ ---- -layout: doc -page_title: credential-libraries update - Command -description: >- - The "credential-libraries update" command updates an existing credential library resource with new information. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# credential-libraries update - -Command: `boundary credential-libraries update` - -The `credential-libraries update` command lets you update Boundary credential library resources. - -## Examples - -The following example updates an existing Vault credential library with the ID `csvlt_5fvkRjCjou` to point to a new Vault secrets engine path: - -```shell-session -$ boundary credential-libraries update vault-generic \ - -id csvlt_5fvkRjCjou \ - -vault-path "database/creds/db-mysql" -``` - -**Example output:** - - - -```plaintext -Credential Library information: - Created Time: Fri, 18 Aug 2023 16:22:29 PDT - Credential Store ID: csvlt_5fvkRjCjou - ID: clvlt_QYnQPAjA24 - Name: northwind dba - Type: vault-generic - Updated Time: Fri, 18 Aug 2023 20:04:27 PDT - Version: 2 - - Scope: - ID: p_tnqESc86qE - Name: db-project - Parent Scope ID: o_4VUR6ZATqW - Type: project - - Authorized Actions: - no-op - read - update - delete - - Attributes: - HTTP Method: GET - Path: database/creds/db-mysql -``` - - - - -## Usage - - - -```shell-session -$ boundary credential-libraries update vault [options] [args] -``` - - - -### Command options - -- `-description` `(string: "")` - A description to set on the credential library. -- `-id` `(string: "")` - The ID of the credential library to update. -- `-name` `(string: "")` - A name to set on the credential library. -- `-version` `(int: 0)` - The version of the credential library against which to perform the update operation. -If you don't specify a version, the command performs a check-and-set automatically. - -#### Usages by type - -The available types are `vault-generic` and `vault-ssh-certificate`. - - - -A credential library type, `vault` is deprecated, so use `vault-generic` type -instead. - - - - - - -The `credential-libraries update vault-generic` command lets you update a generic Vault credential library. - -#### Example - -The following example updates a generic Vault credential library with the ID `clvlt_1234567890` to add the name `devops` and the description `For DevOps usage`: - -```shell-session -$ boundary credential-libraries update vault-generic \ - -id clvlt_1234567890 \ - -name devops \ - -description "For DevOps usage" -``` - -#### Usage - - - -```shell-session -$ boundary credential-libraries create vault-generic [options] [args] -``` - - - -#### Vault credential library options - -The following are specific Vault credential library options in addition to the command options: - -- `-credential-mapping-override` - An override for credential mapping. -- `-vault-http-method` `(string: "")` - The HTTP method the library should use when it communicates with Vault. -- `-vault-http-request-body` `(strinboundary credential-libraries update vault-ssh-certificate -id clvsclt_1234567890 -name devops -description "For DevOps usage": "")` - The HTTP request body the credential library uses to communicate with Vault. -This value can be the HTTP request body itself, it can refer to a file on disk (`file://`) from which the value is read, or it can refer to an environment variable (`env://`) from which the value is read. -- `-vault-path` `(string: "")` - The path in Vault to request credentials from. - - - - - -The `credential-libraries update vault-ssh-certificate` command lets you update a Vault SSH certificate credential library. - -#### Example - -The following example updates a Vault SSH certificate credential library with the ID `clvsclt_1234567890` to add the name `devops` and the description `For DevOps usage`: - -```shell-session -$ boundary credential-libraries update vault-ssh-certificate \ - -id clvsclt_1234567890 \ - -name devops \ - -description "For DevOps usage" -``` - -#### Usage - - - -```shell-session -$ boundary credential-libraries update vault-ssh-certificate [options] [args] -``` - - - -#### Vault SSH certificate credential library options - -The following are options specific to the Vault SSH certificate credential library, in addition to the command options: - -- `-additional-valid-principal` - Any additional users or groups that you want to configure as valid principals. -By default, Boundary only passes the username to Vault as a valid principal. -Use this option when you want to configure additional users or groups as valid principals that the certificate should be signed for in Vault. - - For more information, refer to OpenSSH's definition of [valid principals](https://github.com/openssh/openssh-portable/blob/5f93c4836527d9fda05de8944a1c7b4a205080c7/PROTOCOL.certkeys#L176-L181) and Vault's [SSH secrets engine](https://developer.hashicorp.com/vault/api-docs/secret/ssh#valid_principals) documentation. -- `-critical-option` - A key=value pair to add to the request's - critical-options map. - It can also be a key value only which sets a JSON null as the value. - If you provide a value, Boundary infers the type automatically. - You can use `-string-critical-option`, `-bool-critical-option`, or `-num-critical-option` to override the type. - You can specify values for this option multiple times. - This option supports sourcing values from files using `file://` and environment variables using `env://`. -- `-critical-options` `(string: "")` A JSON map value to use as the entirety of the request's critical-options map. -Usually this value is sourced from a file using the `file://` syntax. -This value is exclusive with the other critical-option flags. -- `-extension` - A key=value pair to add to the request's extensions map. -It can also be a key value only which will set a JSON null as the value. -If you provide a value, Boundary automatically infers the type. -You can use `-string-extension`, `-bool-extension`, or `-num-extension` to override the type. -You can specify values for this option multiple times. -This option supports sourcing values from files using `file://` and environment variables using `env://`. -- `-extensions` `(string: "")` - A JSON map value to use as the entirety of - the request's extensions map. - Usually this value is sourced from a file using the `file://` syntax. - This option is exclusive with the other extension flags. -- `-key-bits` `(string: "")` - The number of bits to use when the SSH private key is generated. -The value depends on the `key_type`. -If you use a `ed25519` key, you should not set a value or set the value to `0`. -If you use a `ecdsa` key, you should set the value to `256`, `384`, or `521`. -If you use an `rsa` key, you should set the value to `2048`, `3072`, or `4096`. -- `-key-id` `(string: "")` - Specifies the certificate's key id. -- `-key-type` `(string: "")` - Specifies the key type for the ssh private key. -Supported values include `ed25519`, `ecdsa`, and `rsa`. -- `-ttl` `(string: "")` - The generated certificate's time-to-live. -- `-username` `(string: "")` - The username to use with the SSH certificate. -- `-vault-path` `(string: "")` - The path in Vault to request credentials from. - - - - - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/credential-stores/create.mdx b/website/content/docs/commands/credential-stores/create.mdx deleted file mode 100644 index 0c6748072..000000000 --- a/website/content/docs/commands/credential-stores/create.mdx +++ /dev/null @@ -1,161 +0,0 @@ ---- -layout: docs -page_title: credential-stores create - Command -description: >- - The "credential-stores create" command creates new credential store resources. You can create static or Vault credential stores to manage credentials. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# credential-stores create - -Command: `boundary credential-stores create` - -The `credential-stores create` command lets you create a Boundary credential store resource. - -## Examples - -The following example creates a credential store resource in a project scope with the ID `p_tnqESc86qE`: - -```shell-session -$ boundary credential-stores create vault -scope-id p_tnqESc86qE \ - -vault-address $VAULT_ADDR \ - -vault-token $VAULT_TOKEN \ - -vault-namespace $VAULT_NAMESPACE -``` - -**Example output:** - - - -```plaintext -Credential Store information: - Created Time: Thu, 28 Jul 2022 15:08:12 MDT - ID: csvlt_ytzGHsfp3r - Type: vault - Updated Time: Thu, 28 Jul 2022 15:08:12 MDT - Version: 1 - - Scope: - ID: p_jd7lspegXk - Name: ssh-project - Parent Scope ID: o_SN2K0DAGpi - Type: project - - Authorized Actions: - no-op - read - update - delete - - Authorized Actions on Credential Store's Collections: - credential-libraries: - create - list - - Attributes: - Address: https://vault-cluster-boundary.vault.11eb3a47-8920-4714-ba99-0242ac11000e.aws.hashicorp.cloud:8200 - Token HMAC: NZJWT74Jyq09gLQfP4RiK5eDWfY7NWXYHoKL4nKQFDY -``` - - - - -## Usage - - - -```shell-session -$ boundary credential-stores create [type] [sub command] [options] [args] -``` - - - -### Command options - -- `-description` `(string: "")` - The description to set on the credential store. -- `-name` `(string: "")` - The name to set on the credential store. -- `-scope-id` `(string: "")` - The scope in which to make the request. -The default scope is `global`. -You can also indicate the scope using the **BOUNDARY_SCOPE_ID** environment variable. - -### Usages by type - -The available types are `static` and `vault`. - - - - -The `credential-stores create static` command lets you create a static-type credential store. - -#### Example - -The following example creates a static credential score in a scope with the ID `p_1234567890`: - -```shell-session -$ boundary credential-stores create static -scope-id p_1234567890 -``` - -#### Usage - - - -```shell-session -$ boundary credential-stores create static [options] [args] -``` - - - - - - - -The `credential-stores create vault` command lets you create a Vault credential store. - -#### Example - -The following example creates a Vault credential store: - -```shell-session -$ boundary credential-stores create vault \ - -vault-address "http://127.0.0.1:8200" \ - -vault-token "" -``` - -#### Usage - - - -```shell-session -$ boundary credential-stores create vault [options] [args] -``` - - - -#### Vault credential stores options - -The following options are specific to Vault credential stores in addition to the command options: - -- `-vault-address` `(string: "")` - The address of the Vault server. -The address should be a complete URL such as https://127.0.0.1:8200. -- `-vault-ca-cert` `(string: "")` - The CA certificate to use when you connect to Vault. -This value can be the CA certificate itself, or it can be a reference to a file on disk (`file://`) or an environment variable (`env://`) from which Boundary reads the value. -- `-vault-client-certificate` `(string: "")` - The client certificate to use when Boundary connects to Vault for this credential store. -This value can be the client certificate itself, or it can be a reference to a file on disk (`file://`) or an environment variable (`env://`) from which Boundary reads the value. -- `-vault-client-certificate-key` `(string: "")` - The private key the client certificate should use when Boundary connects to Vault for this store. -This value can be the private key itself, or it can be a reference to a file on disk (`file://`) or an environment variable (`env://`) from which Boundary reads the value. -- `-vault-namespace` `(string: "")` - The Vault namespace the credential store should use. -- `-vault-tls-server-name` `(string: "")` - The name to use as the SNI host when you connect using TLS. -- `-vault-tls-skip-verify` - If set, skips TLS verification. -The default value is `false`. -- `-vault-token` `(string: "")` - The Vault token to use when Boundary connects to Vault for this credential store. -- `-worker-filter` `(string: "")` - A Boolean expression to filter which workers can process Vault commands for this credential store. - - - - - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/credential-stores/delete.mdx b/website/content/docs/commands/credential-stores/delete.mdx deleted file mode 100644 index 246974ea1..000000000 --- a/website/content/docs/commands/credential-stores/delete.mdx +++ /dev/null @@ -1,43 +0,0 @@ ---- -layout: docs -page_title: credential-stores delete - Command -description: >- - The "credential-stores delete" command deletes an existing credential store resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# credential-stores delete - -Command: `boundary credential-stores delete` - -The `credential-stores delete` command deletes a credential store given its ID. - -## Examples - -The following example deletes a credential store with the ID `csvlt_5fvkRjCjou`: - -```shell-session -$ boundary credential-stores delete -id csvlt_5fvkRjCjou -The delete operation completed successfully. -``` - -## Usage - - - -```shell-session -$ boundary credential-stores delete [options] [args] -``` - - - - -### Command options - -- `-id` `(string: "")` - The ID of the credential store to delete. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/credential-stores/index.mdx b/website/content/docs/commands/credential-stores/index.mdx deleted file mode 100644 index 5895f0d4e..000000000 --- a/website/content/docs/commands/credential-stores/index.mdx +++ /dev/null @@ -1,75 +0,0 @@ ---- -layout: docs -page_title: credential-stores - Command -description: >- - The "credential-stores" command performs operations on credential store resources. Credential stores can manage credentials of differing types and access levels. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# credential-stores - -Command: `boundary credential-stores` - -The `credential-stores` command lets you manage Boundary credential store resources. - -A credential store is a resource that can retrieve, store, and potentially generate credentials of differing types and differing access levels. -They belong to projects and support the principle of least privilege by limiting the credentials that can be accessed to the minimum necessary for the project. -A credential store can also contain credential libraries. - -## Examples - -The following example lists all credential stores for a scope with the ID `p_tnqESc86qE`: - -```shell-session -$ boundary credential-stores list -scope-id p_tnqESc86qE -``` - -**Example output:** - - - -```plaintext -Credential Store information: - ID: csvlt_5fvkRjCjou - Version: 1 - Type: vault - Authorized Actions: - no-op - read - update - delete -``` - - - -## Usage - - - -```shell-session -Usage: boundary credential-stores [sub command] [options] [args] - - # ... - -Subcommands: - create Create a credential store - delete Delete a credential store - list List a credential store - read Read a credential store - update Update a credential store -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [create](/boundary/docs/commands/credential-stores/create) -- [delete](/boundary/docs/commands/credential-stores/delete) -- [list](/boundary/docs/commands/credential-stores/list) -- [read](/boundary/docs/commands/credential-stores/read) -- [update](/boundary/docs/commands/credential-stores/update) diff --git a/website/content/docs/commands/credential-stores/list.mdx b/website/content/docs/commands/credential-stores/list.mdx deleted file mode 100644 index f8f21452d..000000000 --- a/website/content/docs/commands/credential-stores/list.mdx +++ /dev/null @@ -1,74 +0,0 @@ ---- -layout: docs -page_title: credential-stores list - Command -description: >- - The "credential-stores list" command lists the available credential store resources within an enclosing scope or resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# credential-stores list - -Command: `boundary credential-stores list` - -The `credential-stores list` command lists any credential stores within an enclosing scope or resource. - -## Examples - -The following example lists all credential stores for a scope with the ID `p_tnqESc86qE`: - -```shell-session -$ boundary credential-stores list -scope-id p_tnqESc86qE -``` - -**Example output:** - - - -```plaintext -Credential Store information: - ID: csvlt_5fvkRjCjou - Version: 1 - Type: vault - Authorized Actions: - no-op - read - update - delete -``` - - - -## Usage - - - -```shell-session -$ boundary credential-stores list [options] [args] -``` - - - - -### Command options - -- `-filter` `(string: "")` - If set, Boundary filters the list operation before the results are returned. -The filter operates against each item in the list. -We recommend that you use single quotes, because the filters contain double quotes. -Refer to the [Filtering and listing resources documentation](/boundary/docs/filtering) for more details. -- `-recursive` - If set, the list operation is applied recursively into child scopes, if supported by the type. -The default value is `false`. -- `-scope-id ``(string: "")` - The scope in which to make the request. -The default value is `global`. -You can also specify the scope using the **BOUNDARY_SCOPE_ID** environment variable. -- `list_token` (optional) - An opaque token that is returned from the previous `list` response. -If you do not supply a value, pagination starts from the beginning. -- `page_size` (optional) - An unsigned integer that indicates the number of items that should be included on the page of search results. -If you do not provide a value, or if you provide a value of `0`, Boundary uses the default page size of 1000 items. -If you configure it, the `page_size` value overrides the default page size. -Controller administrators can also configure a `max_page_size` option that constrains the maximum page size a user can request. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/credential-stores/read.mdx b/website/content/docs/commands/credential-stores/read.mdx deleted file mode 100644 index bf9ea7b14..000000000 --- a/website/content/docs/commands/credential-stores/read.mdx +++ /dev/null @@ -1,78 +0,0 @@ ---- -layout: docs -page_title: credential-stores read - Command -description: >- - The "credential-stores read" command retrieves the details of a credential store resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# credential-stores read - -Command: `boundary credential-stores read` - -The `credential-stores read` command reads credential store information for a credential store with a specific ID. - -## Examples - -The following example retrieves credential store information for a credential store with the ID `csvlt_5fvkRjCjou`: - -```shell-session -$ boundary credential-stores read -id csvlt_5fvkRjCjou -``` - -**Example output:** - - - -```plaintext -Credential Store information: - Created Time: Fri, 18 Aug 2023 16:22:02 PDT - ID: csvlt_5fvkRjCjou - Type: vault - Updated Time: Fri, 18 Aug 2023 16:22:02 PDT - Version: 1 - - Scope: - ID: p_tnqESc86qE - Name: db-project - Parent Scope ID: o_4VUR6ZATqW - Type: project - - Authorized Actions: - no-op - read - update - delete - - Authorized Actions on Credential Store's Collections: - credential-libraries: - create - list - - Attributes: - Address: http://127.0.0.1:8200 - Token Status: expired - Worker Filter: "worker" in "/tags/type" -``` - - - -## Usage - - - -```shell-session -$ boundary credential-stores read [options] [args] -``` - - - -### Command options - -- `-id` `(string: "")` - The ID of the credential store for which to read information. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/credential-stores/update.mdx b/website/content/docs/commands/credential-stores/update.mdx deleted file mode 100644 index b9bc520f3..000000000 --- a/website/content/docs/commands/credential-stores/update.mdx +++ /dev/null @@ -1,164 +0,0 @@ ---- -layout: doc -page_title: credential-stores update - Command -description: >- - The "credential-stores update" command updates an existing credential store resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# credential-stores update - -Command: `boundary credential-stores update` - -The `credential-stores update` command lets you update Boundary credential store resources. - -## Examples - -The following example updates an existing Vault credential store with the ID `csvlt_5fvkRjCjou` to add the description `For DevOps usage`, and the Vault namespace `devops`: - -```shell-session -$ boundary credential-stores update vault -id csvlt_5fvkRjCjou \ - -description "For DevOps usage" \ - -vault-namespace "devops" -``` - -**Example output:** - - - -```plaintext -Credential Store information: - Created Time: Fri, 18 Aug 2023 16:22:02 PDT - Description: For DevOps usage - ID: csvlt_5fvkRjCjou - Type: vault - Updated Time: Sun, 20 Aug 2023 22:21:25 PDT - Version: 2 - - Scope: - ID: p_tnqESc86qE - Name: db-project - Parent Scope ID: o_4VUR6ZATqW - Type: project - - Authorized Actions: - no-op - read - update - delete - - Authorized Actions on Credential Store's Collections: - credential-libraries: - create - list - - Attributes: - Address: http://127.0.0.1:8200 - Namespace: devops - Token Status: current - Worker Filter: "worker" in "/tags/type" -``` - - - - -## Usage - - - -```shell-session -$ boundary credential-stores update vault [options] [args] -``` - - - -### Command options - -- `-description` `(string: "")` - The description to set on the credential store. -- `-id` `(string: "")` - The ID of the credential store to update. -- `-name` `(string: "")` - The name to set on the credential store. -- `-version` `(int: 0)` - The version of the credential store against which to perform an update operation. -If you do not specify a version, the command performs a check-and-set automatically. - -#### Usages by type - -The available types are `static` and `vault`. - - - - -The `credential-stores update static` command lets you update information for a static credential store. - -#### Example - -The following example updates a static credential store with the name `devops` and the description `For DevOps usage`: - -```shell-session -$ boundary credential-stores update static \ - -name devops \ - -description "For DevOps usage" -``` - -#### Usage - - - -```shell-session -$ boundary credential-stores update static [options] [args] -``` - - - - - - -The `credential-stores update vault` command lets you update a Vault credential store. - -#### Example - -The following example updates a Vault credential store with the ID `csvlt_1234567890` to add the name `devops` and the description `For DevOps usage`: - -```shell-session -$ boundary credential-stores update vault \ - -id csvlt_1234567890 \ - -name devops \ - -description "For DevOps usage" -``` - -#### Usage - - - -```shell-session -$ boundary credential-stores update vault [options] [args] -``` - - - -#### Vault credential store options - -The following options are specific to Vault credential stores in addition to the command options: - -- `-vault-address` `(string: "")` - The address of the Vault server. -The address should be a complete URL such as https://127.0.0.1:8200. -- `-vault-ca-cert` `(string: "")` - The CA certificate to use when you connect to Vault. -This value can be the CA certificate itself, or it can be a reference to a file on disk (`file://`) or an environment variable (`env://`) from which Boundary reads the value. -- `-vault-client-certificate` `(string: "")` - The client certificate to use when Boundary connects to Vault for this credential store. -This value can be the client certificate itself, or it can be a reference to a file on disk (`file://`) or an environment variable (`env://`) from which Boundary reads the value. -- `-vault-client-certificate-key` `(string: "")` - The private key the client certificate should use when Boundary connects to Vault for this store. -This value can be the private key itself, or it can be a reference to a file on disk (`file://`) or an environment variable (`env://`) from which Boundary reads the value. -- `-vault-namespace` `(string: "")` - The Vault namespace the credential store should use. -- `-vault-tls-server-name` `(string: "")` - The name to use as the SNI host when you connect using TLS. -- `-vault-tls-skip-verify` - If set, skips TLS verification. -The default value is `false`. -- `-vault-token` `(string: "")` - The Vault token to use when Boundary connects to Vault for this credential store. -- `-worker-filter` `(string: "")` - A Boolean expression to filter which workers can process Vault commands for this credential store. - - - - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/credentials/create.mdx b/website/content/docs/commands/credentials/create.mdx deleted file mode 100644 index d915e0f63..000000000 --- a/website/content/docs/commands/credentials/create.mdx +++ /dev/null @@ -1,252 +0,0 @@ ---- -layout: docs -page_title: credentials create - Command -description: >- - The "credentials create" command creates new credential resources. Available types are json, ssh-private-key, username-password, and username-password-domain. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# credentials create - -Command: `boundary credentials create` - -The `credentials create` command lets you create Boundary credential resources. - -## Examples - -The following example defines a new username password credential within a static credential store with the ID `credup_J15mtU4qmy`: - -```shell-session -$ boundary credentials create username-password \ - -name ssh-user \ - -credential-store-id credup_J15mtU4qmy\ - -username ssh-user \ - -password env://SSH_USER_PASS -``` - -**Example output:** - - - -```plaintext -Credential information: - Created Time: Tue, 22 Aug 2023 15:56:07 PDT - Credential Store ID: csst_5GGWwRngd7 - ID: credup_J15mtU4qmy - Name: ssh-user - Type: username_password - Updated Time: Tue, 22 Aug 2023 15:56:07 PDT - Version: 1 - - Scope: - ID: p_1zMlAwGHtH - Name: quick-start-project - Parent Scope ID: o_R0wbo0H6Zl - Type: project - - Authorized Actions: - no-op - read - update - delete - - Attributes: - Password HMAC: bXhHJHgaGz6fpolEpQPd0azcICSgmbVuSLfyhJhmqJY - Username: ssh-user -``` - - - - -## Usage - - - -```shell-session -$ boundary credentials create [type] [sub command] [options] [args] -``` - - - -### Command options - -- `-credential-store-id` `(string: "")` - The credential-store resource in which to create the credential. -You can also specify the credential store using the **BOUNDARY_CREDENTIAL_STORE_ID** environment variable. -- `-description` `(string: "")` - A description to set on the credential. -- `-name` `(string: "")` - A name to set on the credential. - -#### Usages by type - -The available types are `json`, `ssh-private-key`, `username-password`, and `username-password-domain`. - - - - -The `credentials create json` command lets you create a JSON type credential. - -#### Example - -The following example creates a JSON credential in a credential store with the ID `csst_1234567890`: - -```shell-session -$ boundary credentials create json \ - -credential-store-id csst_1234567890 \ - -object file:///home/user/secret -``` -#### Usage - - - -```shell-session -$ boundary credentials create json [options] [args] -``` - - - -#### JSON object credential options - -The following options are specific to JSON credentials in addition to the command options: - -- `-bool-kv` `(map: {})` – A key=value Boolean value to add to the request's object map. -You can specify this option multiple times. -This value can be a reference to a file on disk (`file://`) or an environment variable (`env://`) from which Boundary reads the value. -- `-kv` `(map: {})` – A key=value pair to add to the request's object map. -This option can also be a key value only which will set a JSON null as the value. -If you provide a value, Boundary automatically infers the type. -Use `-string-kv`,`-bool-kv`, or `-num-kv` to override the type. -You can specify this option multiple times. -This value can be a reference to a file on disk (`file://`) or an environment variable (`env://`) from which Boundary reads the value. -- `-num-kv` `(map: {})` – A key=value numeric value to add to the request's object map. -You can specify this option multiple times. -This value can be a reference to a file on disk (`file://`) or an environment variable (`env://`) from which Boundary reads the value. -- `-object` `(string: "")` - A JSON map value to use as the entirety of the request's object map. -Usually this is sourced from a file using `file://` syntax. -This option is exclusive with the other kv flags. -- `-string-kv` `(map: {})` – A key=value string value to add to the request's object map. -You can specify this option multiple times. -This value can be a reference to a file on disk (`file://`) or an environment variable (`env://`) from which Boundary reads the value. - - - - -The `credentials create ssh-private-key` command lets you create an SSH private key credential type. - -#### Example - -The following example creates an SSH private key credential in a credential store with the ID `csvlt_1234567890`: - -```shell-session -$ boundary credentials create ssh-private-key \ - -credential-store-id csvlt_1234567890 \ - -username user \ - -private-key file:///home/user/.ssh/id_ed25519 -``` - -#### Usage - - - -```shell-session -$ boundary credentials create ssh-private-key [options] [args] -``` - - - -#### SSH private key credential options - -The following options are specific to SSH private key credentials in addition to the command options: - -- `-private-key` `(string: "")` - The SSH private key associated with the - credential. - This value can be a reference to a file on disk (`file://`) or an environment variable (`env://`) from which Boundary reads the value. -- `-private-key-passphrase` `(string: "")` - The passphrase associated with the - SSH private key. - Boundary ingores this value if the private key does not require a passphrase or if you do not supply a private key. - This value can be a reference to a file on disk (`file://`) or an environment variable (`env://`) from which Boundary reads the value. - If you leave this option empty, and the key requires a passphrase, you can enter it manually. -- `-username` `(string: "")` - The username associated with the credential. - - - - -The `credentials create username-password` command lets you create a username password type credential. - -#### Example - -The following example creates a username password credential in a credential store with the ID `csvlt_1234567890`: - -```shell-session -$ boundary credentials create username-password \ - -credential-store-id csvlt_1234567890 \ - -username user -password pass -``` - -#### Usage - - - -```shell-session -$ boundary credentials create username-password -credential-store-id [options] [args] -``` - - - - -#### Username password credential options - -The following options are specific to username password credentials in addition to the command options: - -- `-password` `(string: "")` - The password associated with the credential. -This value can be a reference to a file on disk (`file://`) or an environment variable (`env://`) from which Boundary reads the value. -- `-username` `(string: "")` - The username associated with the credential. - - - - -The `credentials create username-password-domain` command lets you create a username password domain credential type for Active Directory authentication. - -Username password domain credentials are primarily used with RDP targets for credential injection. - -#### Example - -The following example creates a username password domain credential in a credential store with the ID `csst_1234567890`: - -```shell-session -boundary credentials create username-password-domain \ - -credential-store-id csst_1234567890 \ - -username administrator \ - -password env://ADMIN_PASSWORD \ - -domain company.com -``` - -#### Usage - - - -```shell-session -boundary credentials create username-password-domain [options] [args] -``` - - - -#### Username password domain credential options - -The following options are specific to username password domain credentials in addition to the command options: - -- `domain` `(string: "")` - The Active Directory domain name. If you include the domain in the `username` field, Boundary automatically fills in the domain information. - - For example, if you enter `admin@mydomain` or `mydomain\admin` in the `username` field, Boundary automatically completes the `domain` field with `mydomain`. - -- `password` `(string: "")` - The password associated with the credential. This value can be a reference to a file on disk (file://) or an environment variable (env://) from which Boundary reads the value. - -- `username` `(string: "")` - The username associated with the credential. This value can include domain information in `username@domain` or `domain\username` format. - - - - - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/credentials/delete.mdx b/website/content/docs/commands/credentials/delete.mdx deleted file mode 100644 index c83199c84..000000000 --- a/website/content/docs/commands/credentials/delete.mdx +++ /dev/null @@ -1,42 +0,0 @@ ---- -layout: docs -page_title: credentials delete - Command -description: >- - The "credentials delete" command deletes an existing credential resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# credentials delete - -Command: `boundary credentials delete` - -The `credentials delete` command lets you delete a credential given its ID. - -## Examples - -The following example deletes a credential with the ID `credup_6zHHwQWvUS`: - -```shell-session -$ boundary credentials delete -id credup_6zHHwQWvUS -The delete operation completed successfully. -``` - -## Usage - - - -```shell-session -$ boundary credentials delete [options] [args] -``` - - - -### Command options - -- `-id` `(string: "")` - The ID of the credential to delete. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/credentials/index.mdx b/website/content/docs/commands/credentials/index.mdx deleted file mode 100644 index 67e28ba0a..000000000 --- a/website/content/docs/commands/credentials/index.mdx +++ /dev/null @@ -1,94 +0,0 @@ ---- -layout: docs -page_title: credentials - Command -description: >- - The "credentials" command performs operations on Boundary credential resources. Credentials contain secrets that bind an identity to a set of permissions. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# credentials - -Command: `boundary credentials` - -The `credentials` command lets you create and manage Boundary credential resources in Boundary's static credential store. - - - -The `credentials` command does not support viewing, creating, or managing credentials that reside in the Vault credential store. - - - -A credential is a data structure containing one or more secrets that bind an identity to a set of permissions or capabilities on a host for a session. - -## Examples - -The following example retrieves information about a credential with the ID `credup_J15mtU4qmy`: - -```shell-session -$ boundary credentials read -id credup_J15mtU4qmy -``` - -**Example output:** - - - -```plaintext -Credential information: - Created Time: Tue, 22 Aug 2023 15:56:07 PDT - Credential Store ID: csst_5GGWwRngd7 - ID: credup_J15mtU4qmy - Name: ssh-user - Type: username_password - Updated Time: Tue, 22 Aug 2023 15:56:07 PDT - Version: 1 - - Scope: - ID: p_1zMlAwGHtH - Name: quick-start-project - Parent Scope ID: o_R0wbo0H6Zl - Type: project - - Authorized Actions: - no-op - read - update - delete - - Attributes: - Password HMAC: bXhHJHgaGz6fpolEpQPd0azcICSgmbVuSLfyhJhmqJY - Username: ssh-user -``` - - - -## Usage - - - -```shell-session -Usage: boundary credentials [sub command] [options] [args] - - # ... - -Subcommands: - create Create a credential - delete Delete a credential - list List a credential - read Read a credential - update Update a credential -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [create](/boundary/docs/commands/credentials/create) -- [delete](/boundary/docs/commands/credentials/delete) -- [list](/boundary/docs/commands/credentials/list) -- [read](/boundary/docs/commands/credentials/read) -- [update](/boundary/docs/commands/credentials/update) diff --git a/website/content/docs/commands/credentials/list.mdx b/website/content/docs/commands/credentials/list.mdx deleted file mode 100644 index 53bf962e9..000000000 --- a/website/content/docs/commands/credentials/list.mdx +++ /dev/null @@ -1,92 +0,0 @@ ---- -layout: docs -page_title: credentials list - Command -description: >- - The "credentials list" command lists the available credential resources within an enclosing scope or resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# credentials list - -Command: `boundary credentials list` - -The `credentials list` command lists credentials within an enclosing scope or resource. - -## Examples - -The following example lists all credentials for a credential store with the ID `csst_5GGWwRngd7`: - -```shell-session -$ credentials list -credential-store-id csst_5GGWwRngd7 -``` - -**Example output:** - - - -```plaintext -Credential information: - ID: credup_29IUJANN59 - Version: 1 - Type: username_password - Name: tester - Authorized Actions: - no-op - read - update - delete - - ID: credup_6zHHwQWvUS - Version: 1 - Type: username_password - Name: support-eng - Authorized Actions: - no-op - read - update - delete - - ID: credup_J15mtU4qmy - Version: 1 - Type: username_password - Name: ssh-user - Authorized Actions: - no-op - read - update - delete -``` - - - -## Usage - - - -```shell-session -$ boundary credentials list [options] [args] -``` - - - - -### Command options - -- `-credential-store-id` `(string: "")` - The credential store resource that contains the credentials you want to list. -You can also specify the credential store using the **BOUNDARY_CREDENTIAL_STORE_ID** environment variable. -- `-filter` `(string: "")` - If set, Boundary filters the list operation before the results are returned. -The filter operates against each item in the list. -We recommend that you use single quotes, because the filters contain double quotes. -Refer to the [Filtering and listing resources documentation](/boundary/docs/filtering) for more details. -- `list_token` (optional) - An opaque token that is returned from the previous `list` response. -If you do not supply a value, pagination starts from the beginning. -- `page_size` (optional) - An unsigned integer that indicates the number of items that should be included on the page of search results. -If you do not provide a value, or if you provide a value of `0`, Boundary uses the default page size of 1000 items. -If you configure it, the `page_size` value overrides the default page size. -Controller administrators can also configure a `max_page_size` option that constrains the maximum page size a user can request. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/credentials/read.mdx b/website/content/docs/commands/credentials/read.mdx deleted file mode 100644 index 00127757e..000000000 --- a/website/content/docs/commands/credentials/read.mdx +++ /dev/null @@ -1,75 +0,0 @@ ---- -layout: docs -page_title: credentials read - Command -description: >- - The "credentials read" command retrieves the details of an existing credential resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# credentials read - -Command: `boundary credentials read` - -The `credentials read` command retrieves information about a credential with a specified ID. - -## Examples - -The following example retrieves credential information for a credential with the ID `credup_29IUJANN59`: - -```shell-session -$ boundary credentials read -id credup_29IUJANN59 -``` - -**Example output:** - - - -```plaintext -Credential information: - Created Time: Tue, 22 Aug 2023 18:26:06 PDT - Credential Store ID: csst_5GGWwRngd7 - ID: credup_29IUJANN59 - Name: tester - Type: username_password - Updated Time: Tue, 22 Aug 2023 18:26:06 PDT - Version: 1 - - Scope: - ID: p_1zMlAwGHtH - Name: quick-start-project - Parent Scope ID: o_R0wbo0H6Zl - Type: project - - Authorized Actions: - no-op - read - update - delete - - Attributes: - Password HMAC: bXhHJHgaGz6fpolEpQPd0azcICSgmbVuSLfyhJhmqJY - Username: tester -``` - - - -## Usage - - - -```shell-session -$ boundary credentials read [options] [args] -``` - - - - -### Command options - -- `-id` `(string: "")` - The ID of the credential for which you want to retrieve information. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/credentials/update.mdx b/website/content/docs/commands/credentials/update.mdx deleted file mode 100644 index 7ea107d77..000000000 --- a/website/content/docs/commands/credentials/update.mdx +++ /dev/null @@ -1,252 +0,0 @@ ---- -layout: doc -page_title: credentials update - Command -description: >- - The "credentials update" command updates an existing credential resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# credentials update - -Command: `boundary credentials update` - -The `credentials update` command lets you update Boundary credential resources. - -## Examples - -The following example updates an existing user password credential with a new password: - -```shell-session -$ export NEW_SSH_USER_PASSWORD="my-new-long-password" - -$ boundary credentials update username-password -id credup_J15mtU4qmy \ - -password env://NEW_SSH_USER_PASSWORD -``` - -**Example output:** - - - -```plaintext -Credential information: - Created Time: Tue, 22 Aug 2023 15:56:07 PDT - Credential Store ID: csst_5GGWwRngd7 - Description: Ops admin who needs to access the machine - ID: credup_J15mtU4qmy - Name: ssh-user - Type: username_password - Updated Time: Tue, 22 Aug 2023 21:26:34 PDT - Version: 2 - - Scope: - ID: p_1zMlAwGHtH - Name: quick-start-project - Parent Scope ID: o_R0wbo0H6Zl - Type: project - - Authorized Actions: - no-op - read - update - delete - - Attributes: - Password HMAC: JxqSB5DJ_dBlTCJAfkX6k-o-6CwjgEDmmnbrTxvQ7_g - Username: ssh-user -``` - - - - -## Usage - - - -```shell-session -$ boundary credentials update [type] [sub command] [options] [args] -``` - - - -### Command options - -- `-description` `(string: "")` - A description to set on the credential. -- `-id` `(string: "")` - The ID of the credential to update. -- `-name` `(string: "")` - A name to set on the credential. -- `-version` `(int: 0)` - The version of the credential to update. -If you don't specify a version, the command performs a check-and-set automatically. - -#### Usages by type - -The available types are `json`, `ssh-private-key`, `username-password`, and `username-password-domain`. - - - - -The `credentials update json` command lets you update a JSON credential. - -#### Example - -The following example updates a JSON credential with the ID `csst_1234567890`: - -```shell-session -$ boundary credentials update json \ - -id csst_1234567890 \ - -name devops \ - -description "For DevOps usage" -``` - -#### Usage - - - -```shell-session -$ boundary credentials update json [options] [args] -``` - - - -#### JSON object credential options - -The following options are specific to JSON credentials in addition to the command options: - -- `-bool-kv` `(map: {})` – A key=value Boolean value to add to the request's object map. -You can specify this option multiple times. -This value can be a reference to a file on disk (`file://`) or an environment variable (`env://`) from which Boundary reads the value. -- `-kv` `(map: {})` – A key=value pair to add to the request's object map. -This option can also be a key value only which will set a JSON null as the value. -If you provide a value, Boundary automatically infers the type. -Use `-string-kv`,`-bool-kv`, or `-num-kv` to override the type. -You can specify this option multiple times. -This value can be a reference to a file on disk (`file://`) or an environment variable (`env://`) from which Boundary reads the value. -- `-num-kv` `(map: {})` – A key=value numeric value to add to the request's object map. -You can specify this option multiple times. -This value can be a reference to a file on disk (`file://`) or an environment variable (`env://`) from which Boundary reads the value. -- `-object` `(string: "")` - A JSON map value to use as the entirety of the request's object map. -Usually this is sourced from a file using `file://` syntax. -This option is exclusive with the other kv flags. -- `-string-kv` `(map: {})` – A key=value string value to add to the request's object map. -You can specify this option multiple times. -This value can be a reference to a file on disk (`file://`) or an environment variable (`env://`) from which Boundary reads the value. - - - - -The `credentials update ssh-private-key` lets you update an SSH private key credential. - -#### Example - -The following example updates an SSH private key with the ID `clvlt_1234567890`: - -```shell-session -$ boundary credentials update ssh-private-key \ - -id clvlt_1234567890 \ - -name devops \ - -description "For DevOps usage" -``` - -#### Usage - - - -```shell-session -$ boundary credentials update ssh-private-key [options] [args] -``` - - - -#### SSH private key credential options - -The following options are specific to SSH private key credentials in addition to the command options: - -- `-private-key` `(string: "")` - The SSH private key associated with the - credential. - This value can be a reference to a file on disk (`file://`) or an environment variable (`env://`) from which Boundary reads the value. -- `-private-key-passphrase` `(string: "")` - The passphrase associated with the - SSH private key. - Boundary ingores this value if the private key does not require a passphrase or if you do not supply a private key. - This value can be a reference to a file on disk (`file://`) or an environment variable (`env://`) from which Boundary reads the value. - If you leave this option empty, and the key requires a passphrase, you can enter it manually. -- `-username` `(string: "")` - The username associated with the credential. - - - - -The `credentials update username-password` command lets you update a username password type. - -#### Example - -The following example updates a username password credential with the ID `clvlt_1234567890`: - -```shell-session -$ boundary credentials update username-password \ - -id clvlt_1234567890 \ - -name devops \ - -description "For DevOps usage" -``` - -#### Usage - - - -```shell-session -$ boundary credentials update username-password [options] [args] -``` - - - -#### Username password credential options - -The following options are specific to username password credentials in addition to the command options: - -- `-password` `(string: "")` - The password associated with the credential. -This value can be a reference to a file on disk (`file://`) or an environment variable (`env://`) from which Boundary reads the value. -- `-username` `(string: "")` - The username associated with the credential. - - - - -The `credentials update username-password-domain` command lets you update an existing username password domain credential type. - -Username password domain credentials are primarily used with RDP targets for credential injection. - -#### Example - -The following example updates a username password domain credential with the ID `csst_1234567890`: - -```shell-session -boundary credentials update username-password-domain \ - -id csst_1234567890 \ - -name devops \ - -description "For DevOps usage" \ -``` - -#### Usage - - - -```shell-session -boundary credentials update username-password-domain [options] [args] -``` - - -#### Username password domain credential options - -The following options are specific to username password domain credentials in addition to the command options: - -- `domain` `(string: "")` - The Active Directory domain name. If you include the domain in the `username` field, Boundary automatically fills in the domain information. - - For example, if you enter `admin@mydomain` or `mydomain\admin` in the `username` field, Boundary automatically completes the `domain` field with `mydomain`. - -- `password` `(string: "")` - The password associated with the credential. This value can be a reference to a file on disk (file://) or an environment variable (env://) from which Boundary reads the value. - -- `username` `(string: "")` - The username associated with the credential. This value can include domain information in `username@domain` or `domain\username` format. - - - - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/database/index.mdx b/website/content/docs/commands/database/index.mdx deleted file mode 100644 index 2ea9fb283..000000000 --- a/website/content/docs/commands/database/index.mdx +++ /dev/null @@ -1,59 +0,0 @@ ---- -layout: docs -page_title: database - Command -description: >- - The "database" command performs operations on Boundary's database. You can initialize or migrate the database. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# database - -Command: `boundary database` - -The `database` command lets you perform operations on Boundary's database. - -Boundary manages its state and configuration in a relational database management system (RDBMS), namely PostgreSQL. -You must create, set up, and make the PostgreSQL database accessible to the Boundary controller nodes before you configure the nodes themselves. - -## Examples - -The following example initializes the Boundary database: - -```shell-session -$ boundary database init \ - -skip-auth-method-creation \ - -skip-host-resources-creation \ - -skip-scopes-creation \ - -skip-target-creation \ - -config /etc/boundary.d/controller.hcl -``` - -Before you can start Boundary, you must initialize the database from one Boundary controller. -This operation is only required once. -It will execute the required database migrations for the Boundary cluster to operate. - -## Usage - - - -```shell-session -Usage: boundary database [sub command] [options] [args] - - # ... - -Subcommands: - init Initialize Boundary's database - migrate Migrate Boundary's database to the most recent schema supported by this binary. -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [init](/boundary/docs/commands/database/init) -- [migrate](/boundary/docs/commands/database/migrate) diff --git a/website/content/docs/commands/database/init.mdx b/website/content/docs/commands/database/init.mdx deleted file mode 100644 index 238020357..000000000 --- a/website/content/docs/commands/database/init.mdx +++ /dev/null @@ -1,135 +0,0 @@ ---- -layout: docs -page_title: database init - Command -description: >- - The "database init" command initializes Boundary's database. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# database init - -Command: `boundary database init` - -The `database init` command initializes Boundary's database. - -## Examples - -The following example initializes a Boundary's database with the configuration specified in the `/etc/boundary.d/controller.hcl` file: - -```shell-session -$ boundary database init -config=/etc/boundary.d/controller.hcl -``` - -The `controller.hcl` file contains the database URL. - - - -```hcl -...snip... - -# Controller configuration block -controller { - # This name attr must be unique across all controller instances if running in HA mode - name = "boundary-controller-1" - description = "Boundary controller number one" - - # This is the public hostname or IP where the workers can reach the - # controller. This should typically be a load balancer address - public_cluster_addr = "example-cluster-lb.example.com" - - # Enterprise license file, can also be the raw value or env:// value - license = "file:///path/to/license/file.hclic" - - # After receiving a shutdown signal, Boundary will wait 10s before initiating the shutdown process. - graceful_shutdown_wait_duration = "10s" - - # Database URL for postgres. This is set in boundary.env and - #consumed via the “env://” notation. - database { - url = "env://POSTGRESQL_CONNECTION_STRING" - } -} - -...snip... -``` - - - - -## Usage - - - -```shell-session -$ boundary database init [options] [args] -``` - - - -Some initial resources are created in the following order, and in the indicated scopes: - -- Initial login role (global) -- Password-type auth method (global) -- Org scope (global) -- Project scope (org) - - Static-type host catalog (project) - - Static-type host set - - Static-type host - - Target (project) - - - -You can use flags to prevent Boundary from creating these resources. -If you use flags to skip any of these resources, any resources that would be created afterwards are also skipped. -Refer to the following [init options](#init-options) for the available flags. - - - -### Command options - -- `-config` `(string: "")` - The path to the configuration file. -- `-config-kms` `(string: "")` - The path to a configuration file containing a `kms` block marked for the `config` purpose. -The KMS block performs decryption of the main configuration file. -If you don't set a `kms` block, Boundary looks for such a block in the main configuration file, which has some drawbacks; see the help output for `boundary config encrypt -h` for details. -- `-log-format` `(string: "")` - The log format. -Supported values are `standard` and `json`. -- `-log-level` `(string: "")` - The log verbosity level. Supported values include the following in order of more detail to less: - - - `trace` - - `debug` - - `info` - - `warn` - - `err` - - You can also specify a log level using the **BOUNDARY_LOG_LEVEL** environment variable. - -### Init options: - -- `-migration-url` `(string: "")` - If set, this value overrides the migration URL set in the configuration file, and specifies the URL used to connect to the database for initialization. -Configuring this option can allow different permissions for the user running initialization vs. standard operations. -This value can refer to a direct database URL, or it can refer to file on disk (`file://`) or an environment variable (`env://`) from which Boundary reads the URL. - -- `-skip-auth-method-creation` - If not set, skips the creation of an auth method as part of initialization. -If you set this value, the recovery KMS is required to perform any actions. -The default value is `false`. - -- `-skip-host-resources-creation` - If not set, skips the creation of host resources as part of the initialization, inlcuding host catalog, host set, and hosts. -The default value is `false`. - -- `-skip-initial-authenticated-user-role-creation` - If set, skips the creation of the role and grants that are provisioned by default for all authenticated users. - -- `-skip-initial-login-role-creation` - If not set, skips the creation of a default role allowing necessary grants for logging in as part of initialization. -If you set this value, the recovery KMS is required to perform any actions. -The default value is `false`. - -- `-skip-scopes-creation` - If not set, skips the creation of scopes as part of initialization. -The default value is `false`. - -- `-skip-target-creation` - If not set, skips the creation of a target as part of initialization. -The default value is `false`. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/database/migrate.mdx b/website/content/docs/commands/database/migrate.mdx deleted file mode 100644 index ecca22fc5..000000000 --- a/website/content/docs/commands/database/migrate.mdx +++ /dev/null @@ -1,64 +0,0 @@ ---- -layout: docs -page_title: database migrate - Command -description: >- - The "database migrate" command migrates Boundary's database within an enclosing scope or resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# database migrate - -Command: `boundary database migrate` - -The `database migrate` command migrates the Boundary database within an enclosing scope or resource. - -## Examples - -The following example migrates Boundary's database to the database URL specified in the controller configuration file: - -```shell-session -$ boundary database migrate -config=/etc/boundary.d/controller.hcl -``` - -## Usage - - - -```shell-session -$ boundary database migrate [options] -``` - - - - -### Command options - -- `-config` `(string: "")` - The path to the configuration file. -- `-config-kms` `(string: "")` - The path to a configuration file containing a `kms` block marked for the `config` purpose. -The KMS block performs decryption of the main configuration file. -If you don't set a `kms` block, Boundary looks for such a block in the main configuration file, which has some drawbacks; see the help output for `boundary config encrypt -h` for details. -- `-log-format` `(string: "")` - The log format. Supported values are `standard` and `json`. -- `-log-level` `(string: "")` - The log verbosity level. Supported values include the following in order of more detail to less: - - - `trace` - - `debug` - - `info` - - `warn` - - `err` - - You can also specify a log level using the **BOUNDARY_LOG_LEVEL** environment variable. - -### Migration options: - -- `-migration-url` `(string: "")` - If set, this value overrides the migration URL set in the configuration file, and specifies the URL use to connect to the database for migration. -Configuring this option can allow different permissions for the user running initialization or migration vs. a standard operation. -This value can refer to a direct database URL, or it can refer to a file on disk (`file://`) or an environment variable (env://) from which Boundary reads the URL. -- `-repair` `(string: "")` - If set, runs the repair function for the provided migration - version. - - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/delete.mdx b/website/content/docs/commands/delete.mdx deleted file mode 100644 index 6a69cfe06..000000000 --- a/website/content/docs/commands/delete.mdx +++ /dev/null @@ -1,46 +0,0 @@ ---- -layout: docs -page_title: delete - Command -description: >- - The "delete" command deletes existing resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# delete - -Command: `boundary delete` - -The `boundary delete` command lets you delete Boundary resources. -It is a generic command that runs a delete operation on a Boundary resource using the resource's ID. - -When you run this command, Boundary interprets it as the type-specific command. -For example, if you enter the `delete` command with a storage bucket ID, Boundary runs the `storage-buckets delete` command. -Help, error, or cURL output from the command may show the full command syntax. - -## Example - -This example deletes a storage bucket with the ID `sb_1234567890`: - -```shell-session -$ boundary delete -id sb_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary delete [resource ID] [args] -``` - - - -### Command options - -- `-id=` - The ID of the resource you want to delete. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/dev.mdx b/website/content/docs/commands/dev.mdx deleted file mode 100644 index 005ce8234..000000000 --- a/website/content/docs/commands/dev.mdx +++ /dev/null @@ -1,262 +0,0 @@ ---- -layout: docs -page_title: dev - Command -description: >- - The `dev` command starts a Boundary instance in a dev mode. Dev mode provides admin credentials for password authentication. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# dev - -Command: `boundary dev` - -The `dev` command starts a Boundary instance in a dev mode. Dev mode -provides admin credentials for password authentication. - -Dev mode brings up a fully functioning instance of Boundary which includes: - -- A controller server -- A worker server -- A Postgres database - -These components are ephemeral; therefore, data is not persisted. -Setting up an environment in dev mode is a convenient method for quick testing. - -## Examples - -The following example starts a Boundary instance in a dev mode: - -```shell-session -$ boundary dev -``` - -**Example output:** - - - -```plaintext -==> Boundary server configuration: - - [Bsr] AEAD Key Bytes: McoUxn6XMdaYdS8lb2bqjgvrZIaLWML0 - [Controller] AEAD Key Bytes: SA+ccZA42hj/7XRwYeq4c7OEeSoYT4Ds - [Recovery] AEAD Key Bytes: 9KJyjHcC35MPcz6VsfGczZn4KLCNXhz5 - [Worker-Auth] AEAD Key Bytes: Pgr4AbL+S6hThU6B0cyVOI7cqtoyCVrS - [Bsr] AEAD Type: aes-gcm - [Recovery] AEAD Type: aes-gcm - [Root] AEAD Type: aes-gcm - [Worker-Auth-Storage] AEAD Type: aes-gcm - [Worker-Auth] AEAD Type: aes-gcm - Cgo: disabled - Controller Public Cluster Addr: 127.0.0.1:9201 - Dev Database Container: infallible_mahavira - Dev Database Url: postgres://postgres:password@localhost:32769/boundary?sslmode=disable - Generated Admin Login Name: admin - Generated Admin Password: password - Generated Host Catalog Id: hcst_1234567890 - Generated Host Id: hst_1234567890 - Generated Host Set Id: hsst_1234567890 - Generated Ldap Auth Method Base Search DNs: users="ou=people,dc=example,dc=org" groups="ou=groups,dc=example,dc=org" - Generated Ldap Auth Method Host:Port: 127.0.0.1:64160 (does not have a root DSE; use simple bind) - Generated Ldap Auth Method Id: amldap_1234567890 - Generated Oidc Auth Method Id: amoidc_1234567890 - Generated Org Scope Id: o_1234567890 - Generated Password Auth Method Id: ampw_1234567890 - Generated Project Scope Id: p_1234567890 - Generated Target With Address Id: ttcp_1234567890 - Generated Target With Host Source Id: ttcp_0987654321 - Generated Unprivileged Login Name: user - Generated Unprivileged Password: password - Listener 1: tcp (addr: "127.0.0.1:9200", cors_allowed_headers: "[]", cors_allowed_origins: "[*]", cors_enabled: "true", max_request_duration: "1m30s", purpose: "api") - Listener 2: tcp (addr: "127.0.0.1:9201", max_request_duration: "1m30s", purpose: "cluster") - Listener 3: tcp (addr: "127.0.0.1:9203", max_request_duration: "1m30s", purpose: "ops") - Listener 4: tcp (addr: "127.0.0.1:9202", max_request_duration: "1m30s", purpose: "proxy") - Log Level: info - Mlock: supported: false, enabled: false - Version: Boundary v0.13.1 - Version Sha: db01791662a7126fbf4ea0a27b23b70acd20b17b - Worker Auth Current Key Id: september-viewing-rubdown-wrench-sliceable-valid-chute-retrace - Worker Auth Storage Path: (in-memory) - Worker Public Proxy Addr: 127.0.0.1:9202 - -==> Boundary server started! Log data will stream in below: -... -``` - - - -The generated admin username is `admin` and the password is `password`. - -## Usage - - - -```shell-session -$ boundary dev [options] -``` - - - - -### Command options - - -- `-api-listen-address` `(string: "")` - The address to bind for controller "api" - purposes. If the address begins with a forward slash, Boundary assumes it is a Unix - domain socket path. You can also specify an address using the - **BOUNDARY_DEV_CONTROLLER_API_LISTEN_ADDRESS** environment variable. - -- `-audit-events` `(string: "")` - If set, indicates whether you want to emit audit events. Supported values are `true` and `false`. - -- `-bsr-key` `(string: "")` - A valid, base64-encoded AES key to be used - for session recording. You can also specify the BSR key using the **BOUNDARY_DEV_BSR_KEY** - environment variable. - -- `-cluster-listen-address` `(string: "")` - The address to bind for controller - "cluster" purposes. If the address begins with a forward slash, Boundary assumes it is a Unix domain socket path. You can also specify an address using the - **BOUNDARY_DEV_CONTROLLER_CLUSTER_LISTEN_ADDRESS** environment variable. - -- `-combine-logs` - If set, sends both startup information and logs to stdout. - If you do not set this value, startup information goes - to stdout and logs are sent to stderr. The default is `false`. - -- `-container-image` `(string: "")` - A container image to use. - This value must be in `:` format - -- `-controller-only` - If set, indicates that only a dev controller should be - started instead of both a dev controller and dev worker. The default value is `false`. - -- `-controller-public-cluster-address` `(string: "")` - The public address at which - the controller is reachable for cluster tasks, such as worker connections. - You can also specify the public address using the **BOUNDARY_DEV_CONTROLLER_PUBLIC_CLUSTER_ADDRESS** environment variable. - -- `-database-url` `(string: "")` - The URL that Boundary uses to connect to - the database for initialization, otherwise a Docker container is - started. This URL can refer to a file on disk (`file://`) from which a URL is read, an environment variable (`env://`) from which the URL is read, or a direct database URL. - -- `-disable-database-destruction` - If set, creates a database automatically in Docker. - The database is not removed when the dev server is shut down. - The default value is `false`. - -- `-event-allow-filter` `(string: "")` - An optional allow filter for every event. - You can specfiy this value multiple times. - -- `-event-deny-filter` `(string: "")` - An optional deny filter for every event. - You can specify this value multiple times. - -- `-event-format` `(string: "")` - The event format. - The following values are supported: - - - `cloudevents-json` - - `cloudevents-text` - - `hclog-json` - - `hclog-text` - -- `-host-address` `(string: "")` - The address to use for the default host that is - created. This value must be a bare host or IP address, it cannot be a port. The default value is `localhost`. You can also specify a host address using the **BOUNDARY_DEV_HOST_ADDRESS** environment variable. - -- `-id-suffix` `(string: "")` - If set, designates that auto-created resources use this - suffix value for their identifier, along with any resource-specific prefix, if set. This value must be 10 alphanumeric characters. As an example, if this is set to `1234567890`, - the generated password auth method ID is `ampw_1234567890`, the - generated TCP target ID is `ttcp_1234567890`, and so on. - - This value must be different from any `-secondary-id-suffix` or **BOUNDARY_DEV_SECONDARY_ID_SUFFIX** value. - The default is `1234567890`. You can also configure a suffix using the **BOUNDARY_DEV_ID_SUFFIX** environment variable. - -- `-log-format` `(string: "")` - The log format. Supported values are `standard` and - `json`. - -- `-log-level` `(string: "")` - The desired log verbosity level. - Supported values, in order of more detail to less, are: - - - `trace` - - `debug` - - `info` - - `warn` - - `err` - - You can also specify log verbosity level using the **BOUNDARY_LOG_LEVEL** environment variable. - -- `-login-name` `(string: "")` - The initial admin login name. If you set this value to an empty - string, Boundary autogenerates a login name. The default value is `admin`. You can also specify a login name using the **BOUNDARY_DEV_LOGIN_NAME** environment variable. - -- `-observation-events` `(string: "")` - If set, indicates whether you want Boundary to emit observation events. Supported values are `true` and `false`. - -- `-ops-listen-address` `(string: "")` - An address to bind to for "ops" purpose. - If the address begins with a forward slash, Boundary assumes it is a Unix domain - socket path. You can also specify an address using the - **BOUNDARY_DEV_OPS_LISTEN_ADDRESS** environment variable. - -- `-password` `(string: "")` - The initial admin login password. If you set this value to an empty - string, Boundary autogenerates a password. The default value is `password`. You can also specify an initial admin login password using the **BOUNDARY_DEV_PASSWORD** environment variable. - -- `-plugin-execution-dir` `(string: "")` - The directory where Boundary should write - plugins that it executes. - If you do not set a value, Boundary defaults to using the system temp directory. - You can also specify a directory using the **BOUNDARY_DEV_PLUGIN_EXECUTION_DIR** - environment variable. - -- `-proxy-listen-address` `(string: "")` - The address to bind for worker "proxy" - purposes. You can also specify an address using the - **BOUNDARY_DEV_WORKER_PROXY_LISTEN_ADDRESS** environment variable. - -- `-recovery-key` `(string: "")` - The base64'd 256-bit AES key to use - for recovery operations. You can also specify a recovery key using the - **BOUNDARY_DEV_RECOVERY_KEY** environment variable. - -- `-secondary-id-suffix` `(string: "")` - If set, indicates that secondary auto-created - resources should use the given value for their identifier, along with their - resource-specific prefix, if set. This value must be 10 alphanumeric characters. Currently it is only used for the target resource. The secondary suffix must be different from the `-id-suffix` and **BOUNDARY_DEV_ID_SUFFIX** values. The default value is `0987654321`. You can also specify a secondary suffix using the **BOUNDARY_DEV_SECONDARY_ID_SUFFIX** environment variable. - -- `-system-events` `(string: "")` - If set, indicates whether you want Boundary to emit system events. Supported values are `true` and `false`. - -- `-target-default-port` `(int: 0)` - The default port to use for the default target - that is created. The default value is `22`. You can also specify a default target port using the **BOUNDARY_DEV_TARGET_DEFAULT_PORT** environment variable. - -- `-target-session-connection-limit` `(int: 0)` - The maximum number of connections - per session to set on the default target. A value of `-1` means unlimited. The default is - `-1`. You can also specify the maximum number of connections using the - **BOUNDARY_DEV_TARGET_SESSION_CONNECTION_LIMIT** environment variable. - -- `-target-session-max-seconds` `(int: 0)` - The maximum number of seconds to use for sessions on the default target. -You can also specify the maximum number of seconds using the **BOUNDARY_DEV_TARGET_SESSION_MAX_SECONDS** environment variable. - -- `-ui-passthrough-dir` `(string: "")` - A passthrough directory in the - webserver at /. You can also specify a passthrough directory using the - **BOUNDARY_DEV_UI_PASSTHROUGH_DIR** environment variable. - -- `-unprivileged-login-name` `(string: "")` - The initial unprivileged user's name. If - you set this value to an empty string, Boundary automatically generates the user name. The default value is `user`. - You can also specify the user name using the **BOUNDARY_DEV_UNPRIVILEGED_LOGIN_NAME** - environment variable. - -- `-unprivileged-password` `(string: "")` - The initial unprivileged user login - password. If you set this value to an empty string, Boundary automatically generates the password. The default value is `password`. You can also specify the password using the - **BOUNDARY_DEV_UNPRIVILEGED_PASSWORD** environment variable. - -- `-worker-auth-enable-debugging` - If set, turns on debug logging for the - worker authentication process. The default value is `false`. - -- `-worker-auth-key` `(string: "")` - A valid, base64-encoded AES key to - use for worker-auth purposes You can also specify a key using the - **BOUNDARY_DEV_WORKER_AUTH_KEY** environment variable. - -- `-worker-auth-method` `(string: "")` - If set, lets you specify how the generated - worker authenticates to the controller. The default is `random`. - -- `-worker-auth-storage-dir` `(string: "")` - The directory in which to store - worker authentication credentials when in dev mode. If you do not set this value, Boundary uses in-memory storage or a temporary directory. - -- `-worker-auth-storage-skip-cleanup` - If set, prevents deletion of - worker credential storage directory, if set. This value has no effect unless - you specfiy a `worker-auth-storage-dir` value. The default value is `false`. - -- `-worker-public-address` `(string: "")` - The public address at which the worker - is reachable for session proxying. You can also specify an address using the - **BOUNDARY_DEV_WORKER_PUBLIC_ADDRESS** environment variable. - -- `-worker-recording-storage-dir` `(string: "")` - The directory in which to - store worker session recordings when in dev mode. If you do not specify a directory, Boundary creates a temporary directory. Session recording is only available for Boundary Enterprise and HCP Boundary. \ No newline at end of file diff --git a/website/content/docs/commands/groups/add-members.mdx b/website/content/docs/commands/groups/add-members.mdx deleted file mode 100644 index 20d07a425..000000000 --- a/website/content/docs/commands/groups/add-members.mdx +++ /dev/null @@ -1,80 +0,0 @@ ---- -layout: docs -page_title: groups add-members - Command -description: >- - The "groups add-members" command adds users as members of a group resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# groups add-members - -Command: `boundary groups add-members` - -The `groups add-members` command lets you add users as members of a group. - -## Examples - -The following example adds a user with ID, `u_qboadM3Q25` to the group with ID, `g_XzlDiNLgoz`: - -```shell-session -$ boundary groups add-members -id g_XzlDiNLgoz -member u_qboadM3Q25 -``` - -**Example output:** - - - -```plaintext -Group information: - Created Time: Thu, 24 Aug 2023 09:51:44 PDT - Description: A test group - ID: g_XzlDiNLgoz - Name: group01 - Updated Time: Thu, 24 Aug 2023 11:12:31 PDT - Version: 2 - - Scope: - ID: o_R0wbo0H6Zl - Name: quick-start-org - Parent Scope ID: global - Type: org - - Authorized Actions: - no-op - read - update - delete - add-members - set-members - remove-members - - Members: - ID: u_qboadM3Q25 - Scope ID: o_R0wbo0H6Zl -``` - - - - -## Usage - - - -```shell-session -$ boundary groups add-members [options] [args] -``` - - - - -### Command options - -- `-id` `(string: "")` - The ID of the group you want to add a member to. -- `-member` `(string: "")` - The ID of the user you want to add to the group. -You can specify the `-member` flag multiple times. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/groups/create.mdx b/website/content/docs/commands/groups/create.mdx deleted file mode 100644 index dbe83c9c5..000000000 --- a/website/content/docs/commands/groups/create.mdx +++ /dev/null @@ -1,80 +0,0 @@ ---- -layout: docs -page_title: groups create - Command -description: >- - The "groups create" command creates a new group resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# groups create - -Command: `boundary groups create` - -The `groups create` command lets you create a new group. - -## Examples - -The following example creates a group, `group01` in the scope `o_R0wbo0H6Zl`: - -```shell-session -$ boundary groups create -name "group01" \ - -description "A test group" \ - -scope-id o_R0wbo0H6Zl -``` - -**Example output:** - - - -```plaintext -Group information: - Created Time: Thu, 24 Aug 2023 09:51:44 PDT - Description: A test group - ID: g_XzlDiNLgoz - Name: group01 - Updated Time: Thu, 24 Aug 2023 09:51:44 PDT - Version: 1 - - Scope: - ID: o_R0wbo0H6Zl - Name: quick-start-org - Parent Scope ID: global - Type: org - - Authorized Actions: - no-op - read - update - delete - add-members - set-members - remove-members -``` - - - - -## Usage - - - -```shell-session -$ boundary groups create [options] [args] -``` - - - - -### Command options - -- `-description` `(string: "")` - A description to set on the new group. -- `-name` `(string: "")` - A name to set on the new group. -- `-scope-id` `(string: "")` - The scope in which to create the group. -The default value is `global`. -You can also specify a scope using the **BOUNDARY_SCOPE_ID** environment variable. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/groups/delete.mdx b/website/content/docs/commands/groups/delete.mdx deleted file mode 100644 index 8893993cf..000000000 --- a/website/content/docs/commands/groups/delete.mdx +++ /dev/null @@ -1,44 +0,0 @@ ---- -layout: docs -page_title: groups delete - Command -description: >- - The "groups delete" command deletes an existing group resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# groups delete - -Command: `boundary groups delete` - -The `groups delete` command lets you delete an existing group. - - -## Examples - -The following example deletes a group with the given ID, `g_FNVVhAd0on`. - -```shell-session -$ boundary groups delete -id g_FNVVhAd0on -The delete operation completed successfully. -``` - -## Usage - - - -```shell-session -$ boundary groups delete [options] [args] -``` - - - - -### Command options - -- `-id` `(string: "")` - The ID of the group to delete. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/groups/index.mdx b/website/content/docs/commands/groups/index.mdx deleted file mode 100644 index c87ac029e..000000000 --- a/website/content/docs/commands/groups/index.mdx +++ /dev/null @@ -1,97 +0,0 @@ ---- -layout: docs -page_title: groups - Command -description: >- - The "groups" command performs operations on group resources. A group represents a collection of users with the same access control. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# groups - -Command: `boundary groups` - -The `groups` command lets you create and manage group resources in Boundary. - -A group in Boundary is a resource that represents a collection of users that are treated equally for the purposes of access control. -A group is a principal, which means it can be assigned to roles. -Roles assigned to a group are indirectly assigned to the users in the group, and users receive all permissions of the assigned roles. -You can define groups at the global, organization, or project scope. - -## Examples - -The following example creates a group, `group01` in a scope with the id `o_R0wbo0H6Zl`: - -```shell-session -$ boundary groups create -name "group01" \ - -description "A test group" \ - -scope-id o_R0wbo0H6Zl -``` - -**Example output:** - - - -```plaintext -Group information: - Created Time: Thu, 24 Aug 2023 09:51:44 PDT - Description: A test group - ID: g_XzlDiNLgoz - Name: group01 - Updated Time: Thu, 24 Aug 2023 09:51:44 PDT - Version: 1 - - Scope: - ID: o_R0wbo0H6Zl - Name: quick-start-org - Parent Scope ID: global - Type: org - - Authorized Actions: - no-op - read - update - delete - add-members - set-members - remove-members -``` - - - -## Usage - - - -```shell-session -Usage: boundary groups [sub command] [options] [args] - - # ... - -Subcommands: - add-members Add members to a group - create Create a group - delete Delete a group - list List a group - read Read a group - remove-members Remove members from a group - set-members Set the full contents of the members on a group - update Update a group -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [add-members](/boundary/docs/commands/groups/add-members) -- [create](/boundary/docs/commands/groups/create) -- [delete](/boundary/docs/commands/groups/delete) -- [list](/boundary/docs/commands/groups/list) -- [read](/boundary/docs/commands/groups/read) -- [remove-members](/boundary/docs/commands/groups/remove-members) -- [set-members](/boundary/docs/commands/groups/set-members) -- [update](/boundary/docs/commands/groups/update) diff --git a/website/content/docs/commands/groups/list.mdx b/website/content/docs/commands/groups/list.mdx deleted file mode 100644 index a3c6cb1c1..000000000 --- a/website/content/docs/commands/groups/list.mdx +++ /dev/null @@ -1,104 +0,0 @@ ---- -layout: docs -page_title: groups list - Command -description: >- - The "groups list" command lists the available group resources within an enclosing scope or resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# groups list - -Command: `boundary groups list` - -The `groups list` command lists all groups within an enclosing scope or resource. - -## Examples - -The following example lists all groups defined within the scope `o_R0wbo0H6Zl`: - -```shell-session -$ boundary groups list -scope-id o_R0wbo0H6Zl -``` - -**Example output:** - - - -```plaintext -Group information: - ID: g_XzlDiNLgoz - Version: 2 - Name: group01 - Description: A test group - Authorized Actions: - no-op - read - update - delete - add-members - set-members - remove-members - - ID: g_FNVVhAd0on - Version: 1 - Name: webdev - Description: Web dev group - Authorized Actions: - no-op - read - update - delete - add-members - set-members - remove-members - - ID: g_9SpLKOoTse - Version: 1 - Name: support - Description: Support engineering group - Authorized Actions: - no-op - read - update - delete - add-members - set-members - remove-members -``` - - - -## Usage - - - -```shell-session -$ boundary groups list [options] [args] -``` - - - - -### Command options - -- `-filter` `(string: "")` - If set, Boundary filters the list operation before the results are returned. -The filter operates against each item in the list. -We recommend that you use single quotes, because the filters contain double quotes. -Refer to the [Filtering and listing resources documentation](/boundary/docs/filtering) for more details. -- `-recursive` - If set, runs the list operation recursively on any child scopes, if the type supports it. -The default value is `false`. -- `-scope-id ``(string: "")` - The scope from which to list the groups. -The default value is `global`. -You can also specify this value using the **BOUNDARY_SCOPE_ID** environment variable. -- `list_token` (optional) - An opaque token that is returned from the previous `list` response. -If you do not supply a value, pagination starts from the beginning. -- `page_size` (optional) - An unsigned integer that indicates the number of items that should be included on the page of search results. -If you do not provide a value, or if you provide a value of `0`, Boundary uses the default page size of 1000 items. -If you configure it, the `page_size` value overrides the default page size. -Controller administrators can also configure a `max_page_size` option that constrains the maximum page size a user can request. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/groups/read.mdx b/website/content/docs/commands/groups/read.mdx deleted file mode 100644 index 6361983a7..000000000 --- a/website/content/docs/commands/groups/read.mdx +++ /dev/null @@ -1,78 +0,0 @@ ---- -layout: docs -page_title: groups read - Command -description: >- - The "groups read" command retrieves the details of an existing group resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# groups read - -Command: `boundary groups read` - -The `groups read` command retrieves the group details for a given ID. - - -## Examples - -The following example retrieves the group information for a group with the ID, `g_XzlDiNLgoz`: - -```shell-session -$ boundary groups read -id g_XzlDiNLgoz -``` - -**Example output:** - - - -```plaintext -Group information: - Created Time: Thu, 24 Aug 2023 09:51:44 PDT - Description: A test group - ID: g_XzlDiNLgoz - Name: group01 - Updated Time: Thu, 24 Aug 2023 11:12:31 PDT - Version: 2 - - Scope: - ID: o_R0wbo0H6Zl - Name: quick-start-org - Parent Scope ID: global - Type: org - - Authorized Actions: - no-op - read - update - delete - add-members - set-members - remove-members - - Members: - ID: u_qboadM3Q25 - Scope ID: o_R0wbo0H6Zl -``` - - - -## Usage - - - -```shell-session -$ boundary groups read [options] [args] -``` - - - - -### Command options - -- `-id` `(string: "")` - The ID of the group to retrieve information for. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/groups/remove-members.mdx b/website/content/docs/commands/groups/remove-members.mdx deleted file mode 100644 index 1f16d623b..000000000 --- a/website/content/docs/commands/groups/remove-members.mdx +++ /dev/null @@ -1,81 +0,0 @@ ---- -layout: docs -page_title: groups remove-members - Command -description: >- - The "groups remove-members" command removes members from a group resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# groups remove-members - -Command: `boundary groups remove-members` - -The `groups remove-members` command removes users from a group, given its ID. - -## Examples - -The following example removes a user with the ID `u_J5l9FWB7yq` from a group with the ID `g_FNVVhAd0on`: - -```shell-session -$ boundary groups remove-members -id g_FNVVhAd0on \ - -member u_J5l9FWB7yq -``` - -**Example output:** - - - -```plaintext -Group information: - Created Time: Thu, 24 Aug 2023 13:58:23 PDT - Description: Web dev group - ID: g_FNVVhAd0on - Name: webdev - Updated Time: Thu, 24 Aug 2023 14:21:05 PDT - Version: 3 - - Scope: - ID: o_R0wbo0H6Zl - Name: quick-start-org - Parent Scope ID: global - Type: org - - Authorized Actions: - no-op - read - update - delete - add-members - set-members - remove-members - - Members: - ID: u_ad8tbsXHJP - Scope ID: o_R0wbo0H6Zl -``` - - - -The output displays the group information. - -## Usage - - - -```shell-session -$ boundary groups remove-members [options] [args] -``` - - - -### Command options - -- `-id` `(string: "")` - The ID of the group from which to remove a member. -- `-member` `(string: "")` - The ID of the user to be removed from the group. -You can specify the `-member` flag multiple times. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/groups/set-members.mdx b/website/content/docs/commands/groups/set-members.mdx deleted file mode 100644 index 212b0968f..000000000 --- a/website/content/docs/commands/groups/set-members.mdx +++ /dev/null @@ -1,85 +0,0 @@ ---- -layout: docs -page_title: groups set-members - Command -description: >- - The "groups set-members" command configures a complete set of users as members in a group resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# groups set-members - -Command: `boundary groups set-members` - -The `groups set-members` command lets you configure the complete set of users in a group. - -## Examples - -The following example set users with the IDs, "`u_ad8tbsXHJP`" and "`u_J5l9FWB7yq`" as group members in a group with the group ID `g_FNVVhAd0on`: - -```shell-session -$ boundary groups set-members -id g_FNVVhAd0on \ - -member u_ad8tbsXHJP \ - -member u_J5l9FWB7yq -``` - -**Example output:** - - - -```plaintext -Group information: - Created Time: Thu, 24 Aug 2023 13:58:23 PDT - Description: Web dev group - ID: g_FNVVhAd0on - Name: webdev - Updated Time: Thu, 24 Aug 2023 14:12:35 PDT - Version: 2 - - Scope: - ID: o_R0wbo0H6Zl - Name: quick-start-org - Parent Scope ID: global - Type: org - - Authorized Actions: - no-op - read - update - delete - add-members - set-members - remove-members - - Members: - ID: u_ad8tbsXHJP - Scope ID: o_R0wbo0H6Zl - - ID: u_J5l9FWB7yq - Scope ID: o_R0wbo0H6Z -``` - - - -The output displays the group information. - -## Usage - - - -```shell-session -$ boundary groups set-members [options] [args] -``` - - - -### Command options - -- `-id` `(string: "")` - The ID of the group on which to set members. -- `-member` `(string: "")` - The ID of the user or users you want to add to the group. -You can specify the `-member` flag multiple times. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/groups/update.mdx b/website/content/docs/commands/groups/update.mdx deleted file mode 100644 index 8edf39bd3..000000000 --- a/website/content/docs/commands/groups/update.mdx +++ /dev/null @@ -1,96 +0,0 @@ ---- -layout: docs -page_title: groups update - Command -description: >- - The "groups update" command updates an existing group resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# groups update - -Command: `boundary groups update` - -The `groups update` command lets you update an existing group's information. - -## Examples - -In this example, an existing group (`g_9SpLKOoTse`) has the following details: - - - -```plaintext -Group information: - Created Time: Thu, 24 Aug 2023 13:58:50 PDT - Description: Support engineering group - ID: g_9SpLKOoTse - Name: support - Updated Time: Thu, 24 Aug 2023 13:58:50 PDT - Version: 3 - -...snip... -``` - - - -The following command updates the group's `description` and `version`: - -```shell-session -$ boundary groups update -id g_9SpLKOoTse \ - -description "Customer support for product XXX" \ - -version 4 -``` - -**Example output:** - - - -```plaintext -Group information: - Created Time: Thu, 24 Aug 2023 13:58:50 PDT - Description: Customer support for product XXX - ID: g_9SpLKOoTse - Name: support - Updated Time: Thu, 24 Aug 2023 14:33:18 PDT - Version: 4 - - Scope: - ID: o_R0wbo0H6Zl - Name: quick-start-org - Parent Scope ID: global - Type: org - - Authorized Actions: - no-op - read - update - delete - add-members - set-members - remove-members -``` - - - -## Usage - - - -```shell-session -$ boundary groups update [options] [args] -``` - - - -### Command options - -- `-description` `(string: "")` - The description to set on the group. -- `-id` `(string: "")` - The ID of the group to update. -- `-name` `(string: "")` - The name to set on the group. -- `-version` `(string: "")` - The version of the group to update. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/host-catalogs/create.mdx b/website/content/docs/commands/host-catalogs/create.mdx deleted file mode 100644 index fcae40885..000000000 --- a/website/content/docs/commands/host-catalogs/create.mdx +++ /dev/null @@ -1,158 +0,0 @@ ---- -layout: docs -page_title: host-catalogs create - Command -description: >- - The "host-catalogs create" command creates a new host catalog resource. You can create plugin or static host catalog types. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# host-catalogs create - -Command: `host-catalogs create` - -The `host-catalogs create` command lets you create a new host catalog. - -## Example - -This example creates a static host catalog with the name `prodops` and the description `For ProdOps usage`: - -```shell-session -$ boundary host-catalogs create static -name prodops -description "For ProdOps usage" -``` - -## Usage - - - -```shell-session -$ boundary host-catalogs create [type] [options] [args] - -Please see the typed subcommand help for detailed usage information. - -Subcommands: - plugin Create a plugin-type host catalog - static Create a static-type host catalog -``` - - - -### Usages by type - -You can create plugin or static host catalog types. - - - - -The `boundary host-catalogs create plugin` command lets you create a plugin type host catalog. - -#### Example - -This example creates a plugin type host catalog with the name `prodops` and the description `Plugin host-catalog for ProdOps`, and adds it to a scope with the ID `p_1234567890`. - -```shell-session -$ boundary host-catalogs create plugin -scope-id p_1234567890 -name prodops -description "Plugin host-catalog for ProdOps" -``` - -#### Usage - - - -```shell-session -$ boundary host-catalogs create plugin [options] [args] -``` - - - -#### Command options - -- `-description=` - The description to set on the plugin host catalog. -- `-name=` - The name to set on the plugin host catalog. -- `-plugin-id=` - The ID of the plugin associated with the host catalog you want to create. -- `-plugin-name=` - The name of the plugin associated with the host catalog you want to create. -- `-scope-id=` - The scope in which you want to create the host catalog. -The default scope is `global`. -You can also specify the scope using the **BOUNDARY_SCOPE_ID** environment variable. -- `-worker-filter=` A boolean expression to filter which workers can handle dynamic host catalog commands for this host catalog. - -#### Attribute options - -- `-attr` - A key=value pair to add to the request's attribute map. -This option can also be a key value only, which sets a JSON null as the value. -If you provide a value, Boundary automatically infers the type. -You can override the type using `-string-attr`, `-bool-attr`, or `-num-attr`. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. -- `-attributes=` - A JSON map value that you can use as the entirety of the request's attributes map. -Usually this value is sourced from a file using the `file://` syntax. -This option is exclusive with other `attr` flags. -- `-bool-attr` - A key=value Boolean value that you can add to the request's attributes map. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. -- `-num-attr` - A key=value numeric value that you can add to the request's attributes map. -You can specify this value multiple times. -This attribute supports referencing values from files using `file://` and environment variables using `env://`. -- `-string-attr` - A key=value string value that you can add to the request's attributes map. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. - -#### Secrets options - -- `-bool-secret` - A key=value Boolean value that you can add to the request's secrets map. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. -- `-num-secret` - A key=value numeric value that you can add to the request's secrets map. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. -- `-secret` - A key=value pair that you can add to the request's secrets map. -This option can also be a key value only, which sets a JSON null as the value. -If you provide a value, Boundary automatically infers the type. -You can override the type using `-string-secret`, `-bool-secret`, or `-num-secret`. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. -- `-secrets=` - A JSON map value that you can use as the entirety of the request's secrets map. -Usually this value is sourced from file using `file://` syntax. -This option is exclusive with other secret flags. -- `-string-secret` - A key=value string value that you can add to the request's attributes map. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. - - - - - -The `boundary host-catalogs create static` command lets you create a static type host catalog. - -#### Example - -This example creates a static type host catalog with the name `prodops` and the description `Static host-catalog for ProdOps` and adds it to the scope `p_1234567890`: - -```shell-session -$ boundary host-catalogs create static -scope-id p_1234567890 -name prodops -description "Static host-catalog for ProdOps" -``` - -#### Usage - - - -```shell-session -$ boundary host-catalogs create static [options] [args] -``` - - - -#### Command options - -- `-description=` - The description to set on the static host catalog. -- `-name=` - The name to set on the static host catalog. -- `-scope-id=` - The scope in which to create the static host catalog. -The default scope is `global`. -You can also specify the scope using the **BOUNDARY_SCOPE_ID** environment variable, - - - - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/host-catalogs/delete.mdx b/website/content/docs/commands/host-catalogs/delete.mdx deleted file mode 100644 index 5e6ed4374..000000000 --- a/website/content/docs/commands/host-catalogs/delete.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: host-catalogs delete - Command -description: >- - The "host-catalogs delete" command deletes a existing host catalog resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# host-catalogs delete - -Command: `host-catalogs delete` - -The `host-catalogs delete` command lets you delete an existing host catalog by providing the ID. - -## Example - -This example deletes a host catalog with the ID `_1234567890`: - -```shell-session -$ boundary host-catalogs delete -id _1234567890 -``` - -## Usage - - - -```shell-session -$ boundary host-catalogs delete [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the host catalog to delete. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/host-catalogs/index.mdx b/website/content/docs/commands/host-catalogs/index.mdx deleted file mode 100644 index 9bf273e6f..000000000 --- a/website/content/docs/commands/host-catalogs/index.mdx +++ /dev/null @@ -1,51 +0,0 @@ ---- -layout: docs -page_title: host-catalogs - Command -description: >- - The "host-catalogs" command performs operations on Boundary host catalog resources. Host catalogs contain hosts and host sets. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# host-catalogs - -Command: `boundary host-catalogs` - -The `host-catalogs` command lets you perform operations on Boundary host catalog resources. - -## Example - -The following example reads the information from a host catalog with the ID `hcst_1234567890`: - -```shell-session -$ boundary host-catalogs read -id hcst_1234567890 -``` - -## Usage - - - -```shell-session -Usage: boundary host-catalogs [options] [args] - # ... -Subcommands: - create Create a host catalog - delete Delete a host catalog - list List a host catalog - read Read a host catalog - update Update a host catalog -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [create](/boundary/docs/commands/host-catalogs/create) -- [delete](/boundary/docs/commands/host-catalogs/delete) -- [list](/boundary/docs/commands/host-catalogs/list) -- [read](/boundary/docs/commands/host-catalogs/read) -- [update](/boundary/docs/commands/host-catalogs/update) \ No newline at end of file diff --git a/website/content/docs/commands/host-catalogs/list.mdx b/website/content/docs/commands/host-catalogs/list.mdx deleted file mode 100644 index c60110151..000000000 --- a/website/content/docs/commands/host-catalogs/list.mdx +++ /dev/null @@ -1,55 +0,0 @@ ---- -layout: docs -page_title: host-catalogs list - Command -description: >- - The "host-catalogs list" command lists the available host catalog resourcess within a scope or resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# host-catalogs list - -Command: `boundary host-catalogs list` - -The `boundary host-catalogs list` command lets you list the Boundary host catalogs within a given scope or resource. - -## Example - -This example lists all host catalogs in the scope `_1234567890`. -The `recursive` option means Boundary runs the operation recursively on any child scopes, if applicable: - -```shell-session -$ boundary host-catalogs list -scope-id _1234567890 -recursive -``` - -## Usage - - - -```shell-session -$ boundary host-catalogs list [options] [args] -``` - - - -### Command options - -- `-filter=` - If set, Boundary filters the list operation before the results are returned. -The filter operates against each item in the list. -We recommend that you use single quotes, because the filters contain double quotes. -Refer to the [Filtering and listing resources documentation](/boundary/docs/filtering) for more details. -- `-recursive` - If set, runs the list operation recursively on any child scopes, if the type supports it. -- `-scope-id=` - The scope from which you want to list host catalogs. -The default scope is `global`. -You can also specify the scope using the **BOUNDARY_SCOPE_ID** environment variable. -- `list_token` (optional) - An opaque token that is returned from the previous `list` response. -If you do not supply a value, pagination starts from the beginning. -- `page_size` (optional) - An unsigned integer that indicates the number of items that should be included on the page of search results. -If you do not provide a value, or if you provide a value of `0`, Boundary uses the default page size of 1000 items. -If you configure it, the `page_size` value overrides the default page size. -Controller administrators can also configure a `max_page_size` option that constrains the maximum page size a user can request. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/host-catalogs/read.mdx b/website/content/docs/commands/host-catalogs/read.mdx deleted file mode 100644 index 2bf37cf22..000000000 --- a/website/content/docs/commands/host-catalogs/read.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: host-catalogs read - Command -description: >- - The "host-catalogs read" command retrieves host catalog information for a host catalog resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# host-catalogs read - -Command: `boundary host-catalogs read` - -The `boundary host-catalogs read` command lets you read information about a Boundary host catalog using its given ID. - -## Example - -This example reads the details for a host catalog with the ID `_1234567890`: - -```shell-session -$ boundary host-catalogs read -id _1234567890 -``` - -## Usage - - - -```shell-session -$ boundary host-catalogs read [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the host catalog whose information you want to read. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/host-catalogs/update.mdx b/website/content/docs/commands/host-catalogs/update.mdx deleted file mode 100644 index d45c46a69..000000000 --- a/website/content/docs/commands/host-catalogs/update.mdx +++ /dev/null @@ -1,155 +0,0 @@ ---- -layout: docs -page_title: host-catalogs update - Command -description: >- - The "host-catalogs update" command updates an existing host catalog resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# host-catalogs update - -Command: `host-catalogs update` - -The `host-catalogs update` command lets you update an existing host catalog. - -## Example - -This example updates a static host catalog with the ID `hcst_1234567890` to add the name `devops` and the description `For DevOps usage`: - -```shell-session -$ boundary host-catalogs update static -id hcst_1234567890 -name devops -description "For DevOps usage" -``` - -## Usage - - - -```shell-session -$ boundary host-catalogs update [type] [options] [args] - -Please see the typed subcommand help for detailed usage information. - -Subcommands: - plugin Update a plugin-type host catalog - static Update a static-type host catalog -``` - - - -### Usages by type - -You can update plugin or static host set types. - - - - -The `boundary host-catalogs update plugin` command lets you update a plugin type host catalog. - -#### Example - -This example updates a plugin type host catalog with the ID `hc_1234567890` to add the name `devops` and the description `Plugin host-catalog for DevOps`. - -```shell-session -$ boundary host-catalogs update plugin -id hc_1234567890 -name "devops" -description "Plugin host-catalog for DevOps" -``` - -#### Usage - - - -```shell-session -$ boundary host-catalogs update plugin [options] [args] -``` - - - -#### Command options - -- `-description=` - The description to set on the plugin host catalog. -- `-id=` - The ID of the plugin type host catalog to update. -- `-name=` - The name to set on the plugin host catalog. -- `-version=` - The version of the plugin host catalog to update. -If you do not specify a version, the command automatically performs a check-and-set. - -#### Attribute options - -- `-attr` - A key=value pair to add to the request's attribute map. -This option can also be a key value only, which sets a JSON null as the value. -If you provide a value, Boundary automatically infers the type. -You can override the type using `-string-attr`, `-bool-attr`, or `-num-attr`. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. -- `-attributes=` - A JSON map value that you can use as the entirety of the request's attributes map. -Usually this value is sourced from a file using the `file://` syntax. -This option is exclusive with other `attr` flags. -- `-bool-attr` - A key=value Boolean value that you can add to the request's attributes map. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. -- `-num-attr` - A key=value numeric value that you can add to the request's attributes map. -You can specify this value multiple times. -This attribute supports referencing values from files using `file://` and environment variables using `env://`. -- `-string-attr` - A key=value string value that you can add to the request's attributes map. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. - -### Secrets options - -- `-bool-secret` - A key=value Boolean value that you can add to the request's secrets map. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. -- `-num-secret` - A key=value numeric value that you can add to the request's secrets map. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. -- `-secret` - A key=value pair that you can add to the request's secrets map. -This option can also be a key value only, which sets a JSON null as the value. -If you provide a value, Boundary automatically infers the type. -You can override the type using `-string-secret`, `-bool-secret`, or `-num-secret`. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. -- `-secrets=` - A JSON map value that you can use as the entirety of the request's secrets map. -Usually this value is sourced from file using `file://` syntax. -This option is exclusive with other secret flags. -- `-string-secret` - A key=value string value that you can add to the request's attributes map. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. - - - - - -The `boundary host-catalogs update static` command lets you update a static type host catalog. - -#### Example - -This example updates a static type host catalog with the ID `hcst_1234567890` to add the name `devops` and the description `Static host-catalog for DevOps`: - -```shell-session -$ boundary host-catalogs update static -id hcst_1234567890 -name "devops" -description "Static host-catalog for DevOps" -``` - -#### Usage - - - -```shell-session -$ boundary host-catalogs update static [options] [args] -``` - - - -#### Command options - -- `-description=` - The description to set on the static host catalog. -- `-id=` - The ID of the static type host catalog you want to update. -- `-name=` - The name to set on the static host catalog. -- `-version=` - The version of the static type host catalog you want to update. -If you do not specify a version, the command automatically performs a check-and-set. - - - - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/host-sets/add-hosts.mdx b/website/content/docs/commands/host-sets/add-hosts.mdx deleted file mode 100644 index 73391f997..000000000 --- a/website/content/docs/commands/host-sets/add-hosts.mdx +++ /dev/null @@ -1,45 +0,0 @@ ---- -layout: docs -page_title: host-sets add-hosts - Command -description: >- - The "host-sets add-hosts" command adds new hosts to host set resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# host-sets add-hosts - -Command: `host-sets add-hosts` - -The `host-sets add-hosts` command lets you add hosts to host sets, if the types match and it is allowed by the host set type. - -## Example - -This example adds the hosts `hst_1234567890` and `hst_0987654321` to the host set `hsst_1234567890`: - -```shell-session -$ boundary host-sets add-hosts -id hsst_1234567890 -host hst_1234567890 -host hst_0987654321 -``` - -## Usage - - - -```shell-session -$ boundary host-sets add-hosts [options] [args] -``` - - - -### Command options - -- `-host=` - The hosts you want to add to the host set. -You can specify multiple hosts. -- `-id=` - The ID of the host set you want to add hosts to. -- `-version=` The version of the host set you want to add hosts to. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/host-sets/create.mdx b/website/content/docs/commands/host-sets/create.mdx deleted file mode 100644 index b38ce85cf..000000000 --- a/website/content/docs/commands/host-sets/create.mdx +++ /dev/null @@ -1,146 +0,0 @@ ---- -layout: docs -page_title: host-sets create - Command -description: >- - The "host-sets create" command creates a new host set resource. You can create plugin or static type host sets. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# host-sets create - -Command: `host-sets create` - -The `host-sets create` command lets you create a new host set. - -## Example - -This example creates a static host set with the name `prodops` and the description `For ProdOps usage`: - -```shell-session -$ boundary host-sets create static -name prodops -description "For ProdOps usage" -``` - -## Usage - - - -```shell-session -$ boundary host-sets create [type] [options] [args] - -Please see the typed subcommand help for detailed usage information. - -Subcommands: - plugin Create a plugin-type host set - static Create a static-type host set -``` - - - -### Usages by type - -You can create plugin or static type host sets. - - - - -The `boundary host-sets create plugin` command lets you create a plugin type host set. - -#### Example - -This example creates a plugin type host set with the name `prodops` and the description `Plugin host-set for ProdOps`, and adds it to a host catalog with the ID `hcst_1234567890`. - -```shell-session -$ boundary host-sets create plugin -host-catalog-id hcst_1234567890 -name prodops -description "Plugin host-set for ProdOps" -``` - -#### Usage - - - -```shell-session -$ boundary host-sets create plugin [options] [args] -``` - - - -#### Command options - -- `-description=` - The description to set on the plugin host set. -- `-host-catalog-id=` - The host catalog resource to use for the operation. -You can also specify the host catalog using the **BOUNDARY_HOST_CATALOG_ID** environment variable. -- `-name=` - The name to set on the plugin host set. - -#### Attribute options - -- `-attr` - A key=value pair to add to the request's attribute map. -This option can also be a key value only, which sets a JSON null as the value. -If you provide a value, Boundary automatically infers the type. -You can override the type using `-string-attr`, `-bool-attr`, or `-num-attr`. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. -- `-attributes=` - A JSON map value that you can use as the entirety of the request's attributes map. -Usually this value is sourced from a file using the `file://` syntax. -This option is exclusive with other `attr` flags. -- `-bool-attr` - A key=value Boolean value that you can add to the request's attributes map. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. -- `-num-attr` - A key=value numeric value that you can add to the request's attributes map. -You can specify this value multiple times. -This attribute supports referencing values from files using `file://` and environment variables using `env://`. -- `-string-attr` - A key=value string value that you can add to the request's attributes map. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. - -#### Plugin host-set options - -- `-preferred-endpoint=` - If set, indicates which IP address or DNS name out of a host's available options is preferred as an endpoint. -You can specify your preference using `cidr:` or `dns:`. -You can specify multiple preferences to create an order of preferences. -If you do not specify a preference, Boundary chooses a value from all available values using a built-in priority order. -The endpoint preference option may not be valid for all plugin types. -- `-sync-interval=` - The interval of time between sync operations on the host set. -You can enter an integer number of seconds or a string such as `400s`, `5m`, or `6h`. -The interval is applied to the end of the previous sync operation, not the beginning. -If you set the interval to a negative value, it disables synchronization for that host set. -If you set the interval to null, Boundary uses the default value. -The default value may change between releases. - - - - - -The `boundary host-sets create static` command lets you create a static type host set. - -#### Example - -This example creates a static type host set with the name `prodops` and the description `Static host for ProdOps`: - -```shell-session -$ boundary host-sets create static -name prodops -description "Static host-set for ProdOps" -``` - -#### Usage - - - -```shell-session -$ boundary host-sets create static [options] [args] -``` - - - -#### Command options - -- `-description=` - The description to set on the static host set. -- `-host-catalog-id=` - The host catalog resource to use for the operation. -You can also specify the host catalog using the **BOUNDARY_HOST_CATALOG_ID** environment variable. -- `-name=` - The name to set on the static host set. - - - - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/host-sets/delete.mdx b/website/content/docs/commands/host-sets/delete.mdx deleted file mode 100644 index c78a25c5b..000000000 --- a/website/content/docs/commands/host-sets/delete.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: host-sets delete - Command -description: >- - The "host-sets delete" command deletes a existing host set resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# host-sets delete - -Command: `host-sets delete` - -The `host-sets delete` command lets you delete an existing host set by providing the ID. - -## Example - -This example deletes a host set with the ID `_1234567890`: - -```shell-session -$ boundary host-sets delete -id _1234567890 -``` - -## Usage - - - -```shell-session -$ boundary host-sets delete [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the host set you want to delete. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/host-sets/index.mdx b/website/content/docs/commands/host-sets/index.mdx deleted file mode 100644 index a5ad92263..000000000 --- a/website/content/docs/commands/host-sets/index.mdx +++ /dev/null @@ -1,57 +0,0 @@ ---- -layout: docs -page_title: host-sets - Command -description: >- - The "host-sets" command performs operations on Boundary host set resources. A host set represents a collection of hosts with the same access control. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# host-sets - -Command: `boundary host-sets` - -The `host-sets` command lets you perform operations on Boundary host set resources. - -## Example - -The following command reads the details of a host set with the ID `hsst_1234567890`: - -```shell-session -$ boundary host-sets read -id hsst_1234567890 -``` - -## Usage - - - -```shell-session -Usage: boundary host-sets [options] [args] - # ... -Subcommands: - add-hosts Add hosts to the specified host set - create Create a host set - delete Delete a host set - list List a host set - read Read a host set - remove-hosts Remove hosts from the specified host set - set-hosts Set the full contents of the hosts on the specified host set - update Update a host set -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [add-hosts](/boundary/docs/commands/host-sets/add-hosts) -- [create](/boundary/docs/commands/host-sets/create) -- [delete](/boundary/docs/commands/host-sets/delete) -- [list](/boundary/docs/commands/host-sets/list) -- [read](/boundary/docs/commands/host-sets/read) -- [remove-hosts](/boundary/docs/commands/host-sets/remove-hosts) -- [set-hosts](/boundary/docs/commands/host-sets/set-hosts) -- [update](/boundary/docs/commands/host-sets/update) \ No newline at end of file diff --git a/website/content/docs/commands/host-sets/list.mdx b/website/content/docs/commands/host-sets/list.mdx deleted file mode 100644 index 29e3249e8..000000000 --- a/website/content/docs/commands/host-sets/list.mdx +++ /dev/null @@ -1,52 +0,0 @@ ---- -layout: docs -page_title: host-sets list - Command -description: >- - The "host-sets list" command lists the available host set resources within a scope or resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# host-sets list - -Command: `boundary host-sets list` - -The `boundary host-sets list` command lets you list the Boundary host sets within a given scope or resource. - -## Example - -This example lists all host sets within the host catalog `_1234567890`: - -```shell-session -$ boundary host-sets list -host-catalog-id _1234567890 -``` - -## Usage - - - -```shell-session -$ boundary host-sets list [options] [args] -``` - - - -### Command options - -- `-filter=` - If set, Boundary filters the list operation before the results are returned. -The filter operates against each item in the list. -We recommend that you use single quotes, because the filters contain double quotes. -Refer to the [Filtering and listing resources documentation](/boundary/docs/filtering) for more details. -- `-host-catalog-id=` - The host catalog resource to use to produce the list. -You can also specify the host catalog using the **BOUNDARY_HOST_CATALOG_ID** environment variable. -- `list_token` (optional) - An opaque token that is returned from the previous `list` response. -If you do not supply a value, pagination starts from the beginning. -- `page_size` (optional) - An unsigned integer that indicates the number of items that should be included on the page of search results. -If you do not provide a value, or if you provide a value of `0`, Boundary uses the default page size of 1000 items. -If you configure it, the `page_size` value overrides the default page size. -Controller administrators can also configure a `max_page_size` option that constrains the maximum page size a user can request. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/host-sets/read.mdx b/website/content/docs/commands/host-sets/read.mdx deleted file mode 100644 index ac3ebe632..000000000 --- a/website/content/docs/commands/host-sets/read.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: host-sets read - Command -description: >- - The "host-sets read" command retrieves the details of an existing host set resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# host-sets read - -Command: `boundary host-sets read` - -The `boundary host-sets read` command lets you read the details of a Boundary host set using its given ID. - -## Example - -This example reads host set details for a host set with the ID `_1234567890`: - -```shell-session -$ boundary host-sets read -id _1234567890 -``` - -## Usage - - - -```shell-session -$ boundary host-sets read [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the host set whose information you want to read. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/host-sets/remove-hosts.mdx b/website/content/docs/commands/host-sets/remove-hosts.mdx deleted file mode 100644 index 5724f8a69..000000000 --- a/website/content/docs/commands/host-sets/remove-hosts.mdx +++ /dev/null @@ -1,45 +0,0 @@ ---- -layout: docs -page_title: host-sets remove-hosts - Command -description: >- - The "host-sets remove-hosts" command removes hosts from host set resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# host-sets remove-hosts - -Command: `host-sets remove-hosts` - -The `host-sets remove-hosts` command lets you remove hosts from host sets, if the types match and it is allowed by the host set type. - -## Example - -This example removes the host `hst_0987654321` from the host set `hsst_1234567890`: - -```shell-session -$ boundary host-sets remove-hosts -id hsst_1234567890 -host hst_0987654321 -``` - -## Usage - - - -```shell-session -$ boundary host-sets remove-hosts [options] [args] -``` - - - -### Command options - -- `-host=` - The hosts you want to remove from the host set. -You can specify multiple hosts. -- `-id=` - The ID of the containing host set you want to remove hosts from. -- `-version=` - The version of the host set you want to remove hosts from. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/host-sets/set-hosts.mdx b/website/content/docs/commands/host-sets/set-hosts.mdx deleted file mode 100644 index 1e0c75811..000000000 --- a/website/content/docs/commands/host-sets/set-hosts.mdx +++ /dev/null @@ -1,45 +0,0 @@ ---- -layout: docs -page_title: host-sets set-hosts - Command -description: >- - The "host-sets set-hosts" command configures a complete set of hosts on host set resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# host-sets set-hosts - -Command: `host-sets set-hosts` - -The `host-sets set-hosts` command lets you configure the complete set of hosts on a host set resource, if the types match and it is allowed by the host set type. - -## Example - -This example sets the host `hst_1234567890` on the host set `hsst_1234567890`: - -```shell-session -$ boundary host-sets set-hosts -id hsst_1234567890 -host hst_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary host-sets set-hosts [options] [args] -``` - - - -### Command options - -- `-host=` - The hosts to configure on the host set. -You can specify multiple hosts. -- `-id=` - The ID of the host set to set hosts on. -- `-version=` The version of the host set you want to set hosts on. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/host-sets/update.mdx b/website/content/docs/commands/host-sets/update.mdx deleted file mode 100644 index 5c6c925be..000000000 --- a/website/content/docs/commands/host-sets/update.mdx +++ /dev/null @@ -1,148 +0,0 @@ ---- -layout: docs -page_title: host-sets update - Command -description: >- - The "host-sets update" command updates an existing host set resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# host-sets update - -Command: `host-sets update` - -The `host-sets update` command lets you update an existing host set. - -## Example - -This example updates a static host set with the ID `hsst_1234567890` to add the name `devops` and the description `For DevOps usage`: - -```shell-session -$ boundary host-sets update static -id hsst_1234567890 -name devops -description "For DevOps usage" -``` - -## Usage - - - -```shell-session -$ boundary host-sets update [type] [options] [args] - -Please see the typed subcommand help for detailed usage information. - -Subcommands: - plugin Update a plugin-type host set - static Update a static-type host set -``` - - - -### Usages by type - -You can update plugin or static host set types. - - - - -The `boundary host-sets update plugin` command lets you update a plugin type host set. - -#### Example - -This example updates a plugin type host set with the ID `hsplg_1234567890` to add the name `devops` and the description `Plugin host-set for DevOps`. - -```shell-session -$ boundary host-sets update plugin -id hsplg_1234567890 -name "devops" -description "Plugin host-set for DevOps" -``` - -#### Usage - - - -```shell-session -$ boundary host-sets update plugin [options] [args] -``` - - - -#### Command options - -- `-description=` - The description to set on the plugin host set. -- `-id=` - The ID of the plugin type host set to update. -- `-name=` - The name to set on the plugin host set. -- `-version=` - The version of the plugin host set to update. -If you do not specify a version, the command automatically performs a check-and-set. - -#### Attribute options - -- `-attr` - A key=value pair to add to the request's attribute map. -This option can also be a key value only, which sets a JSON null as the value. -If you provide a value, Boundary automatically infers the type. -You can override the type using `-string-attr`, `-bool-attr`, or `-num-attr`. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. -- `-attributes=` - A JSON map value that you can use as the entirety of the request's attributes map. -Usually this value is sourced from a file using the `file://` syntax. -This option is exclusive with other `attr` flags. -- `-bool-attr` - A key=value Boolean value that you can add to the request's attributes map. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. -- `-num-attr` - A key=value numeric value that you can add to the request's attributes map. -You can specify this value multiple times. -This attribute supports referencing values from files using `file://` and environment variables using `env://`. -- `-string-attr` - A key=value string value that you can add to the request's attributes map. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. - -#### Plugin host-set options - -- `-preferred-endpoint=` - If set, specifies which IP address or DNS name out of a host's available options is preferred as an endpoint. -You can specify your preference using `cidr:` or `dns:`. -You can specify multiple preferences to create an order of preferences. -If you do not specify a preference, Boundary chooses a value from all available values using a built-in priority order. -The endpoint preference option may not be valid for all plugin types. -- `-sync-interval=` - The interval of time between sync operations on the host set. -You can enter an integer number of seconds or a string such as `400s`, `5m`, or `6h`. -The interval is applied to the end of the previous sync operation, not the beginning. -If you set the interval to a negative value, it disables synchronization for that host set. -If you set the interval to null, Boundary uses the default value. -The default value may change between releases. - - - - - -The `boundary host-sets update static` command lets you update a static type host set. - -#### Example - -This example updates a static type host set with the ID `hsst_1234567890` to add the name `devops` and the description `Static host-set for DevOps`: - -```shell-session -$ boundary host-sets update static -id hsst_1234567890 -name "devops" -description "Static host-set for DevOps" -``` - -#### Usage - - - -```shell-session -$ boundary host-sets update static [options] [args] -``` - - - -#### Command options - -- `-description=` - The description to set on the static host set. -- `-id=` - The ID of the static type host set to update. -- `-name=` - The name to set on the static host set. -- `-version=` - The version of the static type host set to update. -If you do not specify a version, the command automatically performs a check-and-set. - - - - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/hosts/create.mdx b/website/content/docs/commands/hosts/create.mdx deleted file mode 100644 index 7ba37cd08..000000000 --- a/website/content/docs/commands/hosts/create.mdx +++ /dev/null @@ -1,75 +0,0 @@ ---- -layout: docs -page_title: hosts create - Command -description: >- - The "hosts create" command creates a new host resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# hosts create - -Command: `hosts create` - -The `hosts create` command lets you create a new host. - -## Example - -This example creates a static host with the name `prodops` and the description `For ProdOps usage`: - -```shell-session -$ boundary hosts create static -name prodops -description "For ProdOps usage" -``` - -## Usage - - - -```shell-session -$ boundary hosts create [type] [options] [args] - -Please see the typed subcommand help for detailed usage information. - -Subcommands: - static Create a static type host. -``` - - - -### Usages by type - -The `boundary hosts create static` command lets you create a static type host. - -#### Example - -This example creates a static type host with the name `prodops`, the description `Static host for ProdOps`, and the address `127.0.0.1`. - -```shell-session -$ boundary hosts create static -name prodops -description "Static host for ProdOps" -address "127.0.0.1" -``` - -#### Usage - - - -```shell-session -$ boundary hosts create static [options] [args] -``` - - - -#### Command options - -- `-description=` - The description to set on the host. -- `-host-catalog-id=` - The host catalog resource to use for the operation. -You can also specify the host catalog using the **BOUNDARY_HOST_CATALOG_ID** environment variable. -- `-name=` - The name to set on the host. - -#### Static host options - -- `-address=` - The address of the static host. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/hosts/delete.mdx b/website/content/docs/commands/hosts/delete.mdx deleted file mode 100644 index 0ee7d61fe..000000000 --- a/website/content/docs/commands/hosts/delete.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: hosts delete - Command -description: >- - The "hosts delete" command deletes an existing host resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# hosts delete - -Command: `hosts delete` - -The `hosts delete` command lets you delete an existing host by providing the ID. - -## Example - -This example deletes a host with the ID `h_1234567890`: - -```shell-session -$ boundary hosts delete -id h_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary hosts delete [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the host you want to delete. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/hosts/index.mdx b/website/content/docs/commands/hosts/index.mdx deleted file mode 100644 index 55e7446c3..000000000 --- a/website/content/docs/commands/hosts/index.mdx +++ /dev/null @@ -1,51 +0,0 @@ ---- -layout: docs -page_title: hosts - Command -description: >- - The "hosts" command performs operations on Boundary host resources. A host represents a computing element with a network address that Boundary can reach. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# hosts - -Command: `boundary hosts` - -The `hosts` command lets you perform operations on Boundary host resources. - -## Example - -The following command reads the details of a host with the ID `hst_1234567890`: - -```shell-session -$ boundary hosts read -id hst_1234567890 -``` - -## Usage - - - -```shell-session -Usage: boundary hosts [options] [args] - # ... -Subcommands: - create Create a host - delete Delete a host - list List a host - read Read a host - update Update a host -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [create](/boundary/docs/commands/hosts/create) -- [delete](/boundary/docs/commands/hosts/delete) -- [list](/boundary/docs/commands/hosts/list) -- [read](/boundary/docs/commands/hosts/read) -- [update](/boundary/docs/commands/hosts/update) diff --git a/website/content/docs/commands/hosts/list.mdx b/website/content/docs/commands/hosts/list.mdx deleted file mode 100644 index 5fc796479..000000000 --- a/website/content/docs/commands/hosts/list.mdx +++ /dev/null @@ -1,52 +0,0 @@ ---- -layout: docs -page_title: hosts list - Command -description: >- - The "hosts list" command lists the available host resources within a scope or resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# hosts list - -Command: `boundary hosts list` - -The `boundary hosts list` command lets you list the Boundary hosts within a given scope or resource. - -## Example - -This example lists all hosts within the host catalog `_1234567890`: - -```shell-session -$ boundary hosts list -host-catalog-id _1234567890 -``` - -## Usage - - - -```shell-session -$ boundary hosts list [options] [args] -``` - - - -### Command options - -- `-filter=` - If set, Boundary filters the list operation before the results are returned. -The filter operates against each item in the list. -We recommend that you use single quotes, because the filters contain double quotes. -Refer to the [Filtering and listing resources documentation](/boundary/docs/filtering) for more details. -- `-host-catalog-id=` - The host catalog resource to use to produce the list. -You can also specify the host catalog using the **BOUNDARY_HOST_CATALOG_ID** environment variable. -- `list_token` (optional) - An opaque token that is returned from the previous `list` response. -If you do not supply a value, pagination starts from the beginning. -- `page_size` (optional) - An unsigned integer that indicates the number of items that should be included on the page of search results. -If you do not provide a value, or if you provide a value of `0`, Boundary uses the default page size of 1000 items. -If you configure it, the `page_size` value overrides the default page size. -Controller administrators can also configure a `max_page_size` option that constrains the maximum page size a user can request. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/hosts/read.mdx b/website/content/docs/commands/hosts/read.mdx deleted file mode 100644 index e82601307..000000000 --- a/website/content/docs/commands/hosts/read.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: hosts read - Command -description: >- - The "hosts read" command retrieves details about a host resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# hosts read - -Command: `boundary hosts read` - -The `boundary hosts read` command lets you read information about a Boundary host using its given ID. - -## Example - -This example reads the information about a host with the ID `h_1234567890`: - -```shell-session -$ boundary hosts read -id h_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary hosts read [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the host whose information you want to read. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/hosts/update.mdx b/website/content/docs/commands/hosts/update.mdx deleted file mode 100644 index da9307c4a..000000000 --- a/website/content/docs/commands/hosts/update.mdx +++ /dev/null @@ -1,76 +0,0 @@ ---- -layout: docs -page_title: hosts update - Command -description: >- - The "hosts update" command updates an existing host resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# hosts update - -Command: `hosts update` - -The `hosts update` command lets you update an existing host. - -## Example - -This example updates a host with the ID `hst_1234567890` to add the name `devops` and the description `For DevOps usage`: - -```shell-session -$ boundary hosts update -id hst_1234567890 -name devops -description "For DevOps usage" -``` - -## Usage - - - -```shell-session -$ boundary hosts update [type] [options] [args] - -Please see the typed subcommand help for detailed usage information. - -Subcommands: - static Update a static type host. -``` - - - -### Usages by type - -The `boundary hosts update static` command lets you update a static type host. - -#### Example - -This example updates a static type host with the ID `hst_1234567890` to add the name `devops`, the description `Static host for DevOps`, and the address `10.20.30.40`. - -```shell-session -$ boundary hosts update static -id hst_1234567890 -name "devops" -description "Static host for DevOps" -address "10.20.30.40" -``` - -#### Usage - - - -```shell-session -$ boundary hosts update static [options] [args] -``` - - - -#### Command options - -- `-description=` - The description to set on the host. -- `-id=` - The ID of the host you want to update. -- `-name=` - The name to set on the host. -- `-version=` - The version of the host to update. -If you do not specify a version, the command performs a check-and-set automatically. - -#### Static host options - -- `-address=` - The address of the static host. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/index.mdx b/website/content/docs/commands/index.mdx deleted file mode 100644 index 426d3ebdf..000000000 --- a/website/content/docs/commands/index.mdx +++ /dev/null @@ -1,433 +0,0 @@ ---- -layout: docs -page_title: Commands (CLI) -description: >- - Learn about Boundary's CLI command structure and behavior. View standard connection options, client options, and environment variables. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary CLI overview - -Boundary's CLI has predictable behavior throughout its various commands. This -page details the common patterns used to help you make better use -of the CLI. - -## CLI command structure - -There are a number of command and subcommand options available. -To see all available command options, run `boundary -h`, -and to see all available subcommand options, run `boundary -h`. - -Below is the typical structure for most Boundary CLI commands: - - - -```text -boundary [options] [args] -``` - - - -- `options` - [Client](#client-options) and [connection](#connection-options) options to specify additional settings -- `args` - API arguments specific to the operation - -### Examples - -The following example shows the use of the [`-addr`](/boundary/docs/api-clients/cli#addr) flag to specify which Boundary controller to send a request to: - -```shell-session -$ boundary authenticate password \ - -addr=https://boundary.example.com:9200 \ - -auth-method-id=ampw_1234567890 -``` - -Instead of specifying the `-addr` flag for every command, you can set an environment variable `BOUNDARY_ADDR=https://boundary.controller.com:9200`. - -## Autocompletion - -Boundary's CLI supports autocompletion, which allows tab completion of commands, -flags, and in some case, the parameters to those flags. - -Run the following command to install autocompletion to the CLI: - -```shell-session -$ boundary config autocomplete install -``` - -If you want to install autocompletion manually using Bash, add the following line in a -`~/.bash_profile` or a similar file: - -```shell-session -complete -C /path/to/boundary boundary -``` - -## Keyring token storage - -Boundary uses various mechanisms, depending on platform, to allow for secure -storage of authentication tokens for later use. Each platform has a -platform-specific option. -On Windows and macOS, the platform-specific options are the defaults. -The Unix password manager [pass](https://www.passwordstore.org/) is available on all platforms. -You can also set `-keyring-type` to `none` or use the environment variable **BOUNDARY_KEYRING_TYPE** to disable storage and retrieval of the token on all platforms. - -Additionally, you can store or retrieve more than one token at once using the -`-token-name` flag or **BOUNDARY_TOKEN_NAME** environment variable. -Configuring multiple tokens lets you store tokens used by different Boundary installations, or other needs. - - - - -On Windows, Boundary uses the default Windows credential store, `wincred`. - -Available keyring types include: - -- `wincred` (default) -- `pass` -- `none` - - - - -On macOS, Boundary uses Keychain via `/usr/bin/security`. -Using this binary lets us keep the Boundary binary statically linked, which we prefer. - -Available keyring types include: - -- `keychain` (default) -- `pass` -- `none` - - - - -On all other platforms, the default is `pass`. -However, you can use an implementation of the [freedesktop.org secret service](https://specifications.freedesktop.org/secret-service/latest/) if it is available via `gnome-keyring`, `kwallet`, or other applications. - -Available keyring types include: - -- `pass` (default) -- `secret-service` -- `none` - - - - -## Map to collections and sub-types - -Generally speaking, Boundary's CLI commands map to the collections they operate -on. For example, when you operate on roles, the command is `boundary roles ...`. - -As a result, the patterns for reading, deleting, and listing are predictable: - -- `boundary read` -- `boundary delete` -- `boundary list` - -The `read` and `delete` commands always operate on a particular resource identifier, so -they require an `-id` parameter. -The `list` command operates on collections, so it requires either a `-scope-id` parameter or, depending on the type, a higher level resource identifier, such as `-auth-method-id`. - -Creating and updating resources may require an extra parameter, if the resource type -is abstract. -An abstract resource type cannot be operated on directly, but must be operated on through an implementation. -As an example, a role is not an abstract type, and does not have various implementations. -Therefore, you can operate directly on a role as demonstrated in the following examples: - -- `boundary roles create` -- `boundary roles update`. - -However, a target can be one of many types of targets, and a concrete -implementation of a target is a `tcp` type of target. Therefore, an extra -parameter is required when you create or update a target: - -- `boundary targets create tcp` -- `boundary targets update tcp` - -This format allows the CLI to perform proper presentation and validation of parameters -and functions for the given type. - -Similar to `read`, the `update` command operates on an existing target, so it always requires -an `-id` parameter. Similar to `list`, the `create` command operates on a collection, so it always either requires a `-scope-id` parameter or a parameter that defines the parent resource. - -## Parameter handling - -All parameters specified on the CLI are specified as a Go-style flag with a -single dash, e.g. `-id`. You can specify the arguments to those flags using an -equals sign, as in `-id=r_1234567890`, or a space, like `-id r_1234567890`. - -To see the available parameters, pass the `-h` flag to any command. - -Flags are semi-position dependent. The flags must come **after** the command -definition, but are otherwise order independent. - -For example, the following commands are equivalent: - -- `boundary roles create -scope-id global -name foo` -- `boundary roles create -name foo -scope-id global` - -But the following example results in an error: - -- `boundary roles -name foo -scope-id global create` - -This structure applies to using the `-h` command as well. - -### Clear/default values - -On the CLI, you can use `null` as a value to indicate to Boundary that you want -to unset a value, and revert it to Boundary's default value. -In many cases this default value is empty, but in other cases it's not. -For example, a `name` or `description` parameter is empty by default, but a password auth method's minimum password length is not `0`, but rather `8`. - -Additionally, you are not typically allowed to set string values to the empty string `""`, since specific values must be non-empty. -You should use `null` to clear a value to ensure that you revert it to Boundary's recommended default value. - - - -Boundary uses `null` because the API is JSON. Using `null` as the -value causes the key for the parameter to be inserted into the eventual API -call's JSON object, but with the value set to the JSON `null`. This in turn -informs the controller that the value should be set to its default. Keep in -mind that this is not a direct translation to database `NULL` semantics. - - - -### Connection options - -Every command that results in an API call contains a set of flags that control -connection options, which control TLS and other settings for the connection. - -To print out all available CLI command options, run the command with `-help` or -the `-h` flag. - -```shell-session -$ boundary dev -help -``` - -- `-addr` `(string: "")` - The address of the Boundary controller, as a complete URL, for example `https://boundary.example.com:9200`. You can also specify the address - using the **BOUNDARY_ADDR** environment variable. - -- `-ca-cert` `(string: "")` - The path on the local disk to a single PEM-encoded CA - certificate that is used to verify the controller or worker's server's SSL certificate. - This value takes precedence over `-ca-path`. You can also specify the path using the **BOUNDARY_CACERT** environment variable. - -- `-ca-path` `(string: "")` - The path on the local disk to a directory of - PEM-encoded CA certificates to verify the controller's SSL certificate. - You can also specify the path using the **BOUNDARY_CAPATH** environment variable. - -- `-client-cert` `(string: "")` - The path on the local disk to a single PEM-encoded - CA certificate to use for TLS authentication to the Boundary controller. If - you specify this flag, the `-client-key` flag is also required. You can also specify the path using the **BOUNDARY_CLIENT_CERT** environment variable. - -- `-client-key` `(string: "")` - The path on the local disk to a single PEM-encoded - private key matching the client certificate from `-client-cert`. You can also specify the path using the **BOUNDARY_CLIENT_KEY** environment variable. - -- `-tls-insecure` - If set, disables verification of TLS certificates. - Using this option is highly discouraged as it decreases the security of data - transmissions to and from the Boundary server. The default is `false`. You can also disable verification of TLS certificates using the **BOUNDARY_TLS_INSECURE** environment variable. - -- `-tls-server-name` `(string: "")` - The name to use as the SNI host when - you connect to the Boundary server using TLS. You can also specify the SNI host name using the - **BOUNDARY_TLS_SERVER_NAME** environment variable. - -### Client options - -Every command that results in an API call contains a set of flags that control -client options. Some notable options include the following: - -- `-keyring-type` `(string: "")` - The type of keyring to use. The default value is - `auto`, which uses the Windows credential manager, OSX keychain, or - cross-platform password store, depending on platform. Set this value to `none` to disable - keyring functionality. Available keyring types, depending on platform, are: - - - `wincred` - - `keychain` - - `pass` - - `secret-service` - - You can also specify the keyring type using the **BOUNDARY_KEYRING_TYPE** environment variable. - -- `-output-curl-string` - If set, formats the command that - would have been run as a string using `curl` that you can use directly on the - command line. This is a great way to discover how CLI functions map to API - calls. The default is `false`. - -- `-recovery-config` `(string: "")` - If set, specifies a configuration - file that contains the information necessary to access a KMS configured to be - used for the recovery workflow within a Boundary controller. You can also specify the configuration file using the **BOUNDARY_RECOVERY_CONFIG** environment variable. - -- `-skip-cache-daemon` - If set, skips starting the caching daemon or sending the current used or retrieved token to the caching daemon. -The default is `false`. -You can also specify this value using the BOUNDARY_SKIP_CACHE_DAEMON environment variable. - -- `-token` `(string: "")` - A URL that points to a file on disk `(file://)` or an environment variable `(env://)` from which the token is read. This value overrides the `token-name` parameter. - -- `-token-name` `(string: "")` - The name of the token. When the CLI authenticates, it stores the token - in the platform-specific OS credential store. You can use the `token-name` - parameter to store more than one token at a time. When you specify this - parameter during authentication, Boundary uses the given name as part of the key for - storage. If you specify it for any other command, Boundary uses the corresponding - token for that call. You can also specify the token name using the - **BOUNDARY_TOKEN_NAME** environment variable. - -### Output options - -Nearly every command supports having its success output be formatted as JSON via -`-format json`. For commands that result in an API call, the JSON output is -the exact output from the controller. If you use the output of the CLI in scripts -or as parameters to other tools, **always** use the formatted output. The default text -output is meant for human users, and the formatting or the information included -within that output from the original JSON may change at any time. - -Note that using `-format json` on a `boundary authenticate` command results in -Boundary not saving the token to the system password store. In this case, the -authentication information is only printed to your terminal in JSON format. -You can use the `BOUNDARY_TOKEN` environment variable or `-token` flag to -provide the token in subsequent commands. - - - `-format` `(string: "")` - The given format to print the output. Valid - formats are `table` or `json`. The default value is `table`. You can also specify the format using the `BOUNDARY_CLI_FORMAT` environment variable. - -## Environment variables - -The CLI reads the following environment variables to set behavioral defaults. -Environment variables can alleviate the need to repetitively type a flag. Flags always take -precedence over the environment variables. - -### Connection options - -Boundary includes the following environment variables to help you configure connection options. - -### `BOUNDARY_ADDR` - -The address of the Boundary controller as a complete URL, for example `https://boundary.example.com:9200`. - -### `BOUNDARY_CACERT` - -The path on the local disk to a single PEM-encoded CA certificate to verify the controller -or worker's SSL certificate. This variable takes precedence over the `BOUNDARY_CAPATH` variable or `-ca-path` connection option, if specified. - -### `BOUNDARY_CAPATH` - -The path on the local disk to a directory of PEM-encoded CA certificates to verify the SSL -certificate of the controller. - -### `BOUNDARY_CLIENT_CERT` - -The path on the local disk to a single PEM-encoded CA certificate to use for TLS authentication -to the Boundary controller. If you set the path, you must also specify a client key using the `BOUNDARY_CLIENT_KEY` variable or `-client-key` connection option. - -### `BOUNDARY_CLIENT_KEY` - -The path on the local disk to a single PEM-encoded private key that matches the client certificate -specified by the `BOUNDARY_CLIENT_CERT` variable or the `-client-cert` connection option. - -### `BOUNDARY_SKIP_CACHE_DAEMON` - -Prevents Boundary from starting the caching demon or sending the current used or retrieved token to the caching daemon. -You can use the `BOUNDARY_SKIP_CACHE_DAEMON` variable or the `-skip-cache-daemon` connection option. - -### `BOUNDARY_TLS_INSECURE` - -If set, disables verification of TLS certificates. Using this option is highly discouraged as it -decreases the security of data transmissions to and from the Boundary server. The default value is `false`. - -### `BOUNDARY_TLS_SERVER_NAME` - -The name to use as the SNI host when you connect to the Boundary server using TLS. - -### Client options - -Boundary includes the following environment variables to help you configure client options. - -### `BOUNDARY_KEYRING_TYPE` - -The type of keyring to use. Defaults to `auto` which uses the Windows credential manager, -OSX keychain, or cross-platform password store, depending on the platform. -Set the value to `none` to disable keyring -functionality. Available keyring types, depending on the platform, include: - -- `wincred` -- `keychain` -- `pass` -- `secret-service` - -### `BOUNDARY_RECOVERY_CONFIG` - -If set, determines if the given config file is parsed for a "kms" block with the purpose `recovery`. -If you specify a value, Boundary uses the recovery mechanism to authorize the call. - -### `BOUNDARY_TOKEN_NAME` - -The token name when stored in the system credential store. -You can specify a token name to allow switching user identities for different commands. - -### Connect options - -Boundary includes the following environment variables to help you configure connect options. - -### `BOUNDARY_CONNECT_AUTHZ_TOKEN` - -The authorization string returned from the Boundary controller when an "authorize-session" action is used against a target. -If you set the string to `-`, the command attempts to read in the authorization string from standard input. - -### `BOUNDARY_CONNECT_EXEC` - -If set, executes the given binary after connecting to the worker. -This enviornment variable should be a binary on your path or an absolute path. -If you follow any command flags with ` -- ` (space, two hyphens, space), then any arguments that follow are set directly to the binary. - -### `BOUNDARY_CONNECT_LISTEN_ADDR` - -If set, attempts to bind the listening address to the given value, which must be an IP address. -If the CLI cannot bind the address, the command produces an error. -If you don't set this value, it defaults to the most common IPv4 loopback address, 127.0.0.1. - -### `BOUNDARY_CONNECT_LISTEN_PORT` - -If set, attempts to bind the listening port to the given value, if you set this variable. -If the CLI cannot bind the address, the command produces an error. - -### `BOUNDARY_CONNECT_TARGET_SCOPE_ID` - -The target scope ID, if you authorize the session using scope parameters and target name. -This variable is mutually exclusive with `BOUNDARY_CONNECT_TARGET_SCOPE_NAME`. - -### `BOUNDARY_CONNECT_TARGET_SCOPE_NAME` - -The target scope name, if you authorize the session using scope parameters and target name. -This variable is mutually exclusive with `BOUNDARY_CONNECT_TARGET_SCOPE_ID`. - -### Command options - -Boundary includes the following environment variables to help you configure command options. - -### `BOUNDARY_AUTH_METHOD_ID` - -An auth method ID. - -### `BOUNDARY_LOG_LEVEL` - -The log verbosity level, mostly as a fallback for events. -Supported values, listed in order of more detail to less, are: - -- `trace` -- `debug` -- `info` -- `warn` -- `err` - -### `BOUNDARY_SCOPE_ID` - -The scope to use for the operation. - -### Output options - -Boundary includes the following environment variables to help you configure output options. - -### `BOUNDARY_CLI_FORMAT` - -The given format in which to print the output. Valid formats are `table` and `json`. The default value is `table`. diff --git a/website/content/docs/commands/logout.mdx b/website/content/docs/commands/logout.mdx deleted file mode 100644 index 17c64702a..000000000 --- a/website/content/docs/commands/logout.mdx +++ /dev/null @@ -1,58 +0,0 @@ ---- -layout: docs -page_title: logout - Command -description: >- - The `logout` command deletes the current token from Boundary and removes it from the local store. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# logout - -Command: `boundary logout` - -The `logout` command deletes the current token from Boundary and removes it from the local store. - -## Examples - -The following example logs out the current user and removes the token from the credential store: - -```shell-session -$ boundary logout -The token was successfully deleted within the Boundary controller. -The token was successfully removed from the local credential store. -``` - -## Usage - - - -```shell-session -$ boundary logout [options] -``` - - - - -### Command options - -- `-keyring-type` `(string: "")` - The type of keyring to use. - This value defaults to `auto` and uses the Windows credential manager, OSX keychain, or - cross-platform password store, depending on the platform. - Set this value to `none` to disable keyring functionality. - Depending on the platform, the following types of keyring are supported: - - - `wincred` - - `keychain` - - `pass` - - `secret-service` - - You can also specify the keyring using the **BOUNDARY_KEYRING_TYPE** environment - variable. - -- `-token-name` `(string: "")` - The name to use when Boundary loads the token from the system credential store. - If you specify a token name, it must correspond to the name you use for authentication. - You can also be specify a token name using the **BOUNDARY_TOKEN_NAME** environment variable. \ No newline at end of file diff --git a/website/content/docs/commands/managed-groups/create.mdx b/website/content/docs/commands/managed-groups/create.mdx deleted file mode 100644 index 73b14881b..000000000 --- a/website/content/docs/commands/managed-groups/create.mdx +++ /dev/null @@ -1,115 +0,0 @@ ---- -layout: docs -page_title: managed-groups create - Command -description: >- - The "managed-groups create" command creates a new managed group resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# managed-groups create - -Command: `managed-groups create` - -The `managed-groups create` command lets you create a new managed group. - -## Example - -This example creates a managed group with the name `prodops` and the description `For ProdOps usage`: - -```shell-session -$ boundary managed-groups create -name prodops -description "For ProdOps usage" -``` - -## Usage - - - -```shell-session -$ boundary managed-groups create [options] [args] - -Please see the typed subcommand help for detailed usage information. - -Subcommands: - ldap Create an ldap managed group - oidc Create an oidc managed group -``` - - - -### Usages by type - -You can create LDAP or OIDC managed groups. - - - - -The `boundary managed-groups create ldap` command lets you create LDAP managed groups. - -#### Example - -This example creates a LDAP managed group using the LDAP group name `admin` and the description `Ldap managed group for ProdOps`: - -```shell-session -$ boundary managed-groups create ldap -group-names admin -description "Ldap managed group for ProdOps" -``` - -#### Usage - - - -```shell-session -$ boundary managed-groups create ldap [options] [args] -``` - - - -#### Command options - -- `-auth-method-id=` - The auth-method resource to use for creating the managed group. -You can also specify the auth-method resource using the **BOUNDARY_AUTH_METHOD_ID** environment variable. -- `-description=` - The description to set for the LDAP managed group. -- `-group-names=` - The LDAP group names against which an LDAP account's associated groups are evaluated to determine membership. -Boundary evaluates managed group membership when you log in. -You can specify multiple group names. -- `-name=` - The name for the LDAP managed group. - - - - -The `boundary managed-groups create oidc` command lets you create OIDC managed groups. - -#### Example - -This example creates a OIDC managed group using a filter and the description `Oidc managed group for ProdOps`: - -```shell-session -$ boundary managed-groups create oidc -filter '"/token/email" == "doe@example.com"' -description "Oidc managed group for ProdOps" -``` - -#### Usage - - - -```shell-session -$ boundary managed-groups create oidc [options] [args] -``` - - - -#### Command options - -- `-auth-method-id=` - The auth-method resource to use for creating the managed group. -You can also specify the auth-method resource using the **BOUNDARY_AUTH_METHOD_ID** environment variable. -- `-description=` - The description to set for the OIDC managed group. -- `-filter=` - The filter that defines the criteria against which an account's OIDC token and user info are evaluated to determine if it is a member of the OIDC managed group. -Boundary evaluates managed group membership when you log in. -- `-name=` - The name to set for the OIDC managed group. - - - - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/managed-groups/delete.mdx b/website/content/docs/commands/managed-groups/delete.mdx deleted file mode 100644 index ce5982446..000000000 --- a/website/content/docs/commands/managed-groups/delete.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: managed-groups delete - Command -description: >- - The "managed-groups delete" command deletes an existing managed group resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# managed-groups delete - -Command: `managed-groups delete` - -The `managed-groups delete` command lets you delete an existing managed group by providing the ID. - -## Example - -This example deletes a managed group with the ID `_1234567890`: - -```shell-session -$ boundary managed-groups delete -id _1234567890 -``` - -## Usage - - - -```shell-session -$ boundary managed-groups delete [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the managed group you want to delete. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/managed-groups/index.mdx b/website/content/docs/commands/managed-groups/index.mdx deleted file mode 100644 index 2b4e380bf..000000000 --- a/website/content/docs/commands/managed-groups/index.mdx +++ /dev/null @@ -1,51 +0,0 @@ ---- -layout: docs -page_title: managed-groups - Command -description: >- - The "managed-groups" command performs operations on Boundary managed group resources. Managed groups represent collections of accounts. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# managed-groups - -Command: `boundary managed-groups` - -The `managed-groups` command lets you perform operations on Boundary managed group resources. - -## Example - -The following command creates a managed group with the name `prodops` and the description `For ProdOps usage`: - -```shell-session -$ boundary managed-groups create -name prodops -description "For ProdOps usage" -``` - -## Usage - - - -```shell-session -Usage: boundary managed-groups [options] [args] - # ... -Subcommands: - create Create a managed group - delete Delete a managed group - list List a managed group - read Read a managed group - update Update a managed group -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [create](/boundary/docs/commands/managed-groups/create) -- [delete](/boundary/docs/commands/managed-groups/delete) -- [list](/boundary/docs/commands/managed-groups/list) -- [read](/boundary/docs/commands/managed-groups/read) -- [update](/boundary/docs/commands/managed-groups/update) diff --git a/website/content/docs/commands/managed-groups/list.mdx b/website/content/docs/commands/managed-groups/list.mdx deleted file mode 100644 index 0bce63ec0..000000000 --- a/website/content/docs/commands/managed-groups/list.mdx +++ /dev/null @@ -1,52 +0,0 @@ ---- -layout: docs -page_title: managed-groups list - Command -description: >- - The "managed-groups list" command lists the available managed group resources within a scope or resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# managed-groups list - -Command: `boundary managed-groups list` - -The `boundary managed-groups list` command lets you list the Boundary managed groups within a given scope or resource. - -## Example - -This example lists all managed groups within the scope `s_1234567890`: - -```shell-session -$ boundary managed-groups list -scope-id s_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary managed-groups list [options] [args] -``` - - - -### Command options - -- `auth-method-id=` - The auth method resource to use for this operation. -You can also specify the auth method using the **BOUNDARY_AUTH_METHOD_ID** environment variable. -- `-filter=` - If set, Boundary filters the list operation before the results are returned. -The filter operates against each item in the list. -We recommend that you use single quotes, because the filters contain double quotes. -Refer to the [Filtering and listing resources documentation](/boundary/docs/filtering) for more details. -- `list_token` (optional) - An opaque token that is returned from the previous `list` response. -If you do not supply a value, pagination starts from the beginning. -- `page_size` (optional) - An unsigned integer that indicates the number of items that should be included on the page of search results. -If you do not provide a value, or if you provide a value of `0`, Boundary uses the default page size of 1000 items. -If you configure it, the `page_size` value overrides the default page size. -Controller administrators can also configure a `max_page_size` option that constrains the maximum page size a user can request. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/managed-groups/read.mdx b/website/content/docs/commands/managed-groups/read.mdx deleted file mode 100644 index e14a994f3..000000000 --- a/website/content/docs/commands/managed-groups/read.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: managed-groups read - Command -description: >- - The "managed-groups read" command retrieves the details of a managed group resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# managed-groups read - -Command: `boundary managed-groups read` - -The `boundary managed-groups read` command lets you read the details of a Boundary managed group using its given ID. - -## Example - -This example reads the details of a managed group with the ID `_1234567890`: - -```shell-session -$ boundary managed-groups read -id _1234567890 -``` - -## Usage - - - -```shell-session -$ boundary managed-groups read [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the managed group you want to read information for. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/managed-groups/update.mdx b/website/content/docs/commands/managed-groups/update.mdx deleted file mode 100644 index 575b8e56d..000000000 --- a/website/content/docs/commands/managed-groups/update.mdx +++ /dev/null @@ -1,117 +0,0 @@ ---- -layout: docs -page_title: managed-groups update - Command -description: >- - The "managed-groups update" command updates an existing managed group resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# managed-groups update - -Command: `managed-groups update` - -The `managed-groups update` command lets you update an existing managed group. - -## Example - -This example updates a managed group with the ID `_1234567890` to include the name `prodops` and the description `For ProdOps usage`: - -```shell-session -$ boundary managed-groups update -id _1234567890 -name "prodops" -description "For ProdOps usage" -``` - -## Usage - - - -```shell-session -$ boundary managed-groups update [options] [args] - -Please see the managed-groups subcommand help for detailed usage information. - -Subcommands: - ldap Update an ldap managed group - oidc Update an oidc managed group -``` - - - -### Usages by type - -You can update LDAP or OIDC managed groups. - - - - -The `boundary managed-groups update ldap` command lets you update LDAP managed groups. - -#### Example - -This example updates a LDAP managed group with the ID `acctldap_1234567890` to add the name `devops` and the description `Ldap managed group for DevOps`: - -```shell-session -$ boundary managed-groups update ldap -id acctldap_1234567890 -name "devops" -description "Ldap managed group for DevOps" -``` - -#### Usage - - - -```shell-session -$ boundary managed-groups update ldap [options] [args] -``` - - - -#### Command options - -- `-description=` - The description to set for the LDAP managed group. -- `-group-names=` - The LDAP group names against which an LDAP account's associated groups are evaluated to determine membership. -Boundary evaluates managed group membership when you log in. -You can specify multiple group names. -- `-id=` - The ID of the LDAP managed group to update. -- `-name=` - The name to set for the LDAP managed group. -- `-version=` - The version of the LDAP managed group to update. -If you do not specify a version, the command automatically performs a check-and-set. - - - - -The `boundary managed-groups update oidc` command lets you update OIDC managed groups. - -#### Example - -This example updates an OIDC managed group with the ID `acctoidc_1234567890` to add the name `devops` and the description `Oidc managed group for DevOps`: - -```shell-session -$ boundary managed-groups update oidc -id acctoidc_1234567890 -name "devops" -description "Oidc managed group for DevOps" -``` - -#### Usage - - - -```shell-session -$ boundary managed-groups update oidc [options] [args] -``` - - - -#### Command options - -- `-description=` - The description to set for the OIDC managed group. -- `-filter=` - The filter that defines the criteria against which an account's OIDC token and user info are evaluated to determine if it is a member of the OIDC managed group. -Boundary evaluates managed group membership when you log in. -- `-id=` - The ID of the OIDC managed group you want to update. -- `-name=` - The name to set for the OIDC managed group. -- `-version=` - The version of the OIDC managed group to update. -If you do not specify a version, the command performs a check-and-set automatically. - - - - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/policies/create.mdx b/website/content/docs/commands/policies/create.mdx deleted file mode 100644 index 26a350dfc..000000000 --- a/website/content/docs/commands/policies/create.mdx +++ /dev/null @@ -1,66 +0,0 @@ ---- -layout: docs -page_title: policies create - Command -description: >- - The "policies create" command creates new policy resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# policies create - -This feature requires HCP Boundary or Boundary Enterprise - -Command: `boundary policies create` - -The `boundary policies create` command lets you create Boundary policies. - -Storage policies codify how long session recordings must be kept and when they should be deleted. -For more information, refer to the [storage policies](/boundary/docs/domain-model/storage-policy) documentation. - -## Example - -This example creates a storage policy with the name `prod` and the description `Prod Storage Policy`. -The policy has a retention period of 10 days, and it will be deleted after 20 days: - -```shell-session -$ boundary policies create storage -name prod -description "Prod Storage Policy" -retain-for-days 10 -delete-after-days 20 -``` - -## Usage - - - -```shell-session -$ boundary policies create storage [options] [args] -``` - - - -### Subcommands - -- `storage` - Creates a storage type policy. - -### Command options - -- `-description=` - The description to set for the policy. -- `-name=` -The name to set on the policy. -The name is optional, but if you set it, it must be unique within the scope ID. -If you do not provide a name, Boundary uses the storage policy ID as the default name. -- `-scope-id=` - Scope in which to create the policy. -The default scope is global. -You can also specify a scope using the **BOUNDARY_SCOPE_ID** environment variable. - -### Storage policy options - -- `-delete-after-days=` - The number of days after which Boundary will delete a session recording. -- `-delete-after-overridable=` - Whether the policy's deletion period can be overridden by downstream policies. -The value can be `true` or `false`. -- `-retain-for-days=` - The number of days a session recording should be retained for. -- `-retain-for-overridable=` - Whether the policy's retention period can be overriden by downstream storage policies. -The value can be `true` or `false`. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/policies/delete.mdx b/website/content/docs/commands/policies/delete.mdx deleted file mode 100644 index 620f87228..000000000 --- a/website/content/docs/commands/policies/delete.mdx +++ /dev/null @@ -1,43 +0,0 @@ ---- -layout: docs -page_title: policies delete - Command -description: >- - The "policies delete" command deletes existing policy resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# policies delete - -This feature requires HCP Boundary or Boundary Enterprise - -Command: `boundary policies delete` - -The `boundary policies delete` command lets you delete Boundary policies. - -## Example - -This example deletes a policy with the ID `p_1234567890`: - -```shell-session -$ boundary policies delete -id p_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary policies delete [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the policy you want to delete. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/policies/index.mdx b/website/content/docs/commands/policies/index.mdx deleted file mode 100644 index e597fa218..000000000 --- a/website/content/docs/commands/policies/index.mdx +++ /dev/null @@ -1,56 +0,0 @@ ---- -layout: docs -page_title: policies - Command -description: >- - The "policies" command performs operations on Boundary policy resources. Policies codify how long Boundary retains session recordings. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# policies - -This feature requires HCP Boundary or Boundary Enterprise - -Command: `boundary policies` - -The `policies` command lets you perform operations on Boundary policies. - -Storage policies codify how long session recordings must be kept and when they should be deleted. -For more information, refer to the [storage policies](/boundary/docs/domain-model/storage-policy) documentation. - -## Example - -The following command reads a policy with the id `pst_1234567890`: - -```shell-session -$ boundary policies read -id chr_1234567890 -``` - -## Usage - - - -```shell-session -Usage: boundary policies [options] [args] - # ... -Subcommands: - create Create a policy - delete Delete a policy - list List a policy - read Read a policy - update Update a policy -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [create](/boundary/docs/commands/policies/create) -- [delete](/boundary/docs/commands/policies/delete) -- [list](/boundary/docs/commands/policies/list) -- [read](/boundary/docs/commands/policies/read) -- [update](/boundary/docs/commands/policies/update) \ No newline at end of file diff --git a/website/content/docs/commands/policies/list.mdx b/website/content/docs/commands/policies/list.mdx deleted file mode 100644 index 3d164b8ed..000000000 --- a/website/content/docs/commands/policies/list.mdx +++ /dev/null @@ -1,52 +0,0 @@ ---- -layout: docs -page_title: policies list - Command -description: >- - The "policies list" command lists the available policy resources within a scope or resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# policies list - -This feature requires HCP Boundary or Boundary Enterprise - -Command: `policies list` - -The `policies list` command lets you list the policies within a given scope or resource. - -## Example - -This example lists all policies within the scope `s_1234567890`. -The `recursive` option means Boundary runs the operation recursively on any child scopes, if applicable: - -```shell-session -$ boundary policies list -scope-id s_1234567890 -recursive -``` - -## Usage - - - -```shell-session -$ boundary policies list [options] [args] -``` - - - -### Command options - -- `-filter=` - If set, Boundary filters the list operation before the results are returned. -The filter operates against each item in the list. -We recommend that you use single quotes, because the filters contain double quotes. -Refer to the [Filtering and listing resources documentation](/boundary/docs/filtering) for more details. -- `recursive` - If set, runs the list operation recursively on any child scopes, if the type supports it. -The default value is `false`. -- `scope-id=` - The scope from which to list policies. -The default value is `global`. -You can also specify this value using the **BOUNDARY_SCOPE_ID** environment variable. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/policies/read.mdx b/website/content/docs/commands/policies/read.mdx deleted file mode 100644 index 3bc1c5d4b..000000000 --- a/website/content/docs/commands/policies/read.mdx +++ /dev/null @@ -1,43 +0,0 @@ ---- -layout: docs -page_title: policies read - Command -description: >- - The "policies read" command retrieves the details of an existing policy resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# policies read - -This feature requires HCP Boundary or Boundary Enterprise - -Command: `boundary policies read` - -The `boundary policies read` command lets you read information about Boundary policies. - -## Example - -This example reads the details of a policy with the ID `p_1234567890`: - -```shell-session -$ boundary policies read -id p_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary policies read [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the policy you want to read. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/policies/update.mdx b/website/content/docs/commands/policies/update.mdx deleted file mode 100644 index d11773690..000000000 --- a/website/content/docs/commands/policies/update.mdx +++ /dev/null @@ -1,66 +0,0 @@ ---- -layout: docs -page_title: policies update - Command -description: >- - The "policies update" command updates existing policy resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# policies update - -This feature requires HCP Boundary or Boundary Enterprise - -Command: `boundary policies update` - -The `boundary policies update` command lets you update Boundary policies. - -Storage policies codify how long session recordings must be kept and when they should be deleted. -For more information, refer to the [storage policies](/boundary/docs/domain-model/storage-policy) documentation. - -## Example - -This example updates a storage policy with the ID `pst_1234567890` to add the name `dev` and the description `Dev Storage Policy`. -The policy has a retention period of 1 day, and it will be deleted after 2 days: - -```shell-session -$ boundary policies update storage -id pst_1234567890 -name dev -description "Dev Storage Policy" -retain-for-days 1 -delete-after-days 2 -``` - -## Usage - - - -```shell-session -$ boundary policies update storage [options] [args] -``` - - - -### Subcommands - -- `storage` - Updates a storage type policy. - -### Command options - -- `-description=` - The description to set for the policy. -- `-id=` - The ID of the policy you want to update. -- `-name=` -The name to set on the policy. -The name is optional, but if you set it, it must be unique within the scope ID. -If you do not provide a name, Boundary uses the storage policy ID as the default name. -- `-version=` - The version of the policy to update. -If you do not specify a version, the command performs a check-and-set automatically. - -### Storage policy options - -- `-delete-after-days=` - The number of days after which Boundary will delete a session recording. -- `-delete-after-overridable=` - Whether the policy's deletion period can be overridden by downstream policies. -The value can be `true` or `false`. -- `-retain-for-days=` - The number of days a session recording should be retained for. -- `-retain-for-overridable=` - Whether the policy's retention period can be overriden by downstream storage policies. -The value can be `true` or `false`. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/read.mdx b/website/content/docs/commands/read.mdx deleted file mode 100644 index 702838e63..000000000 --- a/website/content/docs/commands/read.mdx +++ /dev/null @@ -1,46 +0,0 @@ ---- -layout: docs -page_title: read - Command -description: >- - The "read" command retrieves details about existing Boundary resources using the resource's ID. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# read - -Command: `boundary read` - -The `boundary read` command lets you read Boundary resources. -It is a generic command that runs a read operation on a Boundary resource using the resource's ID. - -When you run this command, Boundary interprets it as the type-specific command. -For example, if you enter the `read` command with a storage bucket ID, Boundary runs the `storage-buckets read` command. -Help, error, or cURL output from the command may show the full command syntax. - -## Example - -This example reads a storage bucket with the ID `sb_1234567890`: - -```shell-session -$ boundary read -id sb_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary read [resource ID] [args] -``` - - - -### Command options - -- `-id=` - The ID of the resource you want to read. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/roles/add-grant-scopes.mdx b/website/content/docs/commands/roles/add-grant-scopes.mdx deleted file mode 100644 index f05a6ee82..000000000 --- a/website/content/docs/commands/roles/add-grant-scopes.mdx +++ /dev/null @@ -1,53 +0,0 @@ ---- -layout: docs -page_title: roles add-grant-scopes - Command -description: >- - The "roles add-grant-scopes" command adds grant scopes to an existing role resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# roles add-grant-scopes - -Command: `roles add-grant-scopes` - -The `roles add-grant-scopes` command lets you add grant scopes to a role. -You can specify multiple grant scopes per role. - -## Example - -This example adds a grant to a role with the ID `r_1234567890` in the current scope and any children scopes: - -```shell-session -$ boundary roles add-grant-scopes -id r_1234567890 -grant-scope-id "this" -grant-scope-id "children" -``` - -## Usage - - - -```shell-session -$ boundary roles add-grant-scopes [options] [args] -``` - - - -### Command options - -- `-grant-scope-id=` - The scope IDs that inherit grants set on the role. - You can specify the following values: - - `this` - Applies to the current scope. - - `children` - Applies to all direct children of the scope and can only be used with global and org scopes. - - `descendants` - Applies to all descendants of the scope and can only be used with the global scope. - - Boundary does not allow you to create redudnant grant scopes. - For example, if an org scope inherits a grant from the global scope, you cannot apply the same grant directly to the org scope. - -- `-id=` - The ID of the role you want to add grant scopes to. -- `-version=` The version of the role to add grant scopes to. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/roles/add-grants.mdx b/website/content/docs/commands/roles/add-grants.mdx deleted file mode 100644 index ab5a82c83..000000000 --- a/website/content/docs/commands/roles/add-grants.mdx +++ /dev/null @@ -1,51 +0,0 @@ ---- -layout: docs -page_title: roles add-grants - Command -description: >- - The "roles add-grants" command adds grants to an existing role resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# roles add-grants - -Command: `roles add-grants` - -The `roles add-grants` command lets you add grants to a role. -You can specify multiple grants per role. - -## Example - -This example adds a grant which permits read permissions to a role with the ID `r_1234567890`: - -```shell-session -$ boundary roles add-grants -id r_1234567890 -grant "ids=*;type=*;actions=read" -``` - -## Usage - - - -```shell-session -$ boundary roles add-grants [options] [args] -``` - - - -### Command options - -- `-grant=` - The grants you want to add. -You can specify grants in compact string format or JSON. -If you use JSON, be sure to escape it properly. -You can optionally specify multiple grants. -- `-ids=` - The IDs of the roles you want to add grants to. -You can specify one or more IDs. -If you specify multiple IDs using text, use commas to separate the IDs. -If you specify multiple IDs using JSON, use an array. -- `-version=` The version of the role to add grants to. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/roles/add-principals.mdx b/website/content/docs/commands/roles/add-principals.mdx deleted file mode 100644 index 2a0a89f21..000000000 --- a/website/content/docs/commands/roles/add-principals.mdx +++ /dev/null @@ -1,48 +0,0 @@ ---- -layout: docs -page_title: roles add-principals - Command -description: >- - The "roles add-principals" command add principals to an existing role resource. Principals can be users or groups. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# roles add-principals - -Command: `roles add-principals` - -The `roles add-principals` command lets you add principals to a role. -Principals can be users or groups. -You can specify multiple principals per role. - -## Example - -This example adds the principals `$GROUP_ID` to a role with the ID `r_1234567890`: - -```shell-session -$ boundary roles add-principals -id r_1234567890 -principal=$GROUP_ID -``` - -## Usage - - - -```shell-session -$ boundary roles add-principals [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the role you want to add principals to. -- `-principal=` - The principals you want to add to the role. -Principals can be users or groups. -You can optionally specify multiple principals per role. -- `-version=` The version of the role to add principals to. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/roles/create.mdx b/website/content/docs/commands/roles/create.mdx deleted file mode 100644 index 76de7610a..000000000 --- a/website/content/docs/commands/roles/create.mdx +++ /dev/null @@ -1,45 +0,0 @@ ---- -layout: docs -page_title: roles create - Command -description: >- - The "roles create" command creates a new role resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# roles create - -Command: `roles create` - -The `roles create` command lets you create a new role. - -## Example - -This example creates a role with the name `prodops` and the description `Role for ProdOps`: - -```shell-session -$ boundary roles create -name prodops -description "Role for ProdOps" -``` - -## Usage - - - -```shell-session -$ boundary roles create [options] [args] -``` - - - -### Command options - -- `-description=` - The description to assign to the role. -- `-name=` - The name to assign to the role. -- `-scope-id=` - The scope in which you want to create the role. -The default is `global`. -You can also specify the scope using the **BOUNDARY_SCOPE_ID** environment variable. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/roles/delete.mdx b/website/content/docs/commands/roles/delete.mdx deleted file mode 100644 index 7f5b615e7..000000000 --- a/website/content/docs/commands/roles/delete.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: roles delete - Command -description: >- - The "roles delete" command deletes an existing role resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# roles delete - -Command: `roles delete` - -The `roles delete` command lets you delete a role. - -## Example - -This example deletes a role with the ID `r_1234567890`: - -```shell-session -$ boundary roles delete -id r_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary roles delete [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the role you want to delete. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/roles/index.mdx b/website/content/docs/commands/roles/index.mdx deleted file mode 100644 index f1ba5bd03..000000000 --- a/website/content/docs/commands/roles/index.mdx +++ /dev/null @@ -1,69 +0,0 @@ ---- -layout: docs -page_title: roles - Command -description: >- - The "roles" command performs operations on Boundary role resources. Roles contain collections of permissions which are granted to principals assigned to the role. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# roles - -Command: `boundary roles` - -The `roles` command lets you perform operations on Boundary role resources. - -## Example - -The following command creates a role with the name `prodops` and the description `For ProdOps usage`: - -```shell-session -$ boundary roles create -name prodops -description "For ProdOps usage" -``` - -## Usage - - - -```shell-session -Usage: boundary roles [options] [args] - # ... -Subcommands: - add-grant-scopes Add grant scopes to a role - add-grants Add grants to a role - add-principals Add principals (users, groups) to a role - create Create a role - delete Delete a role - list List a role - read Read a role - remove-grant-scopes Remove grant scopes from a role - remove-grants Remove grants from a role - remove-principals Remove principals (users, groups) from a role - set-grant-scopes Set the full contents of grant scopes on a role - set-grants Set the full contents of the grants on a role - set-principals Set the full contents of the principals (users, groups) on a role - update Update a role -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [add-grant-scopes](/boundary/docs/commands/roles/add-grant-scopes) -- [add-grants](/boundary/docs/commands/roles/add-grants) -- [add-principals](/boundary/docs/commands/roles/add-principals) -- [create](/boundary/docs/commands/roles/create) -- [delete](/boundary/docs/commands/roles/delete) -- [list](/boundary/docs/commands/roles/list) -- [read](/boundary/docs/commands/roles/read) -- [remove-grant-scopes](/boundary/docs/commands/roles/remove-grant-scopes) -- [remove-grants](/boundary/docs/commands/roles/remove-grants) -- [remove-principals](/boundary/docs/commands/roles/remove-principals) -- [set-grant-scopes](/boundary/docs/commands/roles/set-grant-scopes) -- [set-grants](/boundary/docs/commands/roles/set-grants) -- [set-principals](/boundary/docs/commands/roles/set-principals) -- [update](/boundary/docs/commands/roles/update) diff --git a/website/content/docs/commands/roles/list.mdx b/website/content/docs/commands/roles/list.mdx deleted file mode 100644 index 4ee7ba947..000000000 --- a/website/content/docs/commands/roles/list.mdx +++ /dev/null @@ -1,56 +0,0 @@ ---- -layout: docs -page_title: roles list - Command -description: >- - The "roles list" command lists the available role resources within a scope or resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# roles list - -Command: `boundary roles list` - -The `boundary roles list` command lets you list the Boundary roles within a given scope or resource. - -## Example - -This example lists all roles within the scope `s_1234567890`. -The `recursive` option means Boundary runs the operation recursively on any child scopes, if applicable: - -```shell-session -$ boundary roles list -scope-id s_1234567890 -recursive -``` - -## Usage - - - -```shell-session -$ boundary roles list [options] [args] -``` - - - -### Command options - -- `-filter=` - If set, filters the list operation before the results are returned. -The filter operates against each item in the list. -We recommend that you use single quotes, because the filters contain double quotes. -Refer to the [Filtering and listing resources documentation](/boundary/docs/filtering) for more details. -- `-recursive` - If set, runs the list operation recursively on any child scopes, if the type supports it. -The default value is `false`. -- `-scope-id=` - The enclosing scope from which you want to list the roles. -The default value is `global`. -You can also specify this value using the **BOUNDARY_SCOPE_ID** environment variable. -- `list_token` (optional) - An opaque token that is returned from the previous `list` response. -If you do not supply a value, pagination starts from the beginning. -- `page_size` (optional) - An unsigned integer that indicates the number of items that should be included on the page of search results. -If you do not provide a value, or if you provide a value of `0`, Boundary uses the default page size of 1000 items. -If you configure it, the `page_size` value overrides the default page size. -Controller administrators can also configure a `max_page_size` option that constrains the maximum page size a user can request. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/roles/read.mdx b/website/content/docs/commands/roles/read.mdx deleted file mode 100644 index 5e6b21a5b..000000000 --- a/website/content/docs/commands/roles/read.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: roles read - Command -description: >- - The "roles read" command retrieves the details of a role resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# roles read - -Command: `boundary roles read` - -The `boundary roles read` command lets you read the information about a Boundary role using its given ID. - -## Example - -This example reads the details of a role with the ID `r_1234567890`: - -```shell-session -$ boundary roles read -id r_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary roles read [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the role you want to read. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/roles/remove-grant-scopes.mdx b/website/content/docs/commands/roles/remove-grant-scopes.mdx deleted file mode 100644 index fce20f601..000000000 --- a/website/content/docs/commands/roles/remove-grant-scopes.mdx +++ /dev/null @@ -1,54 +0,0 @@ ---- -layout: docs -page_title: roles remove-grant-scopes - Command -description: >- - The "roles remove-grant-scopes" command removes grant scopes from an existing role resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# roles remove-grant-scopes - -Command: `roles remove-grant-scopes` - -The `roles remove-grant-scopes` command lets you remove grant scopes from a role. -You can specify multiple grant scopes per role. - -## Example - -This example removes a grant from a role with the ID `r_1234567890` in the current scope and any children scopes: - -```shell-session -$ boundary roles remove-grant-scopes -id r_1234567890 -grant-scope-id "this" -grant-scope-id "children" -``` - - -## Usage - - - -```shell-session -$ boundary roles remove-grant-scopes [options] [args] -``` - - - -### Command options - -- `-grant-scope-id=` - The scope IDs that inherit grants removed from the role. - You can specify the following values: - - `this` - Applies to the current scope. - - `children` - Applies to all direct children of the scope and can only be used with global and org scopes. - - `descendants` - Applies to all descendants of the scope and can only be used with the global scope. - - Boundary does not allow you to create redudnant grant scopes. - For example, if an org scope inherits a grant from the global scope, you cannot apply the same grant directly to the org scope. - -- `-id=` - The ID of the role you want to remove grant scopes from. -- `-version=` The version of the role to remove grant scopes from. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/roles/remove-grants.mdx b/website/content/docs/commands/roles/remove-grants.mdx deleted file mode 100644 index 069189037..000000000 --- a/website/content/docs/commands/roles/remove-grants.mdx +++ /dev/null @@ -1,51 +0,0 @@ ---- -layout: docs -page_title: roles remove-grants - Command -description: >- - The "roles remove-grants" command removes grants from an existing role resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# roles remove-grants - -Command: `roles remove-grants` - -The `roles remove-grants` command lets you remove grants from a role. -You can specify multiple grants per role. - -## Example - -This example removes a grant which permits read permissions from a role with the ID `r_1234567890`: - -```shell-session -$ boundary roles remove-grants -id r_1234567890 -grant "ids=*;type=*;actions=read" -``` - -## Usage - - - -```shell-session -$ boundary roles remove-grants [options] [args] -``` - - - -### Command options - -- `-grant=` - The grants you want to remove from the role. -You can specify grants in compact string format or JSON. -If you use JSON, be sure to escape it properly. -You can optionally specify multiple grants. -- `-ids=` - The IDs of the roles you want to remove grants from. -You can specify one or more IDs. -If you specify multiple IDs using text, use commas to separate the IDs. -If you specify multiple IDs using JSON, use an array. -- `-version=` - The version of the role you want to remove grants from. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/roles/remove-principals.mdx b/website/content/docs/commands/roles/remove-principals.mdx deleted file mode 100644 index 0e2c6a4c8..000000000 --- a/website/content/docs/commands/roles/remove-principals.mdx +++ /dev/null @@ -1,48 +0,0 @@ ---- -layout: docs -page_title: roles remove-principals - Command -description: >- - The "roles remove-principals" command removes principals from an existing role resource. Principals can be users or groups. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# roles remove-principals - -Command: `roles remove-principals` - -The `roles remove-principals` command lets you remove principals from a role. -Principals can be users or groups. -You can specify multiple principals per role. - -## Example - -This example removes the principals `sg_1234567890` from a role with the ID `r_1234567890`: - -```shell-session -$ boundary roles remove-principals -id r_1234567890 -principal sg_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary roles remove-principals [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the role you want to remove principals from. -- `-principal=` - The principals you want to remove from the role. -Principals can be users or groups. -You can optionally specify multiple principals per role. -- `-version=` The version of the role to remove principals from. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/roles/set-grant-scopes.mdx b/website/content/docs/commands/roles/set-grant-scopes.mdx deleted file mode 100644 index d6eb3ef20..000000000 --- a/website/content/docs/commands/roles/set-grant-scopes.mdx +++ /dev/null @@ -1,53 +0,0 @@ ---- -layout: docs -page_title: roles set-grant-scopes - Command -description: >- - The "roles set-grant-scopes" command sets the complete set of grant scopes on an existing role resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# roles set-grant-scopes - -Command: `roles set-grant-scopes` - -The `roles set-grant-scopes` command lets you set the complete set of grant scopes on a role. -You can specify multiple grant scopes per role. - -## Example - -This example sets the complete set of grant scopes on a role with the ID `r_1234567890` in the current scope and any children scopes: - -```shell-session -$ boundary roles set-grant-scopes -id r_1234567890 -grant-scope-id "this" -grant-scope-id "children" -``` - -## Usage - - - -```shell-session -$ boundary roles set-grant-scopes [options] [args] -``` - - - -### Command options - -- `-grant-scope-id=` - The scope IDs that inherit grants set on the role. - You can specify the following values: - - `this` - Applies to the current scope. - - `children` - Applies to all direct children of the scope and can only be used with global and org scopes. - - `descendants` - Applies to all descendants of the scope and can only be used with the global scope. - - Boundary does not allow you to create redudnant grant scopes. - For example, if an org scope inherits a grant from the global scope, you cannot apply the same grant directly to the org scope. - -- `-id=` - The ID of the role you want to set grant scopes on. -- `-version=` The version of the role to set grant scopes on. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/roles/set-grants.mdx b/website/content/docs/commands/roles/set-grants.mdx deleted file mode 100644 index 2ce24d40e..000000000 --- a/website/content/docs/commands/roles/set-grants.mdx +++ /dev/null @@ -1,52 +0,0 @@ ---- -layout: docs -page_title: roles set-grants - Command -description: >- - The "roles set-grants" command sets the complete set of grants on an existing role resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# roles set-grants - -Command: `roles set-grants` - -The `roles set-grants` command lets you set the complete set of grants on a role. -You can specify multiple grants per role. - -## Example - -This example sets multiple grants which allow read and list permissions for a role with the ID `r_1234567890`: - -```shell-session -$ boundary roles set-grants -id r_1234567890 -grant "ids=*;type=*;actions=read" -grant - "ids=*;type=*;actions=list" -``` - -## Usage - - - -```shell-session -$ boundary roles set-grants [options] [args] -``` - - - -### Command options - -- `-grant=` - The grants you want to set on the role. -You can specify grants in compact string format or JSON. -If you use JSON, be sure to escape it properly. -You can optionally specify multiple grants. -- `-ids=` - The IDs of the roles you want to set grants on. -You can specify one or more IDs. -If you specify multiple IDs using text, use commas to separate the IDs. -If you specify multiple IDs using JSON, use an array. -- `-version=` The version of the role to set grants on. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/roles/set-principals.mdx b/website/content/docs/commands/roles/set-principals.mdx deleted file mode 100644 index 3d251550c..000000000 --- a/website/content/docs/commands/roles/set-principals.mdx +++ /dev/null @@ -1,48 +0,0 @@ ---- -layout: docs -page_title: roles set-principals - Command -description: >- - The "roles set-principals" command sets the complete set of principals on an existing role resource. Principals can be users or groups. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# roles set-principals - -Command: `roles set-principals` - -The `roles set-principals` command lets you set the complete set of principals on a role. -Principals can be users or groups. -You can specify multiple principals per role. - -## Example - -This example sets the principals `u_anon` and `sg_1234567890` on a role with the ID `r_1234567890`: - -```shell-session -$ boundary roles set-principals -id r_1234567890 -principal u_anon -principal sg_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary roles set-principals [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the role you want to set principals on. -- `-principal=` - The principals you want to set on the role. -Principals can be users or groups. -You can optionally specify multiple principals per role. -- `-version=` The version of the role to set principals on. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/roles/update.mdx b/website/content/docs/commands/roles/update.mdx deleted file mode 100644 index a4022be99..000000000 --- a/website/content/docs/commands/roles/update.mdx +++ /dev/null @@ -1,45 +0,0 @@ ---- -layout: docs -page_title: roles update - Command -description: >- - The "roles update" command updates an existing role resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# roles update - -Command: `roles update` - -The `roles update` command lets you update an existing role. - -## Example - -This example updates a role with the ID `r_1234567890` to add the name `devops` and the description `Role for DevOps`: - -```shell-session -$ boundary roles update -id r_1234567890 -name "devops" -description "Role for DevOps" -``` - -## Usage - - - -```shell-session -$ boundary roles update [options] [args] -``` - - - -### Command options - -- `-description=` - The description to set on the role. -- `-id=` - The ID of the role you want to update. -- `-name=` - The name to set on the role. -- `-version=` - The version of the role you want to update. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/scopes/create.mdx b/website/content/docs/commands/scopes/create.mdx deleted file mode 100644 index 159dbac4e..000000000 --- a/website/content/docs/commands/scopes/create.mdx +++ /dev/null @@ -1,49 +0,0 @@ ---- -layout: docs -page_title: scopes create - Command -description: >- - The "scopes create" command creates a new scope resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# scopes create - -Command: `scopes create` - -The `scopes create` command lets you create a new scope. - -## Example - -This example creates a scope with the name `prodops` and the description `Scope for ProdOps`: - -```shell-session -$ boundary scopes create -name prodops -description "Scope for ProdOps" -``` - -## Usage - - - -```shell-session -$ boundary scopes create [options] [args] -``` - - - -### Command options - -- `-description=` - The description to set on the scope. -- `-name=` - The name to set on the scope. -- `-scope-id=` - The scope in which you want to create the scope. -The default is `global`. -You can also specify the scope using the **BOUNDARY_SCOPE_ID** environment variable. -- `-skip-admin-role-creation` - If set, Boundary does not create a role that grants the current user administrative access to the newly created scope. -The default value is `false`. -- `-skip-default-role-creation` - If set, Boundary does not create a role that grants the anonymous user access to log in to auth methods and other actions within the newly created scope. -The default value is `false`. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/scopes/delete.mdx b/website/content/docs/commands/scopes/delete.mdx deleted file mode 100644 index 9136c9b1e..000000000 --- a/website/content/docs/commands/scopes/delete.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: scopes delete - Command -description: >- - The "scopes delete" command deletes an existing scope resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# scopes delete - -Command: `scopes delete` - -The `scopes delete` command lets you delete an existing scope by providing the ID. - -## Example - -This example deletes a scope with the ID `o_1234567890`: - -```shell-session -$ boundary scopes delete -id o_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary scopes delete [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the scope you want to delete. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/scopes/destroy-key-version.mdx b/website/content/docs/commands/scopes/destroy-key-version.mdx deleted file mode 100644 index 294eabee9..000000000 --- a/website/content/docs/commands/scopes/destroy-key-version.mdx +++ /dev/null @@ -1,45 +0,0 @@ ---- -layout: docs -page_title: scopes destroy-key-version - Command -description: >- - The "scopes destroy-key-version" destroys a key version in the scope resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# scopes destroy-key-version - -Command: `scopes destroy-key-version` - -The `scopes destroy-key-version` command lets you destroy a key version in the scope. -You cannot destroy the key version that is currently active. -When you run this command, it may start an asynchronous job to re-encrypt any existing data that was encrypted with the key version that you destroy. -You can check the progress of the key destruction job using the [`boundary scopes list-key-version-destruction-jobs`](/boundary/docs/commands/scopes/list-key-version-destruction-jobs) command. - -## Example - -This example destroys a key version with the ID `krkv_123456789` in the scope `global`: - -```shell-session -$ boundary scopes destroy-key-version -scope-id global -key-version-id krkv_123456789 -``` - -## Usage - - - -```shell-session -$ boundary scopes destroy-key-version [args] -``` - - - -### Command options - -- `-key-version-id=` - The ID of the key version you want to destroy. -- `-scope-id=` - The ID of the scope in which the key version you want to destroy exists. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/scopes/index.mdx b/website/content/docs/commands/scopes/index.mdx deleted file mode 100644 index e095ec687..000000000 --- a/website/content/docs/commands/scopes/index.mdx +++ /dev/null @@ -1,59 +0,0 @@ ---- -layout: docs -page_title: scopes - Command -description: >- - The "scopes" command performs operations on Boundary scope resources. Scopes are permission boundaries modeled as containers. They group resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# scopes - -Command: `boundary scopes` - -The `scopes` command lets you perform operations on Boundary scope resources. - -## Example - -The following command creates a scope with the name `prodops` and the description `For ProdOps usage`: - -```shell-session -$ boundary scopes create -name prodops -description "For ProdOps usage" -``` - -## Usage - - - -```shell-session -Usage: boundary scopes [options] [args] - # ... -Subcommands: - create Create a scope - delete Delete a scope - destroy-key-version Destroy a key version within a scope - list List a scope - list-key-version-destruction-jobs List all pending key version destruction jobs within a scope - list-keys List keys within a scope - read Read a scope - rotate-keys Rotate the keys within a scope - update Update a scope -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [create](/boundary/docs/commands/scopes/create) -- [delete](/boundary/docs/commands/scopes/delete) -- [destroy-key-version](/boundary/docs/commands/scopes/destroy-key-version) -- [list](/boundary/docs/commands/scopes/list) -- [list-key-version-destruction-jobs](/boundary/docs/commands/scopes/list-key-version-destruction-jobs) -- [list-keys](/boundary/docs/commands/scopes/list-keys) -- [read](/boundary/docs/commands/scopes/read) -- [rotate-keys](/boundary/docs/commands/scopes/rotate-keys) -- [update](/boundary/docs/commands//scopes/update) \ No newline at end of file diff --git a/website/content/docs/commands/scopes/list-key-version-destruction-jobs.mdx b/website/content/docs/commands/scopes/list-key-version-destruction-jobs.mdx deleted file mode 100644 index 41495ed27..000000000 --- a/website/content/docs/commands/scopes/list-key-version-destruction-jobs.mdx +++ /dev/null @@ -1,42 +0,0 @@ ---- -layout: docs -page_title: scopes list-key-version-destruction-jobs - Command -description: >- - The "scopes list-key-version-destruction-jobs" lists all pending key version destruction jobs within a scope resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# scopes list-key-version-destruction-jobs - -Command: `scopes list-key-version-destruction-jobs` - -When the [key version destruction job](/boundary/docs/commands/scopes/destroy-key-version) runs, it asynchronously re-encrypts any existing data within the latest key version before it destroys the key version you selected for destruction. -The `scopes list-key-version-destruction jobs` command lists all pending key version destruction jobs within a scope. - -## Example - -This example lists all pending key version destruction jobs within the scope `global`: - -```shell-session -$ boundary scopes list-key-version-destruction-jobs -scope-id global -``` - -## Usage - - - -```shell-session -$ boundary scopes list-key-version-destruction-jobs [args] -``` - - - -### Command options - -- `-scope-id=` - The ID of the scope from which to list key version destruction jobs. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/scopes/list-keys.mdx b/website/content/docs/commands/scopes/list-keys.mdx deleted file mode 100644 index 431c505e6..000000000 --- a/website/content/docs/commands/scopes/list-keys.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: scopes list-keys - Command -description: >- - The "scopes list-keys" command lists the available keys within a scope or resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# scopes list-keys - -Command: `boundary scopes list-keys` - -The `boundary scopes list-keys` command lets you list the keys within a given scope or resource. - -## Example - -This example lists all keys within the scope `s_1234567890`: - -```shell-session -$ boundary scopes list-keys -scope-id s_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary scopes list-keys [args] -``` - - - -### Command options - -- `-scope-id=` - The ID of the enclosing scope from which to list the keys. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/scopes/list.mdx b/website/content/docs/commands/scopes/list.mdx deleted file mode 100644 index 93dc5239b..000000000 --- a/website/content/docs/commands/scopes/list.mdx +++ /dev/null @@ -1,56 +0,0 @@ ---- -layout: docs -page_title: scopes list - Command -description: >- - The "scopes list" command lists the available scope resources within a scope or resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# scopes list - -Command: `boundary scopes list` - -The `boundary scopes list` command lets you list the Boundary scopes within a given scope or resource. - -## Example - -This example lists all scopes within the scope `s_1234567890`. -The `recursive` option means Boundary runs the operation recursively on any child scopes, if applicable: - -```shell-session -$ boundary scopes list -scope-id s_1234567890 -recursive -``` - -## Usage - - - -```shell-session -$ boundary scopes list [options] [args] -``` - - - -### Command options - -- `-filter=` - If set, Boundary filters the list operation before the results are returned. -The filter operates against each item in the list. -We recommend that you use single quotes, because the filters contain double quotes. -Refer to the [Filtering and listing resources documentation](/boundary/docs/filtering) for more details. -- `-recursive` - If set, runs the list operation recursively on any child scopes, if the type supports it. -The default value is `false`. -- `-scope-id=` - The enclosing scope from which to list the scopes. -The default value is `global`. -You can also specify this value using the **BOUNDARY_SCOPE_ID** environment variable. -- `list_token` (optional) - An opaque token that is returned from the previous `list` response. -If you do not supply a value, pagination starts from the beginning. -- `page_size` (optional) - An unsigned integer that indicates the number of items that should be included on the page of search results. -If you do not provide a value, or if you provide a value of `0`, Boundary uses the default page size of 1000 items. -If you configure it, the `page_size` value overrides the default page size. -Controller administrators can also configure a `max_page_size` option that constrains the maximum page size a user can request. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/scopes/read.mdx b/website/content/docs/commands/scopes/read.mdx deleted file mode 100644 index d28f644e8..000000000 --- a/website/content/docs/commands/scopes/read.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: scopes read - Command -description: >- - The "scopes read" command retrieves the details about a scope resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# scopes read - -Command: `boundary scopes read` - -The `boundary scopes read` command lets you read the details about a Boundary scope using its given ID. - -## Example - -This example reads the details about a scope with the ID `o_1234567890`: - -```shell-session -$ boundary scopes read -id o_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary scopes read [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the scope you want to read. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/scopes/rotate-keys.mdx b/website/content/docs/commands/scopes/rotate-keys.mdx deleted file mode 100644 index 013a270a0..000000000 --- a/website/content/docs/commands/scopes/rotate-keys.mdx +++ /dev/null @@ -1,43 +0,0 @@ ---- -layout: docs -page_title: scopes rotate-keys - Command -description: >- - The "scopes rotate-keys" command deactivates a scope's current KEK and DEKs, and then activates a new set of keys for the scope resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# scopes rotate-keys - -Command: `boundary scopes rotate-keys` - -The `boundary scopes rotate-keys` command lets you replace a scope's current KEK and DEKs with a new set of keys. - -## Example - -This example rotates all keys within the scope `s_1234567890`: - -```shell-session -$ boundary scopes rotate-keys -scope-id s_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary scopes rotate-keys [args] -``` - - - -### Command options - -- `-rewrap` - If set, re-encrypts DEKs with the new KEK. -The default value is `false`. -- `-scope-id=` - The enclosing scope in which you want to rotate the keys. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/scopes/update.mdx b/website/content/docs/commands/scopes/update.mdx deleted file mode 100644 index 150e9133b..000000000 --- a/website/content/docs/commands/scopes/update.mdx +++ /dev/null @@ -1,48 +0,0 @@ ---- -layout: docs -page_title: scopes update - Command -description: >- - The "scopes update" command updates an existing scope resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# scopes update - -Command: `scopes update` - -The `scopes update` command lets you update an existing scope. - -## Example - -This example updates a scope with the ID `o_1234567890` to include the name `devops` and the description `Scope for DevOps`: - -```shell-session -$ boundary scopes update -id o_1234567890 -name "devops" -description "Scope for DevOps" -``` - -## Usage - - - -```shell-session -$ boundary scopes update [options] [args] -``` - - - -### Command options - -- `-description=` - The description to set on the scope. -- `-id=` - The ID of the scope to update. -- `-name=` - The name to set on the scope. -- `-primary-auth-method-id=` - The primary auth method ID for the scope. -The primary auth method is allowed to create users on the initial login. -It is also used as a source for the account full name and email used for the scope's users. -- `-version=` - The version of the scope to update. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/search/index.mdx b/website/content/docs/commands/search/index.mdx deleted file mode 100644 index b586c7da4..000000000 --- a/website/content/docs/commands/search/index.mdx +++ /dev/null @@ -1,111 +0,0 @@ ---- -layout: docs -page_title: search - Command -description: >- - The "search" command searches the local cache for information about session and target resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# search - -Command: `boundary search` - -The `search` command lets you search Boundary's local cache for information about sessions and targets. - -For more information, refer to [Boundary `list` vs `search`](/boundary/docs/api-clients/client-cache/#boundary-list-vs-search). - -## Examples - -The following example searches the local cache for all TCP targets that have the word "Generated" in the name. - -```shell-session -$ boundary search -resource targets -query 'type="tcp" and name%"Generated"' -``` - -**Example output:** - - - -```plaintext -Target information: - ID: ttcp_0987654321 - Scope ID: p_1234567890 - Version: 2 - Type: tcp - Name: Generated target using host sources - Description: Provides a target using host sources in Boundary - Authorized Actions: - no-op - read - update - delete - add-host-sources - set-host-sources - remove-host-sources - add-credential-sources - set-credential-sources - remove-credential-sources - authorize-session - - ID: ttcp_1234567890 - Scope ID: p_1234567890 - Version: 1 - Type: tcp - Name: Generated target with a direct address - Description: Provides an initial target using an address in Boundary - Address: 127.8.0.1 - Authorized Actions: - no-op - read - update - delete - add-host-sources - set-host-sources - remove-host-sources - add-credential-sources - set-credential-sources - remove-credential-sources - authorize-session -``` - - - - - -## Usage - - - -```shell-session -$ boundary search [options] -``` - - - -### Command options - -- `-resource` `(string: "")` - The type of resource you want to search the cache for. -This is a required field. -You can search for the following: - - `sessions` - Searches for any sessions associated with the user. - - `targets` - Searches for any targets associated with the user. - -- `-query` `(optional)` - If set, specifies the [MQL](https://github.com/hashicorp/mql/blob/main/GRAMMAR.md) query you want to use to search for the indexed fields on the resource you specified. -If you do not provide a `-query` value, the search lists all resources of the specified type that have been cached. -The available fields that can be used in the search query for each resource include: - - - targets: id, name, description, type, address, scope_id - - sessions: id, type, endpoint, status, scope_id, target_id, user_id - -- `token` - A URL that points to a file on disk (file://) from which Boundary reads a token or an environment variable (env://) from which the token will be read. -If you set this parameter, it overrides the `token-name` parameter. -- `token-name` - If specified, Boundary uses the value in this parameter as the name when it stores the token in the system credential store. -You can use this value to switch user identities for different commands. -You can also specify a token name using the **BOUNDARY_TOKEN_NAME** environment variable. - - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/server.mdx b/website/content/docs/commands/server.mdx deleted file mode 100644 index a27987888..000000000 --- a/website/content/docs/commands/server.mdx +++ /dev/null @@ -1,89 +0,0 @@ ---- -layout: docs -page_title: server - Command -description: >- - The `server` command starts a server with a configuration file. The command can start a controller, worker, or both. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# server - -Command: `boundary server` - -The `server` command starts a server with a configuration file. -You can use it to start a controller, worker, or both. -Refer to the [configuration](/boundary/docs/configuration) page to learn more about configuring Boundary. - -## Examples - -The following example starts the worker server by providing the full path to the worker config file, `/home/ubuntu/boundary/downstream-worker.hcl`: - -```shell-session -$ boundary server -config="/home/ubuntu/boundary/downstream-worker.hcl" -``` - -**Example output:** - - - -```shell-session -==> Boundary server configuration: - - Cgo: disabled - Listener 1: tcp (addr: "0.0.0.0:9202", max_request_duration: "1m30s", purpose: "proxy") - Log Level: info - Mlock: supported: true, enabled: false - Version: Boundary v0.13.0+ent - Version Sha: d8aaf3500f65fb7d605d27db232457fe3a26bf43 - Worker Auth Current Key Id: harddisk-stunt-serve-shininess-essay-courier-manger-deface - Worker Auth Registration Request: GzusqckarbczHoLGQ4UA25uSRvw33DNChURoR2CF1BXRUm7frqLSncV64LeYWxQDCstE25Vj6QSBQ1aGh8BUo1dnz899rt3LgktzRGU4vWYcHmvPQKpsSUTJqA42nJxBfpxopKyCvzxZNxgbTSw5BNN9BUsnoy58niY5ui38NhKPKdmKjVDoU4TRVd4Bvti4F2H5C8pBB3qhY6qyeaSRoKjDcEzdTa7S3JicVzbtmfWnfyMLTJ21jRypH2S5haK4RBhFP319mw6DYNhVo7opBkBoW2FaaJbeowGj8b5wFX - Worker Auth Storage Path: /home/ubuntu/boundary/worker2 - Worker Public Proxy Addr: 44.204.92.85:9202 - -==> Boundary server started! Log data will stream in below: -... -``` - - - - -## Usage - - - -```shell-session -$ boundary server -config=/etc/boundary.d/controller.hcl -``` - - - - -### Command options - -- `-config` `(string: "")` - The path to the configuration file. -If you use HCL formatting, you can specify multiple configuration files. - -- `-config-kms` `(string: "")` - The path to a configuration file that contains a "kms" - block marked for `config` purpose. - The kms block decrypts the main configuration file. - If you do not set a kms block, Boundary looks for the kms block in the main - configuration file, which has some drawbacks; see the help output for - "boundary config encrypt -h" for details. - -- `-log-format` `(string: "")` - The log format to use, mostly as a fallback for events. - Supported values are `standard` and `json`. - -- `-log-level` `(string: "")` - The log verbosity level to use, mostly as a fallback for - events. The following values are supported, in order of more detail to less. - - - `trace` - - `debug` - - `info` - - `warn` - - `err` - - You can also be specify log verbosity level using the **BOUNDARY_LOG_LEVEL** environment variable. \ No newline at end of file diff --git a/website/content/docs/commands/session-recordings/delete.mdx b/website/content/docs/commands/session-recordings/delete.mdx deleted file mode 100644 index f79f2a2a8..000000000 --- a/website/content/docs/commands/session-recordings/delete.mdx +++ /dev/null @@ -1,43 +0,0 @@ ---- -layout: docs -page_title: session-recordings delete - Command -description: >- - The "session-recordings delete" command deletes an existing session recording resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# session-recordings delete - -This feature requires HCP Boundary or Boundary Enterprise - -Command: `session-recordings delete` - -The `session-recordings delete` command lets you delete a session recording. - -## Example - -This example deletes a session recording with the ID `sr_1234567890`: - -```shell-session -$ boundary session-recordings delete -id sr_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary session-recordings delete [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the session recording you want to delete. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/session-recordings/download.mdx b/website/content/docs/commands/session-recordings/download.mdx deleted file mode 100644 index 7c8a48c64..000000000 --- a/website/content/docs/commands/session-recordings/download.mdx +++ /dev/null @@ -1,50 +0,0 @@ ---- -layout: docs -page_title: session-recordings download - Command -description: >- - The "session-recordings download" command downloads session recording resources so that you can view them. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# session-recordings download - -This feature requires HCP Boundary or Boundary Enterprise - -Command: `boundary session-recordings download` - -The `boundary session-recordings download` command lets you download a Boundary session recording. - -## Example - -The following command downloads a session recording with the id `chr_1234567890`: - -```shell-session -$ boundary session-recordings download -id chr_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary session-recordings download [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the session recording resource you want to download. -- `-no-clobber` - If set, prevents downloads from overwriting existing files. -This option is aliased as `-nc`. -The default value is `false`. -- `-output=` - If set, indicates an optional output file for the download. -If you do not provide a value, the recording ID is given a ".cast" extension. -Use `-` for stdout. -This option is aliased as `-o`. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/session-recordings/index.mdx b/website/content/docs/commands/session-recordings/index.mdx deleted file mode 100644 index 4852c0009..000000000 --- a/website/content/docs/commands/session-recordings/index.mdx +++ /dev/null @@ -1,53 +0,0 @@ ---- -layout: docs -page_title: session-recordings - Command -description: >- - The "session-recordings" command performs operations on Boundary session recording resources. Session recordings capture sessions between users and targets. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# session-recordings - -This feature requires HCP Boundary or Boundary Enterprise - -Command: `boundary session-recordings` - -The `session-recordings` command lets you perform operations on Boundary session recording resources. - -## Example - -The following command downloads a session recording with the id `chr_1234567890`: - -```shell-session -$ boundary session-recordings download -id chr_1234567890 -``` - -## Usage - - - -```shell-session -Usage: boundary session-recordings [options] [args] - # ... -Subcommands: - delete Delete a session recording - download Download a session recording - list List a session recording - read Read a session recording - reapply-storage-policy Reapply storage policy to a session recording -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [delete](/boundary/docs/commands/session-recordings/delete) -- [download](/boundary/docs/commands/session-recordings/download) -- [list](/boundary/docs/commands/session-recordings/list) -- [read](/boundary/docs/commands/session-recordings/read) -- [reapply-storage-policy](/boundary/docs/commands/session-recordings/reapply-storage-policy) \ No newline at end of file diff --git a/website/content/docs/commands/session-recordings/list.mdx b/website/content/docs/commands/session-recordings/list.mdx deleted file mode 100644 index c07a85b39..000000000 --- a/website/content/docs/commands/session-recordings/list.mdx +++ /dev/null @@ -1,54 +0,0 @@ ---- -layout: docs -page_title: session-recordings list - Command -description: >- - The "session-recordings list" command lists the available session recording resources within a scope or resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# session-recordings list - -This feature requires HCP Boundary or Boundary Enterprise - -Command: `boundary session-recordings list` - -The `boundary session-recordings list` command lets you list the Boundary session recordings within a given scope or resource. - -## Example - -This example lists all session recordings within the scope `s_1234567890`. -The `recursive` option means Boundary runs the operation recursively on any child scopes, if applicable: - -```shell-session -$ boundary session-recordings list -scope-id s_1234567890 -recursive -``` - -## Usage - - - -```shell-session -$ boundary session-recordings list [options] [args] -``` - - - -### Command options - -- `recursive` - If set, runs the list operation recursively on any child scopes, if the type supports it. -The default value is `false`. -- `scope-id=` - The scope from which you want to list the session recordings. -The default value is `global`. -You can also specify this value using the **BOUNDARY_SCOPE_ID** environment variable. -- `list_token` (optional) - An opaque token that is returned from the previous `list` response. -If you do not supply a value, pagination starts from the beginning. -- `page_size` (optional) - An unsigned integer that indicates the number of items that should be included on the page of search results. -If you do not provide a value, or if you provide a value of `0`, Boundary uses the default page size of 1000 items. -If you configure it, the `page_size` value overrides the default page size. -Controller administrators can also configure a `max_page_size` option that constrains the maximum page size a user can request. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/session-recordings/read.mdx b/website/content/docs/commands/session-recordings/read.mdx deleted file mode 100644 index 0c47e0603..000000000 --- a/website/content/docs/commands/session-recordings/read.mdx +++ /dev/null @@ -1,43 +0,0 @@ ---- -layout: docs -page_title: session-recordings read - Command -description: >- - The "session-recordings read" command retrieves the details of a session recording resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# session-recordings read - -This feature requires HCP Boundary or Boundary Enterprise - -Command: `boundary session-recordings read` - -The `boundary session-recordings read` command lets you read information about a Boundary session recording by providing the ID. - -## Example - -This example reads the details of a session recording with the ID `sr_1234567890`: - -```shell-session -$ boundary session-recordings read -id sr_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary session-recordings read [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the session recording you want to read. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/session-recordings/reapply-storage-policy.mdx b/website/content/docs/commands/session-recordings/reapply-storage-policy.mdx deleted file mode 100644 index 93e85bdf2..000000000 --- a/website/content/docs/commands/session-recordings/reapply-storage-policy.mdx +++ /dev/null @@ -1,43 +0,0 @@ ---- -layout: docs -page_title: session-recordings reapply-storage-policy - Command -description: >- - The "session-recordings reapply-storage-policy" command reapplies a storage policy to a session recording resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# session-recordings reapply-storage-policy - -This feature requires HCP Boundary or Boundary Enterprise - -Command: `session-recordings reapplly-storage-policy` - -The `session-recordings reapply-storage-policy` command lets you reapply a storage policy to a session recording. - -## Example - -This example reapplies a storage policy to a session recording with the ID `sr_1234567890`: - -```shell-session -$ boundary session-recordings reapply-storage-policy -id sr_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary session-recordings delete [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the session recording you want to reapply the storage policy to. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/sessions/cancel.mdx b/website/content/docs/commands/sessions/cancel.mdx deleted file mode 100644 index f488f173a..000000000 --- a/website/content/docs/commands/sessions/cancel.mdx +++ /dev/null @@ -1,42 +0,0 @@ ---- -layout: docs -page_title: sessions cancel - Command -description: >- - The "sessions cancel" command cancels a session resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# sessions cancel - -Command: `boundary sessions cancel` - -The `boundary sessions cancel` command lets you cancel a Boundary session by providing the ID. -If the session is already canceled, the command succeeds with no effect. - -## Example - -This example cancels a session with the ID `s_1234567890`: - -```shell-session -$ boundary sessions cancel -id s_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary sessions cancel [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the session you want to cancel. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/sessions/index.mdx b/website/content/docs/commands/sessions/index.mdx deleted file mode 100644 index e97792e3d..000000000 --- a/website/content/docs/commands/sessions/index.mdx +++ /dev/null @@ -1,47 +0,0 @@ ---- -layout: docs -page_title: sessions - Command -description: >- - The "sessions" command performs operations on Boundary session resources. A session is a set of related connections between a user and host. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# sessions - -Command: `boundary sessions` - -The `sessions` command lets you perform operations on Boundary session resources. - -## Example - -The following command reads the details of a session with the id `s_1234567890`: - -```shell-session -$ boundary sessions read -id s_1234567890 -``` - -## Usage - - - -```shell-session -Usage: boundary sessions [options] [args] - # ... -Subcommands: - cancel Cancel a session - list List a session - read Read a session -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [cancel](/boundary/docs/commands/sessions/cancel) -- [list](/boundary/docs/commands/sessions/list) -- [read](/boundary/docs/commands/sessions/read) \ No newline at end of file diff --git a/website/content/docs/commands/sessions/list.mdx b/website/content/docs/commands/sessions/list.mdx deleted file mode 100644 index 474dd7f7c..000000000 --- a/website/content/docs/commands/sessions/list.mdx +++ /dev/null @@ -1,60 +0,0 @@ ---- -layout: docs -page_title: sessions list - Command -description: >- - The "sessions list" command lists the available session resources within a scope or resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# sessions list - -Command: `boundary sessions list` - -The `boundary sessions list` command lets you list the Boundary sessions within a given scope or resource. - -## Example - -This example lists all sessions within the scope `s_1234567890`. -The `recursive` option means Boundary runs the operation recursively on any child scopes, if applicable: - -```shell-session -$ boundary sessions list -scope-id s_1234567890 -recursive -``` - -## Usage - - - -```shell-session -$ boundary sessions list [options] [args] -``` - - - -### Command options - -- `-filter=` - If set, Boundary filters the list operation before the results are returned. -The filter operates against each item in the list. -We recommend that you use single quotes, because the filters contain double quotes. -Refer to the [Filtering and listing resources documentation](/boundary/docs/filtering) for more details. -- `-include-terminated` - If set, Boundary includes terminated sessions in the `list` results. -The default value is `false`. -This field has been deprecated and will be removed from a future release. -Boundary will include terminated sessions in all list results, unless you filter them out. -- `recursive` - If set, runs the list operation recursively on any child scopes, if the type supports it. -The default value is `false`. -- `scope-id=` - The scope from which to list sessions. -The default value is `global`. -You can also specify this value using the **BOUNDARY_SCOPE_ID** environment variable. -- `list_token` (optional) - An opaque token that is returned from the previous `list` response. -If you do not supply a value, pagination starts from the beginning. -- `page_size` (optional) - An unsigned integer that indicates the number of items that should be included on the page of search results. -If you do not provide a value, or if you provide a value of `0`, Boundary uses the default page size of 1000 items. -If you configure it, the `page_size` value overrides the default page size. -Controller administrators can also configure a `max_page_size` option that constrains the maximum page size a user can request. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/sessions/read.mdx b/website/content/docs/commands/sessions/read.mdx deleted file mode 100644 index 42a0d7b77..000000000 --- a/website/content/docs/commands/sessions/read.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: sessions read - Command -description: >- - The "sessions read" command retrieves the details of a session resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# sessions read - -Command: `boundary sessions read` - -The `boundary sessions read` command lets you read information a Boundary session by providing the ID. - -## Example - -This example reads the details of a session with the ID `s_1234567890`: - -```shell-session -$ boundary sessions read -id s_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary sessions read [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the session you want to read. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/storage-buckets/create.mdx b/website/content/docs/commands/storage-buckets/create.mdx deleted file mode 100644 index a5f4b93aa..000000000 --- a/website/content/docs/commands/storage-buckets/create.mdx +++ /dev/null @@ -1,46 +0,0 @@ ---- -layout: docs -page_title: storage-buckets create - Command -description: >- - The "storage-buckets create" command creates new storage bucket resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# storage-buckets create - -This feature requires HCP Boundary or Boundary Enterprise - -Command: `boundary storage-buckets create` - -The `boundary storage-buckets create` command lets you create Boundary storage buckets. -Storage buckets are Boundary resources that represent storage resources in an external store. - -## Example - -This example creates a storage bucket with the name `prodops` and the description `storage bucket for ProdOps`: - -```shell-session -$ boundary storage-buckets create -name prodops -description "storage bucket for ProdOps" -``` - -## Usage - - - -```shell-session -$ boundary storage-buckets create [options] [args] -``` - - - -### Command options - -- `-bucket-name=` - The name of the storage bucket in the external store. -- `-bucket-prefix==` - An optional prefix to set on the storage bucket. -- `-worker-filter=` - A Boolean expression to filter which workers can process communication to this storage bucket. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/storage-buckets/delete.mdx b/website/content/docs/commands/storage-buckets/delete.mdx deleted file mode 100644 index 14f7fe240..000000000 --- a/website/content/docs/commands/storage-buckets/delete.mdx +++ /dev/null @@ -1,43 +0,0 @@ ---- -layout: docs -page_title: storage-buckets delete - Command -description: >- - The "storage-buckets delete" deletes existing storage bucket resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# storage-buckets delete - -This feature requires HCP Boundary or Boundary Enterprise - -Command: `boundary storage-buckets delete` - -The `boundary storage-buckets delete` command lets you delete Boundary storage buckets. - -## Example - -This example deletes a storage bucket with the ID `_1234567890`: - -```shell-session -$ boundary storage-buckets delete -id _1234567890 -``` - -## Usage - - - -```shell-session -$ boundary storage-buckets delete [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the storage bucket you want to delete. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/storage-buckets/index.mdx b/website/content/docs/commands/storage-buckets/index.mdx deleted file mode 100644 index 3c020f0fe..000000000 --- a/website/content/docs/commands/storage-buckets/index.mdx +++ /dev/null @@ -1,53 +0,0 @@ ---- -layout: docs -page_title: storage-buckets - Command -description: >- - The "storage-buckets" command performs operations on Boundary storage bucket resources. Storage buckets store session recordings. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# storage-buckets - -This feature requires HCP Boundary or Boundary Enterprise - -Command: `boundary storage-buckets` - -The `storage-buckets` command lets you perform operations on Boundary storage bucket resources. - -## Example - -The following command reads the details of a storage bucket with the id `sb_1234567890`: - -```shell-session -$ boundary storage-buckets read -id sb_1234567890 -``` - -## Usage - - - -```shell-session -Usage: boundary storage-buckets [options] [args] - # ... -Subcommands: - create Create a storage bucket - delete Delete a storage bucket - list List a storage bucket - read Read a storage bucket - update Update a storage bucket -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [create](/boundary/docs/commands/storage-buckets/create) -- [delete](/boundary/docs/commands/storage-buckets/delete) -- [list](/boundary/docs/commands/storage-buckets/list) -- [read](/boundary/docs/commands/storage-buckets/read) -- [update](/boundary/docs/commands/storage-buckets/update) \ No newline at end of file diff --git a/website/content/docs/commands/storage-buckets/list.mdx b/website/content/docs/commands/storage-buckets/list.mdx deleted file mode 100644 index 9850fcac6..000000000 --- a/website/content/docs/commands/storage-buckets/list.mdx +++ /dev/null @@ -1,58 +0,0 @@ ---- -layout: docs -page_title: storage-buckets list - Command -description: >- - The "storage-buckets list" command lists the available storage bucket resources within a scope or resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# storage-buckets list - -This feature requires HCP Boundary or Boundary Enterprise - -Command: `storage-buckets list` - -The `storage-buckets list` command lets you list the storage buckets within a given scope or resource. - -## Example - -This example lists all storage buckets within the scope `s_1234567890`. -The `recursive` option means Boundary runs the operation recursively on any child scopes, if applicable: - -```shell-session -$ boundary storage-buckets list -scope-id s_1234567890 -recursive -``` - -## Usage - - - -```shell-session -$ boundary storage-buckets list [options] [args] -``` - - - -### Command options - -- `-filter=` - If set, Boundary filters the list operation before the results are returned. -The filter operates against each item in the list. -We recommend that you use single quotes, because the filters contain double quotes. -Refer to the [Filtering and listing resources documentation](/boundary/docs/filtering) for more details. -- `recursive` - If set, runs the list operation recursively on any child scopes, if the type supports it. -The default value is `false`. -- `scope-id=` - The scope from which to list storage buckets. -The default value is `global`. -You can also specify this value using the **BOUNDARY_SCOPE_ID** environment variable. -- `list_token` (optional) - An opaque token that is returned from the previous `list` response. -If you do not supply a value, pagination starts from the beginning. -- `page_size` (optional) - An unsigned integer that indicates the number of items that should be included on the page of search results. -If you do not provide a value, or if you provide a value of `0`, Boundary uses the default page size of 1000 items. -If you configure it, the `page_size` value overrides the default page size. -Controller administrators can also configure a `max_page_size` option that constrains the maximum page size a user can request. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/storage-buckets/read.mdx b/website/content/docs/commands/storage-buckets/read.mdx deleted file mode 100644 index a6639fcc2..000000000 --- a/website/content/docs/commands/storage-buckets/read.mdx +++ /dev/null @@ -1,43 +0,0 @@ ---- -layout: docs -page_title: storage-buckets read - Command -description: >- - The "storage-buckets read" command retrieves the details of an existing storage bucket resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# storage-buckets read - -This feature requires HCP Boundary or Boundary Enterprise - -Command: `boundary storage-buckets read` - -The `boundary storage-buckets read` command lets you read information about Boundary storage buckets. - -## Example - -This example reads the details of a storage bucket with the ID `_1234567890`: - -```shell-session -$ boundary storage-buckets read -id _1234567890 -``` - -## Usage - - - -```shell-session -$ boundary storage-buckets read [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the storage bucket you want to read. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/storage-buckets/update.mdx b/website/content/docs/commands/storage-buckets/update.mdx deleted file mode 100644 index 18e6dca58..000000000 --- a/website/content/docs/commands/storage-buckets/update.mdx +++ /dev/null @@ -1,93 +0,0 @@ ---- -layout: docs -page_title: storage-buckets update - Command -description: >- - The "storage-buckets update" command updates existing storage bucket resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# storage-buckets update - -This feature requires HCP Boundary or Boundary Enterprise - -Command: `boundary storage-buckets update` - -The `boundary storage-buckets update` command lets you update Boundary storage buckets by ID. - -## Example - -This example updates a storage bucket with the ID `_1234567890` to add the name `devops` and the description `storage bucket for DevOps`: - -```shell-session -$ boundary storage-buckets update -id _1234567890 -name devops -description "storage bucket for DevOps" -``` - -## Usage - - - -```shell-session -$ boundary storage-buckets update [options] [args] -``` - - - -### Command options - -- `-description=` - The description to set for the storage bucket. -- `-id=` - The ID of the storage bucket you want to update. -- `-name=` - The name to set for the storage bucket. -- `-version=` - The version of the storage bucket against which to perform the update operation. -If you do not specify a version, the command performs a check-and-set operation automatically. - -### Attribute options - -- `-attr` - A key=value pair to add to the request's attribute map. -This option can also be a key value only, which sets a JSON null as the value. -If you provide a value, Boundary automatically infers the type. -You can override the type using `-string-attr`, `-bool-attr`, or `-num-attr`. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. -- `-attributes=` - A JSON map value that you can use as the entirety of the request's attributes map. -Usually this value is sourced from a file using the `file://` syntax. -This option is exclusive with other `attr` flags. -- `-bool-attr` - A key=value Boolean value that you can add to the request's attributes map. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. -- `-num-attr` - A key=value numeric value that you can add to the request's attributes map. -You can specify this value multiple times. -This attribute supports referencing values from files using `file://` and environment variables using `env://`. -- `-string-attr` - A key=value string value that you can add to the request's attributes map. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. - -### Secrets options - -- `-bool-secret` - A key=value Boolean value that you can add to the request's secrets map. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. -- `-num-secret` - A key=value numeric value that you can add to the request's secrets map. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. -- `-secret` - A key=value pair that you can add to the request's secrets map. -This option can also be a key value only, which sets a JSON null as the value. -If you provide a value, Boundary automatically infers the type. -You can override the type using `-string-secret`, `-bool-secret`, or `-num-secret`. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. -- `-secrets=` - A JSON map value that you can use as the entirety of the request's secrets map. -Usually this value is sourced from file using `file://` syntax. -This option is exclusive with other secret flags. -- `-string-secret` - A key=value string value that you can add to the request's attributes map. -You can specify this value multiple times. -This option supports referencing values from files using `file://` and environment variables using `env://`. - -### Storage bucket options - -- `-worker-filter=` - A Boolean expression that you can use to filter which workers can process communication to the storage bucket. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/targets/add-credential-sources.mdx b/website/content/docs/commands/targets/add-credential-sources.mdx deleted file mode 100644 index 15325e964..000000000 --- a/website/content/docs/commands/targets/add-credential-sources.mdx +++ /dev/null @@ -1,51 +0,0 @@ ---- -layout: docs -page_title: targets add-credential-sources - Command -description: >- - The "targets add-credential-sources" command adds credential sources to target resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# targets add-credential-sources - -Command: `targets add-credential-sources` - -The `targets add-credential-sources` command lets you add credential sources to target resources. - -## Example - -This example adds the brokered credential sources `clvlt_1234567890` and `clvlt_0987654321` to a TCP target with the ID `ttcp_1234567890`: - -```shell-session -$ boundary targets add-credential-sources -id ttcp_1234567890 -brokered-credential-source clvlt_1234567890 -brokered-credential-source clvlt_0987654321 -``` - -## Usage - - - -```shell-session -$ boundary targets add-credential-sources [options] [args] -``` - - - -### Command options - -- `-application-credential-source=` - This option is deprecated. -Use `-brokered-credential-source` instead. -- `-brokered-credential-source=` - The credential source you want to add. -Boundary returns the credential source to the user when it creates a connection. -You can specify multiple credential sources. -- `-id=` - The ID of the target you want to add the credential source to. -- `-injected-application-credential-source=` - The credential source you want to add. -Boundary injects the credential source when it creates a connection. -You can specify multiple credential sources. -- `-version=` - The version of the target to perform the operation on. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/targets/add-host-sources.mdx b/website/content/docs/commands/targets/add-host-sources.mdx deleted file mode 100644 index e030a0bdc..000000000 --- a/website/content/docs/commands/targets/add-host-sources.mdx +++ /dev/null @@ -1,45 +0,0 @@ ---- -layout: docs -page_title: targets add-host-sources - Command -description: >- - The "targets add-host-sources" command adds host sources to target resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# targets add-host-sources - -Command: `targets add-host-sources` - -The `targets add-host-sources` command lets you add host sources to target resources. - -## Example - -This example adds the host sources `hsst_1234567890` and `hsst_0987654321` to a TCP target with the ID `ttcp_1234567890`: - -```shell-session -$ boundary targets add-host-sources -id ttcp_1234567890 -host-source hsst_1234567890 -host-source hsst_0987654321 -``` - -## Usage - - - -```shell-session -$ boundary targets add-host-sources [options] [args] -``` - - - -### Command options - -- `-host-source=` - The host source you want to add. -You may specify multiple host sources. -- `-id=` - The ID of the target you want to add a host source to. -- `-version=` - The version of the target to perform the operation on. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/targets/authorize-session.mdx b/website/content/docs/commands/targets/authorize-session.mdx deleted file mode 100644 index 89b250a8b..000000000 --- a/website/content/docs/commands/targets/authorize-session.mdx +++ /dev/null @@ -1,58 +0,0 @@ ---- -layout: docs -page_title: targets authorize-session - Command -description: >- - The "targets authorize-session" command fetches session authorization credentials for a target resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# targets authorize-session - -Command: `targets authorize-session` - -The `targets authorize-session` command lets you fetch session authorization credentials for a target so that you can start a session later. - -## Examples - -This example fetches authorization credentials for a target with the ID `ttcp_wtXnow8Krb` and a specific host with the ID `hst_DHei2VpkBH`: - -```shell-session -$ boundary targets authorize-session -id=ttcp_wtXnow8Krb -host-id=hst_DHei2VpkBH -``` - -You can also request an authorized session using the scope ID and target name. -This example requests authorization credentials using the scope ID `o_1234567890` and the target name `prod-ssh`: - -```shell-session -$ boundary targets authorize-session -scope-id o_1234567890 -name prod-ssh -``` - -## Usage - - - -```shell-session -$ boundary targets authorize-session [options] [args] -``` - - - -### Command options - -- `-host-id=` - The ID of a host from the target's host sets. -If you specify a host, Boundary uses that specific host for the connection. -If you do not specify a host, Boundary chooses one at random. -- `-id=` - The ID of the target you want to authorize a session for. -- `-name=` - The name of the target you want to fetch credentials for, if you want to authorize the session using scope parameters and target name. -- `-scope-id=` - The scope ID of the target you want to fetch credentials for, if you want to authorize the session using scope parameters and target name. -Alternatively, you can specify a scope ID using the **BOUNDARY_SCOPE_ID** environment variable. -You cannot specify a scope ID if you specify a `-scope-name`. -- `-scope-name=` - The scope name of the target you want to fetch credentials for, if you want to authorize the session using scope parameters and target name. -Alternatively, you can specify a scope name using the **BOUNDARY_SCOPE_NAME** environment variable. -You cannot specify a scope name if you specify a `-scope-id`. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/targets/create.mdx b/website/content/docs/commands/targets/create.mdx deleted file mode 100644 index 6b6044b06..000000000 --- a/website/content/docs/commands/targets/create.mdx +++ /dev/null @@ -1,192 +0,0 @@ ---- -layout: docs -page_title: targets create - Command -description: >- - The "targets create" command creates a new target resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# targets create - -Command: `targets create` - -The `targets create` command lets you create a new target. - -## Example - -This example creates a TCP target with the name `prodops` and the description `For ProdOps usage`: - -```shell-session -$ boundary targets create tcp -name prodops -description "For ProdOps usage" -``` - -## Usage - - - -```shell-session -$ boundary targets create [type] [sub command] [options] [args] - -Please see the typed subcommand help for detailed usage information. - -Subcommands: - rdp Create an rdp-type target (HCP & Boundary Enterprise only) - ssh Create a ssh-type target (HCP & Boundary Enterprise only) - tcp Create a tcp-type target -``` - - - -### Usages by type - -You can create RDP, SSH, or TCP targets. - - - - -The `targets create rdp` command lets you create RDP targets. - -#### Example - -This example creates an RDP target with the name `admindc` and the description `RDP target for Admin Domain Controller`: - -```shell-session -$ boundary targets create rdp -name admindc -description "RDP target for Admin Domain Controller" -``` - -#### Usage - - - -```shell-session -$ boundary targets create rdp [options] [args] -``` - - - -#### RDP target options - -- `-address=` - An optional valid network address for the target to connect to. -You cannot use an address alongside host sources. - - If you set a target address for RDP targets that use Kerberos authentication, use the target's hostname and append the domain to it, for example `target-hostname.mydomain.com`. For RDP targets that use NTLM authentication, set the target address to the target's IP address. -- `-default-client-port=` - The default client port on the target. -- `-default-port=` - The default port on the target. -Due to a port conflict on modern Windows operating systems (Windows 11+, Windows Server 2025), transparent sessions cannot use the default RDP port `3389`. -You must configure a custom port to use transparent sessions with RDP targets. - - Refer to [Using transparent sessions with RDP on Windows](/boundary/docs/credentials/rdp-testing-and-compatibility-matrix#using-transparent-sessions-with-rdp-on-windows) for more information about configuring a custom port for transparent sessions. -- `-egress-worker-filter=` - A Boolean expression that filters which egress workers can process sessions for the target. -- `-ingress-worker-filter=` - A Boolean expression that filters which ingress workers can process sessions for the target. -- `-session-connection-limit=` - The maximum number of connections allowed for a session. -A value of `-1` means the connections are unlimited. -- `-session-max-seconds=` - The maximum lifetime of the session, including all connections. -You can specify an integer number of seconds or a duration string. -If you do not specfiy a maximum duration, Boundary uses the default value of 8 hours (28800 seconds). -- `-with-alias-authorize-session-host-id=` - The host ID that an alias uses to authorize sessions for the target. -- `-with-alias-scope-id=` - The scope ID that you want to create the target and alias in. -The default is `global`. -At this time, aliases are only supported for the global scope. -- `-with-alias-value=` - The value of the alias that you want to use to represent the target. -Use this parameter to create the alias and target, and associate them with each other, at the same time. - - - - - -The `targets create ssh` command lets you create SSH targets. - -#### Example - -This example creates an SSH target with the name `prodops` and the description `SSH target for ProdOps`: - -```shell-session -$ boundary targets create ssh -name prodops -description "SSH target for ProdOps" -``` - -#### Usage - - - -```shell-session -$ boundary targets create ssh [options] [args] -``` - - - -#### SSH target options - -- `-address=` - An optional valid network address for the target to connect to. -You cannot use an address alongside host sources. -- `-default-client-port=` - The default client port on the target. -- `-default-port=` - The default port on the target. -If you do not specify a default port, Boundary uses port 22. -- `-egress-worker-filter=` - A Boolean expression that filters which egress workers can process sessions for the target. -- `-enable-session-recording=` - A Boolean expression you can use to enable session recording for the target. -- `-ingress-worker-filter=` - A Boolean expression that filters which ingress workers can process sessions for the target. -- `-session-connection-limit=` - The maximum number of connections allowed for a session. -A value of `-1` means the connections are unlimited. -- `-session-max-seconds=` - The maximum lifetime of the session, including all connections. -You can specify an integer number of seconds or a duration string. -If you do not specfiy a maximum duration, Boundary uses the default value of 8 hours (28800 seconds). -- `-storage-bucket-id=` - The public ID of the storage bucket to associate with the target. -- `-with-alias-authorize-session-host-id=` - The host ID that an alias uses to authorize sessions for the target. -- `-with-alias-scope-id=` - The scope ID that you want to create the target and alias in. -The default is `global`. -At this time, aliases are only supported for the global scope. -- `-with-alias-value=` - The value of the alias that you want to use to represent the target. -Use this parameter to create the alias and target, and associate them with each other, at the same time. - - - - - -The `targets create tcp` command lets you create TCP targets. - -#### Example - -This example creates a TCP target with the name `prodops` and the description `TCP target for ProdOps`: - -```shell-session -$ boundary targets create tcp -name prodops -description "TCP target for ProdOps" -``` - -#### Usage - - - -```shell-session -$ boundary targets create tcp [options] [args] -``` - - - -#### TCP target options - -- `-address=` - An optional valid network address for the target to connect to. -You cannot use an address alongside host sources. -- `-default-client-port=` - The default client port on the target. -- `-default-port=` - The default port on the target. -If you do not specify a default port, Boundary uses port 22. -- `-egress-worker-filter=` - A Boolean expression that filters which egress workers can process sessions for the target. -- `-ingress-worker-filter=` - A Boolean expression that filters which ingress workers can process sessions for the target. -- `-session-connection-limit=` - The maximum number of connections allowed for a session. -A value of `-1` means the connections are unlimited. -- `-session-max-seconds=` - The maximum lifetime of the session, including all connections. -You can specify an integer number of seconds or a duration string. -If you do not specfiy a maximum duration, Boundary uses the default value of 8 hours (28800 seconds). -- `-with-alias-authorize-session-host-id=` - The host ID that an alias uses to authorize sessions for the target. -- `-with-alias-scope-id=` - The scope ID that you want to create the alias in at target creation time. -The default is `global`. -At this time, aliases are only supported for the global scope. -- `-with-alias-value=` - The value of the alias that you want to use to represent the target. -Use this parameter to create the alias and target, and associate them with each other, at the same time. - - - - -@include 'cmd-option-note.mdx' diff --git a/website/content/docs/commands/targets/delete.mdx b/website/content/docs/commands/targets/delete.mdx deleted file mode 100644 index aedfa8527..000000000 --- a/website/content/docs/commands/targets/delete.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: targets delete - Command -description: >- - The "targets delete" command deletes an existing target resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# targets delete - -Command: `targets delete` - -The `targets delete` command lets you delete a target. - -## Example - -This example deletes a target with the ID `t_1234567890`: - -```shell-session -$ boundary targets delete -id t_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary targets delete [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the target you want to delete. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/targets/index.mdx b/website/content/docs/commands/targets/index.mdx deleted file mode 100644 index 39ebe80e4..000000000 --- a/website/content/docs/commands/targets/index.mdx +++ /dev/null @@ -1,67 +0,0 @@ ---- -layout: docs -page_title: targets - Command -description: >- - The "targets" command performs operations on Boundary target resources. Targets represent networked services that users can connect to during sessions. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# targets - -Command: `boundary targets` - -The `targets` command lets you perform operations on Boundary target resources. - -## Example - -The following command updates the description for a target with the ID `ttcp_1234567890`: - -```shell-session - $ boundary targets update -id ttcp_1234567890 -description "updated postgres target" -``` - -## Usage - - - -```shell-session -boundary targets [sub command] [options] [args] - - # ... - -Subcommands: - add-credential-sources Add credential sources to a target - add-host-sources Add host sources to a target - authorize-session Request session authorization against the target - create Create a target - delete Delete a target - list List a target - read Read a target - remove-credential-sources Remove credential sources from a target - remove-host-sources Remove host sources from a target - set-credential-sources Set the full contents of the credential sources on a target - set-host-sources Set the full contents of the host sources on a target - update Update a target -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [add-credential-sources](/boundary/docs/commands/targets/add-credential-sources) -- [add-host-sources](/boundary/docs/commands/targets/add-host-sources) -- [authorize-session](/boundary/docs/commands/targets/authorize-session) -- [create](/boundary/docs/commands/targets/create) -- [delete](/boundary/docs/commands/targets/delete) -- [list](/boundary/docs/commands/targets/list) -- [read](/boundary/docs/commands/targets/read) -- [remove-credential-sources](/boundary/docs/commands/targets/remove-credential-sources) -- [remove-host-sources](/boundary/docs/commands/targets/remove-host-sources) -- [set-credential-sources](/boundary/docs/commands/targets/set-credential-sources) -- [set-host-sources](/boundary/docs/commands/targets/set-host-sources) -- [update](/boundary/docs/commands/targets/update) \ No newline at end of file diff --git a/website/content/docs/commands/targets/list.mdx b/website/content/docs/commands/targets/list.mdx deleted file mode 100644 index df72bd3a0..000000000 --- a/website/content/docs/commands/targets/list.mdx +++ /dev/null @@ -1,56 +0,0 @@ ---- -layout: docs -page_title: targets list - Command -description: >- - The "targets list" command lists the available target resources within a scope or resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# targets list - -Command: `targets list` - -The `targets list` command lets you list the targets within a given scope or resource. - -## Example - -This example lists all targets within the scope `s_1234567890`. -The `recursive` option means Boundary runs the operation recursively on any child scopes, if applicable: - -```shell-session -$ boundary targets list -scope-id s_1234567890 -recursive -``` - -## Usage - - - -```shell-session -$ boundary targets list [options] [args] -``` - - - -### Command options - -- `-filter=` - If set, Boundary filters the list operation before the results are returned. -The filter operates against each item in the list. -We recommend that you use single quotes, because the filters contain double quotes. -Refer to the [Filtering and listing resources documentation](/boundary/docs/filtering) for more details. -- `recursive` - If set, runs the list operation recursively on any child scopes, if the type supports it. -The default value is `false`. -- `scope-id=` - The scope from which to list the targets. -The default value is `global`. -You can also specify this value using the **BOUNDARY_SCOPE_ID** environment variable. -- `list_token` (optional) - An opaque token that is returned from the previous `list` response. -If you do not supply a value, pagination starts from the beginning. -- `page_size` (optional) - An unsigned integer that indicates the number of items that should be included on the page of search results. -If you do not provide a value, or if you provide a value of `0`, Boundary uses the default page size of 1000 items. -If you configure it, the `page_size` value overrides the default page size. -Controller administrators can also configure a `max_page_size` option that constrains the maximum page size a user can request. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/targets/read.mdx b/website/content/docs/commands/targets/read.mdx deleted file mode 100644 index 80775038d..000000000 --- a/website/content/docs/commands/targets/read.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: targets read - Command -description: >- - The "targets read" command retrieves the details of a target resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# targets read - -Command: `targets read` - -The `targets read` command lets you read the details of a target with a given ID. - -## Example - -This example reads the details of a target with the ID `t_1234567890`: - -```shell-session -$ boundary targets read -id t_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary targets read [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the target you want to read. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/targets/remove-credential-sources.mdx b/website/content/docs/commands/targets/remove-credential-sources.mdx deleted file mode 100644 index 359d42af9..000000000 --- a/website/content/docs/commands/targets/remove-credential-sources.mdx +++ /dev/null @@ -1,49 +0,0 @@ ---- -layout: docs -page_title: targets remove-credential-sources - Command -description: >- - The "targets remove-credential-sources" removes credential sources from target resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# targets remove-credential-sources - -Command: `targets remove-credential-sources` - -The `targets remove-credential-sources` command lets you remove credential sources from target resources. - -## Example - -This example removes the brokered credential sources `clvlt_1234567890` and `clvlt_0987654321` from a TCP target with the ID `ttcp_1234567890`: - -```shell-session -$ boundary targets remove-credential-sources -id ttcp_1234567890 -brokered-credential-source clvlt_1234567890 -brokered-credential-source clvlt_0987654321 -``` - -## Usage - - - -```shell-session -$ boundary targets remove-credential-sources [options] [args] -``` - - - -### Command options - -- `-application-credential-source=` - This option is deprecated. -Use `-brokered-credential-source` instead. -- `-brokered-credential-source=` - The credential source you want to remove. -You may specify multiple credential sources. -- `-id=` - The ID of the target you want to remove the credential source from. -- `-injected-application-credential-source=` - The credential source you want to remove. -You may specify multiple credential sources. -- `-version=` - The version of the target to perform the operation on. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/targets/remove-host-sources.mdx b/website/content/docs/commands/targets/remove-host-sources.mdx deleted file mode 100644 index a0f24486c..000000000 --- a/website/content/docs/commands/targets/remove-host-sources.mdx +++ /dev/null @@ -1,45 +0,0 @@ ---- -layout: docs -page_title: targets remove-host-sources - Command -description: >- - The "targets remove-host-sources" command removes host sources from target resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# targets remove-host-sources - -Command: `targets remove-host-sources` - -The `targets remove-host-sources` command lets you remove host sources from target resources. - -## Example - -This example removes the host sources `hsst_1234567890` and `hsst_0987654321` from a target with the ID `ttcp_1234567890`: - -```shell-session -$ boundary targets remove-host-sources -id ttcp_1234567890 -host-source hsst_1234567890 -host-source hsst_0987654321 -``` - -## Usage - - - -```shell-session -$ boundary target remove-host-sources [options] [args] -``` - - - -### Command options - -- `-host-source=` - The host source you want to remove. -You may specify multiple host sources. -- `-id=` - The ID of the target you want to remove a host source from. -- `-version=` - The version of the target to perform the operation on. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/targets/set-credential-sources.mdx b/website/content/docs/commands/targets/set-credential-sources.mdx deleted file mode 100644 index 1d1f33388..000000000 --- a/website/content/docs/commands/targets/set-credential-sources.mdx +++ /dev/null @@ -1,52 +0,0 @@ ---- -layout: docs -page_title: targets set-credential-sources - Command -description: >- - The "targets set-credential-sources" command sets credential sources on target resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# targets set-credential-sources - -Command: `targets set-credential-sources` - -The `targets set-credential-sources` command lets you set credential sources on target resources. - -## Example - -This example sets a brokered credential source `clvlt_1234567890` on a target with the ID `ttcp_1234567890`: - -```shell-session -$ boundary targets set-credential-sources -id ttcp_1234567890 -brokered-credential-source clvlt_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary targets set-credential-sources [options] [args] -``` - - - -### Command options - -- `-application-credential-source=` - This option is deprecated. -Use `-brokered-credential-source` instead. - -- `-brokered-credential-source=` - The brokered credential source you want to set on the target. -Boundary returns the credential source to the user when it creates a connection. -You may specify multiple credential sources. -- `-id=` - The ID of the target you want to set the credential source on. -- `-injected-application-credential-source=` - The injected credential source you want to set on the target. -Boundary injects the credential source when it creates a connection. -You may specify multiple credential sources. -- `-version=` - The version of the target to perform the operation on. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/targets/set-host-sources.mdx b/website/content/docs/commands/targets/set-host-sources.mdx deleted file mode 100644 index 853b9ec06..000000000 --- a/website/content/docs/commands/targets/set-host-sources.mdx +++ /dev/null @@ -1,45 +0,0 @@ ---- -layout: docs -page_title: targets set-host-sources - Command -description: >- - The "targets set-host-sources" command sets host sources on target resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# targets set-host-sources - -Command: `targets set-host-sources` - -The `targets set-host-sources` command lets you set host sources on target resources. - -## Example - -This example sets the host source `hsst_1234567890` on a target with the ID `ttcp_1234567890`: - -```shell-session -$ boundary targets set-host-sources -id ttcp_1234567890 -host-source hsst_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary targets set-host-sources [options] [args] -``` - - - -### Command options - -- `-host-source=` - The host source you want to set on the target. -You may specify multiple host sources. -- `-id=` - The ID of the target you want to set a host source on. -- `-version=` - The version of the target to perform the operation on. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/targets/update.mdx b/website/content/docs/commands/targets/update.mdx deleted file mode 100644 index ae4b90f92..000000000 --- a/website/content/docs/commands/targets/update.mdx +++ /dev/null @@ -1,175 +0,0 @@ ---- -layout: docs -page_title: targets update - Command -description: >- - The "targets update" command updates an existing target resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# targets update - -Command: `targets update` - -The `targets update` command lets you update a target. - -## Example - -This example updates a TCP target with the ID `ttcp_1234567890` to add the name `devops` and the description `For DevOps usage`: - -```shell-session -$ boundary targets update tcp -id ttcp_1234567890 -name devops -description "For DevOps usage" -``` - -## Usage - - - -```shell-session -$ boundary targets update [type] [sub command] [options] [args] - -Please see the typed subcommand help for detailed usage information. - -Subcommands: - rdp Update an rdp-type target (HCP & Boundary Enterprise only) - ssh Update a ssh-type target (HCP & Boundary Enterprise only) - tcp Update a tcp-type target -``` - - - -### Usages by type - -You can update RDP, SSH, or TCP targets. - - - - -The `targets update rdp` command lets you update existing RDP targets. - -#### Example - -This example updates an RDP target with the id `rdp_1234567890` to add the name `devops` and the description `RDP target for DevOps`: - -```shell-session -$ boundary targets update rdp -id trdp_1234567890 -name "devops" -description "RDP target for DevOps" -``` - -#### Usage - - - -```shell-session -$ boundary targets update rdp [options] [args] -``` - - - -#### RDP target options - -- `-address=` - An optional valid network address for the target to connect to. -You cannot use an address alongside host sources. - - If you set a target address for RDP targets that use Kerberos authentication, use the target's hostname and append the domain to it, for example `target-hostname.mydomain.com`. For RDP targets that use NTLM authentication, set the target address to the target's IP address. -- `-default-client-port=` - The default client port on the target. -- `-default-port=` - The default port on the target. -Due to a port conflict on modern Windows operating systems (Windows 11+, Windows Server 2025), transparent sessions cannot use the default RDP port `3389`. -You must configure a custom port to use transparent sessions with RDP targets. - - Refer to [Using transparent sessions with RDP on Windows](/boundary/docs/credentials/rdp-testing-and-compatibility-matrix#using-transparent-sessions-with-rdp-on-windows) for more information about configuring a custom port for transparent sessions. -- `-egress-worker-filter=` - A Boolean expression that filters which egress workers can process sessions for the target. -- `-ingress-worker-filter=` - A Boolean expression that filters which ingress workers can process sessions for the target. -- `-session-connection-limit=` - The maximum number of connections allowed for a session. -A value of `-1` means the connections are unlimited. -- `-session-max-seconds=` - The maximum lifetime of the session, including all connections. -You can specify an integer number of seconds or a duration string. -If you do not specfiy a maximum duration, Boundary uses the default value of 8 hours (28800 seconds). - - - - -The `targets update ssh` command lets you update SSH targets. - -#### Example - -This example updates an SSH target with the ID `tssh_1234567890` to add the name `devops` and the description `SSH target for DevOps`: - -```shell-session -$ boundary targets update ssh -id tssh_1234567890 -name "devops" -description "SSH target for DevOps" -``` - -#### Usage - - - -```shell-session -$ boundary targets update ssh [options] [args] -``` - - - -#### SSH target options - -- `-address=` - An optional valid network address for the target to connect to. -You cannot use an address alongside host sources. -- `-default-client-port=` - The default client port on the target, if set. -- `-default-port=` - The default port on the target, if set. -If you do not specify a default port, Boundary uses port 22. -- `-egress-worker-filter=` - A Boolean expression that filters which egress workers can process sessions for the target. -- `-enable-session-recording=` - A Boolean expression you can use to enable session recording for the target. -- `-ingress-worker-filter=` - A Boolean expression that filters which ingress workers can process sessions for the target. -- `-session-connection-limit=` - The maximum number of connections allowed for a session. -A value of `-1` means the connections are unlimited. -- `-session-max-seconds=` - The maximum lifetime of the session, including all connections. -You can specify an integer number of seconds or a duration string. -If you do not specfiy a maximum duration, Boundary uses the default value of 8 hours (28800 seconds). -- `-storage-bucket-id=` - The public ID of the storage bucket you want to associate with the target. - - - - - -The `targets update tcp` command lets you update TCP targets. - -#### Example - -This example updates a TCP target with the ID `ttcp_1234567890` to add the name `devops` and the description `TCP target for DevOps`: - -```shell-session -$ boundary targets update tcp -id ttcp_1234567890 -name "devops" -description "TCP target for DevOps" -``` - -#### Usage - - - -```shell-session -$ boundary targets update tcp [options] [args] -``` - - - -#### TCP target options - -- `-address=` - An optional valid network address for the target to connect to. -You cannot use an address alongside host sources. -- `-default-client-port=` - The default client port on the target, if set. -- `-default-port=` - The default port on the target, if set. -If you do not specify a default port, Boundary uses port 22. -- `-egress-worker-filter=` - A Boolean expression that filters which egress workers can process sessions for the target. -- `-ingress-worker-filter=` - A Boolean expression that filters which ingress workers can process sessions for the target. -- `-session-connection-limit=` - The maximum number of connections allowed for a session. -A value of `-1` means the connections are unlimited. -- `-session-max-seconds=` - The maximum lifetime of the session, including all connections. -You can specify an integer number of seconds or a duration string. -If you do not specfiy a maximum duration, Boundary uses the default value of 8 hours (28800 seconds). -- `-worker-filter=` - This option is deprecated. -Use the egress or ingress filters instead. - - - - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/update.mdx b/website/content/docs/commands/update.mdx deleted file mode 100644 index b40fc8f51..000000000 --- a/website/content/docs/commands/update.mdx +++ /dev/null @@ -1,46 +0,0 @@ ---- -layout: docs -page_title: update - Command -description: >- - The "update" command updates existing Boundary resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# update - -Command: `boundary update` - -The `boundary update` command lets you update Boundary resources. -It is a generic command that runs an update operation on a Boundary resource using the resource's ID. - -When you run this command, Boundary interprets it as the type-specific command. -For example, if you enter the `update` command with a storage bucket ID, Boundary runs the `storage-buckets update` command. -Help, error, or cURL output from the command may show the full command syntax. - -## Example - -This example updates a storage bucket with the ID `sb_1234567890` to add the name `devops` and the description `storage bucket for DevOps`: - -```shell-session -$ boundary update -id sb_1234567890 -name devops -description "storage bucket for DevOps" -``` - -## Usage - - - -```shell-session -$ boundary update [resource ID] [args] -``` - - - -### Command options - -- `-id=` - The ID of the resource you want to update. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/users/add-accounts.mdx b/website/content/docs/commands/users/add-accounts.mdx deleted file mode 100644 index 91f997ac1..000000000 --- a/website/content/docs/commands/users/add-accounts.mdx +++ /dev/null @@ -1,45 +0,0 @@ ---- -layout: docs -page_title: users add-accounts - Command -description: >- - The "users add-accounts" command associates accounts with a user resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# users add-accounts - -Command: `users add-accounts` - -The `users add-accounts` command lets you associate accounts with a user. - -## Example - -This example associates a user `u_1234567890` with an account `a_1234567890`: - -```shell-session -$ boundary users add-accounts -id u_1234567890 -account a_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary users add-accounts [options] [args] -``` - - - -### Command options - -- `-account=` - The account you want to associate with the user. -You can add multiple accounts. -- `-id=` - The ID of the user you want to associate an account with. -- `-version=` - The version of the user to perform the operation on. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/users/create.mdx b/website/content/docs/commands/users/create.mdx deleted file mode 100644 index 6b2dc96cf..000000000 --- a/website/content/docs/commands/users/create.mdx +++ /dev/null @@ -1,45 +0,0 @@ ---- -layout: docs -page_title: users create - Command -description: >- - The "users create" command create a new user resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# users create - -Command: `users create` - -The `users create` command lets you create a new user. - -## Example - -This example creates a user `prodops` with the description `User for ProdOps`: - -```shell-session -$ boundary users create -name prodops -description "User for ProdOps" -``` - -## Usage - - - -```shell-session -$ boundary users create [options] [args] -``` - - - -### Command options - -- `-description=` - The description to assign the user. -- `-name=` - The name to assign to the user. -- `-scope-id=` - The scope you want to create the user in. -The default is `global`. -You can also specify the scope using the **BOUNDARY_SCOPE_ID** environment variable. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/users/delete.mdx b/website/content/docs/commands/users/delete.mdx deleted file mode 100644 index 0fa5f6c93..000000000 --- a/website/content/docs/commands/users/delete.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: users delete - Command -description: >- - The "users delete" command deletes an existing user resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# users delete - -Command: `users delete` - -The `users delete` command lets you delete a user. - -## Example - -This example deletes a user with the id `u_1234567890`: - -```shell-session -$ boundary users delete -id u_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary users delete [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the user you want to delete. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/users/index.mdx b/website/content/docs/commands/users/index.mdx deleted file mode 100644 index 61d7d4028..000000000 --- a/website/content/docs/commands/users/index.mdx +++ /dev/null @@ -1,59 +0,0 @@ ---- -layout: docs -page_title: users - Command -description: >- - The "users" command performs operations on Boundary user resources. Users represent an individual or entity for the purposes of access control. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# users - -Command: `boundary users` - -The `users` command lets you perform operations on Boundary user resources. - -## Example - -The following command creates a user with the name `prodops` and the description `For ProdOps usage`: - -```shell-session -$ boundary users create -name prodops -description "For ProdOps usage" -``` - -## Usage - - - -```shell-session -Usage: boundary users [options] [args] - - # ... - -Subcommands: - add-accounts Add accounts to a user within Boundary - create Create a user - delete Delete a user - list List a user - read Read a user - remove-accounts Remove accounts from a user within Boundary - set-accounts Set the full contents of the accounts on a user within Boundary - update Update a user -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [add-accounts](/boundary/docs/commands/users/add-accounts) -- [create](/boundary/docs/commands/users/create) -- [delete](/boundary/docs/commands/users/delete) -- [list](/boundary/docs/commands/users/list) -- [read](/boundary/docs/commands/users/read) -- [remove-accounts](/boundary/docs/commands/users/remove-accounts) -- [set-accounts](/boundary/docs/commands/users/set-accounts) -- [update](/boundary/docs/commands/users/update) diff --git a/website/content/docs/commands/users/list.mdx b/website/content/docs/commands/users/list.mdx deleted file mode 100644 index 10dbbc503..000000000 --- a/website/content/docs/commands/users/list.mdx +++ /dev/null @@ -1,55 +0,0 @@ ---- -layout: docs -page_title: users list - Command -description: >- - The "users list" command lists the available user resources from the specified scope or resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# users list - -Command: `users list` - -The `users list` command lets you list the users who belong to a given scope or resource. - -## Example - -This example lists all users in the scope `s_1234567890`: - -```shell-session -$ boundary users list -scope-id s_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary users list [options] [args] -``` - - - -### Command options - -- `-filter=` - If set, Boundary filters the list operation before it is returned. -The filter operates against each item in the list. -We recommend that you use single quotes, as filters contain double quotes. -Refer to the [Filtering and listing resources documentation](/boundary/docs/filtering) for more details. -- `-recursive` - If set, runs the list operation recursively into child scopes, if the type supports it. -The default value is `false`. -- `-scope-id=` - The scope that contains the users you want to list. -The default value is `global`. -You can also specify this value using the **BOUNDARY_SCOPE_ID** environment variable. -- `list_token` (optional) - An opaque token that is returned from the previous `list` response. -If you do not supply a value, pagination starts from the beginning. -- `page_size` (optional) - An unsigned integer that indicates the number of items that should be included on the page of search results. -If you do not provide a value, or if you provide a value of `0`, Boundary uses the default page size of 1000 items. -If you configure it, the `page_size` value overrides the default page size. -Controller administrators can also configure a `max_page_size` option that constrains the maximum page size a user can request. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/users/read.mdx b/website/content/docs/commands/users/read.mdx deleted file mode 100644 index ac87258f3..000000000 --- a/website/content/docs/commands/users/read.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: users read - Command -description: >- - The "users read" command retrieves the details about a user resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# users read - -Command: `users read` - -The `users read` command lets you read information about users by their user ID. - -## Example - -This example reads user details for a user with the ID `u_1234567890`: - -```shell-session -$ boundary users read -id u_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary users read [options] [args] -``` - - - -### Command options - -- `-id=` - The ID of the user you want to read. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/users/remove-accounts.mdx b/website/content/docs/commands/users/remove-accounts.mdx deleted file mode 100644 index c9939317d..000000000 --- a/website/content/docs/commands/users/remove-accounts.mdx +++ /dev/null @@ -1,45 +0,0 @@ ---- -layout: docs -page_title: users remove-accounts - Command -description: >- - The "users remove-accounts" command disassociates accounts from a user resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# users remove-accounts - -Command: `users remove-accounts` - -The `users remove-accounts` command lets you disassociate accounts from a user. - -## Example - -This example disassociates a user `u_1234567890` from an account `a_1234567890`: - -```shell-session -$ boundary users remove-accounts -id u_1234567890 -account a_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary users remove-accounts [options] [args] -``` - - - -### Command options - -- `-account=` - The account you want to disassociate from the user. -You can specify multiple accounts. -- `-id=` - The ID of the user you want to disassociate from an account. -- `-version=` - The version of the user to perform the operation on. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/users/set-accounts.mdx b/website/content/docs/commands/users/set-accounts.mdx deleted file mode 100644 index 9771b3b52..000000000 --- a/website/content/docs/commands/users/set-accounts.mdx +++ /dev/null @@ -1,45 +0,0 @@ ---- -layout: docs -page_title: users set-accounts - Command -description: >- - The "users set-accounts" command configures a complete set of associated acounts on a user resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# users set-accounts - -Command: `users set-accounts` - -The `users set-accounts` command lets you configure a complete set of associated accounts on a user. - -## Example - -This example sets the accounts `a_0987654321` and `a_1234567890` on a user `u_1234567890`: - -```shell-session -$ boundary users set-accounts -id u_1234567890 -account a_0987654321 -account a_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary users set-accounts [options] [args] -``` - - - -### Command options - -- `-account=` - The account you want to set on the user. -You can specify multiple accounts. -- `-id=` - The ID of the user you want to set accounts for. -- `-version=` - The version of the user to perform the operation on. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/users/update.mdx b/website/content/docs/commands/users/update.mdx deleted file mode 100644 index bcf478cbf..000000000 --- a/website/content/docs/commands/users/update.mdx +++ /dev/null @@ -1,45 +0,0 @@ ---- -layout: docs -page_title: users update - Command -description: >- - The "users update" command updates an existing user's information. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# users update - -Command: `users update` - -The `users update` command lets you update a user's information. - -## Example - -This example updates a user with the ID `u_1234567890` to add the name `devops` and the description `User for DevOps`: - -```shell-session -$ boundary users update -id u_1234567890 -name "devops" -description "User for DevOps" -``` - -## Usage - - - -```shell-session -$ boundary users update [options] [args] -``` - - - -### Command options - -- `-description=` - The description to assign the user. -- `-id=` - The ID of the user you want to update. -- `-name=` - The name to assign the user. -- `-version=` - The version of the user to perform the operation on. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/workers/add-worker-tags.mdx b/website/content/docs/commands/workers/add-worker-tags.mdx deleted file mode 100644 index 84c81d6bd..000000000 --- a/website/content/docs/commands/workers/add-worker-tags.mdx +++ /dev/null @@ -1,45 +0,0 @@ ---- -layout: docs -page_title: workers add-worker-tags - Command -description: >- - The "workers add-worker-tags" command adds API tags to worker resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# workers add-worker-tags - -Command: `boundary workers add-worker-tags` - -The `boundary workers add-worker-tags` command lets you add API tags to worker resources. - -## Example - -This example adds the API tags `key1=val-a` and `key2=val-b,val-c` to a worker with the ID `w_1234567890`: - -```shell-session -$ boundary workers add-worker-tags -id w_1234567890 -tag "key1=val-a" -tag "key2=val-b,val-c" -``` - -## Usage - - - -```shell-session -$ boundary workers add-worker-tags [sub command] [args] -``` - - - - -### Command options - -- `-id=` - The ID of the worker you want to add API tags to. -- `tag=` - The API tag resources you want to add to workers. -- `version=` - The version of the worker to add the API tag to. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/workers/certificate-authority.mdx b/website/content/docs/commands/workers/certificate-authority.mdx deleted file mode 100644 index 8ac23f350..000000000 --- a/website/content/docs/commands/workers/certificate-authority.mdx +++ /dev/null @@ -1,84 +0,0 @@ ---- -layout: docs -page_title: workers certificate-authority - Command -description: >- - The "workers certificate-authority" command manages the certificate authority used to authorize worker resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# workers certificate-authority - -Command: `boundary workers certificate-authority` - -The `boundary workers certificate-authority` command lets you manage the certificate authority used to authorize Boundary workers. - -## Example - -This example lets you read information about the current certificate authority: - -```shell-session -$ boundary workers certificate-authority read -``` - -## Usage - - - -```shell-session -$ boundary workers certificate-authority [options] - - # ... - -Subcommands: - read Read the certificate authority used to authorize Boundary workers. - reinitialize Reinitialize the certificate authority used to authorize Boundary workers. -``` - - - -### Usages by type - -You can read or reinitialize certificate authorities. - - - - -The `workers certificate-authority read` command lets you read the details of the certificate authority that is used to authorize Boundary workers. - -#### Usage - -```shell-session -$ boundary workers certificate-authority read [options] [args] -``` - -#### Worker certificate authority options - -- `-scope-id=` - The scope in which to read the certificate authority. -The default scope is `global`. -You can also specify the scope using the **BOUNDARY_SCOPE_ID** environment variable. - - - - -The `workers certificate-authority reinitialize` command lets you reinitialize the certificate authority that is used to authorize Boundary workers. - -#### Usage - -```shell-session -$ workers certificate-authority reinitialize [options] [args] -``` - -#### Worker certificate authority options - -- `-scope-id=` - The scope in which to reinitialize the certificate authority. -The default scope is `global`. -You can also specify the scope using the **BOUNDARY_SCOPE_ID** environment variable. - - - - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/workers/create.mdx b/website/content/docs/commands/workers/create.mdx deleted file mode 100644 index dc4224d04..000000000 --- a/website/content/docs/commands/workers/create.mdx +++ /dev/null @@ -1,116 +0,0 @@ ---- -layout: docs -page_title: workers create - Command -description: >- - The "workers create" command creates new worker resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# workers create - -Command: `boundary workers create` - -The `boundary workers create` command lets you create Boundary workers. - -## Example - -This example creates a worker with the name `prodops` and the description `Worker for ProdOps`: - -```shell-session -$ boundary workers create -name prodops -description "Worker for ProdOps" -``` - -## Usage - - - -```shell-session -$ boundary workers create [options] [args] - - # ... - -Subcommands: - controller-led Create a controller-led type worker. - worker-led Create a worker-led type worker. -``` - - - -### Usages by type - -You can create controller-led or worker-led types of workers. - - - - -The `workers create controller-led` command lets you create a worker by receiving an activation token from a controller. - -#### Example - -This example creates a controller-led worker named `us-east-1-1`: - - - -```shell-session -$ boundary workers create controller-led -name us-east-1-1 -``` - - - -#### Usage - -```shell-session -$ boundary workers create controller-led [options] [args] -``` - -#### Command options - -- `-description=` - A description to set on the controller-led type worker. -- `name=` - A name to set on the controller-led type worker. -- `scope-id=` - The scope in which to make the request. -The default is `global`. -You can also specify the scope using the **BOUNDARY_SCOPE_ID** environment variable. - - - - -The `workers create worker-led` command lets you create a worker by providing an auth method from the worker. - -#### Example - -This example specifies a worker-generated auth token and creates a worker named `us-east-1-1`: - - - -```shell-session -$ boundary workers create worker-led -name us-east-1-1 -worker-generated-auth-token -``` - - - -#### Usage - -```shell-session -$ boundary workers create worker-led [options] [args] -``` - -#### Command options - -- `-description=` - A description to set on the worker-led type worker. -- `name=` - A name to set on the worker-led type worker. -- `scope-id=` - The scope in which to make the request. -The default is `global`. -You can also specify the scope using the **BOUNDARY_SCOPE_ID** environment variable. - -#### Worker creation options - -- `worker-generated-auth-token=` - The auth token that is provided by the worker and used to register the worker with Boundary. - - - - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/workers/delete.mdx b/website/content/docs/commands/workers/delete.mdx deleted file mode 100644 index e9868b0f4..000000000 --- a/website/content/docs/commands/workers/delete.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: workers delete - Command -description: >- - The "workers delete" command deletes existing worker resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# workers delete - -Command: `boundary workers delete` - -The `boundary workers delete` command lets you delete a Boundary worker by its given ID. - -## Example - -This example deletes a worker with the ID `w_1234567890`: - -```shell-session -$ boundary workers delete -id w_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary workers delete [options] [args] -``` - - - -### Command options - -- `id=` - The ID of the worker you want to delete. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/workers/index.mdx b/website/content/docs/commands/workers/index.mdx deleted file mode 100644 index a06f27766..000000000 --- a/website/content/docs/commands/workers/index.mdx +++ /dev/null @@ -1,61 +0,0 @@ ---- -layout: docs -page_title: workers - Command -description: >- - The "workers" command performs operations on Boundary worker resources. Workers are primarily used as network proxies. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# workers - -Command: `boundary workers` - -The `workers` command lets you perform operations on Boundary worker resources. - -## Example - -This example reads information about a worker with the ID `w_1234567890`: - -```shell-session -$ boundary workers read -id w_1234567890 -``` - -## Usage - - - -```shell-session -Usage: boundary workers [options] [args] - - # ... - -Subcommands: - add-worker-tags Add api tags to the specified worker. - certificate-authority Manage the certificate authority used to authorize Boundary workers - create Create a worker - delete Delete a worker - list List a worker - read Read a worker - remove-worker-tags Remove api tags from the specified worker - set-worker-tags Set api tags for the specified worker - update Update a worker -``` - - - -For more information, examples, and usage, click on the name -of the subcommand in the sidebar or one of the links below: - -- [add-worker-tags](/boundary/docs/commands/workers/add-worker-tags) -- [certificate-authority](/boundary/docs/commands/workers/certificate-authority) -- [create](/boundary/docs/commands/workers/create) -- [delete](/boundary/docs/commands/workers/delete) -- [list](/boundary/docs/commands/workers/list) -- [read](/boundary/docs/commands/workers/read) -- [remove-worker-tags](/boundary/docs/commands/workers/remove-worker-tags) -- [set-worker-tags](/boundary/docs/commands/workers/set-worker-tags) -- [update](/boundary/docs/commands/workers/update) \ No newline at end of file diff --git a/website/content/docs/commands/workers/list.mdx b/website/content/docs/commands/workers/list.mdx deleted file mode 100644 index 471ca05ab..000000000 --- a/website/content/docs/commands/workers/list.mdx +++ /dev/null @@ -1,49 +0,0 @@ ---- -layout: docs -page_title: workers list - Command -description: >- - The "workers list" command lists available worker resources in a scope or resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# workers list - -Command: `boundary workers list` - -The `boundary workers list` command lets you list the Boundary workers in a scope or resource. - -## Example - -This example lists all workers in the `global` scope: - -```shell-session -$ boundary workers list -``` - -## Usage - - - -```shell-session -$ boundary workers list [options] [args] -``` - - - -### Command options - -- `-filter=` - If set, Boundary filters the list operation before the results are returned. -The filter operates against each item in the list. -We recommend that you use single quotes, because the filters contain double quotes. -Refer to the [Filtering and listing resources documentation](/boundary/docs/filtering) for more details. -- `recursive` - If set, runs the list operation recursively on any child scopes, if the type supports it. -The default value is `false`. -- `scope-id=` - The scope from which to list the workers. -The default value is `global`. -You can also specify this value using the **BOUNDARY_SCOPE_ID** environment variable. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/workers/read.mdx b/website/content/docs/commands/workers/read.mdx deleted file mode 100644 index 9aa1edd1c..000000000 --- a/website/content/docs/commands/workers/read.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: workers read - Command -description: >- - The "workers read" command retrieves the details of a worker resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# workers read - -Command: `boundary workers read` - -The `boundary workers read` command lets you read a Boundary worker information for a given ID. - -## Example - -This example reads a worker with the ID `w_1234567890`: - -```shell-session -$ boundary workers read -id w_1234567890 -``` - -## Usage - - - -```shell-session -$ boundary workers read [options] [args] -``` - - - -### Command options - -- `id=` - The ID of the worker to read. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/workers/remove-worker-tags.mdx b/website/content/docs/commands/workers/remove-worker-tags.mdx deleted file mode 100644 index 84e092a18..000000000 --- a/website/content/docs/commands/workers/remove-worker-tags.mdx +++ /dev/null @@ -1,45 +0,0 @@ ---- -layout: docs -page_title: workers remove-worker-tags - Command -description: >- - The "workers remove-worker-tags" command removes API tags from worker resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# workers remove-worker-tags - -Command: `boundary workers remove-worker-tags` - -The `boundary workers remove-worker-tags` command lets you remove API tags from worker resources. - -## Example - -This example removes the API tags `key1=val-a` and `key2=val-b,val-c` from a worker with the ID `w_1234567890`: - -```shell-session -$ boundary workers remove-worker-tags -id w_1234567890 -tag "key1=val-a" -tag "key2=val-b,val-c" -``` - -## Usage - - - -```shell-session -$ boundary workers remove-worker-tags [sub command] [args] -``` - - - - -### Command options - -- `-id=` - The ID of the worker you want to remove the tag from. -- `tag=` - The API tag resources you want to remove from the worker. -- `version=` - The version of the worker to perform the operation on. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/workers/set-worker-tags.mdx b/website/content/docs/commands/workers/set-worker-tags.mdx deleted file mode 100644 index 0f3d1e94d..000000000 --- a/website/content/docs/commands/workers/set-worker-tags.mdx +++ /dev/null @@ -1,45 +0,0 @@ ---- -layout: docs -page_title: workers set-worker-tags - Command -description: >- - The "workers set-worker-tags" command sets API tags for worker resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# workers set-worker-tags - -Command: `boundary workers set-worker-tags` - -The `boundary workers set-worker-tags` command lets you set API tags for worker resources. - -## Example - -This example sets the API tags `key1=val-a` and `key2=val-b,val-c` for a worker with the ID `w_1234567890`: - -```shell-session -$ boundary workers set-worker-tags -id w_1234567890 -tag "key1=val-a" -tag "key2=val-b,val-c" -``` - -## Usage - - - -```shell-session -$ boundary workers set-worker-tags [sub command] [args] -``` - - - - -### Command options - -- `-id=` - The ID of the worker you want to set tags for. -- `tag=` - The API tag resources you want to set on the worker. -- `version=` - The version of the worker to perform the operation on. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/commands/workers/update.mdx b/website/content/docs/commands/workers/update.mdx deleted file mode 100644 index 1348df728..000000000 --- a/website/content/docs/commands/workers/update.mdx +++ /dev/null @@ -1,45 +0,0 @@ ---- -layout: docs -page_title: workers update - Command -description: >- - The "workers update" command updates an existing worker resource. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# workers update - -Command: `boundary workers update` - -The `boundary workers update` command lets you update a Boundary worker with a given ID. - -## Example - -This example updates the name and description of a worker with the ID `w_1234567890`: - -```shell-session -$ boundary workers update -id w_1234567890 -name "devops" -description "Worker for DevOps" -``` - -## Usage - - - -```shell-session -$ boundary workers update [options] [args] -``` - - - -### Command options - -- `description=` - A description to set on the worker. -- `id=` - The ID of the worker you want to update. -- `name=` - The name to set on the worker. -- `version=` - The version of the worker to perform the operation on. -If you do not specify a version, the command performs a check-and-set automatically. - -@include 'cmd-option-note.mdx' \ No newline at end of file diff --git a/website/content/docs/common-workflows/index.mdx b/website/content/docs/common-workflows/index.mdx deleted file mode 100644 index fec55efb7..000000000 --- a/website/content/docs/common-workflows/index.mdx +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: docs -page_title: Common Workflows -description: Common workflows for Boundary ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Common Workflows - -This section covers common workflows for managing targets, identities, and sessions within Boundary. This section assumes you've already covered the [Getting Started](/boundary/docs/getting-started) section and are familiar with basic Boundary knowledge. This section extends Getting Started by showing how to accomplish common workflows in the admin console, the command line, and with our [Terraform provider](https://github.com/hashicorp/terraform-provider-boundary). - -For more detailed guides on using Boundary please consult our [Learn site](/boundary/tutorials). diff --git a/website/content/docs/common-workflows/manage-scopes.mdx b/website/content/docs/common-workflows/manage-scopes.mdx deleted file mode 100644 index ab201e781..000000000 --- a/website/content/docs/common-workflows/manage-scopes.mdx +++ /dev/null @@ -1,154 +0,0 @@ ---- -layout: docs -page_title: Manage Scopes -description: How to manage Boundary scopes ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Manage Scopes - -[Scopes](/boundary/docs/domain-model/scopes) are a foundational part of Boundary. They allow users to partition resources and assign ownership of resources to principals. There are three types of scopes within Boundary: - -1. Global (`global`) -2. Org -3. Project - -These are in a hierarchy: - -- There is only one single `global` scope. It is meant as the entry point for initial administration/setup and to manage org scopes. -- Under the `global` scope there can be many org scopes. These are used to hold IAM-related resources and project scopes. -- Under each org scope can be many project scopes. These are used to hold infrastructure-related resources. - -Some resources can only be associated with a specific level of scope. As an example, [Targets](/boundary/docs/domain-model/targets) can only be contained within a project scope. Other resources can be contained by multiple scopes. For example, users can be created within the `global` scope or an org-level scope. See the [domain model](/boundary/docs/domain-model) for detailed resource specific information. - -In this example, we're going to create two scopes, an org and a project. - -~> All resource IDs in this example are illustration only - IDs are uniquely generated for every resource upon creation with the exception being -generated resources in `dev` mode. Please make sure to use the resource IDs that are generated when running this example. For example, if you run -`boundary users create`, use the resource ID of the user seen in stdout, not the ID in the example command. - -## Create an Org - -In this example, we're going to create an org, which lives in the `global` scope. - -~> The CLI and UI will default to having certain administrative roles be created -automatically when a scope is created, so that the user that created the scope -can immediately manage it. The Terraform provider defaults skipping creation of -those roles so that resources are not created outside of Terraform's purview. To -simplify this example, we are telling Terraform to allow these roles to be -created in both this section and in the next section where we create a project -scope. - - - - -```bash -$ boundary scopes create -scope-id global -name my_org -description 'My first org' - -Scope information: - Created Time: Tue, 29 Sep 2020 05:48:22 PDT - Description: My first org - ID: o_y0fEd8iY2J - Name: my_org - Updated Time: Tue, 29 Sep 2020 05:48:22 PDT - Version: 1 - - Scope (parent): - ID: global - Name: global - Type: global -``` - - - - -1. Navigate to the Boundary landing page. -1. Choose the **New** button. -1. Fill org details. -1. Choose **Save** and view the org on the Boundary landing page. - - - - - - -```hcl -resource "boundary_scope" "org" { - scope_id = "global" - name = "my_org" - description = "My first org" - auto_create_default_role = true - auto_create_admin_role = true -} -``` - - - - -## Create a Project - -Next, we're going to add a project scope to our org. - - - - -```bash -$ boundary scopes create -scope-id o_0MkQUfE9jA -name my_project -description 'My first project' - -Scope information: - Created Time: Tue, 29 Sep 2020 05:57:45 PDT - Description: My first project - ID: p_jqCwqjSTQ4 - Name: my_project - Updated Time: Tue, 29 Sep 2020 05:57:45 PDT - Version: 1 - - Scope (parent): - ID: o_0MkQUfE9jA - Name: my_org - Parent Scope ID: global - Type: org -``` - - - - -1. Navigate to an org, which leads to an overview of projects within that org. -1. Choose the **New** button. -1. Fill project details. -1. Choose **Save** and view the project edit form page. -1. _Note_: by default, edit forms are disabled to help prevent unintended edits. To edit your new project choose **Edit Form**. - - - - - - -```hcl -resource "boundary_scope" "project" { - name = "my_project" - description = "My first project" - - # scope_id is taken from the org resource defined above - scope_id = boundary_scope.org.id - auto_create_admin_role = true - auto_create_default_role = true -} -``` - - - diff --git a/website/content/docs/common-workflows/manage-sessions.mdx b/website/content/docs/common-workflows/manage-sessions.mdx deleted file mode 100644 index 985d5c347..000000000 --- a/website/content/docs/common-workflows/manage-sessions.mdx +++ /dev/null @@ -1,206 +0,0 @@ ---- -layout: docs -page_title: Manage Sessions -description: How to manage Boundary sessions ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Manage Sessions - -[Sessions](/boundary/docs/domain-model/sessions) are Boundary resources created when connecting to a [Target](/boundary/docs/domain-model/targets). A target allows Boundary users to define an endpoint with a protocol and default port to establish a session. Unless specified with a `-host-id` flag when establishing a session, Boundary will choose one [Host](/boundary/docs/domain-model/hosts) from the target's [Host Sets](/boundary/docs/domain-model/host-sets) to connect to at random. - -In this section, we'll show you the basics of how to start a session, view the session details, and cancel a session in Boundary using the CLI. - -We assume you're running Boundary in `dev` mode using the default target resource of `ttcp_1234567890`. We also assume you've authenticated using the CLI. See the output of `boundary dev` for these login values. - -## Start a Session - -Connecting to a target creates a session in Boundary (via a call to the target to authorize a session for the user). To demonstrate what a session looks like we are going to connect to a `tcp` target with a default port of 22 for SSH access. - -```bash -$ boundary connect ssh -target-id ttcp_1234567890 -- - -Proxy listening information: - Address: 127.0.0.1 - Connection Limit: 1 - Expiration: Wed, 30 Sep 2020 23:18:14 MST - Port: 61991 - Protocol: tcp - Session ID: s_h7vBIhH5SZ -``` - -For more information regarding different ways to connect to a target behind Boundary see [Connect to Target](/boundary/docs/getting-started/connect-to-target) under Getting Started and [Advanced Session Establishment](#advanced-session-establishment) below. - -## View Sessions - - - - -View all sessions which Boundary has for the project `p_1234567890` by listing them. - -```bash -$ boundary sessions list -scope-id p_1234567890 - -Session information: - ID: s_h7vBIhH5SZ - Status: active - Created Time: 2020-09-30T15:18:14-07:00 - Expiration Time: 2020-09-30T23:18:14-07:00 - Updated Time: 2020-09-30T15:18:35-07:00 - User ID: u_1234567890 - Target ID: ttcp_1234567890 -``` - -We can get a more detailed view of a specific session by reading it. - -```bash -$ boundary sessions read -id s_h7vBIhH5SZ - -Session information: - Auth Token ID: at_51XQGx0bzk - Created Time: Wed, 30 Sep 2020 15:18:14 MST - Endpoint: tcp://localhost:22 - Expiration Time: 2020-09-30T23:18:14-07:00 - Host ID: hst_1234567890 - Host Set ID: hsst_1234567890 - ID: s_h7vBIhH5SZ - Status: active - Target ID: ttcp_1234567890 - Type: tcp - Updated Time: 2020-09-30T15:18:35-07:00 - User ID: u_1234567890 - Version: 2 - - Scope: - ID: p_1234567890 - Name: Generated project scope - Parent Scope ID: o_1234567890 - Type: project - - States: - Start Time: Wed, 30 Sep 2020 15:18:35 MST - Status: active - - End Time: Wed, 30 Sep 2020 15:18:35 MST - Start Time: Wed, 30 Sep 2020 15:18:14 MST - Status: pending -``` - - - - -1. Navigate to a project, then to sessions. -1. View the session information provided there. - - - - - -## Cancel a Session - - - -To send a request to Boundary to cancel a session: - -```bash -$ boundary sessions cancel -id s_h7vBIhH5SZ - -Session information: - Auth Token ID: at_51XQGx0bzk - Created Time: Wed, 30 Sep 2020 15:18:14 MST - Endpoint: tcp://localhost:22 - Expiration Time: 2020-09-30T23:18:14-07:00 - Host ID: hst_1234567890 - Host Set ID: hsst_1234567890 - ID: s_h7vBIhH5SZ - Status: canceling - Target ID: ttcp_1234567890 - Type: tcp - Updated Time: 2020-09-30T15:19:17-07:00 - User ID: u_1234567890 - Version: 3 - - Scope: - ID: p_1234567890 - Name: Generated project scope - Parent Scope ID: o_1234567890 - Type: project - - States: - Start Time: Wed, 30 Sep 2020 15:19:17 MST - Status: canceling - - End Time: Wed, 30 Sep 2020 15:19:17 MST - Start Time: Wed, 30 Sep 2020 15:18:35 MST - Status: active - - End Time: Wed, 30 Sep 2020 15:18:35 MST - Start Time: Wed, 30 Sep 2020 15:18:14 MST - Status: pending -``` - -Boundary then cancels the session and move it into a "Terminated" state. - - - - -1. Navigate to a project, then to sessions. -1. Choose a session and its **Cancel** button. -1. View the session status update from _canceling_ to _terminated_. - - - - - -## Advanced Session Establishment - -Above, we discussed connecting to a target using the `boundary connect` command. In addition to this we can create a session to a target and connect to that session in separate steps. This is accomplished using the `boundary targets authorize-session` command, which generates an authorization token that a user can use to start a session via `boundary connect -authz-token` at their own convenience. - -```bash -$ boundary targets authorize-session -id ttcp_1234567890 - -Target information: - Authorization Token: $LONG_STRING_OF_TEXT - Created Time: 2020-09-30T15:18:14-07:00 - Host ID: hst_1234567890 - Scope ID: p_1234567890 - Session ID: s_h7vBIhH5SZ - Target ID: ttcp_1234567890 - Type: tcp - User ID: u_1234567890 -``` - -Note: You can also provide a `-host-id` flag in the request above which ensures connecting using the provided Authorization Token will connect you to this specific host. - -```bash -$ boundary connect -authz-token $LONG_STRING_OF_TEXT - -Proxy listening information: - Address: 127.0.0.1 - Connection Limit: 1 - Expiration: Wed, 30 Sep 2020 23:18:14 MST - Port: 61991 - Protocol: tcp - Session ID: s_h7vBIhH5SZ -``` - -With the above address and port information we can now connect to our local proxy and have our tcp traffic sent through the Boundary system. - -```bash -$ ssh 127.0.0.1 -p 61991 -... -``` diff --git a/website/content/docs/common-workflows/manage-targets.mdx b/website/content/docs/common-workflows/manage-targets.mdx deleted file mode 100644 index 5dc6a1653..000000000 --- a/website/content/docs/common-workflows/manage-targets.mdx +++ /dev/null @@ -1,245 +0,0 @@ ---- -layout: docs -page_title: Manage Targets -description: How to manage Boundary targets ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Manage Targets - -[Targets](/boundary/docs/domain-model/targets) are Boundary resources which contain one or more [Host Sets](/boundary/docs/domain-model/host-sets). A target allows Boundary users to define an endpoint with a default port and a protocol to establish a session. Unless specified with a `-host-id` flag, Boundary will choose one [Host](/boundary/docs/domain-model/hosts) in the host set to connect to at random. - -In this section, we'll show you the basics of how to define a host, host set, and a target in Boundary on the CLI, the admin console, and using our [Terraform provider](https://github.com/hashicorp/terraform-provider-boundary). - -We assume you're running Boundary in `dev` mode and have a default static host-catalog of `hcst_1234567890`. We also assume you've logged in on the command line and the admin console. See the output of `boundary dev` for these login values. - -~> Note that all resource IDs in this example are illustration only - IDs are uniquely generated for every resource upon creation with the exception being -generated resources in `dev` mode. Please make sure to use the resource IDs that are generated when running this example. For example, if you run -`boundary users create`, use the resource ID of the user seen in stdout, not the ID in the example command. - -## Define a Host - -For this example, we're going to create a target to access postgres on `localhost`. This assumes a couple of things: - -1. The host address is `127.0.0.1` -2. The target port is `:5432` - - - - -```bash -boundary hosts create static -name postgres -description "Postgres host" -address "127.0.0.1" -host-catalog-id "hcst_1234567890" - -Host information: - Created Time: Mon, 28 Sep 2020 18:12:39 PDT - Description: Postgres host - Host Catalog ID: hcst_1234567890 - ID: hst_N5l67hLYrQ - Name: postgres - Type: static - Updated Time: Mon, 28 Sep 2020 18:12:39 PDT - Version: 1 - - Scope: - ID: p_1234567890 - Name: Generated project scope - Parent Scope ID: o_1234567890 - Type: project - - Attributes: - address: 127.0.0.1 -``` - - - - -1. Navigate to a host catalog (Projects > Project > Host Catalogs > Host Catalog). -1. Choose **New Host** from the **Manage** dropdown. -1. Fill host details. -1. Choose **Save** and view the host edit form page. - - - - - - -To define this same host using our Terraform provider: - -```hcl -resource "boundary_host" "postgres" { - type = "static" - name = "postgres" - description = "Postgres host" - address = "127.0.0.1" - host_catalog_id = "hcst_1234567890" -} -``` - - - - -## Define a Host Set - -Host sets allow us to group hosts providing equivalent services together. A target works off of host sets, so even though we are only defining one host in this example, we're going to create a host set of one host. - - - - -```bash -boundary host-sets create static -name "postgres" -description "Postgres host set" -host-catalog-id hcst_1234567890 - -Host Set information: - Created Time: Mon, 28 Sep 2020 18:27:10 PDT - Description: Postgres host set - Host Catalog ID: hcst_1234567890 - ID: hsst_z7gDCPSig5 - Name: postgres - Type: static - Updated Time: Mon, 28 Sep 2020 18:27:10 PDT - Version: 1 - - Scope: - ID: p_1234567890 - Name: Generated project scope - Parent Scope ID: o_1234567890 - Type: project -``` - - - - -1. Navigate to a host catalog, then to the **Host Sets** tab. -1. Choose **Create Host Set** from the **Manage** dropdown. -1. Fill host set details. -1. Choose **Save** and view the host set edit form page. - - - -Then associate the host set with a host: - -1. From the host set edit form, navigate to the **Hosts** tab. -1. Choose **Add Existing Host** from the **Manage** dropdown. -1. Select one or more hosts to associate with the host set. -1. Choose the **Add Hosts** button and view the hosts list. - - - - - - -To define this host set in Terraform: - -```hcl -resource "boundary_host_set" "postgres" { - type = "static" - name = "postgres" - description = "Host set for postgres" - host_catalog_id = "hcst_1234567890" - - // taken from the Terraform example above - host_ids = [ boundary_host.postgres.id ] -} -``` - - - - -## Define a Target - - - - -```bash -boundary targets create tcp -name 'postgres' -description 'Postgres target' -default-port 5432 -scope-id p_1234567890 -session-connection-limit '-1' - -Target information: - Created Time: Mon, 28 Sep 2020 18:43:12 PDT - Description: Postgres target - ID: ttcp_CzVQA3adBf - Name: postgres - Session Connection Limit: -1 - Session Max Seconds: 28800 - Type: tcp - Updated Time: Mon, 28 Sep 2020 18:43:12 PDT - Version: 1 - - Scope: - ID: p_1234567890 - Name: Generated project scope - Parent Scope ID: o_1234567890 - Type: project - Attributes: - Default Port: 5432 -``` - - - - -1. Navigate to a project, then to targets. -1. Choose the **New** button. -1. Fill the target details. -1. Choose **Save** and view the host set edit form page. - - - -Then associate the host set with a host: - -1. From the target edit form, navigate to the **Host Sets** tab. -1. Choose **Add Host Sets** from the **Manage** dropdown. -1. Select one or more host sets to associate with the target. -1. Choose the **Add Host Sets** button and view the host sets list. - - - - - - -To define this target in Terraform: - -```hcl -resource "boundary_target" "postgres" { - type = "tcp" - name = "postgres" - description = "Postgres target" - scope_id = "p_1234567890" - session_connection_limit = -1 - default_port = 5432 - - // taken from the example above - host_set_ids = [ - boundary_host_set.postgres.id - ] -} -``` - - - diff --git a/website/content/docs/community/index.mdx b/website/content/docs/community/index.mdx deleted file mode 100644 index 3cc96d9b8..000000000 --- a/website/content/docs/community/index.mdx +++ /dev/null @@ -1,37 +0,0 @@ ---- -layout: docs -page_title: Boundary Community Edition -description: An introduction to Boundary Community Edition ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary Community Edition - -Boundary provides secure remote access to critical systems with fine-grained -authorizations based on trusted identities. While HCP Boundary provides a -managed solution, Boundary Community Edition is a self-managed distribution that organizations -can deploy on-premise to manage access to infrastructure endpoints. The source -code for Boundary Community Edition is freely available on GitHub. The following sections -contain information on the use case for Boundary and how to install and -configure self-managed Boundary environments. - -Traditional approaches like SSH bastion hosts or VPNs require distributing and -managing credentials, configuring network controls like firewalls, and exposing -the private network. Boundary Community Edition provides secure access to hosts and critical -systems without having to manage credentials or expose your network, and is -free. - -Boundary Community Edition is designed to be straightforward to understand, highly scalable, -and resilient. It can run in clouds, on-premise, or within secure enclaves. -Boundary does not require an agent to be installed on the end host. - -![How Boundary Works](/img/how-boundary-works_light.png#light-theme-only) -![How Boundary Works](/img/how-boundary-works_dark.png#dark-theme-only) - -## Tutorial - -Refer to the [Get Started with self-hosted Boundary](/boundary/tutorials/oss-getting-started) tutorial series to learn how to install and configure Boundary. diff --git a/website/content/docs/concepts/aliases.mdx b/website/content/docs/concepts/aliases.mdx deleted file mode 100644 index 158adeee9..000000000 --- a/website/content/docs/concepts/aliases.mdx +++ /dev/null @@ -1,37 +0,0 @@ ---- -layout: docs -page_title: Aliases -description: >- - Aliases let you associate a string with a resource. Learn how to use an alias instead of an ID when you connect to a target. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Aliases - -An alias is a globally unique, DNS-like string that is associated with a destination resource. You can establish a session to a target by referencing its alias, instead of having to provide a target ID or target name and scope ID. - -For example, if you have an alias `boundary.dev`, you can use it to connect to a target with the following command: `boundary connect ssh boundary.dev`. - -## Background - -When you create a resource in Boundary, it assigns the resource a randomly generated identifier. You must use those IDs to perform actions in Boundary. When you connect to a target using the terminal, you must reference the target ID or target name and scope name. - -As an example, to SSH to a target, you can execute the command `boundary connect ssh -target-id ttcp_123456789`. - -Since it can be difficult to remember the unique IDs, users frequently have to look up the identifiers for any resources they want to operate on. - -Aliases simplify this process. When you create an alias and associate it with a target, you can later use the alias `value` instead of the target ID in commands. Boundary automatically resolves to the target that the alias references. - -## Permissions - -The existence of an alias for a Boundary resource does not change how permissions function. Anyone can attempt to use an alias to access a target, but if you do not have permission to access the target, the attempt fails. You can create an alias for a target, even if you do not have permission to access the target. - -Separating the permissions from aliases and destination resources means a different set of people can manage the aliases than the people who have permission to operate on targets. For example, you may have a project with a sensitive set of targets. You can configure Boundary to allow a select few users to manage those targets, while a different group of users manage the aliases. - -## More information - -Refer to [Overview of aliases](/boundary/docs/targets/configuration) to learn about configuring aliases. \ No newline at end of file diff --git a/website/content/docs/concepts/auditing.mdx b/website/content/docs/concepts/auditing.mdx deleted file mode 100644 index 6accda489..000000000 --- a/website/content/docs/concepts/auditing.mdx +++ /dev/null @@ -1,48 +0,0 @@ ---- -layout: docs -page_title: Auditing -description: >- - Learn how Boundary can help improve compliance and threat management by using session recording to audit user access and actions. Understand the BSR format. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Auditing - -A fundamental challenge of securing access to sensitive computing resources is creating a system of record around users' access and actions over remote sessions. -Organizations are typically motivated to invest in recording capabilities to address at least one of the following: - -1. **Compliance management**: Organizations need to prove compliance of their infrastructure's security posture to internal or external auditors. -Records of remote access are often required. - - Various laws and regulations have record keeping requirements. - These laws and regulations specify what activities need to be recorded and how long the records must be kept. - One of the reasons an organization records access to a system is to comply with the record keeping requirements of a law or regulation. - -2. **Threat management**: Organizations must monitor, investigate, and react to security incidents and malicious activity. -Further, security teams seek to prevent incidents and proactively identify potential threats in real time. - - In the course of their investigations, security teams may need to identify suspicious activity conducted by a specific principal or against a specific target. - Administrators may require a breakdown of session information by user or a time-based view of past activities, for example. - -## Session recording - -Boundary provides auditing capabilities via session recording. -In Boundary, a session represents a set of connections between a user and a host from a target. -The session begins when an authorized user requests access to a target, and it ends when that access is terminated. -All sessions have a fixed time limit, and all connections are proxied through a worker. - -Sessions are recorded by workers. -Workers are the proxy between an end user and a target. -No session data is routed through a controller during the recording stage. -The worker stores the session recording on local disk during the recording phase, and then moves the recording to the external object store when the session is terminated. Session recordings are stored in the BSR (Boundary Session Recording) format. - -## More information - -Refer to the following topics for more information: - -- [Session recording](/boundary/docs/session-recording) -- [BSR file data structure](/boundary/docs/session-recording/data/bsr-file-structure) \ No newline at end of file diff --git a/website/content/docs/concepts/credential-management.mdx b/website/content/docs/concepts/credential-management.mdx deleted file mode 100644 index 801cbf3e8..000000000 --- a/website/content/docs/concepts/credential-management.mdx +++ /dev/null @@ -1,152 +0,0 @@ ---- -layout: docs -page_title: Credential management -description: >- - Learn about using credential brokering or credential injection to authenticate users. Understand the benefits and security considerations of each method. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Credential management - -When users connect to a remote machine, they typically need a set of credentials for authentication. -After they connect to the machine, they may also require another set of credentials to access services or other machines within the network. - -There are two credential management paradigms in Boundary, credential brokering and credential injection. - -## Credential brokering - -Credential brokering is the process by which credentials are fetched from a credential store, and then returned back to the user. - -The user must already be authorized to connect to a specific target to have credentials for that target brokered back to them. - -Credentials are brokered when the session is established. - -The credential brokering process works as follows: - -1. The user authenticates to Boundary using either the CLI or desktop app. -1. The user requests a connection to the target. - - The controller fetches credentials from the credential store and passes the credentials to the user. -1. The user establishes a connection to the session. - - The controller assigns the job to a worker, and the worker establishes a session to the target. -1. The user enters the credentials. - - The user is authenticated to the target. - -You can attach brokered credentials to SSH, TCP, or RDP targets. -Brokered credentials can take the form of a token, username password, username password domain, JSON blob, or an unstructured secret stored in Vault, for example. - -### Security considerations - -Consider a scenario where a user wants to access a target using SSH. - -![Credential brokering diagram](/img/credential-brokering.png) - -In this scenario, the user must be authorized to access the target. -If they are authorized, they can authenticate themselves to the machine using credentials that were brokered, or returned, back to them. - -If the user is not authorized to access the target, they will not be able to retrieve brokered credentials for that target. - - Boundary credential brokering animated - -If a user wants to abstract the authentication process using brokered credentials, they can use the `boundary connect` ssh-style command, and pass credentials to sshpass, PuTTY, or another such tool. -In this scenario, while the brokered credential may not be visible to the user, they still interact with the brokered credentials to perform authentication. - - Pass credentials using the boundary connect command - -Additionally, with Vault's dynamic secrets engine, an administrator could configure their environment such that secrets are essentially one-time passwords, as the credentials are revoked after the session is terminated. - -## Credential injection - -This feature requires HCP Boundary or Boundary Enterprise - -Credential injection is the process by which a credential is fetched from a credential store and then passed on to a worker for authentication to a remote machine. - -With credential injection, the user never sees the credential required to authenticate to the target. - -This provides a passwordless experience for the user, as the worker does both session establishment and authentication to the target on behalf of the user. -This process differs from credential brokering, where credentials are returned to the user rather than injected into the session on worker nodes. - -The credential injection process works as follows: - -1. The user authenticates to Boundary. -1. The user requests a connection to a target. - - The controller fetches credentials from the credential store. -1. The user establishes a connection to the session. - - The controller assigns the job to a worker, and the worker establishes a session to the target. - Then the controller passes credentials to the worker. - The worker authenticates to the target, and the user is then authenticated to the target. - -### Target types - -Credential injection is required for the RDP and SSH target types. - - - -RDP credential injection is currently in beta. -For more information about known issues, configuration requirements, and compatibility with Windows, refer to [RDP credential injection compatibility](/boundary/docs/credentials/rdp-testing-and-compatibility-matrix). - - - -You can inject the following credential types when you access SSH targets: - -- SSH certificates -- Usernames and passwords -- Usernames and public keys - -Keyboard-interactive authentication is not supported for credential injection. -When you use Username password credentials, ensure that your SSH server is configured to allow password authentication. - -You can inject username password domain credentials when you access RDP targets in Windows environments that use Active Directory or NTLMv2 for authentication. - -You can broker additional credentials to RDP or SSH targets after the session is established using injected credentials. - -### Security considerations - -Consider a scenario where a user wants to access a target using SSH. - -![Credential injection diagram](/img/credential-injection.png) - -In this scenario, the user must be authorized to access the target. -If they are authorized, they have the ability to connect to the worker. -Upon connecting to the worker, the worker attempts to establish a remote session to the target, and attempts authentication on behalf of the user. - - Boundary credential injection animated - -If the user is not authorized to access the target, the credentials are not injected on their behalf, nor are the credentials brokered back to them. - -## Tutorial - -Refer to the [Broker static credentials to your first target](/boundary/tutorials/get-started-hcp/hcp-getting-started-credentials) tutorial to practice configuring credential brokering. - -Refer to the [Manage SSH keys with HCP Boundary and Vault](/boundary/tutorials/hcp-administration/hcp-ssh-cred-injection) tutorial to practice configuring credential injection. - -## More information - -Refer to [Credentials in Boundary](/boundary/docs/credentials) to learn more about how Boundary centralizes credential management to enhance security. - -To configure credential brokering or credential injection with static credentials, refer to the following topics: - -- [Create a static credential store](/boundary/docs/credentials/static-cred-boundary) -- [Create a Vault credential store](/boundary/docs/credentials/static-cred-vault). - -Refer to [Secrets engines](/vault/docs/secrets) to learn more about the Vault dynamic secrets engine. \ No newline at end of file diff --git a/website/content/docs/concepts/iam.mdx b/website/content/docs/concepts/iam.mdx deleted file mode 100644 index 8ba3d7b0b..000000000 --- a/website/content/docs/concepts/iam.mdx +++ /dev/null @@ -1,120 +0,0 @@ ---- -layout: docs -page_title: Identity and access management (IAM) -description: >- - Learn how scopes, auth methods, accounts, users, groups, and roles make up the identity and access management (IAM) system. View examples of grant strings. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Identity and access management (IAM) - -There are 6 key components to Boundary's identity and access management system: **Scopes**, **Auth Methods**, **Accounts**, **Users**, **Groups**, and **Roles**. - -## Scopes -[Scopes](/boundary/docs/domain-model/scopes) can be considered as containers for resources and permissions. Each scope also has a permissions boundary that is isolated from other scopes on the same level. There are three types of scopes: -- **Global** - The highest-level scope of Boundary where administrators configure and manage Boundary for the entire company. -- **Org (Organization)** - Org scopes are contained in the global scope and are typically used to represent business units, organizations, or departments. -Org scopes can also be used to contain multiple production-level auth methods in separate scopes. -- **Project** - Project scopes are contained in Org scopes and be used to separate different business workflows. For example, projects can be used to represent different teams, products, or environments (test, dev, prod). - -## Auth methods -[Auth methods](/boundary/docs/domain-model/auth-methods) are resources that authenticate users to -Boundary. Auth methods can only be contained by the global or Org scopes. The available auth methods are: -- Username/Password -- [OIDC](/boundary/tutorials/identity-management/oidc-auth) -- LDAP - -## Accounts -[Accounts](/boundary/docs/domain-model/accounts) are resources that represent an authenticated user from a trusted identity provider through a Boundary auth method. Accounts must belong to an auth method, and can be associated with a single Boundary user. Boundary accounts can belong to the global or Org Scopes. - -## Users -[Users](/boundary/docs/domain-model/users) are resources that represent an individual person or entity for the purposes of -access control. A user can contain multiple accounts from multiple auth methods, and can belong to the global or Org Scopes. - -## Groups -[Groups](/boundary/docs/domain-model/groups) are resources that represent a collection of users, and can be contained by any -scope. [Managed groups](/boundary/docs/domain-model/managed-groups) are a special kind of group that syncs with the auth -method's identity provider to provide up-to-date information. - -## Roles -[Roles](/boundary/docs/domain-model/roles) are resources that contain a collection of -[permissions](/boundary/docs/rbac/assignable-permissions) which are granted to any principal (user or group) from any scope. Roles -can be contained by any scope, and the permissions can be applied to the same scope or any child scope. - -## Access management - -You can add users to Boundary using the password auth method or OIDC/LDAP. - -### Configure users - username/password -There are 3 steps to adding new users to Boundary using the password auth method: -1. Choose the **scope** and the **auth method** that the user will use to authenticate to Boundary. If the desired auth method does not exist, you must create a new one. -2. After the auth method is selected, you can create an **account** under the auth method. -3. In the same scope, create a new **user**, and then attach the new account to the new user. The user is now able to authenticate to Boundary. - -### Configure users - OIDC/LDAP -With the [OIDC](/boundary/tutorials/identity-management/oidc-auth) and LDAP auth methods, Boundary uses data from the identity provider to automatically generate accounts and users in the same scope -as the auth method. The accounts and users are only created once the user authenticates to Boundary for the first time. -The same applies to OIDC/LDAP [managed groups](/boundary/tutorials/identity-management/oidc-idp-groups). - -You can configure the `max_age` in the [OIDC attributes](/boundary/docs/domain-model/auth-methods#oidc-auth-method-attributes) to indicate to the OIDC provider how much time is allowed to pass until a user is challenged to authenticate again. -However, the user will not be prompted to authenticate until the controller's `auth_token_time_to_live` [parameter](/boundary/docs/configuration/controller#auth_token_time_to_live) has expired. -The default value is 7 days. - -To configure time to live in HCP Boundary, refer to [Configure authentication time to live](/hcp/docs/boundary/configure-ttl). - -## Grant permissions -When setting up access controls for a user, it is important to first consider which scope(s) the user needs access to. Roles give users permission to perform actions through grants strings. -It is recommended to add the user to a group, and then add the group to the role(s), instead of adding the user directly to the role(s). This way, you can manage multiple users at the same time, and it is easier to -change the permissions of the user by adding/removing them from groups. You can manage OIDC/LDAP users and managed groups the same way, directly in the provider. - -## Examples -Here are a few examples of access management for personas, using this sample scope structure. In this structure, there are 7 scopes overall: 1 global, 2 Orgs, and 4 -Projects. - -![IAM Example Structure](/img/iam-example-structure.png) - -### Boundary admin -1. **Each** of the 7 scopes requires a role (ex. “admin”) -2. Each role needs to have the user/group added as a principal -3. Each role needs to have the grants of - - - `ids=*;type=*;actions=*` - -### Boundary viewer -1. **Each** of the 7 scopes requires a role (ex. “viewer”) -2. Each role needs to have the user/group added as a principal -3. Each role needs to have the grants of - - - `ids=*;type=*;actions=read,list` - -### Org_A admin -1. The following scopes **each** require a role (ex. “admin”) - - Org_A - - Project_1 - - Project_2 -2. Each role needs to have the user/group added as a principal -3. Each role needs to have the grants of - - - `ids=*;type=*;actions=*` - -### Project_1 admin -1. Project_1 requires a role (ex. “admin”) -2. The role needs to have the user/group added as a principal -3. The role needs to have the grants of - - - `ids=*;type=*;actions=*` - -### Project_1 target access -1. Project_1 requires a role (ex. “target_access”) -2. The role needs to have the user/group added as a principal -3. The role needs to have the grants of - - - `ids=*;type=target;actions=list,read,authorize-session` - - `ids=*;type=session;actions=read:self,cancel:self,list` - -You can use the same roles across “Boundary Admin”, “Org_A Admin”, and “Project_1 Admin” since the scopes and grants are the same. The only difference is -the users/groups that are added to each role. diff --git a/website/content/docs/concepts/transparent-sessions.mdx b/website/content/docs/concepts/transparent-sessions.mdx deleted file mode 100644 index 8885e5cad..000000000 --- a/website/content/docs/concepts/transparent-sessions.mdx +++ /dev/null @@ -1,38 +0,0 @@ ---- -layout: docs -page_title: Transparent sessions -description: >- - Learn how transparent sessions enable you to connect to target resources without entering resource IDs or port numbers. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Transparent sessions - -@include 'alerts/enterprise-only.mdx' - -Transparent sessions shift Boundary from an active connection model to a passive connection model. Boundary operates in the background instead of requiring you to remember specific resource IDs or ephemeral ports to connect to targets. - -As long as Boundary authenticates a user and the user is authorized to access the target, Boundary intercepts the DNS call and routes traffic through a session automatically. - -Transparent sessions require aliases and the Boundary Client Agent. - -An alias is a globally unique, DNS-like string that is associated with a destination resource. You can establish a session to a target by referencing its alias, instead of having to provide a target ID or target name and scope ID. - -The Boundary Client Agent is Boundary's DNS daemon. -When the Boundary Client Agent runs alongside an authenticated Boundary client, the agent establishes itself as the primary resolver on the system and intercepts DNS requests. - -The Boundary Desktop client facilitates quick target discovery and session establishment using your preferred client. If you configure aliases for your targets, install the Boundary Client Agent, and ensure you are authenticated to the cluster, connections are transparent to the user. Boundary provides OS notifications to make it clear when you connect to a target using a transparent session. - -Boundary supports Windows and MacOS for transparent sessions. - -## More information - -Refer to the following topics for more information: - -- [Aliases](/boundary/docs/concepts/aliases) -- [Boundary Client Agent](/boundary/docs/client-agent) -- [Configure transparent sessions](/boundary/docs/targets/configuration/configure-transparent-sessions) diff --git a/website/content/docs/concepts/workers.mdx b/website/content/docs/concepts/workers.mdx deleted file mode 100644 index b15753f53..000000000 --- a/website/content/docs/concepts/workers.mdx +++ /dev/null @@ -1,88 +0,0 @@ ---- -layout: docs -page_title: Workers -description: >- - Workers let you proxy traffic to private targets. Learn about worker capabilities, using tags to filter tasks, worker health, and best practices for deployment. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Workers -Boundary's architecture consists of three main components: -1. **Control plane** - made up of controllers -1. **Data plane** - made up of workers -1. **Client** - installed on the user's device - -**Controllers** are what users authenticate to using the client, they contain Boundary's resources and permissions. In addition, controllers also communicate with external components -such as the database, KMS, Vault, identity providers, and plugins. - -**Workers** are primarily used as network proxies for Boundary sessions, they allow you to access -private targets. Instead of exposing a private network to the public, or allowing users to have access to entire private networks, workers create a direct network -tunnel between users and targets. - -![How Boundary Works](/img/how-boundary-works_light.png#light-theme-only) -![How Boundary Works](/img/how-boundary-works_dark.png#dark-theme-only) - -## Capabilities -You can use workers in various ways depending on your needs, as follows: - -### Session proxying - -You can use workers to proxy sessions between clients and targets located in public or private networks. In addition, you can configure workers in multi-hop sessions and form a chain of proxies to reach deeper into protected networks. - -### Worker authentication - -Workers can authenticate directly to the control plane or through an upstream worker to the control plane. Authenticating through an upstream worker is also referred to as "multi-hop worker authentication." - -### Controller proxy - -In situations where controllers need access to a private service but don't have network access to it, workers can act as a proxy for communication. This is currently supported for controllers connecting to a private Vault environment. - -### Protocol decryption - -Workers can perform SSH protocol decryption for credential injection and session recording. For session recording, workers also write the recorded session contents directly to the storage -bucket. - -## Multi-hop sessions - -This feature requires HCP Boundary or Boundary Enterprise - -Most organizations want to provide access to infrastructure without exposing private networks. Many organizations also have complex network topologies requiring -inbound traffic to route through multiple network enclaves in order to reach the target system. -Multi-hop sessions allow you to chain together two or more workers across multiple networks to form reverse proxy connections between the user and the target, even in complex networks with strict outbound-only policies. - -## Tags - -In multi-datacenter and multi-cloud operating models, patterns of dividing up controllers, workers, and targets into appropriate regions or networks is often -desired to reduce latency or comply with security standards. You can assign workers tags that Boundary -can filter through, to find the appropriate worker to use for a session. For example, Boundary could filter to workers with tag “A,” to connect to targets in “Network A.” - -![Boundary architecture example showing workers with tags](/img/worker-tags.png) - -## Status and health - -Boundary workers report their status to controllers on a regular basis. You can view the last time a worker reported its status in the admin UI as **Last Seen** and in the CLI as the **Last Status Time**. If a worker hasn't reported status recently, it can be an indication of an unhealthy worker. - -You can query the worker health endpoint to determine the health of a worker. The endpoint returns the worker state, active session count, and connection state of the worker. - -## Tutorial - -Refer to the [HCP credential injection with private Vault](/boundary/tutorials/credential-management/hcp-private-vault-cred-injection) tutorial to practice configuring credential injection. - -Refer to the [Worker-aware targets](/boundary/tutorials/worker-management/target-aware-workers) tutorial to practice configuring worker-aware targets and applying worker filters. - - -## More information - -Refer to the following topics for more information: - -- [TLS in Boundary](/boundary/docs/secure/encryption/connections-tls) -- [Credential injection](/boundary/docs/concepts/credential-management#credential-injection) -- [Session recording](/boundary/docs/session-recording) -- [Route traffic through a worker](/boundary/docs/workers/worker-tags) -- [Boundary health endpoints](/boundary/docs/monitor/health) -- [Multi-hop sessions](/boundary/docs/workers/multi-hop) -- [Filtering and listing resources](/boundary/docs/filtering) diff --git a/website/content/docs/configuration/controller.mdx b/website/content/docs/configuration/controller.mdx deleted file mode 100644 index 2ddcab3c1..000000000 --- a/website/content/docs/configuration/controller.mdx +++ /dev/null @@ -1,348 +0,0 @@ ---- -layout: docs -page_title: Controller configuration -description: >- - Learn about configuring controller-specific parameters. Understand how to configure the required KMS stanzas, and view a complete configuration example. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# `controller` stanza - -The `controller` stanza configures Boundary controller-specific parameters. - -```hcl -controller { - name = "example-controller" - description = "An example controller" - database { - url = "postgresql://:@10.0.0.1:5432/" - max_open_connections = 5 - } -} -``` - -- `name` - Specifies a unique name of this controller within the Boundary - cluster. This value can be a direct name string, can refer to a file on disk - (file://) from which an name will be read; or an env var (env://) from which - the name will be read. - -- `description` - Specifies a friendly description of this controller. This value can be a direct description string, -can refer to a file on disk (file://) from which a description will be read; or an env var (env://) from which the -description will be read. - -- `database` - Configuration block with two valid parameters for connecting to Postgres: - - - `url` - Configures the URL for connecting to Postgres. If your Postgres server has TLS disabled, - Boundary will not be able to connect by default. To run Boundary without a TLS connection - to Postgres (not recommended for production usage), add the `sslmode=disable` parameter to - your connection string, such as `url = "postgresql://postgres:boundary@192.168.1.1:5432/boundary?sslmode=disable"` - This value can refer to a file on disk (file://) from which a URL will be read; an env - var (env://) from which the URL will be read; or a direct database URL (postgres://). - Since 0.10.5, this value is re-read on `SIGHUP` to support rotation of the database - credential. - - `migration_url` - Can be used to specify a different URL for migrations, as that - usually requires higher privileges. - This value can refer to a file on disk (file://) from which a URL will be read; an env - var (env://) from which the URL will be read; or a direct database URL (postgres://). - - `max_open_connections` - Can be used to control the maximum number of - connections that can be opened by the controller. - The minimum number of connections required is 5. - Setting this value to 0 will allow the controller to open as many connections as needed. - This value can be a string or an integer representing the max number of connections, - or a string that can refer to a file - on disk (file://) from which the number of connections will be read, - or an env var (env://) from which the number of connections will be read. - - `max_idle_connections` - Can be used to control the maximum number of - idle connections in the idle connection pool. - If `max_open_connections` is greater than 0 but less than - `max_idle_connections`, then `max_idle_connections` will be reduced to match the `max_open_connections` limit. - Setting this value to 0 will mean that no idle connections are retained. - If not set or set to less than 0, the default - [sql.DB](https://pkg.go.dev/database/sql#DB.SetMaxIdleConns) setting will be used. - This value can be a string or an integer representing the max number of connections, - or a string that can refer to a file on disk (file://) from which the number of connections will be read, - or an env var (env://) from which the number of connections will be read. - - `max_idle_time` - Can be used to control the maximum amount of time - a connection may be idle. - Setting this value to 0 will mean that connections are not closed due to a - connections idle time. - If not set or set to less than 0, the default - [sql.DB](https://pkg.go.dev/database/sql#DB.SetConnMaxIdleTime) setting will be used. - This value can be a string representing the duration, - or a string that can refer to a file on disk (file://) from which the duration will be read, - or an env var (env://) from which the duration will be read. - Valid time units are anything specified by Golang's - [ParseDuration()](https://golang.org/pkg/time/#ParseDuration) method. - -- `public_cluster_addr` - Specifies the public host or IP address (and - optionally port) at which the controller can be reached _by workers_. This will - be used by workers after initial connection to controllers via the worker's - `initial_upstreams` block. This defaults to the address of the listener marked for - `cluster` purpose. It is used if there is a load balancer in front of multiple Boundary controllers. This is also especially useful for cloud environments that do not - bind a publicly accessible IP to a NIC on the host directly, such as an Amazon - EIP. This value can be a direct address string, can refer to a file on disk (file://) - from which an address will be read; an env var (env://) from which the - address will be read; or a [go-sockaddr template](https://godoc.org/github.com/hashicorp/go-sockaddr/template). - Note that the address should not include the protocol prefixes like `http://` or `https://`. - -- `auth_token_time_to_live` - Maximum time to live (TTL) for all auth tokens globally (pertains - to all tokens from all auth methods). Valid time units are anything specified by Golang's - [ParseDuration()](https://golang.org/pkg/time/#ParseDuration) method. Default is 7 days. - -- `auth_token_time_to_stale` - Maximum time of inactivity for all auth tokens globally (pertains - to all tokens from all auth methods). Valid time units are anything specified by Golang's - [ParseDuration()](https://golang.org/pkg/time/#ParseDuration) method. Default is 1 day. - -- `scheduler` - The configuration block that specifies the job scheduler behavior on the controller. - - - `job_run_interval` - The interval at which the scheduler will call the database to check if - there are any jobs that need to run. Default is 1 minute. - - - `monitor_interval` - The interval at which the scheduler will check and interrupt any defuncted - jobs that were running on another scheduler. A job is considered defuncted if it has not reported - a status to the database for 5 minutes. Once a job is interrupted it will be run immediate on the - first controller available. Default is 30 seconds. - -- `graceful_shutdown_wait_duration` - Amount of time Boundary will wait before initiating the shutdown procedure, - after receiving a shutdown signal. In this state, Boundary still processes requests as normal but replies - with `503 Service Unavailable` to any health requests. This is designed to allow an operator to configure - load-balancers to preemptively stop new traffic to a Boundary instance that is going away. Valid time units - are anything specified by Go's [ParseDuration()](https://golang.org/pkg/time/#ParseDuration) method. Only - used when an `ops` listener is set and the Controller is present. Default is 0 seconds. - -- `api_rate_limit` - Sets limits on the rate of requests for controller API endpoints. -This setting can help prevent resources from being overwhelmed with too many requests at a time. -The `api_rate_limit` configuration stanza contains the following fields: - - - `resources` - Specifies the Boundary resource you want to limit rates for. - The resource can be `target` or `credential-library`, for example. - You can include all resources by using the wildcard `"*"`. - - `actions` - Specifies the actions you want to limit on the resource. - The actions could be `create`, `list`, or `authorize-session`, for example. - You can include all actions by using the wildcard `"*"`. - - `per` - Specifies how the limit is allocated. - You can choose from the following values: - - `total` - Counts all requests, regardless of auth token or IP address. - - `ip-address` - Counts requests per IP address. - This value lets you limit requests per IP address. - - `auth-token` - Counts requests per the user's auth token. - This value lets you limit requests per auth token. - - You can also use the wildcard `"*"` to include all values, but only when `unlimited` is also configured. - - `limit` - Specifies the number of requests that are allowed within the `period`. - - `period` - Specifies the time window for the `limit`. - The limit resets after this period of time has passed. - - `unlimited` - Indicates that the corresponding resources and actions should not be rate limited. - If you set this value to `true`, you should not specify values for the `limit` and `period` or you will receive an error. - - For more information about how API rate limiting works, refer to the [API rate limiting](/boundary/docs/api/rate-limiting) documentation. - -- `api_rate_limit_disable` - Disables API rate limiting, if set to `true`. -If `api_rate_limit_disable` is set to `true`, and you have provided any `api_rate_limit` stanzas, you will receive an error. -- `api_rate_limit_max_quotas` - Specifies the maximum number of API rate limiting quotas that Boundary allows. - -- `max_page_size` - The max allowed page size when paginating. If a user specifies a page size greater than - this number, it will be truncated to this number. This is also used as the default page size for any requests - that don't explicitly specify a page size. Default is 1000. - -## Signals - -The `SIGHUP` signal causes a controller to reload its configuration file to pick up any updates to the `database url` value. Any other updated values are ignored. - -The `SIGTERM` and `SIGINT` signals initiate a graceful shutdown on a controller. A graceful shutdown closes listeners and servers before shutting down the controller. - -## KMS configuration - -The controller requires two KMS stanzas for `root` and `worker-auth` purposes: - -```hcl -# Root KMS configuration block: this is the root key for Boundary -# Use a production KMS such as AWS KMS in production installs -kms "aead" { - purpose = "root" - aead_type = "aes-gcm" - key = "sP1fnF5Xz85RrXyELHFeZg9Ad2qt4Z4bgNHVGtD6ung=" - key_id = "global_root" -} - -# Worker authorization KMS -# Use a production KMS such as AWS KMS for production installs -# This key is the same key used in the worker configuration -kms "aead" { - purpose = "worker-auth" - aead_type = "aes-gcm" - key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ=" - key_id = "global_worker-auth" -} -``` - -And optionally, a KMS stanza for recovery purpose: - -```hcl -# Recovery KMS block: configures the recovery key for Boundary -# Use a production KMS such as AWS KMS for production installs -kms "aead" { - purpose = "recovery" - aead_type = "aes-gcm" - key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ=" - key_id = "global_recovery" -} -``` - -And optionally, a KMS stanza for configuration encryption purpose: - -```hcl -# Configuration encryption block: decrypts sensitive values in the -# configuration file. See `boundary config [encrypt|decrypt] -h`. -kms "aead" { - purpose = "config" - aead_type = "aes-gcm" - key = "7xtkEoS5EXPbgynwd+dDLHopaCqK8cq0Rpep4eooaTs=" -} -``` - -And optionally, a KMS stanza to enable the session recording feature: - -```hcl -# BSR encryption block: encrypts data and checks the integrity -# of session recordings. If you do not add a BSR key to your -# controller configuration, you cannot enable session recording. -kms "aead" { - purpose = "bsr" - aead_type = "aes-gcm" - key = "8Vg!XCbS.fzNKB@Uu.ccB588H#4iyHAd:TpgjuwC/;J;" - key_id = "session_recording" -} -``` - -Boundary supports many kinds of KMS integrations. For a complete guide to all available -KMS types, see our [KMS documentation](/boundary/docs/configuration/kms). - -## Complete configuration example - -```hcl -# Disable memory lock: https://www.man7.org/linux/man-pages/man2/mlock.2.html -disable_mlock = true - -# Controller configuration block -controller { - # This name attr must be unique across all controller instances if running in HA mode - name = "demo-controller-1" - description = "A controller for a demo!" - - # After receiving a shutdown signal, Boundary will wait 10s before initiating the shutdown process. - graceful_shutdown_wait_duration = "10s" - - # Database URL for postgres. This can be a direct "postgres://" - # URL, or it can be "file://" to read the contents of a file to - # supply the url, or "env://" to name an environment variable - # that contains the URL. - database { - url = "postgresql://boundary:boundarydemo@postgres.yourdomain.com:5432/boundary" - } - - # Rate limiting examples to conserve controller resources - # total limit for all resources and actions - api_rate_limit { - resources = ["*"] - actions = ["*"] - per = "total" - limit = 500 - period = "1s" - } - - # Limit for ip addresses to all resources+actions to prevent a malicious - # host that is fabricating tokens, or spamming unauthed endpoints - api_rate_limit { - resources = ["*"] - actions = ["*"] - per = "ip-address" - limit = 100 - period = "1s" - } - - # Limit of all authed requests, to prevent one user consuming all of the total limit - api_rate_limit { - resources = ["*"] - actions = ["*"] - per = "auth-token" - limit = 100 - period = "1s" - } -} - -# API listener configuration block -listener "tcp" { - # Should be the address of the NIC that the controller server will be reached on - address = "10.0.0.1" - # The purpose of this listener block - purpose = "api" - - tls_disable = false - - # Uncomment to enable CORS for the Admin UI. Be sure to set the allowed origin(s) - # to appropriate values. - #cors_enabled = true - #cors_allowed_origins = ["https://yourcorp.yourdomain.com", "serve://boundary"] -} - -# Data-plane listener configuration block (used for worker coordination) -listener "tcp" { - # Should be the IP of the NIC that the worker will connect on - address = "10.0.0.1" - # The purpose of this listener - purpose = "cluster" -} - -listener "tcp" { - # Should be the address of the NIC where your external systems' - # (eg: Load-Balancer) will connect on. - address = "10.0.0.1" - # The purpose of this listener block - purpose = "ops" - - tls_disable = false -} - -# Root KMS configuration block: this is the root key for Boundary -# Use a production KMS such as AWS KMS in production installs -kms "aead" { - purpose = "root" - aead_type = "aes-gcm" - key = "sP1fnF5Xz85RrXyELHFeZg9Ad2qt4Z4bgNHVGtD6ung=" - key_id = "global_root" -} - -# Worker authorization KMS -# Use a production KMS such as AWS KMS for production installs -# This key is the same key used in the worker configuration -kms "aead" { - purpose = "worker-auth" - aead_type = "aes-gcm" - key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ=" - key_id = "global_worker-auth" -} - -# Recovery KMS block: configures the recovery key for Boundary -# Use a production KMS such as AWS KMS for production installs -kms "aead" { - purpose = "recovery" - aead_type = "aes-gcm" - key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ=" - key_id = "global_recovery" -} - -# BSR encryption block: encrypts data and checks the integrity -# of session recordings. If you do not add a BSR key to your -# controller configuration, you cannot enable session recording. -kms "aead" { - purpose = "bsr" - aead_type = "aes-gcm" - key = "8Vg!XCbS.fzNKB@Uu.ccB588H#4iyHAd:TpgjuwC/;J;" - key_id = "session_recording" -} -``` diff --git a/website/content/docs/configuration/events/common-sink-parameters.mdx b/website/content/docs/configuration/events/common-sink-parameters.mdx deleted file mode 100644 index 6e4e87bb4..000000000 --- a/website/content/docs/configuration/events/common-sink-parameters.mdx +++ /dev/null @@ -1,27 +0,0 @@ ---- -layout: docs -page_title: Common sink parameters -description: |- - The common sink parameters for all sink types. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Common sink parameters - -@include '/configuration-reference/events/common-sink-intro.mdx' - -## `audit_config` parameters - -@include '/configuration-reference/events/common-audit_config-parameters.mdx' - -### `audit_filter_overrides` parameters - -@include '/configuration-reference/events/common-audit_filter_overrides-parameters.mdx' - -## `audit_config` examples - -@include '/configuration-reference/events/common-audit_config-examples.mdx' diff --git a/website/content/docs/configuration/events/file-sink.mdx b/website/content/docs/configuration/events/file-sink.mdx deleted file mode 100644 index f11174060..000000000 --- a/website/content/docs/configuration/events/file-sink.mdx +++ /dev/null @@ -1,23 +0,0 @@ ---- -layout: docs -page_title: File sink - configuration reference -description: |- - The file sink configures Boundary to send events to a file. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# `file` sink - -@include '/configuration-reference/events/file-sink-intro.mdx' - -## Common parameters - -These parameters are shared across all sink types: [common sink parameters](/boundary/docs/monitor/events/common) - -## `file` parameters - -@include '/configuration-reference/events/file-parameters.mdx' \ No newline at end of file diff --git a/website/content/docs/configuration/events/index.mdx b/website/content/docs/configuration/events/index.mdx deleted file mode 100644 index 06078e747..000000000 --- a/website/content/docs/configuration/events/index.mdx +++ /dev/null @@ -1,19 +0,0 @@ ---- -layout: docs -page_title: Events configuration reference -description: |- - Reference document for configuring event parameters ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# `events` stanza - -@include '/configuration-reference/events/events-stanza-intro.mdx' - -## Default events stanza - -@include '/configuration-reference/events/default-events-stanza.mdx' \ No newline at end of file diff --git a/website/content/docs/configuration/events/stderr-sink.mdx b/website/content/docs/configuration/events/stderr-sink.mdx deleted file mode 100644 index d22bb292c..000000000 --- a/website/content/docs/configuration/events/stderr-sink.mdx +++ /dev/null @@ -1,23 +0,0 @@ ---- -layout: docs -page_title: stderr sink - configuration reference -description: |- - The stderr sink configures Boundary to send events to a stderr. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# `stderr` sink - -@include '/configuration-reference/events/stderr-intro.mdx' - -## Common parameters - -These parameters are shared across all sink types: [common sink parameters](/boundary/docs/monitor/events/common) - -## `stderr` parameters - -@include '/configuration-reference/events/stderr-parameters.mdx' \ No newline at end of file diff --git a/website/content/docs/configuration/index.mdx b/website/content/docs/configuration/index.mdx deleted file mode 100644 index 6445881a1..000000000 --- a/website/content/docs/configuration/index.mdx +++ /dev/null @@ -1,111 +0,0 @@ ---- -layout: docs -page_title: Top-level configuration parameters -description: >- - Learn about the parameters that make up the Boundary HCL configuration file. View parameters for HCP and self-managed installations. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Top-level configuration parameters - -[listener]: /boundary/docs/configuration/listener -[controller]: /boundary/docs/configuration/controller -[worker]: /boundary/docs/configuration/workers -[kms]: /boundary/docs/configuration/kms -[plugins]: /boundary/docs/configuration/plugins -[events]: /boundary/docs/configuration/events - -Outside of development mode, Boundary controllers and workers are configured -using a file. The format of this file is -[HCL](https://github.com/hashicorp/hcl). In this section you'll find -configuration block examples for Boundary controllers and workers. - -After the configuration is written, use the `-config` flag to specify a local -path to the file. - -## HCP Boundary-only parameters - -- `hcp_boundary_cluster_id` `(string)` - The ID of an HCP Boundary cluster. - Setting this allows discovery of upstream addresses for self-managed workers - to connect to the cluster. - -## Shared self-managed and HCP Boundary parameters - -- [`worker`](/boundary/docs/configuration/workers): Worker specific configuration. If - present, `boundary server` will start a Worker subprocess. - -- [`listener`](/boundary/docs/configuration/listener): Configures the listeners on which - Boundary serves traffic (API, cluster, and proxy). - - Controllers must have at least two listener blocks defined: one marked for - `api` purpose and the other marked for `cluster` purpose. - - Workers will have only one listener, marked for `proxy` purpose. - - Optionally, the `ops` purpose listener block serves as a higher-level listener - where Boundary's operational endpoints live (eg: /health). - -- [`kms`](/boundary/docs/configuration/kms): Configures KMS blocks [for various - purposes](/boundary/docs/secure/encryption/data-encryption). - -- [`events`](/boundary/docs/configuration/events): Configures event (observability, - audit, error) handling. - -- `disable_mlock` `(bool: false)` – Disables the server from executing the - `mlock` syscall, which prevents memory from being swapped to disk. This is - fine for local development and testing; in production, it is not recommended - unless the systems running Boundary only use encrypted swap or do not use swap - at all. Boundary only supports memory locking on UNIX-like systems that - support the mlock() syscall (Linux, FreeBSD, etc). - - On Linux, to give the Boundary executable the ability to use the `mlock` - syscall without running the process as root, run: - - ```shell - sudo setcap cap_ipc_lock=+ep $(readlink -f $(which boundary)) - ``` - - If you use a Linux distribution with a modern version of systemd, you can add - the following directive to the "[Service]" configuration section: - - ```ini - LimitMEMLOCK=infinity - ``` - -- `log_level` `(string: "info")` – (Deprecated: this is being phased out in - favor of observability and is currently only used as a backup if eventing - fails.) Specifies the log level to use; overridden by CLI and env var - parameters. Supported log levels: Trace, Debug, Error, Warn, Info. - -- `log_format` `(string: "")` – (Deprecated: this is being phased out in favor - of observability and is currently only used as a backup if eventing fails.) - Specifies the log format to use; overridden by CLI and env var parameters. - Supported log formats: `"standard"`, `"json"`. - -## Self-managed Boundary-only parameters - -- [`controller`](/boundary/docs/configuration/controller): Controller specific - configuration. If present, `boundary server` will start a Controller subprocess. - -- [`plugins`](/boundary/docs/configuration/plugins): Configures options for plugins. - -## Signals - -The `SIGHUP` signal causes worker and controller processes to reload their configuration files to pick up updated values. - -~> **Note:** You cannot reload all configuration values using the `SIGHUP` signal. Refer to the configuration pages for -[workers](/boundary/docs/configuration/workers) and [controllers](/boundary/docs/configuration/controller) for details -on which values can be reloaded on `SIGHUP`. - -The `SIGTERM` and `SIGINT` signals cause worker and controller processes to enter graceful shutdown. A graceful shutdown for a controller closes listeners and servers before shutting down the controller. A graceful shutdown for a worker waits for any sessions to drain -before shutting down the worker. Workers in a graceful shutdown state do not receive any new work, including session proxying, from the control plane. - -## Example configurations - -For complete example configurations see the sections for -[controller](/boundary/docs/configuration/controller) and -[worker](/boundary/docs/configuration/workers). diff --git a/website/content/docs/configuration/kms/aead.mdx b/website/content/docs/configuration/kms/aead.mdx deleted file mode 100644 index bd0a63802..000000000 --- a/website/content/docs/configuration/kms/aead.mdx +++ /dev/null @@ -1,38 +0,0 @@ ---- -layout: docs -page_title: AEAD KMS configuration -description: >- - Learn about using the Authenticated Encryption with Associated Data (AEAD) KMS for key management. AEAD is typically used for development workflows or testing. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# `aead` KMS - -~> **Note:** This is mostly used for `dev` workflows or testing. The key will be exposed -to anyone that can view the configuration file. If using this KMS, consider -using `boundary config encrypt` to encrypt all but the `config` KMS and using an -external KMS for `config` purposes. - -```hcl -kms "aead" { - purpose = "worker-auth" - aead_type = "aes-gcm" - key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ=" - key_id = "global_worker-auth" -} -``` - -- `purpose` - Purpose of this KMS, acceptable values are: `worker-auth`, `worker-auth-storage`, - `root`, `previous-root`, `recovery`, `bsr`, or `config`. - -- `aead_type` - The type of encryption this KMS uses. Currently only `aes-gcm` is implemented. - -- `key` - The base64-encoded 256-bit encryption key. - -- `key_id` - The unique name of this key. -It is used to identify the key when you perform a root key migration. -You can use the `key_id` field with all KMS stanzas. diff --git a/website/content/docs/configuration/kms/alicloudkms.mdx b/website/content/docs/configuration/kms/alicloudkms.mdx deleted file mode 100644 index 6c46c9fa2..000000000 --- a/website/content/docs/configuration/kms/alicloudkms.mdx +++ /dev/null @@ -1,85 +0,0 @@ ---- -layout: docs -page_title: AliCloud KMS configuration -description: >- - Learn about using the AliCloud KMS for key management and configuring parameters and authentication. View an example alicloudkms configuration. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# `alicloudkms` KMS - -The AliCloud KMS configures Boundary to use AliCloud KMS for key management. -The AliCloud KMS is activated by one of the following: - -- The presence of a `kms "alicloudkms"` block in Boundary's configuration file. - -## `alicloudkms` example - -This example shows configuring AliCloud KMS through the Boundary configuration file -by providing all the required values: - -```hcl -kms "alicloudkms" { - purpose = "root" - region = "us-east-1" - access_key = "0wNEpMMlzy7szvai" - secret_key = "PupkTg8jdmau1cXxYacgE736PJj4cA" - kms_key_id = "08c33a6f-4e0a-4a1b-a3fa-7ddfa1d4fb73" - key_id = "global_worker-auth" -} -``` - -## `alicloudkms` parameters - -These parameters apply to the `kms` stanza in the Boundary configuration file: - -- `purpose` - Purpose of this KMS, acceptable values are: `worker-auth`, `worker-auth-storage`, - `root`, `previous-root`, `recovery`, `bsr`, or `config`. - -- `region` `(string: "us-east-1")`: The AliCloud region where the encryption key - lives. May also be specified by the `ALICLOUD_REGION` - environment variable. - -- `domain` `(string: "kms.us-east-1.aliyuncs.com")`: If set, overrides the endpoint - AliCloud would normally use for KMS for a particular region. May also be specified - by the `ALICLOUD_DOMAIN` environment variable. - -- `access_key` `(string: )`: The AliCloud access key ID to use. May also be - specified by the `ALICLOUD_ACCESS_KEY` environment variable or as part of the - AliCloud profile from the AliCloud CLI or instance profile. - -- `secret_key` `(string: )`: The AliCloud secret access key to use. May - also be specified by the `ALICLOUD_SECRET_KEY` environment variable or as - part of the AliCloud profile from the AliCloud CLI or instance profile. - -- `kms_key_id` `(string: )`: The AliCloud KMS key ID to use for encryption - and decryption. May also be specified by the `ALICLOUDKMS_WRAPPER_KEY_ID` - environment variable. - -- `key_id` - The unique name of this key. -It is used to identify the key when you perform a root key migration. -You can use the `key_id` field with all KMS stanzas. - -## Authentication - -Authentication-related values must be provided, either as environment -variables or as configuration parameters. - -~> **Note:** Although the configuration file allows you to pass in -`ALICLOUD_ACCESS_KEY` and `ALICLOUD_SECRET_KEY` as part of the 's parameters, it -is _strongly_ recommended to set these values via environment variables. - -```text -AliCloud authentication values: - -* `ALICLOUD_REGION` -* `ALICLOUD_ACCESS_KEY` -* `ALICLOUD_SECRET_KEY` -``` - -The client uses the official AliCloud SDK and will use environment credentials, -the specified credentials, or RAM role credentials in that order. diff --git a/website/content/docs/configuration/kms/awskms.mdx b/website/content/docs/configuration/kms/awskms.mdx deleted file mode 100644 index cec4889b0..000000000 --- a/website/content/docs/configuration/kms/awskms.mdx +++ /dev/null @@ -1,127 +0,0 @@ ---- -layout: docs -page_title: AWS KMS Configuration -description: >- - Learn about using the AWS KMS for key management, configuring parameters and authentication, and best practices for key rotation. View an example configuration. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# `awskms` - -The AWS KMS configures Boundary to use AWS KMS for key management. - -## `awskms` example - -This example shows configuring AWS KMS through the Boundary configuration file -by providing all the required values: - -```hcl -kms "awskms" { - purpose = "root" - region = "us-east-1" - access_key = "AKIAIOSFODNN7EXAMPLE" - secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" - kms_key_id = "19ec80b0-dfdd-4d97-8164-c6examplekey" - endpoint = "https://vpce-0e1bb1852241f8cc6-pzi0do8n.kms.us-east-1.vpce.amazonaws.com" - key_id = "global_worker-auth" -} -``` - -## `awskms` parameters - -These parameters apply to the `kms` stanza in the Boundary configuration file: - -- `purpose` - Purpose of this KMS, acceptable values are: `worker-auth`, `worker-auth-storage`, - `root`, `previous-root`, `recovery`, `bsr`, or `config`. - - To [enable session recording](/boundary/docs/session-recording/configuration/enable-session-recording), you must configure the `bsr` value for the `purpose`. - -- `region` `(string: "us-east-1")`: The AWS region where the encryption key - lives. If not provided, may be populated from the `AWS_REGION` or - `AWS_DEFAULT_REGION` environment variables, from your `~/.aws/config` file, - or from instance metadata. - -- `kms_key_id` `(string: )`: The AWS KMS key ID to use for encryption - and decryption. May also be specified by the `AWSKMS_WRAPPER_KEY_ID` - environment variable. - -- `access_key` `(string: "")`: The AWS access key ID to use. May also be - specified by the `AWS_ACCESS_KEY_ID` environment variable or as part of the - AWS profile from the AWS CLI or instance profile. - -- `session_token` `(string: "")`: Specifies the AWS session token. This can - also be provided via the environment variable `AWS_SESSION_TOKEN`. - -- `secret_key` `(string: "")`: The AWS secret access key to use. May - also be specified by the `AWS_SECRET_ACCESS_KEY` environment variable or as - part of the AWS profile from the AWS CLI or instance profile. - -- `shared_creds_filename` `(string: "")`: If set, the file - name to read as a shared credentials file. - -- `shared_creds_profile` `(string: "")`: If set, the - profile to use from the shared credentials file. If not set, will use the - `AWS_PROFILE` env var, or if that is not set, `"default"`. - -- `role_arn` `(string: "")`: If this and - `web_identity_token_file` are set, the role ARN to use when using a web - identity role provider with STS. - -- `web_identity_token_file` `(string: "")`: If this and - `role_arn` are set, the token file to use when using a web identity role - provider with STS. - -- `role_session_name` `(string: "")`: If using the web - identity role provider, the role session to use. - -- `endpoint` `(string: "")`: The KMS API endpoint to be used to make AWS KMS - requests. May also be specified by the `AWS_KMS_ENDPOINT` environment - variable. This is useful, for example, when connecting to KMS over a [VPC - Endpoint](https://docs.aws.amazon.com/kms/latest/developerguide/kms-vpc-endpoint.html). - If not set, Boundary will use the default API endpoint for your region. - -- `key_id` - The unique name of this key. -It is used to identify the key when you perform a root key migration. -You can use the `key_id` field with all KMS stanzas. - -## Authentication - -Authentication-related values must be provided, either as environment -variables or as configuration parameters. - -~> **Note:** Although the configuration file allows you to pass in -`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` as part of the KMS's parameters, it -is _strongly_ recommended to set these values via environment variables. - -AWS authentication values: - -- `AWS_REGION` or `AWS_DEFAULT_REGION` -- `AWS_ACCESS_KEY_ID` -- `AWS_SECRET_ACCESS_KEY` - -Note: The client uses the official AWS SDK and will use the specified -credentials, environment credentials, shared file credentials, or IAM role/ECS -task credentials in that order, if the above AWS specific values are not -provided. - -Boundary needs the following permissions on the KMS key: - -- `kms:Encrypt` -- `kms:Decrypt` -- `kms:DescribeKey` - -These can be granted via IAM permissions on the principal that Boundary uses, on -the KMS key policy for the KMS key, or via KMS Grants on the key. - -## Key rotation - -This KMS supports rotating the master keys defined in AWS KMS -[doc](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html). Both automatic -rotation and manual rotation is supported for KMS since the key information is stored with the -encrypted data. Old keys must not be disabled or deleted and are used to decrypt older data. -Any new or updated data will be encrypted with the current key defined in the KMS configuration -or set to current under a key alias. diff --git a/website/content/docs/configuration/kms/azurekeyvault.mdx b/website/content/docs/configuration/kms/azurekeyvault.mdx deleted file mode 100644 index 108e3560e..000000000 --- a/website/content/docs/configuration/kms/azurekeyvault.mdx +++ /dev/null @@ -1,76 +0,0 @@ ---- -layout: docs -page_title: Azure Key Vault configuration -description: >- - Learn about using the Azure Key Vault KMS for key management and configuring parameters and authentication. View an example azurekeyvault configuration. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# `azurekeyvault` KMS - -The Azure Key Vault KMS configures Boundary to use Azure Key Vault for key management. -The Azure Key Vault KMS is activated by one of the following: - -- The presence of a `seal "azurekeyvault"` block in Boundary's configuration file. - -## `azurekeyvault` example - -This example shows configuring Azure Key Vault KMS through the Boundary -configuration file by providing all the required values: - -```hcl -kms "azurekeyvault" { - purpose = "root" - tenant_id = "46646709-b63e-4747-be42-516edeaf1e14" - client_id = "03dc33fc-16d9-4b77-8152-3ec568f8af6e" - client_secret = "DUJDS3..." - vault_name = "hc-vault" - key_name = "vault_key" - key_id = "global_worker-auth" -} -``` - -## `azurekeyvault` parameters - -These parameters apply to the `kms` stanza in the Vault configuration file: - -- `purpose` - Purpose of this KMS, acceptable values are: `worker-auth`, `worker-auth-storage`, - `root`, `previous-root`, `recovery`, `bsr`, or `config`. - -- `tenant_id` `(string: )`: The tenant id for the Azure Active Directory organization. May - also be specified by the `AZURE_TENANT_ID` environment variable. - -- `client_id` `(string: )`: The client id for credentials to query the Azure APIs. - May also be specified by the `AZURE_CLIENT_ID` environment variable. - -- `client_secret` `(string: )`: The client secret for credentials to query the Azure APIs. - May also be specified by the `AZURE_CLIENT_SECRET` environment variable. - -- `environment` `(string: "AZUREPUBLICCLOUD")`: The Azure Cloud environment API endpoints to use. May also - be specified by the `AZURE_ENVIRONMENT` environment variable. - -- `vault_name` `(string: )`: The Key Vault vault to use the encryption keys for encryption and - decryption. May also be specified by the `AZUREKEYVAULT_WRAPPER_VAULT_NAME` environment variable. - -- `key_name` `(string: )`: The Key Vault key to use for encryption and decryption. May also be specified by the - `AZUREKEYVAULT_WRAPPER_KEY_NAME` environment variable. - -- `key_id` - The unique name of this key. -It is used to identify the key when you perform a root key migration. -You can use the `key_id` field with all KMS stanzas. - -## Authentication - -Authentication-related values must be provided, either as environment -variables or as configuration parameters. - -Azure authentication values: - -- `AZURE_TENANT_ID` -- `AZURE_CLIENT_ID` -- `AZURE_CLIENT_SECRET` -- `AZURE_ENVIRONMENT` diff --git a/website/content/docs/configuration/kms/gcpckms.mdx b/website/content/docs/configuration/kms/gcpckms.mdx deleted file mode 100644 index 3b63166ae..000000000 --- a/website/content/docs/configuration/kms/gcpckms.mdx +++ /dev/null @@ -1,75 +0,0 @@ ---- -layout: docs -page_title: GCP Cloud KMS configuration -description: >- - Learn about using the GCP Cloud KMS for key management and configuring parameters and authentication. View an example gcpkms configuration. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# `gcpckms` KMS - -The GCP Cloud KMS configures Boundary to use GCP Cloud KMS for key management. - -The GCP Cloud KMS seal is activated by the presence of a `seal "gcpckms"` block in Boundary's configuration file. - -## `gcpckms` example - -This example shows configuring GCP Cloud KMS through the Boundary -configuration file by providing all the required values: - -```hcl -kms "gcpckms" { - purpose = "root" - credentials = "/usr/boundary/boundary-project-user-creds.json" - project = "boundary-project" - region = "global" - key_ring = "boundary-keyring" - crypto_key = "boundary-key" - key_id = "global_worker-auth" -} -``` - -## `gcpckms` parameters - -These parameters apply to the `kms` stanza in the Boundary configuration file: - -- `purpose` - Purpose of this KMS, acceptable values are: `worker-auth`, `worker-auth-storage`, - `root`, `previous-root`, `recovery`, `bsr`, or `config`. - -- `credentials` `(string: )`: The path to the credentials JSON file - to use. May be also specified by the `GOOGLE_CREDENTIALS` or - `GOOGLE_APPLICATION_CREDENTIALS` environment variable or set automatically if - running under Google App Engine, Google Compute Engine or Google Kubernetes - Engine. - -- `project` `(string: )`: The GCP project ID to use. May also be - specified by the `GOOGLE_PROJECT` environment variable. - -- `region` `(string: "us-east-1")`: The GCP region/location where the key ring - lives. May also be specified by the `GOOGLE_REGION` environment variable. - -- `key_ring` `(string: )`: The GCP CKMS key ring to use. May also be specified - by the `GCPCKMS_WRAPPER_KEY_RING` environment variable. - -- `crypto_key` `(string: )`: The GCP CKMS crypto key to use for - encryption and decryption. May also be specified by the `GCPCKMS_WRAPPER_CRYPTO_KEY` - environment variable. - -- `key_id` - The unique name of this key. -It is used to identify the key when you perform a root key migration. -You can use the `key_id` field with all KMS stanzas. - -## Authentication & permissions - -Authentication-related values must be provided, either as environment -variables or as configuration parameters. - -GCP authentication values: - -- `GOOGLE_CREDENTIALS` or `GOOGLE_APPLICATION_CREDENTIALS` -- `GOOGLE_PROJECT` -- `GOOGLE_REGION` diff --git a/website/content/docs/configuration/kms/index.mdx b/website/content/docs/configuration/kms/index.mdx deleted file mode 100644 index f325171a5..000000000 --- a/website/content/docs/configuration/kms/index.mdx +++ /dev/null @@ -1,46 +0,0 @@ ---- -layout: docs -page_title: KMS configuration -description: >- - Learn about using the kms stanza to configure key management system parameters. Discover resources for learning about specific KMS technologies. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# `kms` stanza - -The `kms` stanza configures Boundary kms-specific parameters. - -## Configuration - -KMS configuration can be done through the Boundary configuration file using the -`kms` stanza: - -```hcl -kms [NAME] { - # ... -} -``` - -For example: - -```hcl -kms "transit" { - # ... -} -``` - -## More information - -For specific KMS examples, refer to the following topics: - -- [aead KMS](/boundary/docs/configuration/kms/aead) -- [AliCloud KMS](/boundary/docs/configuration/kms/alicloudkms) -- [AWS KMS](/boundary/docs/configuration/kms/awskms) -- [Azure Key Vault KMS](/boundary/docs/configuration/kms/azurekeyvault) -- [GCP Cloud KMS](/boundary/docs/configuration/kms/gcpckms) -- [OCI KMS](/boundary/docs/configuration/kms/ocikms) -- [Vault Transit KMS](/boundary/docs/configuration/kms/transit) \ No newline at end of file diff --git a/website/content/docs/configuration/kms/ocikms.mdx b/website/content/docs/configuration/kms/ocikms.mdx deleted file mode 100644 index b097b5c49..000000000 --- a/website/content/docs/configuration/kms/ocikms.mdx +++ /dev/null @@ -1,106 +0,0 @@ ---- -layout: docs -page_title: OCI KMS configuration -description: >- - Learn about using the OCI KMS for key management and configuring parameters and authentication. View an example configuration. Understand OCI KMS key rotation. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# `ocikms` KMS - -The OCI KMS configures Boundary to use OCI KMS for key management. - -The OCI KMS is activated by the presence of a `kms "ocikms"` block in Boundary's configuration file. - -## `ocikms` example - -This example shows configuring the OCI KMS through the Boundary configuration file -by providing all the required values: - -```hcl -kms "ocikms" { - purpose = "root" - key_id = "ocid1.key.oc1.iad.afnxza26aag4s.abzwkljsbapzb2nrha5nt3s7s7p42ctcrcj72vn3kq5qx" - crypto_endpoint = "https://afnxza26aag4s-crypto.kms.us-ashburn-1.oraclecloud.com" - management_endpoint = "https://afnxza26aag4s-management.kms.us-ashburn-1.oraclecloud.com" - auth_type_api_key = "true" -} -``` - -## `ocikms` parameters - -These parameters apply to the `kms` stanza in the Boundary configuration file: - -- `purpose` - Purpose of this KMS, acceptable values are: `worker-auth`, `worker-auth-storage`, - `root`, `previous-root`, `recovery`, `bsr`, or `config`. -- `key_id` `(string: )`: The OCI KMS key ID to use. -- `crypto_endpoint` `(string: )`: The OCI KMS cryptographic endpoint (or data plane endpoint) - to be used to make OCI KMS encryption/decryption requests. -- `management_endpoint` `(string: )`: The OCI KMS management endpoint (or control plane endpoint) - to be used to make OCI KMS key management requests. -- `auth_type_api_key` `(boolean: false)`: Specifies if using API key to authenticate to OCI KMS service. - If it is `false`, Boundary authenticates using the instance principal from the compute instance. See Authentication section for details. Default is `false`. - -## Authentication - -Authentication-related values must be provided, either as environment -variables or as configuration parameters. - -If you want to use Instance Principal, add section configuration below and add further configuration settings as detailed in the [configuration docs](/boundary/docs/configuration/). - -```hcl -kms "ocikms" { - purpose = "root" - crypto_endpoint = "" - management_endpoint = "" - key_id = "" -} -``` - -If you want to use User Principal, the plugin will take the API key you defined for OCI SDK, often under `~/.oci/config`. - -```hcl -kms "ocikms" { - purpose = "root" - auth_type_api_key = true - crypto_endpoint = "" - management_endpoint = "" - key_id = "" -} -``` - -To grant permission for a compute instance to use OCI KMS service, write policies for KMS access. - -- Create a [Dynamic Group][oci-dg] in your OCI tenancy. -- Create a policy that allows the Dynamic Group to use or manage keys from OCI KMS. There are multiple ways to write these policies. The [OCI Identity Policy][oci-id] can be used as a reference or starting point. - -The most common policy allows a dynamic group of tenant A to use KMS's keys in tenant B: - -```text -define tenancy tenantB as - -endorse dynamic-group to use keys in tenancy tenantB - -``` - -```text -define tenancy tenantA as - -define dynamic-group as - -admit dynamic-group of tenancy tenantA to use keys in compartment - -``` - -## `ocikms` rotate OCI KMS key - -For the [OCI KMS key rotation feature][oci-kms-rotation], OCI KMS will create a new version of key internally. This process is independent from Boundary, and boundary still uses the same `key_id` without any interruption. - -[oci-sdk]: https://docs.cloud.oracle.com/iaas/Content/API/Concepts/sdkconfig.htm -[oci-dg]: https://docs.cloud.oracle.com/iaas/Content/Identity/Tasks/managingdynamicgroups.htm -[oci-id]: https://docs.cloud.oracle.com/iaas/Content/Identity/Concepts/policies.htm -[oci-kms-rotation]: https://docs.cloud.oracle.com/iaas/Content/KeyManagement/Tasks/managingkeys.htm diff --git a/website/content/docs/configuration/kms/transit.mdx b/website/content/docs/configuration/kms/transit.mdx deleted file mode 100644 index 60c29dfc3..000000000 --- a/website/content/docs/configuration/kms/transit.mdx +++ /dev/null @@ -1,121 +0,0 @@ ---- -layout: docs -page_title: Vault Transit configuration -description: >- - Learn about using the Vault transit secrets engine for key management and configuring parameters and authentication. View an example Transit KMS configuration. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# `transit` seal - -The Transit configures Boundary to use Vault's Transit Secret Engine for key management. - -The Transit KMS is activated by the presence of a `kms transit` block in Boundary's configuration file - -## `transit` example - -This example shows configuring Transit KMS through the Boundary configuration file -by providing all the required values: - -```hcl -kms "transit" { - purpose = "root" - address = "https://vault:8200" - token = "s.Qf1s5zigZ4OX6akYjQXJC1jY" - disable_renewal = "false" - key_id = "global_worker-auth" - - // Key configuration - key_name = "transit_key_name" - mount_path = "transit/" - namespace = "ns1/" - - // TLS Configuration - tls_ca_cert = "/etc/vault/ca_cert.pem" - tls_client_cert = "/etc/vault/client_cert.pem" - tls_client_key = "/etc/vault/ca_cert.pem" - tls_server_name = "vault" - tls_skip_verify = "false" -} -``` - -## `transit` parameters - -These parameters apply to the `kms` stanza in the Vault configuration file: - -- `purpose` - Purpose of this KMS, acceptable values are: `worker-auth`, `worker-auth-storage`, - `root`, `previous-root`, `recovery`, `bsr`, or `config`. - -- `address` `(string: )`: The full address to the Vault cluster. - This may also be specified by the `VAULT_ADDR` environment variable. - -- `token` `(string: )`: The Vault token to use. This may also be - specified by the `VAULT_TOKEN` environment variable. - -- `key_name` `(string: )`: The transit key to use for encryption and - decryption. This may also be supplied using the `TRANSIT_WRAPPER_KEY_NAME` - environment variable. - -- `mount_path` `(string: )`: The mount path to the transit secret engine. - This may also be supplied using the `TRANSIT_WRAPPER_MOUNT_PATH` environment - variable. - -- `namespace` `(string: "")`: The namespace path to the transit secret engine. - This may also be supplied using the `VAULT_NAMESPACE` environment variable. - -- `disable_renewal` `(string: "false")`: Disables the automatic renewal of the token - in case the lifecycle of the token is managed with some other mechanism outside of - Vault, such as Vault Agent. This may also be specified using the - `TRANSIT_WRAPPER_DISABLE_RENEWAL` environment variable. - -- `tls_ca_cert` `(string: "")`: Specifies the path to the CA certificate file used - for communication with the Vault server. This may also be specified using the - `VAULT_CA_CERT` environment variable. - -- `tls_client_cert` `(string: "")`: Specifies the path to the client certificate - for communication with the Vault server. This may also be specified using the - `VAULT_CLIENT_CERT` environment variable. - -- `tls_client_key` `(string: "")`: Specifies the path to the private key for - communication with the Vault server. This may also be specified using the - `VAULT_CLIENT_KEY` environment variable. - -- `tls_server_name` `(string: "")`: Name to use as the SNI host when connecting - to the Vault server via TLS. This may also be specified via the - `VAULT_TLS_SERVER_NAME` environment variable. - -- `tls_skip_verify` `(bool: "false")`: Disable verification of TLS certificates. - Using this option is highly discouraged and decreases the security of data - transmissions to and from the Vault server. This may also be specified using the - `VAULT_SKIP_VERIFY` environment variable. - -- `key_id` - The unique name of this key. -It is used to identify the key when you perform a root key migration. -You can use the `key_id` field with all KMS stanzas. - -## Authentication - -Authentication-related values must be provided, either as environment -variables or as configuration parameters. - -~> **Note:** Although the configuration file allows you to pass in -`token` as part of the KMS stanza's parameters, it is _strongly_ recommended -to omit the `token` parameter from the configuration file and set the -token used to authenticate to Vault via the `VAULT_TOKEN` environment variable. - -The Vault token used to authenticate needs the following permissions on the -transit key: - -```hcl -path "/encrypt/" { - capabilities = ["update"] -} - -path "/decrypt/" { - capabilities = ["update"] -} -``` diff --git a/website/content/docs/configuration/listeners/index.mdx b/website/content/docs/configuration/listeners/index.mdx deleted file mode 100644 index 08e05ebc9..000000000 --- a/website/content/docs/configuration/listeners/index.mdx +++ /dev/null @@ -1,22 +0,0 @@ ---- -layout: docs -page_title: Listeners - configuration reference -description: >- - The listener stanza configures the addresses and ports on which Boundary will respond to requests. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# `listener` stanza - -The `listener` stanza configures the addresses and ports on which Boundary will -respond to requests. At this time, there are two listener types: -[TCP](/boundary/docs/configuration/listeners/tcp-listeners) and [Unix](/boundary/docs/configuration/listeners/unix-listeners). - - -## `listener` purpose - -@include '/configuration-reference/listeners/listener-purpose.mdx' \ No newline at end of file diff --git a/website/content/docs/configuration/listeners/tcp-listeners.mdx b/website/content/docs/configuration/listeners/tcp-listeners.mdx deleted file mode 100644 index 421dc2d57..000000000 --- a/website/content/docs/configuration/listeners/tcp-listeners.mdx +++ /dev/null @@ -1,60 +0,0 @@ ---- -layout: docs -page_title: TCP listeners - configuration reference -description: >- - Learn about using the TCP listener on a TCP address and port, and view configurable parameters. Understand custom response headers. View example configurations. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# `tcp` listener - -@include '/configuration-reference/listeners/tcp-intro.mdx' - -## Listener's custom response headers - -@include '/configuration-reference/listeners/tcp-custom-response-headers.mdx' - -## `tcp` listener parameters - -Refer to the following sections for `tcp` listener parameters. - -### General - -@include '/configuration-reference/listeners/tcp-general-parameters.mdx' - -### `custom_api_response_headers` parameters - -@include '/configuration-reference/listeners/tcp-custom-api-response-headers.mdx' - -### `custom_ui_response_headers` parameters - -@include '/configuration-reference/listeners/tcp-custom-ui-response-headers.mdx' - -### TLS - -@include '/configuration-reference/listeners/tcp-tls.mdx' - - - -## `tcp` listener examples - -Refer to the following sections for examples of `tcp` listeners. - -### Configure TLS - -@include '/configuration-reference/listeners/tcp-configure-tls.mdx' - -### Configure custom http response headers - -@include '/configuration-reference/listeners/tcp-configure-custom-http-response-headers.mdx' - -### Listen on mulitple interfaces - -@include '/configuration-reference/listeners/tcp-listen-on-mulitple-interfaces.mdx' \ No newline at end of file diff --git a/website/content/docs/configuration/listeners/unix-listeners.mdx b/website/content/docs/configuration/listeners/unix-listeners.mdx deleted file mode 100644 index 07471dbe0..000000000 --- a/website/content/docs/configuration/listeners/unix-listeners.mdx +++ /dev/null @@ -1,50 +0,0 @@ ---- -layout: docs -page_title: Unix domain socket - listeners - configuration reference -description: >- - Learn about using the Unix listener on a specified Unix domain socket, and view configurable parameters. View example Unix listener configurations. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# `unix` listener - -@include '/configuration-reference/listeners/unix-intro.mdx' - -## `unix` listener parameters - -Refer to the following sections for the supported `unix` listener parameters. - -### General - -@include '/configuration-reference/listeners/unix-general-parameters.mdx' - -### TLS - -@include '/configuration-reference/listeners/unix-tls-parameters.mdx' - - - -## `unix` listener examples - -Refer to the following sections for examples of `unix` listeners. - -### Configure TLS - -@include '/configuration-reference/listeners/unix-configure-tls.mdx' - -### Listen on multiple interfaces - -@include '/configuration-reference/listeners/unix-listen-on-multiple-interfaces.mdx' - -[golang-tls]: https://golang.org/src/crypto/tls/cipher_suites.go -[api-addr]: /boundary/docs/configuration#api_addr -[cluster-addr]: /boundary/docs/configuration#cluster_addr diff --git a/website/content/docs/configuration/plugins.mdx b/website/content/docs/configuration/plugins.mdx deleted file mode 100644 index 6fcd14b17..000000000 --- a/website/content/docs/configuration/plugins.mdx +++ /dev/null @@ -1,31 +0,0 @@ ---- -layout: docs -page_title: Plugin configuration -description: >- - Learn about the plugin-specific parameter that configures a directory for Boundary to use for writing and executing its built-in plugins. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# `plugin` stanza - -The `plugin` stanza configures plugin-specific parameters. The plugin system is currently internal; over time, the intent is to provide a mechanism for third-party plugins to be able to be used. -Available plugins are currently bundled with Boundary and executed automatically. - -There is currently one configuration parameter available: - -```hcl -plugins { - execution_dir = "/var/run/boundary/plugin-exec" -} -``` - -- `execution_dir` - Specifies a directory that Boundary can use to write and - execute its built-in plugins. This value can be a direct directory string, - can refer to a file on disk (file://) from which a directory location will be - read; or an env var (env://) from which the directory location will be read. - This directory must be writeable by the Boundary user. If not set, Boundary will - attempt to create a suitable directory in the system temporary folder. diff --git a/website/content/docs/configuration/workers.mdx b/website/content/docs/configuration/workers.mdx deleted file mode 100644 index b891be85c..000000000 --- a/website/content/docs/configuration/workers.mdx +++ /dev/null @@ -1,21 +0,0 @@ ---- -layout: docs -page_title: Worker stanza -description: >- - Learn about how to configure workers for proxies, storage, and tags. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# worker stanza - -The `worker` stanza configures Boundary worker-specific parameters. - -@include '/configuration-reference/workers/common-worker-parameters.mdx' - -## Complete configuration example - -@include '/configuration-reference/workers/complete-configuration-example.mdx' \ No newline at end of file diff --git a/website/content/docs/credentials/configure-credential-brokering.mdx b/website/content/docs/credentials/configure-credential-brokering.mdx deleted file mode 100644 index 318072d5c..000000000 --- a/website/content/docs/credentials/configure-credential-brokering.mdx +++ /dev/null @@ -1,83 +0,0 @@ ---- -layout: docs -page_title: Configure targets with credential brokering -description: >- - Configure credential brokering workflows so that Boundary centrally manages credentials and returns them to users when they successfully connect to a target. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Configure targets with credential brokering - -The following section provides steps to configure your targets with credential brokering. -When you use credential brokering, Boundary returns credentials to the user when they successfully connect to a target. - -## Requirements - -- You must have an existing target available. To use brokered credentials to connect to a target that runs SSH, you must use a TCP target type. - -- You must have configured either a static credential store or a Vault credential store: - - - To configure a static credential store, refer to [Create static credential stores](/boundary/docs/credentials/static-cred-boundary). - - To configure a Vault credential store and credential library, refer to [Create Vault credential stores](/boundary/docs/credentials/static-cred-vault). - -- You must have a static credential saved in your static credential store or Vault credential store. The credential must correspond to the target you want to authenticate to. - -## Configuration - -Complete the following steps to configure credential brokering for a target: - - - - -1. Log in to Boundary. -1. Select **Orgs** on the navigation pane. -1. Select your desired org. -1. Select the project where your target resides. -1. Click **Targets** on the navigation pane. -1. Click on the target you want to configure for credential brokering. -1. Click on the **Brokered Credential** tab. -1. Click **Managed** and select **Add Brokered Credential** in the pull down menu. -1. Do one of the following: - - **If you are using a static credential store**: Select the credential that corresponds to your target and click **Add Brokered Credentials**. - - **If you are using a Vault credential store**: Select the credential library that corresponds to your target and click **Add Brokered Credentials**. - - - - -1. Log into Boundary. - - ```shell-session - $ boundary authenticate - Please enter the login name (it will be hidden): - Please enter the password (it will be hidden): - ``` -1. Add brokered credentials to target. - - ```shell-session - $ boundary targets add-credential-sources \ - -id ttcp_vO60a7TwpI \ - -application-credential-source csvlt_Xqa6V6QwfM - ``` - - - - If you are using a static credential store, `brokered-credential-source` refers to the ID of a **credential** in the static credential store. - - If you are using a Vault credential store, `brokered-credential-source` refers to the ID of a **credential library** in the Vault credential store. - - - - - - -## More information - -Refer to the following topics for more information: - -- [Create static credential stores](/boundary/docs/credentials/static-cred-boundary) -- [Create Vault credential stores](/boundary/docs/credentials/static-cred-vault) -- [Target types](/boundary/docs/domain-model/targets#target-types) \ No newline at end of file diff --git a/website/content/docs/credentials/configure-credential-injection.mdx b/website/content/docs/credentials/configure-credential-injection.mdx deleted file mode 100644 index d8c130c25..000000000 --- a/website/content/docs/credentials/configure-credential-injection.mdx +++ /dev/null @@ -1,99 +0,0 @@ ---- -layout: docs -page_title: Configure targets with credential injection -description: >- - Configure credential injection so Boundary provides users with a passwordless experience when connecting to targets. Availabile exclusively for Enterprise users. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Configure targets with credential injection - -This feature requires HCP Boundary or Boundary Enterprise - -The following section provides steps to configure your targets with credential injection. -Credential injection provides end users with a passwordless experience when they connect to targets by automatically injecting credentials without exposing them to the user. - -Credential injection is supported for: -- **SSH targets**: Protocol-aware SSH connections -- **RDP targets**: Protocol-aware RDP connections (BETA) - - @include 'alerts/beta.mdx' - -## Requirements - -- This feature requires either HCP Boundary or Boundary Enterprise -- You must have an existing target available that supports credential injection: - - **RDP targets**: Must be configured with at least one injected application credential - - **SSH targets**: Must be configured with at least one injected application credential - - **TCP targets**: Do not support credential injection -- You must have configured either a static credential store or a Vault credential store: - - - To configure a static credential store, refer to [Create static credential stores](/boundary/docs/credentials/static-cred-boundary). - - To configure a Vault credential store and credential library, refer to [Create Vault credential stores](/boundary/docs/credentials/static-cred-vault). - -- You must have a static credential saved in your static credential store or Vault credential store. The credential must correspond to the target to which you want to authenticate. - -- **For RDP targets**: Network Level Authentication (NLA) is supported. Kerberos and NTLMv2 authentication methods are supported for domain-joined workers. NTLMv2 is supported for non-domain-joined workers. -- **For SSH targets**: Keyboard-interactive authentication is not supported. When you use username-password credentials, ensure that your SSH server is configured to allow password authentication. - -## Configuration - -Complete the following steps to configure targets with credential injection: - - - - -1. Log in to Boundary. -2. Select **Orgs** on the navigation pane. -3. Select your desired org. -4. Select the project where your target resides. -5. Click **Targets** on the navigation pane. -6. Click on your target you want to configure for credential injection. -7. Click on the **Injected Application Credential** tab. -8. Click **Managed** and select **Add Injected Application Credential** in the pull down menu. -9. Do one of the following: - - **If you are using a static credential store**: Select the credential that corresponds to your target and click **Add Injected Application Credential**. - - **If you are using a Vault credential store**: Select the credential library that corresponds to your target and click **Add Injected Application Credential**. - - - - -1. Log into Boundary. - - ```shell-session - $ boundary authenticate - Please enter the login name (it will be hidden): - Please enter the password (it will be hidden): - ``` - -2. Add credential injection to target. - - ```shell-session - $ boundary targets add-credential-sources \ - -id trdp_vO60a7TwpI \ - -injected-application-credential-source csvlt_Xqa6V6QwfM - ``` - - - - If you are using a static credential store, `brokered-credential-source` refers to the ID of a **credential** in the static credential store. - - If you are using a Vault credential store, `brokered-credential-source` refers to the ID of a **credential library** in the Vault credential store. - - - - - - -## More information - -Refer to the following topics for more information: - -- [Create static credential stores](/boundary/docs/credentials/static-cred-boundary) -- [Create Vault credential stores](/boundary/docs/credentials/static-cred-vault) -- [Target types](/boundary/docs/domain-model/targets#target-types) -- [Credentials](/boundary/docs/domain-model/credentials) diff --git a/website/content/docs/credentials/index.mdx b/website/content/docs/credentials/index.mdx deleted file mode 100644 index 6072cec08..000000000 --- a/website/content/docs/credentials/index.mdx +++ /dev/null @@ -1,72 +0,0 @@ ---- -layout: docs -page_title: Credential management with Boundary -description: >- - Credential stores let you store and manage credentials in Boundary. Learn about configuring user workflows with credential management or credential injection. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Credentials in Boundary - -When users connect to a target machine, they typically need a set of credentials for authentication. Rather than requiring users to securely store and manage credentials for every target resource, Boundary centralizes credential management to enhance security. - -## Credential stores - -Boundary supports credential management using [credential stores](/boundary/docs/domain-model/credential-stores), which are resources that store credentials for various targets. - -There are two types of credential stores: - -1. Static credential store -2. Vault credential store - -Static credential stores are built into Boundary and store static credentials like username password, username password domain, or keypairs. Vault credential stores point to a HashiCorp Vault instance, which provides additional capabilities like generating short-lived dynamic credentials and integrating with external systems like Active Directory through the LDAP secrets engine. - -Boundary can retrieve credentials from the credential stores and present them back to the user when they connect to targets. This workflow is referred to as **credential brokering**. Boundary can also inject credentials directly into the session on behalf of the user. This workflow is referred to as **credential injection**. - - -## End user workflows - -End users can experience three workflows when they connect to a target. In the first workflow, when an end user connects to a target, Boundary initiates the session, but the end user must know the credentials to authenticate into the session. This workflow is available for testing purposes, but it is not recommended because it places the burden on the users to securely store and manage credentials. - -The second workflow uses a feature called credential brokering, where credentials are retrieved from a credentials store and returned back to the end user. The end user then enters the credentials into the session when prompted by the target. This workflow is more secure than the first workflow since credentials are centrally managed through Boundary. For more information, refer to the the [Credential brokering](/boundary/docs/concepts/credential-management#credential-brokering) concepts page. - -The third workflow uses a featured called credential injection, where credentials are retrieved from a credential store and injected directly into the session on behalf of the end user. This workflow is the most secure because credentials are not exposed to the end user, reducing the chances of a leaked credential. This workflow is also more streamlined as the user goes through a passwordless experience. For more information, refer to the [Credential injection](/boundary/docs/concepts/credential-management#credential-injection) concepts page. - -The type of target you connect to also determines which credential workflows you can configure: - -- **TCP targets** cannot have any injected application credentials -- **SSH targets** must have at least one injected application credential to establish the SSH connection -- **RDP targets** must have at least one injected application credential to establish the RDP connection - - - -RDP credential injection is currently in beta and requires HCP Boundary or Boundary Enterprise. - - - -For more information, refer to the [Target types](/boundary/docs/domain-model/targets#target-types) documentation. - -## Credential types - -Boundary supports several credential types to accommodate different authentication methods: - -- **Username password**: Basic username and password authentication -- **Username password domain**: Username, password, and domain for Windows environments that use Active Directory authentication, commonly used for credential injection when connecting to an RDP target -- **SSH private key**: SSH private key authentication -- **SSH certificate**: SSH certificate-based authentication -- **JSON**: Flexible JSON-based credential storage - -## Next steps - -The following pages provide steps to configure static credentials using both a static credential store and a Vault credential store. You can also configure targets for either credential brokering or credential injection workflows. - -- [Create a static credential store](/boundary/docs/credentials/static-cred-boundary) -- [Create a Vault credential store](/boundary/docs/credentials/static-cred-vault) -- [Configure targets with credential brokering](/boundary/docs/credentials/configure-credential-brokering) -- [Configure targets with credential injection](/boundary/docs/credentials/configure-credential-injection) - -To learn more about what is supported for the RDP credential injection beta and to view known issues, refer to [RDP credential injection compatibility](/boundary/docs/credentials/rdp-testing-and-compatibility-matrix). diff --git a/website/content/docs/credentials/rdp-testing-and-compatibility-matrix.mdx b/website/content/docs/credentials/rdp-testing-and-compatibility-matrix.mdx deleted file mode 100644 index 688bd068f..000000000 --- a/website/content/docs/credentials/rdp-testing-and-compatibility-matrix.mdx +++ /dev/null @@ -1,208 +0,0 @@ ---- -layout: docs -page_title: RDP credential injection compatibility -description: >- - Learn about what is supported and understand known limitations for the beta version of the RDP credential injection feature. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# RDP credential injection compatibility - -@include 'alerts/beta.mdx' - -RDP credential injection is currently in **beta**. This feature is under active development and testing. - -**Important considerations:** - -- The [compatibility matrix](#compatibility-status) below reflects currently tested configurations. -- Additional client/target combinations are being validated and will be added regularly. -- Some functionality may change before general availability. -- Please report any issues or untested combinations through [official support channels](https://support.hashicorp.com). -- [Create an issue](https://github.com/hashicorp/boundary/issues/new/choose) to send the Boundary team feedback about the beta. - -This documentation will be updated frequently as new combinations are tested and validated. - -**Key takeaways for the RDP credential injection beta:** - -- **Credential source:** The initial beta only supports static credentials from Boundary's built-in **static credential store** or Vault's Key Value store. -- **Supported authentication:** Only **Kerberos** and **NTLMv2** are supported. -- **Unsupported authentication:** Microsoft Entra ID, passwordless methods (Windows Hello, FIDO2), and Smart Cards are **not** supported. -- **Transparent sessions:** RDP transparent sessions on Windows clients require a custom port configuration due to a conflict with the default port `3389`. Refer to [Using transparent sessions with RDP on Windows](#using-transparent-sessions-with-rdp-on-windows) for two possible workarounds. -- **Initial connection:** Users must manually accept a self-signed certificate on their first connection to a target. Some clients prompt users for a username and password even when credential injection is in use, but Boundary ignores the entries. You can enter anything and Boundary uses the configured injected credential to authenticate to the target. -- **Important configuration note:** If you use the Windows RDP client and set the `connection limit` to `1` for RDP targets it will cause all RDP connections to fail. You can leave the connection limit unset or configure a limit of 2 or higher to account for the multiple connections used by the RDP client. - -## How credential injection works - -When users connect to RDP targets, Boundary can automatically inject credentials, preventing exposure to the end-user. This is the most secure workflow, providing a passwordless experience within the supported authentication frameworks. - -Boundary retrieves credentials from a supported credential store and injects them directly into the RDP session on behalf of the user. **The initial beta release only supports static credentials from Boundary's built-in static credential store or Vault's KV store.** Support for the Vault LDAP Secrets Engine, is planned as a fast-follow release. - -Refer to [Credential injection](/boundary/docs/concepts/credential-management#credential-injection) for more information about how credential injection works in Boundary. - -### Supported authentication methods - -As of Boundary 0.20, we **only** support the following traditional authentication methods for RDP targets: - -1. **Kerberos authentication** - The primary method for domain-joined Windows servers. -1. **NTLMv2 authentication** - Used for standalone servers or as a fallback. - - - -Modern and cloud-based authentication methods are **not supported** at this time. This includes, but is not limited to: - -- Microsoft Entra ID (formerly Azure Active Directory) -- Passwordless methods (Windows Hello, FIDO2 keys) -- Certificate-based authentication (including Smart Cards) - - - -## Known limitations - -The following issues may affect RDP connections, particularly when using transparent sessions: - -- **Concurrent transparent sessions hanging:** Attempting to launch more than one concurrent transparent session for RDP will cause the Boundary desktop client to hang silently. You must fully terminate the first session before starting another. -- **Improper session termination:** Closing the RDP client window does not always properly terminate the underlying Boundary session. This can prevent new connections and contributes to the hanging issue described above. -- **Transparent sessions on Windows:** Transparent sessions for RDP do not work out-of-the-box on modern Windows clients (Windows 11+, Windows Server 2025) due to a port conflict. Refer to [Using transparent sessions with RDP on Windows](/boundary/docs/credentials/rdp-testing-and-compatibility-matrix#using-transparent-sessions-with-rdp-on-windows) for two possible workarounds. -- **Error during basic settings exchange:** When you connect to an RDP target using the built-in Windows Remote Desktop Connection app, it creates the following error: - - `rdp.handleProxy:error during basic settings exchange` - - The error has no impact on the connection, it is a known issue. - -## Configuration requirements - -Refer to the following sections for specific configuration requirements for the RDP credential injection beta. - -### Using transparent sessions with RDP on Windows - -Due to a port conflict with the Windows Remote Desktop Connection app on modern Windows operating systems (Windows 11+, Windows Server 2025), transparent sessions fail when you use the default port (`3389`) to establish an RDP connection. -The port conflict is an issue even if you enable Remote Desktop. -This issue prevents users from establishing transparent sessions by entering a target alias in their RDP client. - -To connect to an RDP target using a transparent session from a Windows client, you **must** use a custom port. Two primary workarounds are available: - -1. **Configure a default client port:** Set a custom port (e.g., `83389`) in the target's configuration within Boundary. The user must then connect by specifying this port in their RDP client (for example, `my-server:83389`). -1. **Use `.rdp` bookmark files:** Create and distribute an `.rdp` file that contains the full connection string, including the custom port for the localhost listener (for example, `full address:s:localhost:51129`). Bookmark files allow users to connect by simply opening the file. - -### Certificate handling - -Boundary generates self-signed certificates for each RDP target. When users first connect to a target, they must manually accept the certificate. This is a one-time action per target for most clients, though behavior varies: - -- **Windows clients** remember certificates across sessions. -- **macOS clients** require accepting certificates per alias or endpoint. -- **Custom listen addresses** generate certificate mismatch warnings. - -Future releases may support enterprise certificate authorities for trusted certificates. - -### Connection limits - -The Windows Remote Desktop Connection application consumes multiple connections when initiating a session. - -If you set the connection limit to `1` for RDP targets it will cause all RDP connections using this client to fail. You can leave the connection limit unset or configure a limit of 2 or higher to account for the multiple connections used by the RDP client. - -### Network configuration - -RDP credential injection has specific network requirements: - -- UDP transport is disabled. -- Server redirection is not supported. -- The maximum TLS version is 1.2. TLS 1.3 is incompatible with Windows Server 2025. - -### Client behavior - -Different RDP clients exhibit unique behaviors: - -**Windows Remote Desktop Connection:** -- Does not prompt for credentials when Boundary injects them. -- Requires manual certificate acceptance per endpoint. - -**macOS Windows App:** -- Prompts for credentials, but Boundary ignores the entries. Boundary uses the configured injected credential to authenticate to the target. -- Requires manual certificate acceptance per endpoint. - -## Compatibility status - -Refer to the following sections for information about which Windows versions the beta RDP credential injection feature is compatible with. - -The tables below use the following to indicate compatiblity: - -- **✅:** Tested and verified to be compatible. -- **Pending:** Validation is planned but not yet complete. - -### Windows Server 2025 - -| Client OS | Kerberos only | Kerberos + NTLMv2 (domain-joined worker) | Kerberos + NTLMv2 (non-domain worker) | -|-----------|:-------------:|:----------------------------------------:|:--------------------------------------:| -| Windows 11 | Pending | ✅ | Pending | -| Windows 10 | ✅ | Pending | Pending | -| macOS 15 | Pending | Pending | Pending | -| macOS 14 | Pending | Pending | Pending | -| macOS 13 | Pending | Pending | Pending | - -### Windows Server 2022 - -| Client OS | Kerberos only | Kerberos + NTLMv2 (domain-joined worker) | Kerberos + NTLMv2 (non-domain worker) | -|-----------|:-------------:|:----------------------------------------:|:--------------------------------------:| -| Windows 11 | ✅ | ✅ | ✅ | -| Windows 10 | ✅ | ✅ | ✅ | -| macOS 15 | Pending | ✅ | ✅ | -| macOS 14 | Pending | Pending | Pending | -| macOS 13 | Pending | Pending | Pending | - -### Windows Server 2019 - -| Client OS | Kerberos only | Kerberos + NTLMv2 (domain-joined worker) | Kerberos + NTLMv2 (non-domain worker) | -|-----------|:-------------:|:----------------------------------------:|:--------------------------------------:| -| Windows 11 | ✅ | ✅ | ✅ | -| Windows 10 | ✅ | ✅ | ✅ | -| macOS 15 | ✅ | ✅ | ✅ | -| macOS 14 | Pending | Pending | Pending | -| macOS 13 | Pending | Pending | Pending | - -### Windows Server 2016 - -| Client OS | Kerberos only | Kerberos + NTLMv2 (domain-joined worker) | Kerberos + NTLMv2 (non-domain worker) | -|-----------|:-------------:|:----------------------------------------:|:--------------------------------------:| -| Windows 11 | Pending | ✅ | ✅ | -| Windows 10 | ✅ | ✅ | Pending | -| macOS 15 | ✅ | ✅ | ✅ | -| macOS 14 | Pending | Pending | Pending | -| macOS 13 | Pending | Pending | Pending | - -## Quick troubleshooting and FAQ - -**Q: Can I use credentials from my Vault LDAP engine or Active Directory for this feature?** - -A: Not yet. The initial beta only supports credentials stored in Boundary's static credential store and the Vault K/V store. Support for the Vault LDAP Secrets Engine is a high-priority addition planned for a fast-follow release. - -**Q: Why am I getting a certificate warning when I connect?** - -A: This is expected behavior. Boundary generates a self-signed certificate for each RDP target. You must accept this certificate on your first connection. - -**Q: My connection is failing immediately. What should I check first?** - -A: Check the `connection limit` on your target. It cannot be set to `1`. Leave it unset, or set it to 2 or higher. - -**Q: Why can't I connect to my RDP transparent session on Windows by just using its name?** - -A: Modern Windows versions block local applications from using the default RDP port (3389). You must use a workaround, such as connecting to a custom port or using a pre-configured `.rdp` file. Refer to [Using transparent sessions with RDP on Windows](#using-transparent-sessions-with-rdp-on-windows). - -**Q: My desktop client hung after I tried to open a second RDP session. What do I do?** - -A: This is a known issue. The client currently does not support more than one concurrent RDP transparent session. You must ensure your first session is completely terminated before starting a new one. - -**Q: Does this work with servers that require Entra ID login?** - -A: No. At this time, only servers using traditional Kerberos or NTLMv2 authentication are supported. - -**Q: The macOS Windows App is asking for a password. Is injection not working?** - -A: This is a known behavior of the macOS Windows App. You can leave the password field blank and proceed; Boundary will still inject the correct credentials in the background. - -## More information - -For more information about how Boundary manages credentials, refer to [Credentials in Boundary](/boundary/docs/credentials). diff --git a/website/content/docs/credentials/static-cred-boundary.mdx b/website/content/docs/credentials/static-cred-boundary.mdx deleted file mode 100644 index c1178da9e..000000000 --- a/website/content/docs/credentials/static-cred-boundary.mdx +++ /dev/null @@ -1,131 +0,0 @@ ---- -layout: docs -page_title: Manage static credentials with Boundary -description: >- - Create a static credential store to manage static credentials. Credential stores let you configure targets for credential brokering or injection. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Create a static credential store - -You can manage credentials in Boundary using [credential stores](/boundary/docs/domain-model/credential-stores), which are resources that store credentials for various targets. - -Static credential stores are built into Boundary and store static credentials like username password, username password domain, or keypairs. - -## Requirements - -Ensure that you have an [Org scope and a project scope](/boundary/docs/commands/scopes/create) created in your Boundary instance. - -## Configuration - -Complete the following steps to create a static credential store: - - - - -1. Log in to Boundary -2. Select **Orgs** on the navigation pane. -3. Select your desired org. -4. Select the project to which your static credential store should belong. -5. Select **Credential Stores** on the navigation pane. -6. Select **New Credential Store**. -7. Provide a name for your credential store and select type **Static**. -8. Click **Save**. You now have a static credential store where you can store static credentials. -9. (Optional) If you have a static credential, you can add it into the static credential store. Static credential types can be a username password, username password domain, username private key, or JSON blob. - - a. In your static credential store, click on the **Credentials** tab. - - b. Click **Manage**, and then select **New Credential** from the pull down menu. - - c. Complete the following fields to add static credentials to your static credential store: - - Name (optional) - The name is optional, but if you enter a name, it must be unique. - - Description (optional) - An optional description of the credential for identification purposes. - - Type - The type of static credential you want to add. Select between username password, username keypair, username password domain, or a JSON blob. - - Credential data - Depending on the credential type selected, enter the credential data. - - d. Click **Save**. - - - - -1. Log into Boundary. - - ```shell-session - $ boundary authenticate - Please enter the login name (it will be hidden): - Please enter the password (it will be hidden): - ``` - -2. Create a credential store and provide a name and project ID. - - ```shell-session - $ boundary credential-stores create static \ - -scope-id p_VHAKTCEKcU \ - -name "my-static-credential-store" - ``` - -3. (Optional) If you have a static credential, you can add it into the static credential store using one of the following commands, based on the type of credential. Static credential types can be a username password, username password domain, username and keypair, or JSON blob. - - - For username password credentials: - - ```shell-session - $ boundary credentials create username-password \ - -name "test-credentials" \ - -credential-store-id csst_O8utI0b3XC \ - -username \ - -password env:// - ``` - - To prevent credentials from being logged in the terminal, you must place passwords in an environment variable or file, and pass them to the `-password` option using the `env://` or `file://` syntax. - - - For username and private key credentials: - - ```shell-session - $ boundary credentials create ssh-private-key \ - -credential-store-id csst_O8utI0b3XC \ - -username \ - -private-key file:// - ``` - - To prevent credentials from being logged in the terminal, you must place SSH private keys in an environment variable or file, and pass them to the `-private-key` option using the `env://` or `file://` syntax. - - - For JSON blob credentials: - - ```shell-session - $ boundary credentials create json \ - -credential-store-id csst_O8utI0b3XC \ - -object file:// - ``` - - To prevent credentials from being logged in the terminal, you must place the JSON map value in a file, and pass it to the `-object` option using the `file://` syntax. - - - For username-password-domain credentials: - - ```shell-session - $ boundary credentials create username-password-domain \ - -name "ad-admin-credentials" \ - -credential-store-id csst_O8utI0b3XC \ - -username \ - -password env:// \ - -domain - ``` - - To prevent credentials from being logged in the terminal, you must place passwords in an environment variable or file, and pass them to the `-password` option using the `env://` or `file://` syntax. - - - - -## Next steps - -Once you have created a credential store, you can configure targets for credential brokering or credential injection. -When you use credential brokering, Boundary centrally manages credentials and returns them to the user when they attempt to connect to a target. -Credential injection requires HCP Boundary or Boundary Enterprise, and it provides end users with a passwordless experience when they connect to targets. - -- [Configure a target for credential brokering](/boundary/docs/credentials/configure-credential-brokering) -- [Configure a target for credential injection](/boundary/docs/credentials/configure-credential-injection) - -To learn more about what is supported for the RDP credential injection beta and to view known issues, refer to [RDP credential injection compatibility](/boundary/docs/credentials/rdp-testing-and-compatibility-matrix). \ No newline at end of file diff --git a/website/content/docs/credentials/static-cred-vault.mdx b/website/content/docs/credentials/static-cred-vault.mdx deleted file mode 100644 index 200235e45..000000000 --- a/website/content/docs/credentials/static-cred-vault.mdx +++ /dev/null @@ -1,114 +0,0 @@ ---- -layout: docs -page_title: Manage static credentials with Vault -description: >- - Create a Vault credential store to manage credentials. Credential stores let you configure targets for credential brokering or credential injection. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Create a Vault credential store - -You can manage credentials in Boundary using [credential stores](/boundary/docs/domain-model/credential-stores), which are resources that store credentials for various targets. -Vault credential stores point to a HashiCorp Vault instance, which provides capabilities like generating short-lived dynamic credentials. - -## Requirements - -- You must have a Vault instance available with an address or URL that is reachable from your Boundary instance. This will be used to connect Boundary to Vault. -- You must have static credentials stored in Vault’s key/value secrets engine. Examples of static credential types include username password or username and SSH private key. -- You must have a Vault token for Boundary to authenticate and access your static credentials. - -## Configuration - -Complete the following steps to create a Vault credential store: - - - - -1. Log in to Boundary. -1. Select **Orgs** on the navigation pane. -1. Select your desired org. -1. Select the project to which your static credential store should belong. -1. Select **Credential Stores** on the navigation pane. -1. Select **New Credential Store**. -1. Provide a name for your credential store and select type **Vault**. -1. Complete the fields related to your Vault instance: - - **Address** - The address of your Vault instance. - - **Worker Filter** (optional) - If your Vault instance does not have a publicly accessible address and instead is proxied through a Boundary worker, enter the worker filter. This should be a boolean expression. To generate a worker filter in the correct format, toggle the **Show filter generator** switch. Refer to the examples in the [Worker tags](/boundary/docs/workers/worker-tags) documentation. - - **Token** - Token provided by Vault that provides access to the static credentials within your Vault instance. - - **Namespace** (optional) - Vault namespace. Requires Vault Enterprise. - - **TLS Server Name** (optional) - Name to use as the SNI host if you connect to Vault via TLS. - - **Client Certificate** (optional) - A PEM-encoded client certificate to use for TLS authentication to the Vault server. - - **Client Certificate key** (optional) - A PEM-encoded private key that matches the client certificate from client certificate. - - **CA Certificate** (optional) - A PEM-encoded CA certificate to verify the Vault server's TLS certificate. - -1. Click **Save**. You now have a static credential store where you can store static credentials. -1. In your newly created Vault credential store, click on the **Credential Libraries** tab. -1. Click **Manage**, and then select **New Credential Library** in the pull down menu. -1. Complete the fields related to the static credentials stored in your Vault instance: - - **Name** (optional) - The name is optional, but if you enter a name, it must be unique within the parent credential store. - - **Type** - Select **Generic Secrets**. - - **Vault Path** - Enter the path for the location of your static credentials stored in Vault. Boundary uses this field to locate the static credentials inside Vault. - - **Credential Type** - Select the appropriate credential type that matches the static credential stored in Vault. - - **HTTP Method** - Select **GET**. -1. Click **Save**. - - - - -1. Log into Boundary. - - ```shell-session - $ boundary authenticate - Please enter the login name (it will be hidden): - Please enter the password (it will be hidden): - ``` - -1. Create a credential store and provide a name and project ID. - - ```shell-session - $ boundary credential-stores create vault \ - -scope-id p_VHAKTCEKcU \ - -name "vault-cred-store-test" - ``` - -1. Create a credential library using one of the following commands, based on the type of credential. - - - For username password credentials: - - ```shell-session - $ boundary credential-libraries create vault-generic \ - -name "vault-cred-lib-test" \ - -credential-store-id csvlt_Xqa6V6QwfM \ - -credential-type username_password \ - -vault-path "path/to/vault/credentials" - ``` - - - For username private key credentials: - - ```shell-session - $ boundary credential-libraries create vault-generic \ - -name "vault-cred-lib-test" \ - -credential-store-id csvlt_Xqa6V6QwfM \ - -credential-type ssh_private_key \ - -vault-path "path/to/vault/credentials" - ``` - - - - -## More information - -Refer to [Filtering and listing resources](/boundary/docs/filtering) for more information about Boundary's filter syntax and best practices. - -## Next steps - -Once you have created a credential store, you can configure targets for credential brokering or credential injection. -When you use credential brokering, Boundary centrally manages credentials and returns them to the user when they attempt to connect to a target. -Credential injection requires HCP Boundary or Boundary Enterprise, and it provides end users with a passwordless experience when they connect to targets. - -- [Configure a target for credential brokering](/boundary/docs/credentials/configure-credential-brokering) -- [Configure a target for credential injection](/boundary/docs/credentials/configure-credential-brokering) \ No newline at end of file diff --git a/website/content/docs/deploy/self-managed/configure-controllers.mdx b/website/content/docs/deploy/self-managed/configure-controllers.mdx deleted file mode 100644 index 4a534e264..000000000 --- a/website/content/docs/deploy/self-managed/configure-controllers.mdx +++ /dev/null @@ -1,355 +0,0 @@ ---- -layout: docs -page_title: Configure controllers -description: >- - Configure Boundary controllers for a self-managed deployment, including TLS, KMS, and database parameters. Start the service, authenticate, and manage resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Configure controllers - -Refer to the following sections to configure your Boundary controllers. - -## Prepare TLS certificates - -HashiCorp recommends that the Boundary controller nodes handle TLS using PKI for user connections. -Further, we strongly recommend that you use certificates that an appropriate certificate authority (CA) generated and signed. - -To use TLS, you must have two files on each Boundary controller node. -You may have to create a new directory to store the certificate material at `/etc/boundary.d/tls`. -Place the files in the following paths: - -- `/etc/boundary.d/tls/boundary-cert.pem` - - Place the Boundary TLS certificate with a Common Name (CN) and Subject Alternate Name (SAN) that matches your planned primary DNS record in this path so that the Boundary controllers and any SANs can access it. - -- `/etc/boundary.d/tls/boundary-key.pem` - - Place the Boundary TLS certificate's private key in this path. - -If you do not generate unique TLS key material for each node, you should securely distribute the key material to each of the Boundary controller nodes. - -## Prepare KMS keys - -Boundary controllers require the two following different cryptographic keys: - -- **Root key**: The root KMS key acts as a KEK (Key Encrypting Key) for the scope-specific KEKs, which are also referred to as the scope's root keys. -When you create a scope, Boundary also creates the root KEK and the various DEKs (Data Encryption Keys). -It encrypts the DEKs using the scope's KEK, and then encrypts the KEK with the KMS key marked for the root purpose. -- **Recovery key**: You use the recovery KMS key to authenticate Boundary client rescue and recovery operation workflows. -The recovery key includes a nonce and creation time as an encrypted payload. -Boundary formats the payload as a token and sends it to the controller. -The time and nonce ensure that an adversary cannot replay a value, and also ensure that a client must individually authenticate each operation, so that revoking access to the KMS has an immediate result. - -The following keys are optional: - -- **Worker-auth key (Optional)**: The controller and worker share the worker-auth KMS key to authenticate a worker to the controller. -If a worker uses PKI authentication, this key is unnecessary. -- **BSR key (Optional)**: Session recording requires the BSR KMS key. -Boundary uses the BSR key for encrypting data and checking the integrity of recordings. -If you do not add a BSR key to your controller configuration, you receive an error when you try to enable session recording. - -There are other optional KMS keys that you can configure for different encryption scenarios. -These scenarios include Boundary worker PKI auth encryption and Boundary worker or controller configuration encryption. -Refer to [Data encryption in Boundary](/boundary/docs/secure/encryption/data-encryption) for more information. - - -There are two types of Boundary workers, distinguished by the method by which they authenticate with the Boundary controllers. -One worker uses a PKI exchange to authenticate with the controllers. The other uses a KMS key for authentication by both the worker and the controller. -You use the Worker-auth key listed above to enable KMS worker authentication. - - -HashiCorp strongly recommends that you use either Vault Transit or your cloud provider's key management system. -Refer to the [Vault Transit](/vault/docs/secrets/transit) documentation or your cloud provider's key management documentation for more information. - -After you create the keys in Vault or the key management system of your choice, you can prepare the PostgreSQL database. - -## Prepare the database - -Boundary manages its state and configuration in a Relational Database Management System (RDBMS), PostgreSQL. -You should create, set up, and make the PostgreSQL database accessible to the Boundary controller nodes before you configure the nodes. - -Refer to the [Database recommendations](/boundary/docs/architecture/system-requirements#database-recommendations) documentation for examples of cloud managed PostgreSQL databases. - -## Create the controller configuration - -Once you have configured the following, you can create the controller configuration: - -- At least three virtual machines with Boundary installed on them -- At least one TLS certificate and key to distribute to the virtual machines for TLS communication -- KMS keys to use for at least root and recovery operations -- A PostgreSQL database to manage configuration and state - -You must complete the following controller configuration for each of the Boundary controller nodes. - -### Base controller configuration - -The core required values for a Boundary controller configuration include the following: - -- `listener` blocks for `api`, `cluster`, and `ops` -- A `kms` block -- `disable_mlock` -- A `controller` block - -When you install Boundary from the HashiCorp Linux Repository, it installs some example configuration files under `/etc/boundary.d/`. -Run the following commands to rename the example configuration files: - -1. `sudo mv boundary.hcl boundary.hcl.old` -1. `sudo mv controller.hcl controller.hcl.old` -1. `sudo mv worker.hcl worker.hcl.old` - -HashiCorp recommends that you use either the `env://` or `file://` notation in the configuration files to securely provide secret configuration components to the Boundary controller binaries. -The following controller configuration example uses `env://` to declare the PostgreSQL connect strings as well as secure the AWS KMS configuration items. - -When you install the Boundary binary using a package manager, it includes a unit file that configures an environment file at `/etc/boundary.d/boundary.env`. -You can use this file to set the sensitive values used to configure the Boundary controllers and workers. -The following is an example of a configuration using this environment file: - - - -```shell-session -POSTGRESQL_CONNECTION_STRING=postgresql://boundary:boundary@postgres.yourdomain.com:5432/boundary -AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE -AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY -``` - - - - - -In the example above, the proper IAM roles and permissions for the given `AWS_ACCESS_KEY` and `AWS_SECRET_ACCESS_KEY` must be in place so that Boundary can use them to access the different KMS keys. - - - -Next, populate the `controller.hcl` file with any relevant configuration information. -The following example configuration file is a good starting point for a production Boundary controller installation. -It defines the three `listener` blocks, two unique `kms` blocks that are specific to AWS (as an example), the `disable_mlock` value, and the `controller` block. - - - -```hcl -# disable memory from being swapped to disk -disable_mlock = true - -# API listener configuration block -listener "tcp" { - # Should be the address of the NIC that the controller server will be reached on - # Use 0.0.0.0 to listen on all interfaces - address = "0.0.0.0:9200" - # The purpose of this listener block - purpose = "api" - - # TLS Configuration - tls_disable = false - tls_cert_file = "/etc/boundary.d/tls/boundary-cert.pem" - tls_key_file = "/etc/boundary.d/tls/boundary-key.pem" - - # Uncomment to enable CORS for the Admin UI. Be sure to set the allowed origin(s) - # to appropriate values. - #cors_enabled = true - #cors_allowed_origins = ["https://yourcorp.yourdomain.com", "serve://boundary"] -} - -# Data-plane listener configuration block (used for worker coordination) -listener "tcp" { - # Should be the IP of the NIC that the worker will connect on - address = "0.0.0.0:9201" - # The purpose of this listener - purpose = "cluster" -} - -# Ops listener for operations like health checks for load balancers -listener "tcp" { - # Should be the address of the interface where your external systems' - # (eg: Load-Balancer and metrics collectors) will connect on. - address = "0.0.0.0:9203" - # The purpose of this listener block - purpose = "ops" - - tls_disable = false - tls_cert_file = "/etc/boundary.d/tls/boundary-cert.pem" - tls_key_file = "/etc/boundary.d/tls/boundary-key.pem" -} - -# Controller configuration block -controller { - # This name attr must be unique across all controller instances if running in HA mode - name = "boundary-controller-1" - description = "Boundary controller number one" - - # This is the public hostname or IP where the workers can reach the - # controller. This should typically be a load balancer address - public_cluster_addr = "example-cluster-lb.example.com" - - # Enterprise license file, can also be the raw value or env:// value - license = "file:///path/to/license/file.hclic" - - # After receiving a shutdown signal, Boundary will wait 10s before initiating the shutdown process. - graceful_shutdown_wait_duration = "10s" - - # Database URL for postgres. This is set in boundary.env and - #consumed via the “env://” notation. - database { - url = "env://POSTGRESQL_CONNECTION_STRING" - } -} - -# Events (logging) configuration. This -# configures logging for ALL events to both -# stderr and a file at /var/log/boundary/controller.log -events { - audit_enabled = true - sysevents_enabled = true - observations_enable = true - sink "stderr" { - name = "all-events" - description = "All events sent to stderr" - event_types = ["*"] - format = "cloudevents-json" - } - sink { - name = "file-sink" - description = "All events sent to a file" - event_types = ["*"] - format = "cloudevents-json" - file { - path = "/var/log/boundary" - file_name = "controller.log" - } - audit_config { - audit_filter_overrides { - sensitive = "redact" - secret = "redact" - } - } - } -} - -# Root KMS Key (managed by AWS KMS in this example) -# Keep in mind that sensitive values are provided via ENV VARS -# in this example, such as access_key and secret_key -kms "awskms" { - purpose = "root" - region = "us-east-1" - kms_key_id = "19ec80b0-dfdd-4d97-8164-c6examplekey" - endpoint = "https://vpce-0e1bb1852241f8cc6-pzi0do8n.kms.us-east-1.vpce.amazonaws.com" -} - -# Recovery KMS Key -kms "awskms" { - purpose = "recovery" - region = "us-east-1" - kms_key_id = "19ec80b0-dfdd-4d97-8164-c6examplekey2" - endpoint = "https://vpce-0e1bb1852241f8cc6-pzi0do8n.kms.us-east-1.vpce.amazonaws.com" -} - -# Worker-Auth KMS Key (optional, only needed if you use -# KMS authenticated workers) -kms "awskms" { - purpose = "worker-auth" - region = "us-east-1" - kms_key_id = "19ec80b0-dfdd-4d97-8164-c6examplekey3" - endpoint = "https://vpce-0e1bb1852241f8cc6-pzi0do8n.kms.us-east-1.vpce.amazonaws.com" -} - -# BSR KMS Key (optional, only needed if you use the -# session recording feature) -kms "awskms" { - purpose = "bsr" - region = "us-east-1" - kms_key_id = "19ec80b0-dfdd-4d97-8164-c6examplekey4" - endpoint = "https://vpce-0e1bb1852241f8cc6-pzi0do8n.kms.us-east-1.vpce.amazonaws.com" -} -``` - - -Refer to the list below for explanations of the parameters used in the example above: - -- `disable mlock (bool: false)` - Disables the server from executing the `mlock` syscall, which prevents memory swap to the disk. -Preventing memory swap is fine for local development and testing. -However, HashiCorp does not recommend using it for production unless the systems running Boundary use encrypted swap or do not use swap at all. -Boundary only supports memory locking on UNIX-like systems that support `mlock()` syscall like Linux and FreeBSD. - - On Linux, to give the Boundary executable the ability to use `mlock` syscall without running the process as root, run the following command: - - `sudo setcap cap_ipc_lock=+ep $(readlink -f $(which boundary))` - - If you use a Linux distribution with a modern version of systemd, you can add the following directive to the **"[Service]"** configuration section: - - `LimitMEMLOCK=infinity` - -- `listener` - Configures the listeners on which Boundary serves traffic (API cluster and proxy). -- `controller` - Configures the controller. -If present, `boundary server` starts a controller subprocess. -- `events` - Configures event-specific parameters. - - The example events configuration above is exhaustive and writes all events to both `stderr` and a file. - This configuration may or may not work for your organization's logging solution. - -- `kms` - Configures KMS blocks for [various purposes](/boundary/docs/secure/encryption/data-encryption). - - Refer to the links below for configuration information for the different cloud KMS blocks: - - - [AWS](/boundary/docs/configuration/kms/awskms) - - [Azure](/boundary/docs/configuration/kms/azurekeyvault) - - [GCP](/boundary/docs/configuration/kms/gcpckms) - - [OCI](/boundary/docs/configuration/kms/ocikms) - - [AliCloud](/boundary/docs/configuration/kms/alicloudkms) - - [Vault Transit](/boundary/docs/configuration/kms/transit) - -Refer to the documentation for additional [top-level configuration options](/boundary/docs/configuration) and additional [controller-specific options](/boundary/docs/configuration/controller). - -## Initialize the database - -Before you can start Boundary, you must initialize the database from one Boundary controller. -Initialization is a one-time operation that executes the required database migrations for the Boundary cluster to operate. - -```shell-session -boundary database init -config /etc/boundary.d/controller.hcl -``` - -Unless you configure it not to, Boundary automatically generates a number of resources to make getting started easier. It automatically generates default scopes, auth methods, user, account, and targets. These -resources, however, are not required. You can add the following flags to skip creating these initial resources: - -```shell-session -boundary database init \ - -skip-auth-method-creation \ - -skip-host-resources-creation \ - -skip-scopes-creation \ - -skip-target-creation \ - -config /etc/boundary.d/controller.hcl -``` - -Use the following command to view the help for additional initialization options: - -```shell-session -boundary database init -h -``` - -## Start the Boundary service - -When the configuration files are in place on each Boundary controller, you can proceed to enable and start the binary on each of the Boundary controller nodes using `systemd`. -Run the following commands to start the service: - -1. `sudo systemctl enable boundary` -1. `sudo systemctl start boundary` - -## Authenticate and manage resources - -Upon logging in to Boundary for the first time, HashiCorp recommends creating an admin user for the global and project level scopes to manage Boundary. -Creating an admin user allows you to configure targets within those scopes and manage them. - -HashiCorp recommends that you use the [KMS recovery workflow](/boundary/docs/deploy/self-managed/initialize#log-in-with-recovery-kms) to log in to Boundary for the first time. -Refer to [Creating your first login account](/boundary/docs/deploy/self-managed/initialize#create-your-first-login-account) to learn about setting up your first auth method, user, account, and role to log in to Boundary going forward without the recovery KMS workflow. - -## Next steps - -After you configure the controller, you should: - -1. [Deploy workers](/boundary/docs/deploy/self-managed/deploy-workers) -1. [Initialize Boundary](/boundary/docs/deploy/self-managed/initialize) -1. [Install the Boundary Clients](/boundary/docs/deploy/self-managed/install-clients) \ No newline at end of file diff --git a/website/content/docs/deploy/self-managed/deploy-workers.mdx b/website/content/docs/deploy/self-managed/deploy-workers.mdx deleted file mode 100644 index 0faed3efd..000000000 --- a/website/content/docs/deploy/self-managed/deploy-workers.mdx +++ /dev/null @@ -1,283 +0,0 @@ ---- -layout: docs -page_title: Deploy workers -description: >- - Configure Boundary workers for a self-managed deployment, including environment files and KMS keys. Set up ingress, intermediary, and egress roles for multi-hop. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Deploy workers - -Before you deploy workers, you should have completed the following steps: - -- Installed Boundary on at least three [controller nodes](/boundary/docs/deploy/self-managed/configure-controllers). -- Prepared or have three existing network boundaries: - - Public/DMZ network - - Intermediary network - - Private network -- Prepared three virtual machines for Boundary workers, one in each network boundary with the Boundary binary installed on it. - -In the following configuration files, there are common configuration components as well as some unique components depending on the role the Boundary worker performs. -There are three files, one for each worker in a unique network boundary. -Additionally, Boundary Enterprise supports a [multi-hop configuration](/boundary/docs/workers/multi-hop) in which the Boundary workers can serve one of three purposes: an ingress worker, an ingress/egress worker, or an egress worker. - -## Prepare the environment files - -HashiCorp recommends using either the `env://` or `file://` notation within the configuration files, to securely provide secret configuration components to the Boundary worker binaries. -The following configuration example uses `env://` to secure AWS KMS configuration items. - -When you install the Boundary binary using a package manager, it includes a unit file which configures an environment file at `/etc/boundar.d/boundary.env`. -You can use this file to set the sensitive values that are used to configure the Boundary workers. -The following file is an example of how this environment file could be configured: - - - -```shell-session -AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE -AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY -``` - - - -In the example above, the proper IAM roles and permissions for the given `AWS_ACCESS_KEY` and `AWS_SECRET_ACCESS_KEY` must be in place so that Boundary can use them to access the different KMS keys. - -## Prepare the worker KMS keys - -The worker-auth storage KMS key is used by a Worker for the encrypted storage of authentication keys. -This is recommended Workers using controller-led or worker-led methods. If it is not specified, the authentication keys are not encrypted on disk. -Optionally, if you deploy KMS authentication-driven Boundary workers, an additional KMS key must be generated to authenticate the Boundary worker with the controller. - -HashiCorp strongly recommends using the Key Management System (KMS) of the cloud provider where you deploy your Boundary workers. -Keep in mind that Boundary workers must have the correct level of permissions for interacting with the cloud provider's KMS. -Refer to your cloud provider's documentation, for more information. - -## Create the worker configurations - -After you create the requisite key or keys in the cloud provider of your choice, you can begin configuring the workers. - -The following configuration examples all employ the worker-led authorization flow. -For more information on configuring KMS authentication for Boundary workers, refer to the [KMS authentication configuration documenation](/boundary/docs/workers/registration#kms-configuration). - -If you use Boundary Enterprise, you can configure multiple workers to act in three different roles: ingress, intermediary, and egress. -For Community Edition, workers only serve one role, acting as both the point of ingress and egress. -Select your Boundary edition, and complete the following steps to configure workers. - - - - -For Boundary Enterprise, you can configure ingress, intermediary, and egress workers to take advantage of [multi-hop worker capabilities](/boundary/docs/workers#multi-hop-sessions). - -Note that "ingress," "intermediary," and "egress" are general ways to describe how the respective worker interacts with resources. -A worker can serve more than one of those roles at a time. -Refer to [Multi-hop sessions](/boundary/docs/workers/multi-hop) for more information. - -Complete the steps below to configure workers for Boundary Enterprise. - -### Ingress worker configuration - -@include '/workers/ingress-worker-config.mdx' - -### Intermediate worker configuration - -@include '/workers/intermediate-worker-config.mdx' - -### Egress worker configuration - -@include '/workers/egress-worker-config.mdx' - - - - -For the Community Edition of Boundary, you must configure a worker server that communicates with the controller and is responsible for storage-related tasks. - -Boundary Community Edition only supports egress workers. To configure workers for multi-hop sessions, check the Boundary Enterprise configuration. - -Complete the following steps to configure the worker. - -### Worker configuration - -@include '/workers/single-worker-config.mdx' - - - - - -## Start the Boundary service - -When the configuration files are in place on each Boundary controller, you can proceed to enable and start the binary on each of the Boundary worker nodes using `systemd`. -Run the following commands to start the service: - -1. `sudo systemctl enable boundary` -1. `sudo systemctl start boundary` - -## Adopt the workers (optional) - -If you use the workers as outlined above, you must adopt the Boundary workers. -Complete the following steps to adopt the workers: - - - - - -Complete the following steps to adopt the worker using the UI: - -1. Log in to Boundary as the admin user. - -1. Select **Workers** in the navigation pane. - -1. Click **New**. - -1. (Optional) You can use the workers page to construct the contents of the `worker.hcl` file, if you did not [create the configuration file](/boundary/docs/deploy/self-managed/deploy-workers#create-the-worker-configurations) as part of the installation process above. -Provide the following details, and Boundary constructs the worker configuration file for you: - - Boundary Cluster ID - - Worker Public Address - - Config file path - - Worker Tags - -1. Scroll to the bottom of the **New Worker** page, and paste the **Worker Auth Registration Request** key. -Boundary provides you with the **Worker Auth Registration Request** key in the CLI output when you start the worker. -You can also locate this value in the `auth_request_token` file. - -1. Click **Register Worker**. - -1. Click **Done**. - - The new worker appears on the **Workers** page. - -1. Repeat the registration process for any other workers, such as the intermediate and egress workers. - - - - - -Complete the following steps to adopt the worker using the CLI: - -1. Use the following command to ensure that the `BOUNDARY_ADDR` is set as an environment variable: - - ```hcl - $ export BOUNDARY_ADDR="https://c3a7a20a-f663-40f3-a8e3-1b2f69b3625.boundary.hashicorp.cloud" - ``` - -1. Log into the CLI as the admin user, providing the Auth Method ID, admin login name, and admin password when prompted. - - ```hcl - $ boundary authenticate password \ - -auth-method-id=ampw_KfLAjMS2CG \ - -login-name=admin - ``` - - Example: - - - - ```hcl - $ boundary authenticate password \ - -auth-method-id=ampw_KfLAjMS2CG \ - -login-name=admin - Please enter the password (it will be hidden): - - Authentication information: - Account ID: acctpw_r6crEm0FgM - Auth Method ID: ampw_KfLAjMS2CG - Expiration Time: Mon, 27 Jun 2022 22:03:28 MDT - User ID: u_ysJd0LXX9T - - The token was successfully stored in the chosen keyring and is not displayed here. - ``` - - - -1. Next, use the following command to export the **Worker Auth Request Token** value as an environment variable: - - ```shell-session - $ export WORKER_TOKEN= - ``` - - Boundary provides you with the **Worker Auth Registration Request** key in the CLI output when you start the worker. - You can also locate this value in the `auth_request_token` file. - - The token is used to issue a create worker request that authorizes the worker to Boundary and makes it available. - Currently worker creation is only supported for workers with an authorization token (worker-led and controller-led). - -1. Create a new worker using the worker-led registration method with the following command: - - ```shell-session - $ boundary workers create worker-led -worker-generated-auth-token=$WORKER_TOKEN - - Worker information: - Active Connection Count: 0 - Created Time: Fri, 03 Jan 2025 13:52:04 MST - ID: w_zLGjAbYx1h - Local Storage State: unknown - Type: pki - Updated Time: Fri, 03 Jan 2025 13:52:04 MST - Version: 1 - - Scope: - ID: global - Name: global - Type: global - - Authorized Actions: - no-op - read - update - delete - add-worker-tags - set-worker-tags - remove-worker-tags - ``` - - Confirm the worker registration and view its details by executing the following command and supplying the new worker's id: - - ```shell-session - $ boundary workers read -id w_zLGjAbYx1h - - Worker information: - Active Connection Count: 0 - Address: 127.0.0.1:9202 - Created Time: Fri, 03 Jan 2025 13:52:04 MST - ID: w_zLGjAbYx1h - Last Status Time: 2025-01-03 20:58:41.346537 +0000 UTC - Local Storage State: not configured - Release Version: Boundary v0.18.1+ent - Type: pki - Updated Time: Fri, 03 Jan 2025 13:58:41 MST - Version: 1 - - Scope: - ID: global - Name: global - Type: global - - Tags: - Configuration: - type: ["worker1" "upstream"] - Canonical: - type: ["upstream" "worker1"] - - Authorized Actions: - add-worker-tags - set-worker-tags - remove-worker-tags - no-op - read - update - delete - ``` - -1. Repeat the registration process for any other workers, such as the intermediate and egress workers. - - - - -## Next steps - -After you configure workers, you should: - -1. [Initialize Boundary](/boundary/docs/deploy/self-managed/initialize) -1. [Install the Boundary Clients](/boundary/docs/deploy/self-managed/install-clients) \ No newline at end of file diff --git a/website/content/docs/deploy/self-managed/index.mdx b/website/content/docs/deploy/self-managed/index.mdx deleted file mode 100644 index cbdc1db50..000000000 --- a/website/content/docs/deploy/self-managed/index.mdx +++ /dev/null @@ -1,56 +0,0 @@ ---- -layout: docs -page_title: Deploy Boundary in a self-managed environment -description: >- - Discover resources for deploying a self-managed version of Boundary Enterprise or Boundary Community Edition. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Deploy Boundary in a self-managed environment - -To deploy a self-managed Boundary environment you should: - -1. Install the Boundary binary -1. Deploy and configure Boundary controllers and workers -1. Install end-user clients - -This guide outlines the required steps to manually install and configure a -single self-managed HashiCorp Boundary cluster as defined in the Recommended -architecture topic. -It assumes you install Boundary on virtual machines (VMs) or bare-metal servers -running a Debian or Red Hat-based Linux distribution. - -To deploy HCP Boundary instead, refer to the [Deploy and log in](/boundary/docs/hcp/get-started/deploy-and-login) in the HCP Boundary Get started documentation. - -This document includes general guidance as well as specific recommendations for -popular cloud infrastructure platforms. These recommendations have also been -encoded into official Terraform reference architectures for -[AWS](https://github.com/hashicorp/boundary-reference-architecture/tree/main/deployment/aws), -[Azure](https://github.com/hashicorp/boundary-reference-architecture/tree/main/deployment/azure), -and -[GCP](https://github.com/hashicorp/boundary-reference-architecture/tree/main/deployment/gcp). - -## More information - -Before you begin, you may want to review the following information about Boundary's architecture and system requirements: - -- [System requirements](/boundary/docs/architecture/system-requirements) -- [Recommended architecture](/boundary/docs/architecture/recommended-architecture) -- [Fault tolerance](/boundary/docs/architecture/fault-tolerance) -- [High availability](/boundary/docs/architecture/high-availability) - -## Next steps - -Refer to the following topics to deploy your self-managed environment: - -1. [Install Boundary](/boundary/docs/deploy/self-managed/install) -1. [Configure controllers](/boundary/docs/deploy/self-managed/configure-controllers) -1. [Deploy workers](/boundary/docs/deploy/self-managed/deploy-workers) -1. [Initialize Boundary](/boundary/docs/deploy/self-managed/initialize) -1. [Install Boundary clients](/boundary/docs/deploy/self-managed/install-clients) - -To configure Boundary resources using Terraform, refer to [Terraform patterns](/boundary/docs/deploy/terraform-patterns). \ No newline at end of file diff --git a/website/content/docs/deploy/self-managed/initialize.mdx b/website/content/docs/deploy/self-managed/initialize.mdx deleted file mode 100644 index 285f1ff6f..000000000 --- a/website/content/docs/deploy/self-managed/initialize.mdx +++ /dev/null @@ -1,473 +0,0 @@ ---- -layout: docs -page_title: Initialize Boundary -description: >- - Initialize new Boundary self-managed installations. Log in with the recovery KMS to create initial scope, auth method, login account, user, and role resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Initialize Boundary - -This document describes how to access Boundary for the first time and create the necessary resources to log in as a -user. - -You can also initialize and manage Boundary using Terraform. Refer to the [Terraform patterns](/boundary/docs/deploy/terraform-patterns) page to learn more. - -## Requirements - -Before you initialize Boundary, you should have [initialized a database](/boundary/docs/deploy/self-managed/configure-controllers#initialize-the-database). - -## Log in with recovery KMS - -To access a new Boundary instance for the first time, you must use the recovery KMS defined in the -controller configuration file. The following example represents a configuration file that uses hard-coded AEAD keys: - - - -In a production environment, HashiCorp recommends that you use a cloud provider's KMS such as [AWS KMS](/boundary/docs/configuration/kms/awskms) -to manage the keys Boundary uses to encrypt sensitive information. - - - -```hcl - -kms "aead" { - purpose = "root" - aead_type = "aes-gcm" - key = "sP1fnF5Xz85RrXyELHFeZg9Ad2qt4Z4bgNHVGtD6ung=" - key_id = "global_root" -} - -kms "aead" { - purpose = "worker-auth" - aead_type = "aes-gcm" - key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ=" - key_id = "global_worker-auth" -} - -kms "aead" { - purpose = "recovery" - aead_type = "aes-gcm" - key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ=" - key_id = "global_recovery" -} - -``` - -The KMS with the `recovery` purpose is used to "recover" Boundary, allowing you to authenticate to Boundary and manage -it as a super user. It also allows you to authenticate from the CLI or from Terraform to manage Boundary -without any generated resources. - -To authenticate to Boundary using the recovery KMS workflow: - - - - - -To use the recovery workflow on the CLI, you must pass the `-recovery-config ` flag or set the environment -variable for `BOUNDARY_RECOVERY_CONFIG` for every command ran. Authentication takes place for every command -ran when using the recovery workflow. The `boundary authenticate` command does not apply when you use the recovery KMS. - -```shell-session -$ cat << EOF > /tmp/recovery.hcl -kms "aead" { - purpose = "recovery" - aead_type = "aes-gcm" - key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ=" - key_id = "global_recovery" -} -EOF - -# Example command -$ boundary users create -recovery-config /tmp/recovery.hcl -... -``` - - - - - -To configure your provider to use the recovery KMS workflow, provide the KMS block as the value for -`recovery_kms_hcl`: - -```hcl -provider "boundary" { - addr = "https://boundary.mycorp.com:9200" - recovery_kms_hcl = < - - -## Create your first login account - -This section covers how to configure your first auth method, user, account, and role to log in to Boundary without -the recovery KMS workflow. In this example, we are going to make an admin user for the global and project level -scopes we create. This will allow our user to configure targets within those scopes and manage them. - -### Create org and project scopes - -First, create an org and project scope and skip creating an administrator and admin role for each scope. We are going to -specify a role for managing these scopes by selected users in a later step. - - - - - -```shell-session -$ boundary scopes create -name 'org' -scope-id 'global' \ - -recovery-config /tmp/recovery.hcl \ - -skip-admin-role-creation \ - -skip-default-role-creation - - -$ boundary scopes create -name 'project' -scope-id \ - -recovery-config /tmp/recovery.hcl \ - -skip-admin-role-creation \ - -skip-default-role-creation - -``` - - - - - -```hcl -resource "boundary_scope" "org" { - scope_id = "global" - name = "organization" - description = "Organization scope" - - auto_create_admin_role = false - auto_create_default_role = false -} - -resource "boundary_scope" "project" { - name = "project" - description = "My first project" - scope_id = boundary_scope.org.id - auto_create_admin_role = false - auto_create_default_role = false -} -``` - - - - - -### Create an auth method - -Create an auth method in the organization scope. - - - - - -```shell-session -$ boundary auth-methods create password \ - -recovery-config /tmp/recovery.hcl \ - -scope-id \ - -name 'my_method' \ - -description 'My password auth method' -``` - - - - - -```hcl -resource "boundary_auth_method" "password" { - name = "my_password_auth_method" - description = "Password auth method" - type = "password" - scope_id = boundary_scope.org.id -} -``` - - - - - -### Create a login account - -Create a login account for the auth method. - - - - - -```shell-session -$ boundary accounts create password \ - -recovery-config /tmp/recovery.hcl \ - -login-name "myuser" \ - -auth-method-id -``` - - - - - -```hcl -resource "boundary_account" "myuser" { - name = "myuser" - description = "User account for my user" - type = "password" - login_name = "myuser" - password = "foofoofoo" - auth_method_id = boundary_auth_method.password.id -} -``` - - - - - -### Create a user - -Create a user and associate the user with the login account created in the previous step. -This user will also be the principal in the role we create in the following step. - - - - - -```shell-session -$ boundary users create -scope-id \ - -recovery-config /tmp/recovery.hcl \ - -name "myuser" \ - -description "My user!" - -$ boundary users add-accounts \ - -recovery-config /tmp/recovery.hcl \ - -id \ - -account -``` - - - - - -```hcl -resource "boundary_user" "myuser" { - name = "myuser" - description = "My user!" - account_ids = [boundary_account.myuser.id] - scope_id = boundary_scope.org.id -} -``` - - - - - -### Create roles to manage scopes - -The following section describes the four baseline roles you must create to manage resources within the org and project -scopes that you created. These roles are similar to the roles Boundary automatically created for you if you did not skip generation using the `-skip-initial-login-role-creation` flag when you ran `boundary database init`. Declaring roles explicitly -allows you to manage them independently and fully within Terraform or via the CLI. In doing so, you can precisely define their access. - -The following example creates 4 roles: - -1. To allow anonymous (unauthenticated) users the ability to list scopes and auth methods in the global scope. -1. To allow anonymous (unauthenticated) users the ability to list scopes and auth methods in the organization scope. -1. To allow `myuser` user administration grants at the org scope. -1. To allow `myuser` user administration grants at the project scope. - -#### Anonymous listing role for global scope - - - - - -Assumes recovery key export from above steps is still set: - -```shell-session -# Create global anonymous listing role -$ boundary roles create -name 'global_anon_listing' \ - -recovery-config /tmp/recovery.hcl \ - -scope-id 'global' - -$ boundary roles add-grants -id \ - -recovery-config /tmp/recovery.hcl \ - -grant 'ids=*;type=auth-method;actions=list,authenticate' \ - -grant 'ids=*;type=scope;actions=list,no-op' \ - -grant 'ids={{.Account.Id}};actions=read,change-password' - -$ boundary roles add-principals -id \ - -recovery-config /tmp/recovery.hcl \ - -principal 'u_anon' -``` - - - - - -```hcl -resource "boundary_role" "global_anon_listing" { - scope_id = "global" - grant_strings = [ - "ids=*;type=auth-method;actions=list,authenticate", - "ids=*;type=scope;actions=list,no-op", - "ids={{.Account.Id}};actions=read,change-password" - ] - principal_ids = ["u_anon"] -} -``` - - - - - -#### Anonymous listing role for org scope - - - - - -Assumes recovery key export from above steps is still set: - -```shell-session -$ boundary roles create -name 'org_anon_listing' \ - -recovery-config /tmp/recovery.hcl \ - -scope-id - -$ boundary roles add-grants -id \ - -recovery-config /tmp/recovery.hcl \ - -grant 'ids=*;type=auth-method;actions=list,authenticate' \ - -grant 'type=scope;actions=list' \ - -grant 'ids={{.Account.Id}};actions=read,change-password' - -$ boundary roles add-principals -id \ - -recovery-config /tmp/recovery.hcl \ - -principal 'u_anon' -``` - - - - - -```hcl -resource "boundary_role" "org_anon_listing" { - scope_id = boundary_scope.org.id - grant_strings = [ - "ids=*;type=auth-method;actions=list,authenticate", - "type=scope;actions=list", - "ids={{.Account.Id}};actions=read,change-password" - ] - principal_ids = ["u_anon"] -} -``` - - - - - -#### Org admin role for myuser - - - - - -Assumes recovery key export from above steps is still set: - -```shell-session -$ boundary roles create -name 'org_admin' \ - -recovery-config /tmp/recovery.hcl \ - -scope-id 'global' - -$ boundary roles set-grant-scopes \ - -id \ - -grant-scope-id - -$ boundary roles add-grants -id \ - -recovery-config /tmp/recovery.hcl \ - -grant 'ids=*;type=*;actions=*' - -$ boundary roles add-principals -id \ - -recovery-config /tmp/recovery.hcl \ - -principal -``` - - - - - -```hcl -resource "boundary_role" "org_admin" { - scope_id = "global" - grant_scope_ids = [boundary_scope.org.id] - grant_strings = [ - "ids=*;type=*;actions=*" - ] - principal_ids = [boundary_user.myuser.id] -} -``` - - - - - -#### Project admin for myuser - - - - - -Assumes recovery key export from above steps is still set: - -```shell-session -$ boundary roles create -name 'project_admin' \ - -recovery-config /tmp/recovery.hcl \ - -scope-id \ - -grant-scope-id - -$ boundary roles add-grants -id \ - -recovery-config /tmp/recovery.hcl \ - -grant 'ids=*;type=*;actions=*' - -$ boundary roles add-principals -id \ - -recovery-config /tmp/recovery.hcl \ - -principal -``` - - - - - -```hcl -resource "boundary_role" "project_admin" { - scope_id = boundary_scope.org.id - grant_scope_ids = [boundary_scope.project.id] - grant_strings = [ - "ids=*;type=*;actions=*" - ] - principal_ids = [boundary_user.myuser.id] -} -``` - - - - - -### Log in as your new user - -```shell-session -boundary authenticate password \ - -auth-method-id -``` - -## Next steps - -After you initialize Boundary, you should [Install the Boundary Clients](/boundary/docs/deploy/self-managed/install-clients). \ No newline at end of file diff --git a/website/content/docs/deploy/self-managed/install-clients.mdx b/website/content/docs/deploy/self-managed/install-clients.mdx deleted file mode 100644 index 2b862b400..000000000 --- a/website/content/docs/deploy/self-managed/install-clients.mdx +++ /dev/null @@ -1,64 +0,0 @@ ---- -layout: docs -page_title: Install Boundary clients -description: >- - Install the Boundary CLI, Boundary Desktop Client app, or Boundary installer for Boundary Enterprise or Community Edition on Windows, MacOS, or Linux. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Install Boundary clients - -Boundary end users access infrastructure targets using the Boundary Desktop Client app or the Boundary CLI. Enterprise or HCP Boundary users can use transparent sessions to proxy traffic through the Boundary Client Agent HCP/ENT. - -This guide outlines the required steps to manually install and configure a Boundary client depending on which distribution of Boundary end users access. - -To learn about installing the Boundary binary when you deploy Boundary controllers or workers, refer to the [Install Boundary](/boundary/docs/deploy/self-managed/install) page. - -Select your Boundary distribution, and complete the steps to install the -correct clients: - - - - -@include 'alerts/enterprise-only.mdx' - -The Boundary installer bundles together the following components: - -- Boundary binary (CLI) -- Boundary Desktop Client app -- Boundary Client Agent HCP/ENT - -Download the appropriate Boundary installer for your Windows, MacOS, or Linux environment from the [Install Boundary](/boundary/install#installer) downloads page or the [releases](https://releases.hashicorp.com/boundary-installer) page. You can also download the components individually, but compatibility is not guaranteed. Refer to the [Supported versions policy](/boundary/docs/enterprise/supported-versions#control-plane-and-client-cli-compatibility) to learn more. - - - - Before you launch the Boundary installer, ensure that you have uninstalled all previous versions of the Boundary binary and Boundary Desktop Client app. - - - -To learn more about installing the Boundary CLI and Boundary Desktop Client app, refer to the [Get started with HCP Boundary](/boundary/tutorials/get-started-hcp) tutorials. - - - - -We recommend the following components for end users: - -- Boundary binary (CLI) -- Boundary Desktop Client app - -Download these components for your Windows, MacOS, or Linux environment from the [Install Boundary](/boundary/install) downloads page or the [HashiCorp releases](https://releases.hashicorp.com/) page. - - - -Client compatibility is not guaranteed. You should always ensure that your client is compatible with the version of the Boundary control plane you connect to. Refer to the [Supported versions policy](/boundary/docs/enterprise/supported-versions#control-plane-and-client-cli-compatibility) to learn more. - - - -To learn more about installing the Boundary CLI and Boundary Desktop Client app, refer to the [Get started with self-managed Boundary](/boundary/tutorials/get-started-community) tutorials. - - - \ No newline at end of file diff --git a/website/content/docs/deploy/self-managed/install.mdx b/website/content/docs/deploy/self-managed/install.mdx deleted file mode 100644 index b9c232dcb..000000000 --- a/website/content/docs/deploy/self-managed/install.mdx +++ /dev/null @@ -1,199 +0,0 @@ ---- -layout: docs -page_title: Install Boundary -description: >- - Deploy a self-managed version of Boundary Enterprise or Community Edition on Ubuntu/Debian, CentOS/RHEL, or Amazon Linux by installing the binary file. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Install Boundary - -Pre-built Boundary packages are available from the [HashiCorp Linux -Repository](https://www.hashicorp.com/blog/announcing-the-hashicorp-linux-repository). -In addition to installing the Boundary binary, the official package also -provides a systemd service unit, and a local `boundary` user account under which -the service runs. - - - -You must complete the following steps for each Boundary controller and worker -node that you want to deploy. The binary operates as either a worker or -controller, depending on the configuration that you generate for the -Boundary binary. - - - -The steps vary by Linux distribution. - -Select your distribution of Boundary, and complete the steps to install the -binary: - - - - - - - -1. Use the following command to add the HashiCorp GPC key as a trusted - package-signing key: - - ```shell-session - $ curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg - ``` -1. Add the official HashiCorp Linux repository: - - ```shell-session - $ echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list - ``` - -1. Update the package index: - - ```shell-session - $ sudo apt update - ``` - -1. Install Boundary Enterprise: - - ```shell-session - $ sudo apt install boundary-enterprise - ``` - - - - -1. Use the following command to install `yum-config-manager` to manage your - repositories: - - ```shell-session - $ sudo yum install -y yum-utils - ``` - -2. Add the official HashiCorp Linux repository: - - ```shell-session - $ sudo yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo - ``` - -3. Install Boundary Enterprise: - - ```shell-session - $ sudo yum -y install boundary-enterprise - ``` - - - - -1. Use the following command to install `yum-config-manager` to manage your - repositories: - - ```shell-session - $ sudo yum install -y yum-utils shadow-utils - ``` - -2. Add the official HashiCorp Linux repository: - - ```shell-session - $ sudo yum-config-manager --add-repo https://rpm.releases.hashicorp.com/AmazonLinux/hashicorp.repo - ``` - -3. Install Boundary Enterprise: - - ```shell-session - $ sudo yum -y install boundary-enterprise - ``` - - - - - - - - -1. Use the following command to add the HashiCorp GPC key as a trusted - package-signing key: - - ```shell-session - $ curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg - ``` -1. Add the official HashiCorp Linux repository: - - ```shell-session - $ echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list - ``` - -1. Update the package index: - - ```shell-session - $ sudo apt update - ``` - -1. Install Boundary Community Edition: - - ```shell-session - $ sudo apt install boundary - ``` - - - - -1. Use the following command to install `yum-config-manager` to manage your - repositories: - - ```shell-session - $ sudo yum install -y yum-utils - ``` - -2. Add the official HashiCorp Linux repository: - - ```shell-session - $ sudo yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo - ``` - -3. Install Boundary Community Edition: - - ```shell-session - $ sudo yum -y install boundary - ``` - - - - - -1. Use the following command to install `yum-config-manager` to manage your - repositories: - - ```shell-session - $ sudo yum install -y yum-utils shadow-utils - ``` - -2. Add the official HashiCorp Linux repository: - - ```shell-session - $ sudo yum-config-manager --add-repo https://rpm.releases.hashicorp.com/AmazonLinux/hashicorp.repo - ``` - -3. Install Boundary Community Edition: - - ```shell-session - $ sudo yum -y install boundary - ``` - - - - - - -You should install the binary on the controller and worker instances you configure to run in your Boundary environments. - -## Next steps - -After you install the binary, you should: - -1. [Configure controllers](/boundary/docs/deploy/self-managed/configure-controllers) -1. [Deploy workers](/boundary/docs/deploy/self-managed/deploy-workers) -1. [Initialize Boundary](/boundary/docs/deploy/self-managed/initialize) -1. [Install the Boundary Clients](/boundary/docs/deploy/self-managed/install-clients) \ No newline at end of file diff --git a/website/content/docs/deploy/self-managed/systemd.mdx b/website/content/docs/deploy/self-managed/systemd.mdx deleted file mode 100644 index c98e50e8c..000000000 --- a/website/content/docs/deploy/self-managed/systemd.mdx +++ /dev/null @@ -1,95 +0,0 @@ ---- -layout: docs -page_title: systemd Installation -description: |- - How to install Boundary under systemd on Linux ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Install Boundary under systemd - -This section covers how to install Boundary under the [systemd](https://systemd.io/) init system on modern Linux distributions. In this section, we'll cover an example of breaking out the controller and worker servers onto separate instances, though you can opt to run both on a single server. - -## Filesystem configuration - -`TYPE` below can be either `worker` or `controller` if you want to run them independently, e.g. for high availability. If you want to run combined nodes, modify as desired. - -1. `/etc/boundary.d/boundary-${TYPE}.hcl`: Configuration file for the boundary service. - -2. `/usr/local/bin/boundary`: The Boundary binary, which can be built from the [source](https://github.com/hashicorp/boundary) or downloaded from our [release page](/boundary/downloads). - -3. `/etc/systemd/system/boundary-${TYPE}.service`: Systemd unit file for the Boundary service. - -## User and group configuration - -We recommend running Boundary as a non-root user and using this user to manage the Boundary process running under systemd. The example init files here do exactly that. Our example install script below creates a user and group on Ubuntu or Debian-like systems. - -## systemd unit file - -``` -[Unit] -Description=${NAME} ${TYPE} - -[Service] -ExecStart=/usr/local/bin/${NAME} server -config /etc/${NAME}-${TYPE}.hcl -User=boundary -Group=boundary -LimitMEMLOCK=infinity -Capabilities=CAP_IPC_LOCK+ep -CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK - -[Install] -WantedBy=multi-user.target -``` - -## systemd all-in-one installation script - -Here's a simple install script that creates the `boundary` group and user, installs the -systemd unit file, and enables it at startup: - -``` -#!/bin/bash -# Installs the boundary as a service for systemd on linux -# Usage: ./install.sh - -TYPE=$1 -NAME=boundary - -sudo cat << EOF > /etc/systemd/system/${NAME}-${TYPE}.service -[Unit] -Description=${NAME} ${TYPE} - -[Service] -ExecStart=/usr/local/bin/${NAME} server -config /etc/${NAME}-${TYPE}.hcl -User=boundary -Group=boundary -LimitMEMLOCK=infinity -Capabilities=CAP_IPC_LOCK+ep -CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK - -[Install] -WantedBy=multi-user.target -EOF - -# Add the boundary system user and group to ensure we have a no-login -# user capable of owning and running Boundary -sudo adduser --system --group boundary || true -sudo chown boundary:boundary /etc/${NAME}-${TYPE}.hcl -sudo chown boundary:boundary /usr/local/bin/boundary - -# Make sure to initialize the DB before starting the service. This will result in -# a database already initialized warning if another controller or worker has done this -# already, making it a lazy, best effort initialization -if [ "${TYPE}" = "controller" ]; then - sudo /usr/local/bin/boundary database init -config /etc/${NAME}-${TYPE}.hcl || true -fi - -sudo chmod 664 /etc/systemd/system/${NAME}-${TYPE}.service -sudo systemctl daemon-reload -sudo systemctl enable ${NAME}-${TYPE} -sudo systemctl start ${NAME}-${TYPE} -``` diff --git a/website/content/docs/deploy/terraform-patterns/index.mdx b/website/content/docs/deploy/terraform-patterns/index.mdx deleted file mode 100644 index 6dfdc895c..000000000 --- a/website/content/docs/deploy/terraform-patterns/index.mdx +++ /dev/null @@ -1,69 +0,0 @@ ---- -layout: docs -page_title: Terraform patterns for Boundary -description: >- - Configure the Terraform Boundary provider so that you can use Terraform patterns to install and manage Boundary resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Terraform patterns for Boundary - -HashiCorp recommends using Terraform to deploy and maintain your Boundary environment. - -This following topics outline MVP (Minimum Viable Product) patterns to deploy and maintain Boundary using Terraform. - -## Requirements - -This document assumes the reader has: - -- An understanding of [Terraform](/terraform/docs) fundamentals. -- An existing Boundary installation. Refer to [Deploy Boundary in a self-managed environment](/boundary/docs/deploy/self-managed) to learn about deploying Boundary. - -## Terraform provider configuration - -To use Terraform to manage your Boundary environment, you must first configure the Terraform Boundary provider. - -The following code block provides an example of provider configuration using the userpass authentication method. -You can use any of the available Boundary authentication methods by specifying the appropriate `auth_method_id`. - -```hcl -terraform { - required_providers { - # Declare the provider - boundary = { - source = "hashicorp/boundary" - } - } -} - -# Configure the provider -# This example assumes that you have stored your Boundary cluster address and credentials in Terraform variables - -provider "boundary" { - addr = var.boundary_addr - auth_method_login_name = var.boundary_login_name - auth_method_password = var.boundary_password -} -``` -## More information - -Refer to the [Boundary provider documentation](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/) for more information on the available authentication methods. - -## Next steps - -The following pages provide examples and patterns for configuring Boundary resources with Terraform. - -If you are configuring Boundary resources for the first time, you may want to start by creating a scope. -You create scopes to partition resources and then assign ownership of those resources to users and groups. - -- [Scopes](/boundary/docs/deploy/terraform-patterns/terraform-scopes) -- [Users and auth methods](/boundary/docs/deploy/terraform-patterns/terraform-users-and-auth-methods) -- [Groups and role-based-access-control (RBAC)](/boundary/docs/deploy/terraform-patterns/terraform-groups-and-rbac) -- [Hosts and host management](/boundary/docs/deploy/terraform-patterns/terraform-hosts-and-host-management) -- [Credentials and credential stores](/boundary/docs/deploy/terraform-patterns/terraform-credentials-and-credential-stores) -- [Session recording](/boundary/docs/deploy/terraform-patterns/terraform-session-recording) -- [Targets](/boundary/docs/deploy/terraform-patterns/terraform-targets) \ No newline at end of file diff --git a/website/content/docs/deploy/terraform-patterns/terraform-credentials-and-credential-stores.mdx b/website/content/docs/deploy/terraform-patterns/terraform-credentials-and-credential-stores.mdx deleted file mode 100644 index 2d06da276..000000000 --- a/website/content/docs/deploy/terraform-patterns/terraform-credentials-and-credential-stores.mdx +++ /dev/null @@ -1,204 +0,0 @@ ---- -layout: docs -page_title: Terraform patterns for credentials and credential stores -description: >- - Use Terraform patterns to create and manage Boundary credentials and credential stores. Learn how to create static or Vault credential stores, add credentials. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Terraform patterns for credentials and credential stores - -Boundary supports multiple types of static credentials and Vault dynamic credentials. A credential store stores credentials for hosts. Static credential stores can hold username/passwords, JSON tokens, SSH key pairs, and SSH certificates. - -## Requirements - -This document assumes the reader has: - -- An understanding of [Terraform](/terraform/docs) fundamentals. -- An existing Boundary installation. Refer to [Deploy Boundary in a self-managed environment](/boundary/docs/deploy/self-managed) to learn about deploying Boundary. -- Configured the [Terraform Boundary provider](/boundary/docs/deploy/terraform-patterns/#terraform-provider-configuration). -- Configured [hosts](/boundary/docs/deploy/terraform-patterns/terraform-hosts-and-host-management) for any credential store you plan to create. - -## Static credential store configuration - -This example creates both a static credential store and a Vault credential store. - -```hcl -# Create a static credential store -resource "boundary_credential_store_static" "example" { - name = "example_static_credential_store" - description = "My first static credential store" - scope_id = boundary_scope.project.id -} - -# Create a Vault credential store -resource "boundary_credential_store_vault" "example" { - name = "vault_store" - description = "My first Vault credential store" - - # change to your Vault address - address = "http://127.0.0.1:8200" - - # Use a token that has rights to access the secrets in Vault that - # Boundary should use - token = var.vault_token - scope_id = boundary_scope.project.id -} -``` - -After you create a credential store, you can create one or more credentials in that store. - -### Add static credentials configuration - -This example creates static credentials that Boundary manages. The credentials are for a user named Carlos. - -```hcl -# Create a username/password combination -resource "boundary_credential_username_password" "carlos" { - name = "example_username_password" - description = "My first username password credential" - credential_store_id = boundary_credential_store_static.example.id - username = "Carlos" - password = "Carlos-password" -} - -# Create an ssh private key -resource "boundary_credential_ssh_private_key" "carlos_ssh" { - name = "example_ssh_private_key" - description = "My first ssh private key credential" - credential_store_id = boundary_credential_store_static.example.id - username = "carlos" - - # You can also load the private_key from a file using the Terraform file() function. - private_key = var.carlos_ssh_key - - # change to the passphrase of the private key, if required - private_key_passphrase = "optional-passphrase" -} - -# Create a JSON credential -resource "boundary_credential_json" "example" { - name = "example_json" - description = "My first json credential" - credential_store_id = boundary_credential_store_static.example.id - - # This points to the actual json file. You can also load this from a variable. - object = file("~/object.json") -} -``` - -## Vault credential store configuration - -For Vault credential stores, you can then create a credential library which distributes credentials of a specific access level from a Vault path. - -This example creates a credential library that reads secrets from a Vault path called `my/secret/foo`. - -```hcl - -resource "boundary_credential_library_vault" "foo" { - name = "foo" - description = "My first Vault credential library" - credential_store_id = boundary_credential_store_vault.example.id - - # Defines a valid Vault secret path - path = "my/secret/foo" - http_method = "GET" -} -``` - -### Translate key names from Vault configuration - -If you need to translate the key names from Vault into values expected by -Boundary, use this pattern. - -```hcl -resource "boundary_credential_library_vault" "baz" { - name = "baz" - description = "vault username password credential with mapping overrides" - credential_store_id = boundary_credential_store_vault.example.id - - # Defines the vault path that contains the secret you need - path = "my/secret/baz" - http_method = "GET" - credential_type = "username_password" - - # This maps the username and password field names in Vault to their names in Boundary - credential_mapping_overrides = { - password_attribute = "alternative_password_label" - username_attribute = "alternative_username_label" - } -} -``` - -### Use SSH certificates as credentials configuration - -To use SSH certificates as credentials, you use the `boundary_credential_vault_ssh_certificate` resource as shown in this example. - -```hcl -resource "boundary_credential_library_vault_ssh_certificate" "example" { - name = "foo" - description = "My first Vault SSH certificate credential library" - credential_store_id = boundary_credential_store_vault.foo.id - - # Declares the vault path that generates certificates - path = "ssh/sign/foo" - - # Defines the username - username = "foo" -} -``` -### Declare additional certificate attributes and extensions configuration - -This example declares additional certificate attributes and extensions. Note that you can enable extensions by declaring their names and setting their values to empty strings. - -```hcl -resource "boundary_credential_library_vault_ssh_certificate" "example" { - name = "baz" - description = "vault " - credential_store_id = boundary_credential_store_vault.foo.id - path = "ssh/issue/foo" # change to the Vault endpoint and role - username = "foo" - - # Defines additional optional certificate attributes - key_type = "rsa" - key_bits = 4096 - - extensions = { - permit-pty = "" - permit-X11-forwarding = "" - } - - critical_options = { - force-command = "/bin/some_script" - } -} -``` - -## More information - -For more information about the Boundary resources mentioned in this topic, refer to the domain model documentation: - -- [Credential stores](/boundary/docs/domain-model/credential-stores) -- [Credentials](/boundary/docs/domain-model/credentials) -- [Credential libraries](/boundary/docs/domain-model/credential-libraries) - -For more information about managing the following resources using Terraform, refer to the Boundary provider documentation: - -- Credentials - - [JSON](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/credential_json/) - - [SSH private keys](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/credential_ssh_private_key/) - - [Username/passwords](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/credential_username_password/) -- Credential libraries - - [Vault](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/credential_library_vault/) - - [Vault SSH certificates](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/credential_library_vault_ssh_certificate/) -- Credential stores - - [Static](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/credential_store_static/) - - [Vault](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/credential_store_vault/) - -## Next steps - -Once you have configured credentials and credential stores, you may want to enable [session recording](/boundary/docs/deploy/terraform-patterns/terraform-session-recording) for auditing purposes or configure [targets](/boundary/docs/deploy/terraform-patterns/terraform-targets) for your users to connect to. \ No newline at end of file diff --git a/website/content/docs/deploy/terraform-patterns/terraform-groups-and-rbac.mdx b/website/content/docs/deploy/terraform-patterns/terraform-groups-and-rbac.mdx deleted file mode 100644 index 78cc394b7..000000000 --- a/website/content/docs/deploy/terraform-patterns/terraform-groups-and-rbac.mdx +++ /dev/null @@ -1,105 +0,0 @@ ---- -layout: docs -page_title: Terraform patterns for groups and RBAC -description: >- - Use Terraform patterns to create and manage Boundary groups and role-based access control (RBAC). Learn how to add users to managed groups and assign roles. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Terraform patterns for groups and RBAC - -The following pattern demonstrates how to aggregate users into groups. - -Security best-practices recommend that you use Role-Based Access Control (RBAC) when you make authorization decisions. RBAC is a methodology in which you create a role that defines the actions that a user is allowed to take, and then assign one or more users to that role. - -In Boundary, you can assign users directly to a role, but a better pattern is to put users with equivalent access into groups. You can then assign groups to roles that grant least-privileges to your Boundary environment. - -## Requirements - -This document assumes the reader has: - -- An understanding of [Terraform](/terraform/docs) fundamentals. -- An existing Boundary installation. Refer to [Deploy Boundary in a self-managed environment](/boundary/docs/deploy/self-managed) to learn about deploying Boundary. -- Configured the [Terraform Boundary provider](/boundary/docs/deploy/terraform-patterns/#terraform-provider-configuration). -- Created Boundary [users and auth methods](/boundary/docs/deploy/terraform-patterns/terraform-users-and-auth-methods) to assign to the group you plan to create. - -## Group configuration - -This example adds users to the `Accounting` group. - -```hcl -# Add Jeff and Susmitha to the Accounting group -resource "boundary_group" "Accounting" { - name = "Accounting" - description = "The Accounting Department" - member_ids = [boundary_user.susmitha,id, boundary_user.jeff.id] - scope_id = boundary_scope.project.id -} -``` - -You are not required to populate groups manually, and can instead take advantage of the pre-existing groups provided by an identity provider. - -## Managed group configuration - -This example creates a managed group that is automatically populated based on an LDAP group called `Engineering`. - -```hcl -resource "boundary_managed_group_ldap" "Engineering" { - name = "Engineering" - description = "Engineering Managed LDAP Group" - auth_method_id = boundary_auth_method_ldap.forumsys_ldap.id - group_names = ["Engineering"] -} -``` - -HashiCorp recommends using managed groups whenever possible because it abstracts the management of group membership and simplifies Boundary administration. - -## Role configuration - -After you have created a group, you must assign one or more roles to that group to enable the group members to do useful work in Boundary. - -This pattern creates a role called `readonly` that include a grant -that allows the user read-only access to all Boundary resources. This example also associates the `Accounting` static group and the `Engineering` managed group with that role. - -```hcp -resource "boundary_role" "readonly" { - name = "readonly" - description = "A readonly role" - - # Assign Accounting and Engineering to this role - principal_ids = [boundary_group.accounting.id, boundary_managed_group_ldap.Engineering.id] - - # This is the grant string provides read-only access to all objects in the current scope. - grant_strings = ["ids=*;type=*;actions=read"] - scope_id = boundary_scope.project.id -} -``` - -## More information - -For more information about the Boundary resources mentioned in this topic, refer to the domain model documentation: - -- [Roles](/boundary/docs/domain-model/roles) -- [Groups](/boundary/docs/domain-model/groups) -- [Managed groups](/boundary/docs/domain-model/managed-groups) -- [Grants](/boundary/docs/rbac#grant-strings) - -For more information about managing the following resources using Terraform, refer to the Boundary provider documentation: - -- Accounts - - [Password accounts](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/account_password/) - - [LDAP accounts](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/account_ldap/) - - [OIDC accounts](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/account_oidc/) -- [Users](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/user/) -- [Groups](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/group/) -- [LDAP managed groups](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/managed_group_ldap/) -- [Roles](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/role/) - -## Next steps - -You may want to create [hosts and host sets](/boundary/docs/deploy/terraform-patterns/terraform-hosts-and-host-management) so that you can configure targets for your users to connect to. -Targets require an address or host, and credentials to connect to that host. \ No newline at end of file diff --git a/website/content/docs/deploy/terraform-patterns/terraform-hosts-and-host-management.mdx b/website/content/docs/deploy/terraform-patterns/terraform-hosts-and-host-management.mdx deleted file mode 100644 index 9eb196956..000000000 --- a/website/content/docs/deploy/terraform-patterns/terraform-hosts-and-host-management.mdx +++ /dev/null @@ -1,159 +0,0 @@ ---- -layout: docs -page_title: Terraform patterns for hosts and host management -description: >- - Use Terraform patterns to create and manage Boundary hosts and host catalogs. Learn how to add static or plugin-based hosts to static or dynamic host catalogs. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Terraform patterns for hosts and host management - -Before you can access a system, you must create a target. Targets require an address or host, and credentials to connect to that host. - -You can define target addresses directly to simplify access, but HashiCorp does not recommend that pattern at scale. -Instead, HashiCorp recommends adding hosts to a host set, and then attaching the host set to a target. - -## Requirements - -This document assumes the reader has: - -- An understanding of [Terraform](/terraform/docs) fundamentals. -- An existing Boundary installation. Refer to [Deploy Boundary in a self-managed environment](/boundary/docs/deploy/self-managed) to learn about deploying Boundary. -- Configured the [Terraform Boundary provider](/boundary/docs/deploy/terraform-patterns/#terraform-provider-configuration). - -## Static host catalog configuration - -The following example shows how to create a Boundary static host catalog and add a known host to that catalog. - -```hcl -# Create the host catalog -resource "boundary_host_catalog_static" "example" { - name = "My static catalog" - description = "My static host catalog" - scope_id = boundary_scope.project.id -} - -# Create the static host -resource "boundary_host" "example" { - type = "static" - name = "example_host" - description = "My first host" - address = "10.0.0.1" - - # Associate the host with the static host catalog - host_catalog_id = boundary_host_catalog.static.id -} -``` - -Static host catalogs increase your administrative burden and should only be used when necessary. - -## Dynamic host catalog configuration - -When you use cloud providers like Amazon Web Services (AWS) and Microsoft Azure, a better pattern is to use a plugin-based host catalog that automatically discovers hosts based on the filtering criteria for a given cloud. - -This example creates a dynamic host catalog that auto-discovers AWS hosts in `us-east-1`. - -```hcl -resource "boundary_host_catalog_plugin" "aws_example" { - name = "My AWS catalog" - description = "My AWS dynamic host catalog" - scope_id = boundary_scope.project.id - - # Delare the cloud plugin to use and the region to search for hosts - plugin_name = "aws" - attributes_json = jsonencode({ "region" = "us-east-1" }) - - # Define the cloud credentials to use for searching - secrets_json = jsonencode({ - "access_key_id" = "aws_access_key_id_value", - "secret_access_key" = "aws_secret_access_key_value" - }) -} -``` - -## Azure host catalog configuration - -This host catalog example discovers hosts in Azure. Notice that it is very similar to the AWS example. - -```hcl -resource "boundary_host_catalog_plugin" "azure_example" { - name = "My Azure catalog" - description = "My Azure dynamic host catalog" - scope_id = boundary_scope.project.id - plugin_name = "azure" - - # HashiCorp recommends providing Azure secrets using a file() or environment variables - - # The attributes below must be generated in Azure by creating an Entra ID application - attributes_json = jsonencode({ - "disable_credential_rotation" = "true", - "tenant_id" = "ARM_TENANT_ID", - "subscription_id" = "ARM_SUBSCRIPTION_ID", - "client_id" = "ARM_CLIENT_ID" - }) - - # The secrets below must be generated in Azure by creating an Entra ID application - secrets_json = jsonencode({ - "secret_value" = "ARM_CLIENT_SECRET" - }) -} -``` - -## Add static hosts to hosts sets configuration - -This example adds static hosts to static host sets. - -```hcl -resource "boundary_host_set_static" "web" { - host_catalog_id = boundary_host_catalog_static.example.id - host_ids = [ - # This is the static Boundary host created in the example above. - boundary_host_static.example.id - ] -} -``` - -## Add plugin-based hosts to host sets configuration - -Hosts discovered using a plugin-based host catalog should be added to a `boundary_host_set_plugin` host set. - -This example demonstrates how to add hosts from the AWS host catalog to a host set using tags as a filtering criteria. In this example, the filter looks for tags named `service-type` that have a value of `web`. - -```hcl -resource "boundary_host_set_plugin" "web" { - name = "My web host set plugin" - - # This is the AWS host catalog that was created above - host_catalog_id = boundary_host_catalog_plugin.aws_example.id - - # This is the filter that looks for specific tags using AWS filtering syntax - attributes_json = jsonencode({ "filters" = ["tag:service-type=web"] }) -} -``` - -## More information - -For more information about the Boundary resources mentioned in this topic, refer to the domain model documentation: - -- [Targets](/boundary/docs/domain-model/targets) -- [Hosts](/boundary/docs/domain-model/hosts) -- [Host sets](/boundary/docs/domain-model/host-sets) -- [Host catalogs](/boundary/docs/domain-model/host-catalogs) - -For more information about managing the following resources using Terraform, refer to the Boundary provider documentation: - -- [Static hosts](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/host_static/) -- [Static host catalogs](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/host_catalog_static/) -- [Static host sets](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/host_set_static/) -- [Plugin-based host catalogs](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/host_catalog_plugin/) -- [Plugin-based host sets](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/host_set_plugin/) - -Refer to [Filtering and listing resources](/boundary/docs/filtering) for more information about Boundary's filter syntax and best practices. - -## Next steps - -Once you have configured hosts, you may want to configure [credentials and credential stores](/boundary/docs/deploy/terraform-patterns/terraform-credentials-and-credential-stores) for your hosts and users. \ No newline at end of file diff --git a/website/content/docs/deploy/terraform-patterns/terraform-scopes.mdx b/website/content/docs/deploy/terraform-patterns/terraform-scopes.mdx deleted file mode 100644 index 1e39e29da..000000000 --- a/website/content/docs/deploy/terraform-patterns/terraform-scopes.mdx +++ /dev/null @@ -1,64 +0,0 @@ ---- -layout: docs -page_title: Terraform patterns for scopes -description: >- - Use Terraform patterns to create and manage Boundary scopes. Learn how to configure global, org-level, and project-level scopes using the Boundary provider. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Terraform patterns for scopes - -You can use the following patterns to create org-level and project-level scopes. - -## Requirements - -This document assumes the reader has: - -- An understanding of [Terraform](/terraform/docs) fundamentals. -- An existing Boundary installation. Refer to [Deploy Boundary in a self-managed environment](/boundary/docs/deploy/self-managed) to learn about deploying Boundary. -- Configured the [Terraform Boundary provider](/boundary/docs/deploy/terraform-patterns/#terraform-provider-configuration). - -## Scopes configuration - -The `scope_id` parameter determines what kind of scope to create according to these rules: - -- If `scope_id` is the global scope, an org-level scope is created. -- If `scope_id` is an org-level scope, a project-level scope is created. -- If `scope_id` is a project-level scope, a nested project-level scope is created. - -```hcl -resource "boundary_scope" "project" { - name = "Basic Boundary Demo" - description = "First Ever Boundary Demo" - - # This parameter is the parent scope. It can be either the global scope, an - # org-level scope, or a project-level scope. - scope_id = var.se_org_scope - - # Using the auto_create_x_role flags can help you get set up faster - # becasue you won't have to explicitly define these roles. - auto_create_admin_role = true - auto_create_default_role = true -} -``` - -## More information - -For more information about the Boundary resources mentioned in this topic, refer to the domain model documentation: - -- [Scopes](/boundary/docs/domain-model/scopes) -- [Org-level scopes](/boundary/docs/domain-model/scopes#organizations) -- [Project-level scopes](/boundary/docs/domain-model/scopes#projects) - -For more information about managing the following resources using Terraform, refer to the Boundary provider documentation: - -- [Scopes](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/scope/) - -## Next steps - -You use scopes to partition resources and assign them to users. -Once you have created scopes, you may want to create [users and auth methods](/boundary/docs/deploy/terraform-patterns/terraform-users-and-auth-methods). \ No newline at end of file diff --git a/website/content/docs/deploy/terraform-patterns/terraform-session-recording.mdx b/website/content/docs/deploy/terraform-patterns/terraform-session-recording.mdx deleted file mode 100644 index 81b7c2e5a..000000000 --- a/website/content/docs/deploy/terraform-patterns/terraform-session-recording.mdx +++ /dev/null @@ -1,93 +0,0 @@ ---- -layout: docs -page_title: Terraform patterns for session recording -description: >- - Use Terraform patterns to enable session recording for auditing user sessions in Boundary. Learn how to configure storage policies and storage buckets. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Terraform patterns for session recording - -This feature requires HCP Boundary or Boundary Enterprise - -Session recording requires that you create a storage policy for your current scope and then allocate an AWS S3 bucket to store the recordings. This example does not demonstrate creating the S3 bucket or the associated IAM policies. Refer to the [create storage buckets](/boundary/docs/session-recording/configuration/create-storage-bucket) documentation to learn how to configure AWS. - -## Requirements - -This document assumes the reader has: - -- An understanding of [Terraform](/terraform/docs) fundamentals. -- An existing Boundary installation. Refer to [Deploy Boundary in a self-managed environment](/boundary/docs/deploy/self-managed) to learn about deploying Boundary. -- Configured the [Terraform Boundary provider](/boundary/docs/deploy/terraform-patterns/#terraform-provider-configuration). -- Created a [scope](/boundary/docs/deploy/terraform-patterns/terraform-scopes) for any storage policy you plan to create. -- A licensed version of HCP Boundary or Boundary Enterprise. - -## Storage policy configuration - -This example creates a Boundary storage policy for a project scope. - -```hcl -# Create the storage policy. This policy is effective for the attached scope -resource "boundary_policy_storage" "example" { - - # The policy applies to all recordings in this scope - scope_id = boundary_scope.project.id - - name = "soc2-policy" - description = "SOC 2 compliant storage policy for session recordings" - - # These define your retention parameters - retain_for_days = 2557 - retain_for_overridable = false - - delete_after_days = 2657 - delete_after_overridable = true -} -``` - -## Storage bucket configuration - -This example creates the Boundary storage bucket and attaches it to the S3 bucket. - -```hcl -resource "boundary_storage_bucket" "aws_bucket" { - name = "My aws storage bucket with dynamic credentials" - description = "My first storage bucket" - scope_id = boundary_scop.project.id - plugin_name = "aws" - - # This must match the name of the AWS S3 bucket that stores the recordings - bucket_name = "mybucket1" - - # The role_arn value must be the same arn used as the instance profile - # attached to your Boundary Worker ec2 instance - # https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html - attributes_json = jsonencode({ - "region" = "us-east-1" - "role_arn" = "arn:aws:iam::123456789012:role/S3Access" - "disable_credential_rotation" = true - }) -} -``` - -You have configured the prerequisites for session recording. The last task is to enable recording on a Boundary target. - -## More information - -For more information about the Boundary resources mentioned in this topic, refer to the domain model documentation: - -- [Session recordings](/boundary/docs/domain-model/session-recordings) -- [Storage buckets](/boundary/docs/domain-model/storage-buckets) - -For more information about managing the following resources using Terraform, refer to the Boundary provider documentation: - -- [Storage buckets](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/storage_bucket/) -- [Storage policies](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/policy_storage/) - -## Next steps - -Once you have configured the prerequisites for session recording, you can enable recording on a Boundary [target](/boundary/docs/deploy/terraform-patterns/terraform-targets). \ No newline at end of file diff --git a/website/content/docs/deploy/terraform-patterns/terraform-targets.mdx b/website/content/docs/deploy/terraform-patterns/terraform-targets.mdx deleted file mode 100644 index 7255cee0e..000000000 --- a/website/content/docs/deploy/terraform-patterns/terraform-targets.mdx +++ /dev/null @@ -1,130 +0,0 @@ ---- -layout: docs -page_title: Terraform patterns for targets -description: >- - Use Terraform patterns to create and manage Boundary targets. Learn how to configure SSH and TCP targets, inject passwords, and enable session recording. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Terraform patterns for targets - -Once you have defined a host, a host catalog, and a credential store, you -can create [targets](/boundary/docs/domain-model/targets). - -## Requirements - -This document assumes the reader has: - -- An understanding of [Terraform](/terraform/docs) fundamentals. -- An existing Boundary installation. Refer to [Deploy Boundary in a self-managed environment](/boundary/docs/deploy/self-managed) to learn about deploying Boundary. -- Configured the [Terraform Boundary provider](/boundary/docs/deploy/terraform-patterns/#terraform-provider-configuration). -- Defined a host, [host catalog](/boundary/docs/deploy/terraform-patterns/terraform-hosts-and-host-management), and [credential store](/boundary/docs/deploy/terraform-patterns/terraform-credentials-and-credential-stores). -- (Optional) Configured a storage policy and storage bucket for any targets you want to enable for [session recording](/boundary/docs/deploy/terraform-patterns/terraform-session-recording). - -## Target configuration - -This example creates a target with an injected username and password. - - - - [Credential injection](/boundary/docs/concepts/credential-management#credential-injection) and SSH target types are only supported for HCP Boundary and Boundary Enterprise. You can configure [credential brokering](/boundary/docs/concepts/credential-management#credential-brokering) instead using `brokered_credential_source_ids`. - - - -```hcl -resource "boundary_target" "ssh_foo" { - name = "ssh_foo" - description = "SSH target" - scope_id = boundary_scope.project.id - - # Declare the target type and connection port - type = "ssh" - default_port = "22" - - # Declare the host set - host_source_ids = [ - boundary_host_set.foo.id - ] - - # Declare the injected credentials - injected_application_credential_source_ids = [ - boundary_credential_library_vault.example.id - ] - - # Enable session recording - enable_session_recording = true - storage_bucket_id = boundary_storage_bucket.aws_bucket.id -} - -``` -## Session recording configuration - -This example enables session recording, but uses brokered credentials instead. - -```hcl -resource "boundary_target" "ssh_foo" { - name = "ssh_foo" - description = "SSH target" - scope_id = boundary_scope.project.id - - # Declare the target type and connection port - type = "ssh" - default_port = "22" - - # Declare the host set - host_source_ids = [ - boundary_host_set.foo.id - ] - - # Declare the brokered credentials - # This uses a static credential library created earlier - brokered_application_credential_source_ids = [ - boundary_credential_library.example.id - ] - - # Enable session recording. - enable_session_recording = true - storage_bucket_id = boundary_storage_bucket.aws_bucket.id -} -``` - -## TCP target configuration - -This example creates a `tcp` target that connects to Windows servers using RDP. - -```hcl -resource "boundary_target" "rdp_foo" { - name = "rdp_foo" - description = "RDP target" - scope_id = boundary_scope.project.id - - # Declare the target type and connection port - type = "tcp" - default_port = "3389" - - # Declare the host set. This assumes that this host set contains Windows hosts - host_source_ids = [ - boundary_host_set.foo.id - ] - - # The credentials we will use to connect. RDP requires the use of brokered credentials - # This uses a static credential library created earlier - brokered_application_credential_source_ids = [ - boundary_credential_library.example.id - ] -} -``` - -## More information - -For more information about the Boundary resources mentioned in this topic, refer to the domain model documentation: - -- [Targets](/boundary/docs/domain-model/targets) - -For more information about managing the following resources using Terraform, refer to the Boundary provider documentation: - -- [Targets](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/target/) \ No newline at end of file diff --git a/website/content/docs/deploy/terraform-patterns/terraform-users-and-auth-methods.mdx b/website/content/docs/deploy/terraform-patterns/terraform-users-and-auth-methods.mdx deleted file mode 100644 index 3c8fbef50..000000000 --- a/website/content/docs/deploy/terraform-patterns/terraform-users-and-auth-methods.mdx +++ /dev/null @@ -1,111 +0,0 @@ ---- -layout: docs -page_title: Terraform patterns for users and auth methods -description: >- - Use Terraform patterns to create and manage Boundary users and auth methods. Learn how to configure password and LDAP auth methods, add accounts, create users. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Terraform patterns for users and auth methods - -Boundary supports password, OIDC, and LDAP auth methods. - -## Requirements - -This document assumes the reader has: - -- An understanding of [Terraform](/terraform/docs) fundamentals. -- An existing Boundary installation. Refer to [Deploy Boundary in a self-managed environment](/boundary/docs/deploy/self-managed) to learn about deploying Boundary. -- Configured the [Terraform Boundary provider](/boundary/docs/deploy/terraform-patterns/#terraform-provider-configuration). -- Created a [scope](/boundary/docs/deploy/terraform-patterns/terraform-scopes) to add the users and auth methods to. - -## Auth method configuration - -Below is an example of creating a password auth method. Terraform creates the auth method in the scope that is specified by the `scope_id` option. - -```hcl -resource "boundary_auth_method" "password" { - scope_id = boundary_scope.org.id - type = "password" -} -``` - -### LDAP auth method configuration - -The next example demonstrates how to create an LDAP auth method. - -```hcl -resource "boundary_auth_method_ldap" "forumsys_ldap" { - name = "forumsys public LDAP" - scope_id = "global" # add the new auth method to the global scope - urls = ["ldap://ldap.forumsys.com"] # the addr of the LDAP server - user_dn = "dc=example,dc=com" # the basedn for users - user_attr = "uid" # the user attribute - group_dn = "dc=example,dc=com" # the basedn for groups - bind_dn = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding - bind_password = "password" # passwd to use when binding - state = "active-public" # make sure the new auth-method is available to everyone - enable_groups = true # this turns-on the discovery of a user's groups - discover_dn = true # this turns-on the discovery of an authenticating user's dn -} -``` - -## Account and user configuration - -After you create an auth method, you need to add accounts to it and create users to represent the accounts. Users and accounts are different constructs. A user is a "parent" object associated to one or more accounts created using a supported auth method. - -This example creates 2 accounts using the password auth method and associated users. - -```hcl -# Create a user named "Jeff" -resource "boundary_account_password" "jeff" { - auth_method_id = boundary_auth_method.password.id - type = "password" - login_name = "jeff" - password = "$uper$ecure" -} - -# Associate the Jeff account with a user alias -resource "boundary_user" "jeff" { - name = "jeff" - description = "Jeff's user resource" - account_ids = [boundary_account_password.jeff.id] - scope_id = boundary_scope.org.id -} - -#Create a user named Susmitha -resource "boundary_account_password" "susmitha" { - auth_method_id = boundary_auth_method.password.id - type = "password" - login_name = "susmitha" - password = "more$super$ecure" -} - -# And this associates the account with a user alias -resource "boundary_user" "susmitha" { - name = "susmitha" - description = "Susmitha's user resource" - account_ids = [boundary_account_password.susmitha.id] - scope_id = boundary_scope.org.id -} -``` - -## More information - -For more information about the Boundary resources mentioned in this topic, refer to the domain model documentation: -- [Auth methods](/boundary/docs/domain-model/auth-methods) -- [Users](/boundary/docs/domain-model/users) -- [Accounts](/boundary/docs/domain-model/accounts) - -For more information about managing the following resources using Terraform, refer to the Boundary provider documentation: -- [LDAP accounts](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/account_ldap/) -- [OIDC accounts](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/account_oidc/) -- [Password accounts](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/account_password/) - -## Next steps - -Once you have created users and auth methods, you may want to create [groups for your users or configure RBAC](/boundary/docs/deploy/terraform-patterns/terraform-groups-and-rbac) to define the actions a user is allowed to take. \ No newline at end of file diff --git a/website/content/docs/developing/building.mdx b/website/content/docs/developing/building.mdx deleted file mode 100644 index 19ee576d2..000000000 --- a/website/content/docs/developing/building.mdx +++ /dev/null @@ -1,47 +0,0 @@ ---- -layout: docs -page_title: Build Boundary -description: >- - Learn how to build Boundary from the source. Discover resources to compile a cross-platform build and troubleshoot UI assets. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Build Boundary - -Building Boundary from source requires: - -- [Go](https://golang.org/dl/). Boundary developers keep current with new - releases of Go in order to take advantage of new features and to ensure that - security issues within Go are addressed. If building Boundary yourself, always - use the latest version and keep current. -- `make` installed -- [Docker](https://docs.docker.com/get-docker/) installed -- Basic development environment (git, xcode if you're on Mac, etc) - -1. `$ git clone https://github.com/hashicorp/boundary` or if you're using SSH auth for - github, `$ git clone git@github.com:hashicorp/boundary` -2. `$ cd boundary` -3. `$ make install` - -The first time you run `make install` it will build UI assets, which will take a -long time. After the initial build, you can update those assets to the -currently-pinned version via `make build-ui`. - -Once you've built Boundary, the binary will be available at `/bin/boundary`. Move this -binary to somewhere in your `$PATH` such as `/usr/local/bin`. - -## Cross-platform build - -If you need to cross compile boundary for another OS or architecture, use the [GOOS and GOARCH](https://github.com/hashicorp/boundary/blob/master/scripts/build.sh#L26) -environment variable to set this. Example: `$ GOOS=linux GOARCH=amd64 make install` - -For more details, please consult the [Boundary project on GitHub](https://github.com/hashicorp/boundary#build-and-start-boundary-in-dev-mode). - -## Troubleshoot - -UI assets are built inside a Docker container. If this build step fails, try -increasing memory and swap available to Docker. diff --git a/website/content/docs/developing/index.mdx b/website/content/docs/developing/index.mdx deleted file mode 100644 index 0eee97e90..000000000 --- a/website/content/docs/developing/index.mdx +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: docs -page_title: Develop Boundary -description: >- - Discover resources to help you build and develop Boundary. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Develop Boundary - -The side-bar contains some common development tasks, but for the most up-to-date information about developing Boundary, please consult -our [project on GitHub](https://github.com/hashicorp/boundary) for more information. diff --git a/website/content/docs/developing/ui.mdx b/website/content/docs/developing/ui.mdx deleted file mode 100644 index 9f00af074..000000000 --- a/website/content/docs/developing/ui.mdx +++ /dev/null @@ -1,27 +0,0 @@ ---- -layout: docs -page_title: Develop the UI -description: >- - Learn how to develop the Boundary user interface locally for testing. Use dev mode to run a local fork of the UI without building it into the binary. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Develop the Boundary user interface - -For detailed instructions and the most up-to-date information on developing the -Boundary admin UI, please consult [the project README on GitHub](https://github.com/hashicorp/boundary-ui). - -## Run a local fork of the UI locally in dev mode - -If you're developing the Boundary UI locally you can point a dev mode server at a -local checkout of the repo without building it into the binary. We call this -directory a passthrough directory, and you can enable it using an env var while in -conjunction with running Boundary in dev mode: - -```bash -BOUNDARY_DEV_UI_PASSTHROUGH_DIR=../boundary-ui/ui/admin/dist boundary dev -``` diff --git a/website/content/docs/domain-model/accounts.mdx b/website/content/docs/domain-model/accounts.mdx deleted file mode 100644 index 14fd2e179..000000000 --- a/website/content/docs/domain-model/accounts.mdx +++ /dev/null @@ -1,85 +0,0 @@ ---- -layout: docs -page_title: Account resource -description: >- - Learn about using the accounts resource to establish the identities of users. Understand how to configure general, password, and LDAP account attributes. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Accounts - -An account is a resource -that represents a unique set of credentials -issued from a configured [auth method][] -which can be used to establish the identity of a user. -A [user][] can have zero or more accounts -but an account can only belong to a single user. -An account can only be associated with a user -in the same scope as the account's [auth method][]. - -## Attributes - -All account types have the following configurable attributes: - -- `name` - (optional) - If set, the `name` must be unique within the account's auth method. - -- `description` - (optional) - -### Password account attributes - -Password account types have the following additional attributes: - -- `login_name` - (required) - Must be unique within the account's auth method. - Can only contain lower case letters. - -- `password` - (optional) - Not setting the `password` disables the account. - -### LDAP account attributes - -LDAP account types have the following additional attributes: - -- `login_name` - (required) - Must be unique within the account's auth method. - Can only contain lower case letters. - -- `full_name` - (output only) - Maps to the name attribute for the authenticated user, and is updated every - time the user successfully authenticates. It is empty until the user's - first successful authentication. - -- `email` - (output only) - Maps to the email address attribute for the authenticated user, and is updated - every time the user successfully authenticates. It is empty until the - user's first successful authentication. - -- `dn` - (output only) - Maps to the distinguished name for the authenticated user, and is updated - every time the user successfully authenticates. It is empty until the - user's first successful authentication. - -- `member_of_groups` - (output only) - A list of the groups the authenticated user is a member of. It is empty - until the user's first successful authentication. - -## Referenced by - -- [Auth method][] -- [Managed group][] -- [User][] - -[auth method]: /boundary/docs/domain-model/auth-methods -[managed group]: /boundary/docs/domain-model/managed-groups -[user]: /boundary/docs/domain-model/users - -## Service API docs - -The following services are relevant to this resource: - -- [Account service](/boundary/api-docs/account-service) diff --git a/website/content/docs/domain-model/aliases.mdx b/website/content/docs/domain-model/aliases.mdx deleted file mode 100644 index f5a586318..000000000 --- a/website/content/docs/domain-model/aliases.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -layout: docs -page_title: Alias resource -description: >- - Learn about using the alias resource to transparently connect to targets without having to provide the target ID or target name and scope ID. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Aliases - -An alias is a globally unique, DNS-like string that is associated with a destination resource. -Examples of valid aliases are `webserver` and `webserver.boundary`. -You can establish a session to a target by referencing its alias, instead of having to provide a target ID or target name and scope ID. -For example, if you have an alias `boundary.dev`, you can use it to connect to a target with the following command: `boundary connect ssh boundary.dev`. - -## Attributes - -Aliases have the following attributes: - -- `-description=` - Specifies the optional description you want to use to describe the alias for identification purposes. -- `-destination-id=` - Specifies the ID of the target that the alias points to. -- `-name=` - Specifies the optional name you want to use to describe the alias for identification purposes. -- `-scope-id=` - Scope in which to create the alias. The default is `global`. - You can also specify the scope using the BOUNDARY_SCOPE_ID environment variable. - At this time, aliases are only supported for the global scope. -- `-value=` - Specifies the string that you want to use as the alias to represent the target. - The `value` must comply with DNS naming rules. - -### Target subtypes - -The target subtype has the following additional attributes: - -- `-authorize-session-host-id=` - Indicates the host ID to use when you use the alias to authorize a session. - -## More information - -- [Aliases](/boundary/docs/concepts/aliases) diff --git a/website/content/docs/domain-model/auth-methods.mdx b/website/content/docs/domain-model/auth-methods.mdx deleted file mode 100644 index f1225e89e..000000000 --- a/website/content/docs/domain-model/auth-methods.mdx +++ /dev/null @@ -1,231 +0,0 @@ ---- -layout: docs -page_title: Auth method resource -description: >- - Learn about using the auth method resource to authenticate users. Understand which attributes you can configure for password, OIDC, and LDAP auth methods. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Auth methods - -An auth method is a resource that provides a mechanism for [users][] to -authenticate to Boundary. An auth method contains [accounts][] which link an -individual user to a set of credentials and [managed groups][] which groups -[accounts][] that satisfy criteria and can be used as principals in [roles][]. -Auth methods can be defined at either a [global][] or [organization][] -[scope][]. - -## Attributes - -All auth methods have the following configurable attributes: - -- `name` - (optional) - If set, the `name` must be unique within the auth method's scope. - -- `description` - (optional) - -### Password auth method attributes - -The password auth method has the following additional attributes: - -- `min_login_name_length` - (required) The default is 3. - -- `min_password_length` - (required) The default is 8. - -### OIDC auth method attributes - -The OIDC auth method has the following additional attributes: - -- `account_claim_maps` (optional list) These are a map from custom - claims to the standard claims of sub, name, and email. These maps are - represented as key=value where the key equals the provider from-claim and the - value equals the Boundary to-claim. For example "oid=sub". You can specify this attribute - multiple times for different to-claims. - -- `allowed_audiences` (optional list) Audiences for which provider - responses are allowed. - -- `api_url_prefix` (required) The API prefix to use when generating callback URLs - for the provider. You should set the value to an address that allows the provider to reach - the controller. - -- `callback_url` (output read-only) The URL that should be provided to the IdP - for callbacks. - -- `claims_scopes` (optional list) The claims scope requested. You can specify this attribute - multiple times. - -- `client_id` (required) The OAuth 2.0 client identifier this auth method should - use with the provider. - -- `client-secret` (required) The corresponding client secret. - -- `client_secret_hmac` (output read-only) The HMAC of the client secret that the Boundary controller - returns. It is used for comparison to the value's initial setting. - -- `disable_discovered_config_validation` (optional) Disables validation logic - to ensure that the OIDC provider's information from its discovery endpoint - matches the information here. The validation is only performed at create or - update time. - -- `idp_ca_certs` - (optional) PEM-encoded X.509 CA certificate that can be used - as trust anchors when you connect to an OIDC provider. You can specify this attribute - multiple times. - -- `issuer` - (required) The provider's issuer URL. This value must match the issuer - field in generated tokens. - -- `max_age` (optional) The max age to send to the provider. This value indicates how - much time is allowed to have passed since the last authentication before the - user is challenged again. A value of `0` sets an immediate requirement for all - users to reauthenticate, and an unset `maxAge` results in a Terraform value of - -1 and the default TTL of the chosen OIDC is used. - - If you set a `max_age` value, it works in conjunction with the [`auth_token_time_to_live` parameter](/boundary/docs/configuration/controller#auth_token_time_to_live) set on the controller. Users are not challenged to authenticate again by the provider until the `auth_token_time_to_live` value has expired, even if the `max_age` expires first. - -- `prompt` (optional) If you configure this attribute, the OIDC authorization server prompts users for reauthentication, account selection, or consent when they log in. -You can optionally configure one or more of the following additional attributes to customize the behavior of the authentication process: - - `none` (optional) The authorization server does not display any authentication or consent prompts. - - `login` (optional) The authorization server prompts users for reauthentication before allowing them to log in. - - `consent` (optional) The authorization server prompts users for consent before returning any information to Boundary. - - `select_account` (optional) The authorization server prompts users to select a user account. - The `select_account` setting can be helpful if your users have multiple accounts. - - - -Cloud providers implement `prompt` in different ways. -You may notice differences in behavior if you configure OIDC authentication on multiple cloud providers. - - - -- `signing-algorithm` (required) The allowed signing algorithm. You can specify this attribute - multiple times for multiple values. - - -### LDAP auth method attributes - -The ldap auth method has the following additional attributes: - -- `state` - The state of the auth method; either `inactive`, `active-private`, or - `active-public`. - -- `start_tls` - (optional) If `true`, issues a StartTLS command after establishing - an unencrypted connection. Defaults to `false`. - -- `insecure_tls` - (optional) If `true`, skips LDAP server SSL certificate - validation, which is insecure and should be used with caution. Defaults to - `false`. - -- `discover_dn` - (optional) If `true`, use anon bind to discover the bind DN - (Distinguished Name) of a user. Defaults to `false`. - -- `anon_group_search` - (optional) If `true`, use anon bind when performing LDAP - group searches. Defaults to `false`. - -- `upn_domain` - (optional) If set, the `userPrincipalDomain` is used to construct - the UPN string for the authenticating user. The constructed UPN appears as - `[username]@UPNDomain`. Example: `example.com`, which causes Boundary to - bind as `username@example.com` when it authenticates the user. - -- `urls` - (required) The LDAP URLS that specify LDAP servers to connect to. - There must be at least one URL for each LDAP auth method. When attempting to - connect, the URLs are tried in the order specified. - -- `user_dn` - (optional) If set, the base DN under which to perform user - search. Example: `ou=Users,dc=example,dc=com`. - -- `user_attr` - (optional) If set, defines the attribute on a user's entry - matching the login-name passed when the user authenticates. Examples: cn, uid - -- `user_filter` - (optional) If set, the Go template used to construct an LDAP - user search filter. The template can access the following context variables: - [UserAttr, Username]. The default `user_filter` is - `({{.UserAttr}}={{.Username}})` or - `(userPrincipalName={{.Username}}@UPNDomain)` if the `upn-domain` parameter is - set. - -- `enable_groups` - (optional) If `true`, an authenticated user's groups are - found during authentication. Defaults to `false`. - -- `group_dn` - (optional) If set, the base DN under which to perform a group - search. Example: `ou=Groups,dc=example,dc=com`. - - Note: There is no default, so no base DN is used for group searches, if - it's not specified. - -- `group_attr` - (optional) If set, the LDAP attribute to follow on objects - returned by `group_filter` in order to enumerate user group membership. - Examples: for `group_filter` queries returning group objects, use: `cn`. For - queries returning user objects, use: `memberOf`. The default is `cn`. - -- `group_filter` - (optional) If set, the Go template used when constructing the - group membership query. The template can access the following context - variables: `UserDN`, `Username`. The default is - `(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))`, - which is compatible with several common directory schemas. - -- `certificates` - (optional) If set, PEM encoded x509 certificates in ASN.1 - DER form that can be used as trust anchors when connecting to an LDAP - provider. - -- `client_certificate` - (optional) If set, a PEM encoded x509 certificate in - ASN.1 DER form to be used as a client certificate. It must be set, if you - specify the optional client_certificate_key. - -- `client_certificate_key` - (optional) If set, a PEM encoded certificate key in - PKCS #8, ASN.1 DER form. It must be set, if you specify the optional - client_certificate. - -- `bind_dn` - (optional) If set, the distinguished name of entry to bind when - performing user and group searches. Example: - `cn=vault,ou=Users,dc=example,dc=com`. - -- `bind_password` - (optional) If set, the password to use along with `bind_dn` - when performing user search. It must be set, if you specify the optional - `bind_dn`. - -- `use_token_groups` - (optional) If `true`, use the Active Directory `tokenGroups` - constructed attribute of the user to find the group memberships. This - finds all security groups, including nested ones. - -- `account_attribute_maps` - (optional) If set, the attribute maps from custom - attributes to the standard fullname and email account attributes. These - maps are represented as `key=value` where the key equals the `from_attribute`, and - the value equals the `to_attribute`. For example, `preferredName=fullName`. All - attribute names are case insensitive. - - - `maximum_page_size` - (optional) If set, it specifies a maximum ldap search - result size to use when retrieving the authenticated user's group - memberships. You can use this setting to avoid reaching the LDAP server's max result - size. - - - `dereference_aliases` - (optional) If set, it will control how aliases are - dereferenced when you search. - -## Referenced by - -- [Account][] -- [Global][] -- [Managed group][] -- [Organization][] - -[account]: /boundary/docs/domain-model/accounts -[accounts]: /boundary/docs/domain-model/accounts -[global]: /boundary/docs/domain-model/scopes#global -[managed group]: /boundary/docs/domain-model/managed-groups -[managed groups]: /boundary/docs/domain-model/managed-groups -[organization]: /boundary/docs/domain-model/scopes#organizations -[roles]: /boundary/docs/domain-model/roles -[scope]: /boundary/docs/domain-model/scopes -[users]: /boundary/docs/domain-model/users - -## Service API docs - -The following services are relevant to this resource: - -- [Auth method service](/boundary/api-docs/auth-method-service) -- [Auth token service](/boundary/api-docs/auth-token-service) diff --git a/website/content/docs/domain-model/credential-libraries.mdx b/website/content/docs/domain-model/credential-libraries.mdx deleted file mode 100644 index 105957cd1..000000000 --- a/website/content/docs/domain-model/credential-libraries.mdx +++ /dev/null @@ -1,161 +0,0 @@ ---- -layout: docs -page_title: Credential library resource -description: >- - Learn about using the credential library resource to provide credentials from a credential store. Understand the credential library attributes you can configure. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Credential libraries - -A credential library is a resource that provides [credentials][] of the same type and same access level from a single [credential store][]. - -## Attributes - -A credential library has the following configurable attributes: - -- `name` - (optional) If you set this attribute, the `name` must be unique within the credential library's parent credential store. - -- `description` - (optional) A user-defined description of the credential library for identification purposes. - -### Vault generic credential library attributes - -The generic Vault credential library has the following additional attributes: - -- `vault-path` - (required) The path in Vault to request credentials from. - -- `credential-type` - (optional) The type of credential this library issues. The default value is `unspecified`. - -- `credential-mapping-override` - (optional) If set, this value overrides the field attributes in the credential that is retrieved from Vault. - -- `vault-http-method` - (optional) The HTTP method the library uses when it requests credentials from Vault. -Can be either `GET` or `POST`. -The default value is `GET`. - -- `vault-http-request-body` - (optional) The body of the HTTP request the library sends to Vault when it requests credentials. -Only valid if `http_method` is set to `POST`. - -### Vault SSH certificate credential library attributes - -This feature requires HCP Boundary or Boundary Enterprise - -You can configure SSH credential injection using [Vault's SSH secrets engine](/vault/docs/secrets/ssh) to create the SSH certificate credentials. -SSH certificate-based authentication extends key-based authentication using digital signatures. -Your users' authenticity is determined by a certificate signed by a trusted certificate authority (CA). -You can configure Vault's SSH secrets engine to act as the CA. - -SSH certificates let you specify how long they are valid for, who can gain access to a target host, how users can log in, and what commands can be used on the target machine. -Unlike SSH key pairs, SSH certificates are short-lived and self-destructive. - -A Vault SSH certificate credential library has the following additional attributes: - - - -The certificate is issued for the entire session, so if the `ttl` value is shorter than the target's `session_max_seconds` value, later connections may fail. -To prevent failures, you should ensure that the `ttl` value is equal to or longer than the target's `session_max_seconds`. -Alternatively, you could set the `session_connection_limit` to `1` for any targets that use the credential library. - - - -- `vault-path` - (required) The path in Vault to request credentials from. - -- `username` - (required) The username to use with the SSH certificate. -You can create a template for this value using [Vault credential library parameter templating](#vault-generic-credential-library-parameter-templating). - -- `key_type` - (optional) The type of key to use for the generated SSH private key. -The key type is either `ed25519`, `ecdsa`, or `rsa`. -The default key type is `ed25519`. - -- `key_bits` - (optional) The number of bits used to generate the SSH private key. -The number of bits depends on the `key_type` value you select: - - For an `ed25519` key type, you should not set the `key_bits` value. - - For an `ecdsa` key type, you can select either `256`, `384`, or `521`. - - For an `rsa` key type, you can select either `2048`, `3072`, or `4096`. - -- `ttl` - (optional) The SSH certificate's time-to-live (TTL). - -- `key_id` - (optional) The key ID for the created SSH certificate. You can create a template for this value using [Vault credential library parameter templating](#vault-certificates-library-parameter-templating). - -- `critical_options` - (optional) Any critical options that the certificate should be signed for. -For more information, refer to the [list of critical options](https://github.com/openssh/openssh-portable/blob/5f93c4836527d9fda05de8944a1c7b4a205080c7/PROTOCOL.certkeys#L221-L269) supported by OpenSSH. - -- `extensions` - (optional) Any extensions that the certificate should be signed for. -For more information, refer to the [list of extensions](https://github.com/openssh/openssh-portable/blob/5f93c4836527d9fda05de8944a1c7b4a205080c7/PROTOCOL.certkeys#L270-L319) supported by OpenSSH. -Note that the `permit-pty` value should be set for an interactive shell to function properly. - -- `additional_valid_principals` - (optional) Valid Principals that the certificate should be signed for in addition to the provided username. -For more information, refer to OpenSSH's ["valid principals" definition](https://github.com/openssh/openssh-portable/blob/5f93c4836527d9fda05de8944a1c7b4a205080c7/PROTOCOL.certkeys#L176-L181) as well as Vault's documentation for the [SSH secrets engine](https://developer.hashicorp.com/vault/api-docs/secret/ssh#valid_principals). -Note that all SSH certificates issued by a Vault SSH certificate credential library use the `SSH_CERT_TYPE_USER` certificate type mentioned in the OpenSSH definition link. - -### Vault parameter templating - -Sometimes it can be useful to provide information about a Boundary user or account when making a call to Vault. For example, this can allow picking the correct role when asking for database credentials (if roles are separated per-user), or providing a value to encode in an X.509 certificate generated by Vault. You can template user and account information into either the path in Vault, the `POST` request body, or both. - -#### Vault generic credential library parameter templating - -The following Vault template parameters are supported in Boundary's Vault generic credential library. -Note that account values are tied to the account associated with the token used to make the call: - -- `{{.User.Id}}` - The user's ID. -- `{{.User.Name}}` - The user's name from the user resource. -- `{{.User.FullName}}` - The user's name from the account corresponding to the primary auth method in the user's scope. -This value may not be populated, or it may be different from the account name used in the template. -- `{{.User.Email}}` - The user's email address from the account corresponding to the primary auth method in the user's scope. -This value may not be populated, or it may be different from the account name used in the template. -- `{{.Account.Id}}` - The account's ID. -- `{{.Account.Name}}` - The name of the account from the account resource. -- `{{.Account.LoginName}}` - The account's login name, if a login name is used by that type of account. -- `{{.Account.Subject}}` - The account's subject, if a subject is used by that type of account. -- `{{.Account.Email}}` - The account's email, if email is used by that type of account. - -#### Vault certificates library parameter templating - -The following Vault template parameters are supported in Boundary's Vault certificate library. -Note that account values are tied to the account associated with the token used to make the call: - -- `{{.User.Name}}` - The user's name from the user resource. -- `{{.Account.Id}}` - The account's ID. - -#### Useful templating functions: - -The `truncateFrom` function strips the rest of a string after a specified -substring. This function is useful for pulling a user or account name from an -email address. The following example turns `foo@example.com` into `foo`: - -`{{truncateFrom .Account.Email "@"}}` - -The example above uses the account email, but it could be any other parameter. - -The `coalesce` function chooses the first non-empty value out of the list. This -is useful when using account names/login names since only one may be populated: - -`{{coalesce .Account.Name .Account.LoginName}}` - -## Tutorial - -Refer to the [SSH certificate injection with HCP Boundary](/boundary/tutorials/credential-management/hcp-certificate-injection) tutorial to learn how to configure credential injection with SSH certificates using Vault. - -## Referenced by - -- [Credential][] -- [Credential store][] -- [Target][] - -[credential store]: /boundary/docs/domain-model/credential-stores -[credential stores]: /boundary/docs/domain-model/credential-stores -[credential]: /boundary/docs/domain-model/credentials -[credentials]: /boundary/docs/domain-model/credentials -[project]: /boundary/docs/domain-model/scopes#projects -[projects]: /boundary/docs/domain-model/scopes#projects -[target]: /boundary/docs/domain-model/targets -[targets]: /boundary/docs/domain-model/targets - -## Service API docs - -The following services are relevant to this resource: - -- [Credential library service](/boundary/api-docs/credential-library-service) diff --git a/website/content/docs/domain-model/credential-stores.mdx b/website/content/docs/domain-model/credential-stores.mdx deleted file mode 100644 index f468e47ea..000000000 --- a/website/content/docs/domain-model/credential-stores.mdx +++ /dev/null @@ -1,221 +0,0 @@ ---- -layout: docs -page_title: Credential store resource -description: >- - Learn about using the credential store resource to store and retrieve credentials. Understand the Vault and static credential store attributes you can configure. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Credential stores - -A credential store is a resource -that can retrieve [credentials][] -of differing types and differing access levels. -It belongs to a [project][] and supports the -[principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege) -by providing mechanisms to limit the [credentials][] it can access -to the minimum necessary for the project it is in. - -Credential stores contain either credential libraries or credentials, depending on the type: - -- Vault credential stores contain [credential libraries][]. - Targets use credential libraries to issue credentials for sessions. - -- Static credential stores contain credentials, not credential libraries. - When you use static credential stores, the credentials are stored directly in Boundary. - -## Attributes - -A credential store has the following configurable attributes: - -- `name` - (optional) - If set, the `name` must be unique within the credential store's project. - -- `description` - (optional) - -### Vault credential store attributes - -A Vault credential store has the following additional attributes: - -- `address` - (required) - The address of the Vault server. - This should be a complete URL such as `https://127.0.0.1:8200`. - -- `token` - (required) - A token used for accessing Vault. - This token must meet the [Vault token requirements][token_requirements] described below. - Each Vault credential store must be configured with a unique Vault token. - -- `ca_cert` - (optional) - A PEM-encoded CA certificate to verify the Vault server's TLS certificate. - -- `tls_server_name` - (optional) - Name to use as the SNI host when connecting to Vault via TLS. - -- `tls_skip_verify` - (optional) - Disable verification of TLS certificates. - Using this option is highly discouraged as it decreases the security of data - transmissions to and from the Vault server. - -- `client_certificate` - (optional) - A PEM-encoded client certificate to use for TLS authentication to the Vault server. - -- `client_certificate_key` - (optional) - A PEM-encoded private key matching the client certificate from `client_certificate`. - -- `namespace` - (optional) - A Vault [namespace][]. Requires Vault Enterprise. - -- `worker_filter` HCP/ENT - (optional) - A [filter] used to control which workers can handle Vault requests. - This allows the use of private Vault instances with Boundary. Workers - deployed in the same network as a private Vault instance can access and relay - Vault requests to Boundary controllers. - A worker that matches the worker filter must exist before defining the Vault credential store, as it - will perform the Vault calls needed to set up the credential store with Boundary. - -### Static credential store attributes - -A static credential store has no type-specific attributes. - -## Referenced by - -- [Credential library][] -- [Credential][] -- [Project][] - -## Service API docs - -The following services are relevant to this resource: - -- [Credential store service](/boundary/api-docs/credential-store-service) - -[credential library]: /boundary/docs/domain-model/credential-libraries -[credential libraries]: /boundary/docs/domain-model/credential-libraries -[credential]: /boundary/docs/domain-model/credentials -[credentials]: /boundary/docs/domain-model/credentials -[project]: /boundary/docs/domain-model/scopes#projects - -## Vault token requirements - -Each Vault credential store must be configured with a unique Vault token. -The Vault tokens for all credential stores -must be [periodic][], [renewable][], and an [orphan][]. -All tokens must also have the capabilities of the -[Vault Boundary controller policy][token_policy] described below. - -### Vault policies - -The credential store's token must have the capabilities to issue credentials for -each of its credential libraries plus the capabilities of the -[Vault Boundary controller policy][token_policy] described below. - -We recommend creating a unique Vault policy for each Vault credential store that -grants the minimum set of permissions needed by the credential store's -libraries. We also recommend the [Vault Boundary controller -policy][token_policy] be kept distinct from any other Vault policies. This -allows each credential store to have a token that is configured with two -polices: one shared by all credential stores and one unique to that credential -store. This also allows a credential store to be created with the minimum -permissions necessary at any point in time. The policy unique to a credential -store can then be updated as needed when credential libraries are added and -removed from the credential store. - -#### Vault Boundary controller policy - -The token Boundary receives must have the capabilities in the policy below. An explanation for each capability is documented above the written policy. - -```hcl -# Allow Boundary to read and verify the properties of the token. This is -# provided by the "default" policy. -path "auth/token/lookup-self" { - capabilities = ["read"] -} - -# Allow Boundary to renew the token. This is provided by the "default" -# policy. -path "auth/token/renew-self" { - capabilities = ["update"] -} - -# Allow Boundary to revoke the token when the credential store is updated -# to use a new token or the credential store is deleted. This is provided -# by the "default" policy. -path "auth/token/revoke-self" { - capabilities = ["update"] -} - -# Allow Boundary to renew the credentials in active sessions. This is -# provided by the "default" policy. -path "sys/leases/renew" { - capabilities = ["update"] -} - -# Allow Boundary to revoke the credentials issued for a session when the -# session is terminated. -path "sys/leases/revoke" { - capabilities = ["update"] -} - -# Allow Boundary to read and verify the token's capabilities for each Vault -# path used by the credential store. This is provided by the "default" -# policy. -path "sys/capabilities-self" { - capabilities = ["update"] -} -``` - -Follow the steps below to write this policy to Vault. - -Create the policy: - -```shell-session -$ cat > boundary-controller-policy.hcl <- - Learn about using the credential resource to define secrets for a host. Understand username password, SSH private key, SSH certificate, and JSON credential types. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Credentials - -A credential is a data structure containing one or more secrets that binds an identity to a set of permissions or capabilities on a [host][] for a [session][]. - -Optionally, credentials can be typed to indicate compliance with a specific format. -The following credential types are supported in Boundary: - -- [Username password](#username-password) -- [Username password domain](#username-password-domain) -- [SSH private key](#ssh-private-key) -- [SSH certificate](#ssh-certificate) -- [JSON](#json) - -## Username password - -`username_password` credentials contain the following fields: - -- `username` - The username field associated with the credential. - -- `password` - The password field associated with the credential. - -## Username password domain - -`username_password_domain` credentials contain the following fields: - -- `username` - The username field associated with the credential. - -- `password` - The password field associated with the credential. - -- `domain` - The domain field associated with the credential. - -## SSH private key - -`ssh_private_key` credentials contain the following fields: - -- `username` - The username field associated with the credential. - -- `private_key` - The private key field associated with the credential. - -## SSH certificate - -`ssh_certificate` credentials contain the following fields: - -- `username` - The username field associated with the credential. - -- `ssh_certificate` - The SSH certificate associated with the credential. - -## JSON - -You can provide credentials using a JSON blob. -JSON credentials are only brokered to users that connect to machines. -There is no required structure for the JSON blob, other than it must be a key value map. -Refer to the example below: - - - -```JSON -{ - "type": "service_account", - "project_id": "", - "private_key_id": "", - "private_key": "-----BEGIN PRIVATE KEY----------END PRIVATE KEY-----\n", - "client_email": "", - "client_id": "", - "auth_uri": "https://accounts.google.com/o/oauth2/auth", - "token_uri": "https://oauth2.googleapis.com/token", - "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs", - "client_x509_cert_url": "" -} -``` - - - -## Referenced by - -- [Credential store][] -- [Credential library][] -- [Session][] -- [Target][] - -[credential library]: /boundary/docs/domain-model/credential-libraries -[credential libraries]: /boundary/docs/domain-model/credential-libraries -[credential store]: /boundary/docs/domain-model/credential-stores -[credential stores]: /boundary/docs/domain-model/credential-stores -[host]: /boundary/docs/domain-model/hosts -[session]: /boundary/docs/domain-model/sessions -[target]: /boundary/docs/domain-model/targets diff --git a/website/content/docs/domain-model/groups.mdx b/website/content/docs/domain-model/groups.mdx deleted file mode 100644 index 3102b2cdf..000000000 --- a/website/content/docs/domain-model/groups.mdx +++ /dev/null @@ -1,62 +0,0 @@ ---- -layout: docs -page_title: Group resource -description: >- - Learn about using the group resource to create collections of users with the same access control. Any role assigned to a group is assigned to the group's users. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Groups - -A group is a resource -that represents a collection of [users][] -which can be treated equally -for the purposes of access control. -A group is a principal -which allows it to be assigned to [roles][]. -Any role assigned to a group is indirectly assigned to the users in the group. -This assignment is a transitive property. -A user in a group receives all [permissions][] of the roles assigned to the group. -Groups can be defined at the [global][], [organization][], or [project][] [scope][]. - -## Attributes - -A group has the following configurable attributes: - -- `name` - (optional) - If set, the `name` must be unique within the group's immediate parent scope. - -- `description` - (optional) - -## Referenced by - -- [Global][] -- [Organization][] -- [Role][] -- [User][] - -[global]: /boundary/docs/domain-model/scopes#global -[group]: /boundary/docs/domain-model/groups -[groups]: /boundary/docs/domain-model/groups -[organization]: /boundary/docs/domain-model/scopes#organizations -[permissions]: /boundary/docs/rbac -[project]: /boundary/docs/domain-model/scopes#projects -[role]: /boundary/docs/domain-model/roles -[roles]: /boundary/docs/domain-model/roles -[scope]: /boundary/docs/domain-model/scopes -[user]: /boundary/docs/domain-model/users -[users]: /boundary/docs/domain-model/users - -## Service API docs - -The following services are relevant to this resource: - -- [Group service](/boundary/api-docs/group-service) - -## Tutorial - -Refer to the [Manage Users and Groups with HCP Boundary](/boundary/tutorials/hcp-administration/hcp-manage-users-groups) tutorial to learn how to complete user management related tasks. diff --git a/website/content/docs/domain-model/host-catalogs.mdx b/website/content/docs/domain-model/host-catalogs.mdx deleted file mode 100644 index ae3be848d..000000000 --- a/website/content/docs/domain-model/host-catalogs.mdx +++ /dev/null @@ -1,57 +0,0 @@ ---- -layout: docs -page_title: Host catalog resource -description: >- - Learn about using the host catalog resource to organize and manage hosts and host sets within a project based on their function, environment, or other criteria. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Host catalogs - -A host catalog is a resource -that contains [hosts][] and [host sets][]. -A host catalog can only be defined within a [project][]. - -## Attributes - -A host catalog has the following configurable attributes: - -- `name` - (optional) - If set, the `name` must be unique within the host catalog's project. - -- `description` - (optional) - -### Plugin host catalog information and attributes - -- `plugin_id` - (required) - Must reference an installed plugin. - -- `attributes` - (optional) - A collection of fields which the plugin uses to interface with the backing - service. - -- `secrets` - (optional) - A collection of sensitive fields, like credentials, which the plugin uses to - interface with the backing service. These fields are write-only. - -## Referenced by - -- [Host][] -- [Host set][] -- [Project][] - -[host set]: /boundary/docs/domain-model/host-sets -[host sets]: /boundary/docs/domain-model/host-sets -[host]: /boundary/docs/domain-model/hosts -[hosts]: /boundary/docs/domain-model/hosts -[project]: /boundary/docs/domain-model/scopes#projects - -## Service API docs - -The following services are relevant to this resource: - -- [Host catalog service](/boundary/api-docs/host-catalog-service) diff --git a/website/content/docs/domain-model/host-sets.mdx b/website/content/docs/domain-model/host-sets.mdx deleted file mode 100644 index 6a4e6a9f0..000000000 --- a/website/content/docs/domain-model/host-sets.mdx +++ /dev/null @@ -1,70 +0,0 @@ ---- -layout: docs -page_title: Host set resource -description: >- - Learn about using the host set resource to organize and manage hosts that have the same level of access control and belong to the same host catalog. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Host sets - -A host set is a resource -that represents a collection of [hosts][] -which are considered equivalent -for the purposes of access control. -A host set can only include hosts -from the same [host catalog][] as the host set. -A [target][] can reference host sets from host catalogs -which belong to the same [project][] as the target. - -## Attributes - -A host set has the following configurable attributes: - -- `name` - (optional) - If set, the `name` must be unique within the host set's parent host catalog. - -- `description` - (optional) - -- `preferred_endpoints` - (optional) - A list of selector strings in the format of either `cidr:` - or `dns:` used to select the addresses of hosts when - establishing a [session][] with a target. - -### Plugin host set attributes - -- `attributes` - (optional) - A collection of fields which the plugin uses to lookup which hosts should be - members of this host set. Often this includes a type of filter using a - syntax which is usable by the backing service. - -- `sync_interval_seconds` - (optional) - The number of seconds between the time boundary syncs the hosts in this - set using this host set's plugin. Defaults to `600` seconds, or 10 minutes. - -## Referenced by - -- [Host][] -- [Host catalog][] -- [Target][] - -[host catalog]: /boundary/docs/domain-model/host-catalogs -[host catalogs]: /boundary/docs/domain-model/host-catalogs -[host]: /boundary/docs/domain-model/hosts -[hosts]: /boundary/docs/domain-model/hosts -[project]: /boundary/docs/domain-model/scopes#projects -[projects]: /boundary/docs/domain-model/scopes#projects -[session]: /boundary/docs/domain-model/sessions -[sessions]: /boundary/docs/domain-model/sessions -[target]: /boundary/docs/domain-model/targets -[targets]: /boundary/docs/domain-model/targets - -## Service API docs - -The following services are relevant to this resource: - -- [Host set service](/boundary/api-docs/host-set-service) diff --git a/website/content/docs/domain-model/hosts.mdx b/website/content/docs/domain-model/hosts.mdx deleted file mode 100644 index 7f7073c1c..000000000 --- a/website/content/docs/domain-model/hosts.mdx +++ /dev/null @@ -1,59 +0,0 @@ ---- -layout: docs -page_title: Host resource -description: >- - Learn about using host resources to represent computing elements that are reachable from Boundary. You can organize hosts in host sets and host catalogs. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Hosts - -A host is a resource -that represents a computing element with a network address -reachable from Boundary. -A host belongs to a [host catalog][]. -Hosts can only be associated with [host sets][] -from the same host catalog as the host. - -## Plugin-based host information - -Plugin-based hosts are read-only. They are synced by an installed plugin on -the boundary system using the configuration provided it from the -host catalog and host set at an interval (configurable in the -host set). - -## Attributes - -A host has the following configurable attributes: - -- `name` - (optional) - If set, the `name` must be unique within the host's parent host catalog. - -- `description` - (optional) - -### Static host attributes - -Static host types have the following additional attribute: - -- `address` - (required) - Must be at least 3 characters long and not greater than 255 characters. - -## Referenced by - -- [Host catalog][] -- [Host set][] - -[host catalog]: /boundary/docs/domain-model/host-catalogs -[host catalogs]: /boundary/docs/domain-model/host-catalogs -[host set]: /boundary/docs/domain-model/host-sets -[host sets]: /boundary/docs/domain-model/host-sets - -## Service API docs - -The following services are relevant to this resource: - -- [Host service](/boundary/api-docs/host-service) diff --git a/website/content/docs/domain-model/index.mdx b/website/content/docs/domain-model/index.mdx deleted file mode 100644 index 75b901701..000000000 --- a/website/content/docs/domain-model/index.mdx +++ /dev/null @@ -1,229 +0,0 @@ ---- -layout: docs -page_title: Domain model overview -description: >- - Learn about using the domain model to organize identity and access management and target resources for secure access. Understand how resources work together. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary domain model overview - -HashiCorp Boundary has an extensible domain model that allows administrators to organize IAM (Identity and Access Management) and target resources in a way that best compliments how their organization manages its computing infrastructure. This concept page is a high-level look at scopes, how they work, and their role in the domain model. We will also explore how Boundary approaches IAM and granting access to Targets. For more information about Boundary’s resource types, see the subpages of the Domain Model section. - -## Scopes - -When conducting threat modeling exercises, it is common practice to mitigate identified risks by reducing their potential blast radius and attack surface. Boundary uses the concept of scopes to help security operators achieve this type of mitigation. A [scope](/boundary/docs/domain-model/scopes) can be considered as a container for resources and permissions. Each scope has a permissions boundary that is isolated from other scopes on the same level, creating a defined blast radius. -The diagram below illustrates the relationship between the different levels of scopes. - - -![](/img/boundary-domain-model-overview.jpg) - -The highest-level scope is the [global scope](/boundary/docs/domain-model/scopes#global). Boundary administrators operate on this level to configure and manage Boundary for the entire business. Boundary administrators can also manage child scopes, auth methods, users, groups, roles, and grants. - -The intermediate scope level is [organizations](/boundary/docs/domain-model/scopes#organizations), also referred to as orgs, which are a child scope of global. Though the implementation may be flexible for organization scopes, we recommend scoping by business units in this case. Scoping by business unit provides a clear separation of concerns for each business unit. Creating organizations for the development, operations, and support teams would be an example. - -The lowest scope level is the [project](/boundary/docs/domain-model/scopes#projects). An organization’s scope may have as many projects as required based on its business workflows. To expand on the example used earlier, the development team’s organization can also have project scopes for their different products. - -For example, they could have the following project scopes: - -- Product 1 -- Product 2 -- Product 3 - -## Identity and access management - -As mentioned earlier, IAM is handled at the organization and global scope levels. Here, operators can create and manage principals. Principals are entities in Boundary that are either [users](/boundary/docs/domain-model/users) or [groups](/boundary/docs/domain-model/groups) that may be assigned capabilities. - -Users are associated with either the global or an organization’s scope. For better access control management, users may be positioned into groups to ease access control demands. Groups can also contain users from different organizations or global scopes without creating multiple users for a single entity, making permissioning less complicated to implement. - -An [auth method](/boundary/docs/domain-model/auth-methods) is the mechanism in Boundary used for authentication. An organization may use numerous authentication methods. Boundary supports Open ID Connect (OIDC) auth methods to delegate authentication to an external identity provider (IDP) - such as Azure Active Directory, Okta, and other OIDC providers - as well as a Boundary-native password auth method. Within an auth method, [accounts](/boundary/docs/domain-model/accounts) may be created and associated with users. Once associated with a user, the principal may authenticate in Boundary using the method specified by their auth method. An account for the password auth method consists of a login name and password. A user may be associated with accounts from different auth methods, where they can have both an Azure Active Directory account and an Okta account, for example. In such cases, the user could authenticate with either provider. - -## Access management - -Boundary’s method of access management starts at the lowest level with Actions. Actions are capabilities that can be performed against Boundary resources. Boundary supports generic Actions such as, Create, Read, Update, Delete, and List. However, there are many more that are resource-type-specific actions that can be used in grants. - -The next level of access management is a [grant](/boundary/docs/rbac#grant-strings). A grant in Boundary contains an action(s) and the resource(s) that the action(s) are permitted to be performed against. This can be thought of like a rule. - -For example, a grant can specify the List Action against a specific resource. Grants can specify resource types or resource IDs and may also be implemented as a rule. - -The highest-level in Boundary utilizes the concepts of [roles](/boundary/docs/domain-model/roles). Roles are a collection of zero or more grants. Roles are assigned to principals (users and groups) and govern what actions they are authorized to perform. Roles belong to a single scope and their lifecycle is dependent on the existence of that scope. Should the scope be deleted, the role would be deleted too. The diagram below illustrates the relationship between the different IAM components within Boundary. - -![](/img/component-relationship.png) - -## Target and host resources - -Boundary exposes endpoints to users as [targets](/boundary/docs/domain-model/targets). A target is a resource representing a networked service, with an associated set of permissions, that allows a user to connect and interact with Boundary within a single session. A target may contain references to [host](/boundary/docs/domain-model/hosts) sources or an address, and [credential](/boundary/docs/domain-model/credentials) sources. Users who access a target create an authorized session to its address or one of its host sources with returned credentials from the target’s credential source. - -A target exposes two distinct and mutually exclusive configuration paths for its -representation of a networked service: - -- Target with an address -- Target with host sources - -A target with an address represents a target that is set up with a single IP -address or DNS name directly on the target resource. This mechanism provides -benefits for new Boundary users and users who do not need the flexibility -provided by hosts, host sets, and host catalogs. It is well suited for cases -where there are stand-alone hosts that should not be grouped together and -treated as equal from an access control point of view. Because of its -simplicity, using targets with an address is not recommended when there are a -either a large number of hosts and/or dynamic hosts. - -A target with host sources represents a target that has one or more [host -sets][] associated with it. It trades off the simplicity of directly setting an -address on a target with the flexibility and scalability of Hosts, Host Sets and -Host Catalogs for discovering and categorizing networked resources. We recommend -using targets with host sources for setting up Boundary in environments where a -significant number of resources exist. - -### Summary of resources - -- **[Account][]** : - A resource - that represents a unique set of credentials - issued from a configured [authentication method][] - which can be used to establish the identity of a [user][]. - -- **[Alias][]** : - A resource - that represents a globally unique, DNS-like string that is - associated with a destination resource, such as a [target][]. - -- **[Authentication method][]** : - A resource - that provides a mechanism - for [users][] to authenticate to Boundary. - -- **[Credential][]** : - A data structure containing one or more secrets - that binds an identity to a set of permissions or capabilities - on a [host][] for a [session][]. - -- **[Credential library][]** : - A resource - that provides [credentials][] - of the same type and same access level - from a single [credential store][]. - -- **[Credential store][]** : - A resource - that can retrieve, store, and potentially generate [credentials][] - of differing types and differing access levels. - It may also contain [credential libraries][]. - -- **[Group][]** : - A resource - that represents a collection of [users][] - which can be treated equally - for the purposes of access control. - -- **[Host][]** : - A resource - that represents a computing element with a network address - reachable from Boundary. - -- **[Host catalog][]** : - A resource - that contains [hosts][] and [host sets][]. - -- **[Host set][]** : - A resource - that represents a collection of [hosts][] - which are considered equivalent - for the purposes of access control. - -- **[Managed group][]** : - A resource that groups [accounts][] based on criteria - established by a third-party service backing the [authentication method][]. It - can be used as a principal in [roles][]. - -- **[Role][]** : - A resource - that contains a collection of [permissions][] - which are granted to any principal assigned to the role. - -- **[Session][]** : - A set of related connections between a [user][] and a [host][]. - A session may include a set of [credentials][] - which define the permissions granted to the [user][] on the [host][] for the duration - of the session. - -- **[Session recordings][]** : - A session recording represents a directory structure of files in an external object store that together are the recording of a single [session][] between a [user][] and a [target][]. - -- **[Scope][]** : - A [permission][] boundary modeled as a container. - -- **[Storage bucket][]** : - A storage bucket is used to store [session recordings][]. - The storage bucket represents a bucket in an external object store. - -- **[Storage policy][]** : - A storage policy defines the rules for storing - [session recordings][] in a [storage bucket][]. - The storage policy may specify the retention period for the recordings. - -- **[Target][]** : - A resource - that represents a networked service - with an associated set of permissions - a [user][] can connect to - and interact with - through Boundary - by way of a [session][]. - -- **[User][]** : - A resource - that represents an individual person or entity - for the purposes of access control. - -## Next steps - -When getting started with Boundary, -the first resource to look at should be [scopes][]. -Every other resources is either contained within a scope, -or contained within another resource -that is itself contained within a scope. -Refer to the [scopes] section to help you understand the structure of resources within Boundary. - -[iam]: https://en.wikipedia.org/wiki/Identity_management -[account]: /boundary/docs/domain-model/accounts -[accounts]: /boundary/docs/domain-model/accounts -[alias]: /boundary/docs/concepts/domain-model/aliases -[authentication method]: /boundary/docs/domain-model/auth-methods -[authentication methods]: /boundary/docs/domain-model/auth-methods -[credential library]: /boundary/docs/domain-model/credential-libraries -[credential libraries]: /boundary/docs/domain-model/credential-libraries -[credential store]: /boundary/docs/domain-model/credential-stores -[credential stores]: /boundary/docs/domain-model/credential-stores -[credential]: /boundary/docs/domain-model/credentials -[credentials]: /boundary/docs/domain-model/credentials -[group]: /boundary/docs/domain-model/groups -[groups]: /boundary/docs/domain-model/groups -[host catalog]: /boundary/docs/domain-model/host-catalogs -[host catalogs]: /boundary/docs/domain-model/host-catalogs -[host set]: /boundary/docs/domain-model/host-sets -[host sets]: /boundary/docs/domain-model/host-sets -[host]: /boundary/docs/domain-model/hosts -[hosts]: /boundary/docs/domain-model/hosts -[managed group]: /boundary/docs/domain-model/managed-groups -[role]: /boundary/docs/domain-model/roles -[roles]: /boundary/docs/domain-model/roles -[scope]: /boundary/docs/domain-model/scopes -[scopes]: /boundary/docs/domain-model/scopes -[project]: /boundary/docs/domain-model/scopes#projects -[session]: /boundary/docs/domain-model/sessions -[session recordings]: /boundary/docs/domain-model/session-recordings -[sessions]: /boundary/docs/domain-model/sessions -[storage bucket]: /boundary/docs/domain-model/storage-buckets -[storage policy]: /boundary/docs/concepts/domain-model/storage-policy -[target]: /boundary/docs/domain-model/targets -[targets]: /boundary/docs/domain-model/targets -[user]: /boundary/docs/domain-model/users -[users]: /boundary/docs/domain-model/users -[permission]: /boundary/docs/rbac -[permissions]: /boundary/docs/rbac diff --git a/website/content/docs/domain-model/managed-groups.mdx b/website/content/docs/domain-model/managed-groups.mdx deleted file mode 100644 index cf2d88cbe..000000000 --- a/website/content/docs/domain-model/managed-groups.mdx +++ /dev/null @@ -1,76 +0,0 @@ ---- -layout: docs -page_title: Managed group resource -description: >- - Learn about using the managed group resource to organize identity provider accounts and assign them grants. Understand how to configure OIDC and LDAP attributes. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Managed groups - -A managed group is a resource that represents a collection of [accounts][]. The -collection is formed by evaluating account information defined by the [auth -method][]'s identity provider against the managed group's configuration; members -cannot be managed manually. An account can be associated with zero or more -managed groups within the same [auth method][]. The managed group can be used as -a principal within [roles][] to assign grants. - -## Attributes - -All managed group types have the following configurable attributes: - -- `name` - (optional) - If set, the `name` must be unique within the account's auth method. - -- `description` - (optional) - -### OIDC managed group information and attributes - -Membership in OIDC managed groups is evaluated when the auth method is used for -authentication, based on information contained within the OIDC ID token and the -OIDC User Info endpoint. Every authentication will result in a new evaluation of -managed group membership. - -OIDC managed groups have the following additional attributes: - -- `filter` - (required) - A boolean expression defining a filter run against the provided information. - For general syntax information refer to the [filtering concepts][] page; for more specific information on the data available for this purpose refer to the [managed groups filtering][] page. - -[filtering concepts]: /boundary/docs/filtering -[managed groups filtering]: /boundary/docs/rbac/users/managed-groups - -### LDAP managed group information and attributes - -Membership in LDAP managed groups is evaluated when the auth method is used for -authentication, based on information contained within the LDAP server. Every -authentication results in a new evaluation of managed group membership. -LDAP managed groups have the following additional attributes: - -- `group-names` - (required) - A list of group names. - -## Referenced by - -- [Accounts][] -- [Auth method][] - -[accounts]: /boundary/docs/domain-model/accounts -[auth method]: /boundary/docs/domain-model/auth-methods -[roles]: /boundary/docs/domain-model/roles - -## Service API docs - -The following services are relevant to this resource: - -- [Managed group service](/boundary/api-docs/managed-group-service) - -## Tutorial - -Refer to the [Manage users and groups with HCP Boundary](/boundary/tutorials/hcp-administration/hcp-manage-users-groups) tutorial to learn how to complete user management related tasks. - -Refer to the [Identity management](/boundary/tutorials/identity-management) tutorials to learn about OIDC, LDAP, and managed groups. \ No newline at end of file diff --git a/website/content/docs/domain-model/roles.mdx b/website/content/docs/domain-model/roles.mdx deleted file mode 100644 index 11223db93..000000000 --- a/website/content/docs/domain-model/roles.mdx +++ /dev/null @@ -1,57 +0,0 @@ ---- -layout: docs -page_title: Role resource -description: >- - Learn about using the role resource to group permissions which are then granted to any principal assigned to the role. Understand role attributes. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Roles - -A role is a resource -that contains a collection of [permissions][] -which are granted to any principal assigned to the role. -[Users][], [groups][], and [managed groups][] are principals -which allows either to be assigned to a role. -A role can be defined within any [scope][]. -A role can be assigned to principals from any scope. - -## Attributes - -A role has the following configurable attributes: - -- `name` - (optional) - If set, the `name` must be unique within the role's [project][]. - -- `description` - (optional) - -## Referenced by - -- [Group][] -- [Managed group][] -- [Project][] -- [User][] - -[group]: /boundary/docs/domain-model/groups -[groups]: /boundary/docs/domain-model/groups -[managed group]: /boundary/docs/domain-model/managed-groups -[managed groups]: /boundary/docs/domain-model/managed-groups -[permissions]: /boundary/docs/rbac -[project]: /boundary/docs/domain-model/scopes#projects -[scope]: /boundary/docs/domain-model/scopes -[user]: /boundary/docs/domain-model/users -[users]: /boundary/docs/domain-model/users - -## Service API docs - -The following services are relevant to this resource: - -- [Role service](/boundary/api-docs/role-service) - -## Tutorial - -Refer to the [Managed Roles and Permissions with HCP Boundary](/boundary/tutorials/hcp-administration/hcp-manage-roles) tutorial to learn how to create a role in Boundary. diff --git a/website/content/docs/domain-model/scopes.mdx b/website/content/docs/domain-model/scopes.mdx deleted file mode 100644 index f0dc324a5..000000000 --- a/website/content/docs/domain-model/scopes.mdx +++ /dev/null @@ -1,152 +0,0 @@ ---- -layout: docs -page_title: Scope resource -description: >- - Learn about using the scope resource to organize and manage resources. Understand how to configure global, org, and project scopes to logically group resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Scopes - -A scope is a [permission][] boundary modeled as a container. -Scopes are groupings of resources. -Each scope is also a resource. -You create scopes to partition resources and then assign ownership of those resources to principals (users and groups). - -There are three types of scopes in Boundary: - -- A single [global][] scope is the outermost container. -- [Organizations][] (orgs) are contained by the `global` scope. -- [Projects][] are contained by orgs. - - -Within the software itself and elsewhere in the documentation, Boundary reliably uses "org" instead of "organization". Among other reasons, this removes ambiguity between different regional spellings of the word. It is spelled out here in the domain model for completeness and to ensure its intent is clear. - - -You can only associate certain resources with specific levels of scopes. -For example, while you can create users at the global or org level, you can only create targets within a project. -Refer to the table below for a list of resources and their valid scope types: - -| Resource | Valid scope types | -| -------------------- | -------------------- | -| Accounts | Global, org | -| Aliases | Global | -| Auth methods | Global, org | -| Auth tokens | Global, org | -| Billing | Global | -| Credential libraries | Project | -| Credentials | Project | -| Credential stores | Project | -| Groups | Global, org, project | -| Host catalogs | Project | -| Host sets | Project | -| Hosts | Project | -| Managed groups | Global, org | -| Storage policies | Global, org | -| Roles | Global, org, project | -| Scopes | Global, org, project | -| Session recordings | Global, org | -| Sessions | Project | -| Storage buckets | Global, org | -| Targets | Project | -| Users | Global, org | -| Workers | Global | - -You can nest projects within orgs to configure access to resources. - -For example, you may create an org scope called `IT-Support` that contains the users or groups that make up your IT department. -Then, you might create a project called `QA-Tests` that is contained within the`IT-Support` org. -You can add hosts, host sets, and targets to the `QA-Tests` project to control the resources your IT department can access. - -To more granularly control what resources your users can access, you can separate resources out into additional projects. -You can also assign permissons across scopes, if you want a user from one scope to have access to a resource that is not normally granted to that user's scope. - -## Global - -The global scope is the outermost scope. -There is always a single global scope -and it cannot be deleted. -You use the global scope for the initial administration, setup, and management of any org scopes. -The global scope can directly contain: -[users][], [groups][], [auth methods][], and [organizations][]. - -## Organizations - -An org is a scope directly contained by the global scope. -You can create multiple orgs within the global scope. -Orgs are used to contain identity and access management-related resources and projects. -An org can directly contain: -[users][], [groups][], [auth methods][], [roles][], and [projects][]. - -## Projects - -A project is a scope directly contained by an org scope. -You can create multiple projects within an org scope. -Projects are used to contain infrastructure-related resources. -A project can directly contain: -[roles][], [targets][], [host catalogs][], and [credential stores][]. - -## Attributes - -A scope has the following configurable attributes: - -- `name` - (optional) - If set, the `name` must be unique within the scope's parent scope. - -- `description` - (optional) - -## Storage policy association - -This feature requires HCP Boundary or Boundary Enterprise - -[Storage policies][] that are created in the global scope can be associated with any org scope. -However, a storage policy created in an org scope can only be associated with that org scope. -Changing the storage policy assigned to a scope can impact the resultant set of policy, but such a change only affects future recordings that you create within that scope or using that storage policy. - -## Referenced by - -- [Auth method][] -- [Credential store][] -- [Group][] -- [Host catalog][] -- [Role][] -- [Storage policies][] -- [Target][] -- [User][] - -[auth method]: /boundary/docs/domain-model/auth-methods -[auth methods]: /boundary/docs/domain-model/auth-methods -[credential store]: /boundary/docs/domain-model/credential-stores -[credential stores]: /boundary/docs/domain-model/credential-stores -[global]: /boundary/docs/domain-model/scopes#global -[group]: /boundary/docs/domain-model/groups -[groups]: /boundary/docs/domain-model/groups -[host catalog]: /boundary/docs/domain-model/host-catalogs -[host catalogs]: /boundary/docs/domain-model/host-catalogs -[organization]: /boundary/docs/domain-model/scopes#organizations -[organizations]: /boundary/docs/domain-model/scopes#organizations -[permission]: /boundary/docs/rbac -[permissions]: /boundary/docs/rbac -[project]: /boundary/docs/domain-model/scopes#projects -[projects]: /boundary/docs/domain-model/scopes#projects -[role]: /boundary/docs/domain-model/roles -[roles]: /boundary/docs/domain-model/roles -[storage policies]: /boundary/docs/domain-model/storage-policy -[target]: /boundary/docs/domain-model/targets -[targets]: /boundary/docs/domain-model/targets -[user]: /boundary/docs/domain-model/users -[users]: /boundary/docs/domain-model/users - -## Service API docs - -The following services are relevant to this resource: - -- [Scope service](/boundary/api-docs/scope-service) - -## Tutorial - -Refer to the [Manage Scopes with HCP Boundary](/boundary/tutorials/hcp-administration/hcp-manage-scopes) tutorial to learn how to create an org scope and a project scope. diff --git a/website/content/docs/domain-model/session-connections.mdx b/website/content/docs/domain-model/session-connections.mdx deleted file mode 100644 index 9e37dddd5..000000000 --- a/website/content/docs/domain-model/session-connections.mdx +++ /dev/null @@ -1,32 +0,0 @@ ---- -layout: docs -page_title: Session connection resource -description: >- - Learn how the session connection resource represents the proxy Boundary creates between user and host. Understand how connections are established and terminated. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Session connections - -A session connection represents an authorized proxy between a [user][] and a [host][]. After the creation of a -[session][], a user initiates a connection to a [target][] using the Boundary-provided -proxy information and [credentials][] (if applicable). - -Users can create multiple connections to a target, so long as the session has not expired or reached its maximum -number of connections. - -Session connections terminate on user exit from the proxy, or on termination of the session. - -## Referenced by - -- [Session][] - -[credentials]: /boundary/docs/domain-model/credentials -[host]: /boundary/docs/domain-model/hosts -[session]: /boundary/docs/domain-model/sessions -[target]: /boundary/docs/domain-model/targets -[user]: /boundary/docs/domain-model/users diff --git a/website/content/docs/domain-model/session-recordings.mdx b/website/content/docs/domain-model/session-recordings.mdx deleted file mode 100644 index 479d9d703..000000000 --- a/website/content/docs/domain-model/session-recordings.mdx +++ /dev/null @@ -1,122 +0,0 @@ ---- -layout: docs -page_title: Session recording resource -description: >- - Learn about using the session recording resource to audit user sessions. Understand how storage policy retention periods help you meet your compliance needs. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Session recordings - -This feature requires HCP Boundary or Boundary Enterprise - -A session recording represents a directory structure of -files in an external object store that together are the -recording of a single [session][] between a [user][] and a [target][]. - -The lifecycle of a session recording does not affect the -lifecycle of any files stored in the external object store. - -A session recording belongs to one and only one [storage bucket][]. -It is deleted when you delete the storage bucket it belongs to. - -A session recording is associated with the -target that the recorded session was against. -However, the lifecycle of a session recording is not tied to -the lifecycle of the target it is associated with. -If the target associated wtih a session recording is deleted, -the association to the target is deleted, not the session recording itself. - -Deleting a session recording does not delete or modify -any of the files in the external object store that the session recording represents. - -The session recording captures all interactions that take place during -the session, including metadata about the user, target and any -[hosts][], [host sets][], [host catalogs][], or [credentials][] used. - -A session recording represents [connections][] as separate -entities within the recording. Each recorded connection may also contain a recorded channel. This represents a single channel -in which the user interacted with the target in protocols that -multiplex user interactions over single connections. For example, -the SSH protocol multiplexes user interactions in a single -connection, so a user's interactions over SSH are recorded -in a channel. - -A session recording belongs to the scope of the storage bucket -it is stored in. The scope can be either the global scope or an [organization][] -scope. - -## Resultant set of policy calculation - -[Storage policies][] codify how long session recordings must be kept and when they should be deleted. -The resultant set of policy (RSoP) refers to the set of policy attributes that apply to a resource. -When you apply policies on multiple levels, the results can conflict. -Boundary evaluates each storage policy attribute individually, starting at the global scope and then evaluating any storage policies assigned to org scopes. - -In accordance with the RSoP, Boundary considers the following principles in order: - -1. Retention wins over deletion. The retention duration parameter guarantees that a session recording is retained for at least that duration. Before the retention duration has transpired, manual deletes will fail and Boundary will not attempt to automatically delete any session recordings. -2. Longest retention wins. When Boundary evaluates multiple storage policies, the longer retention duration parameter applies to the session recording. -3. The shortest deletion wins. When Boundary evaluates multiple storage policies, the shorter delete after duration parameter applies to the session recording. - -Each storage policy attribute also indicates whether the attribute can be overridden or not. -If the attribute cannot be overridden, Boundary stops evaluating the RSoP for that attribute at lower scopes. - -Changing the policy assigned to a scope or changing an attribute of a storage policy can impact the RSoP. -Such a change only affects future session recordings created in that scope or using that storage policy. -If a session recording is not in compliance with the current RSoP, the session recording API indicates that it is out of compliance with the current policy. - -### Examples - -In the following examples, Boundary determines the resultant set of policies using the `retain_for_days_overridable` and `delete_after_days_overridable` attributes. -A value of `true` indicates the number of days can be overridden, while a value of `false` indicates that it cannot be overridden. - -#### Example 1 -In this case, the retention value is derived from the org policy and the deletion value is derived from the global policy. - -| | Global policy | Org policy | Result policy | -| ------------------------------ | ------------- | ---------- | ------------- | -| Retain for days (Overridable) | 10 (True) | 20 (True) | 20 | -| Delete after days (Overridable) | 30 (True) | 40 (True) | 30 | - -#### Example 2 -In this case, Boundary ignores the org policy values because the global policy values are not overridable. - -| | Global policy | Org policy | Result policy | -| ------------------------------ | ------------- | ---------- | ------------- | -| Retain for days (Overridable) | 10 (False) | 20 (True) | 10 | -| Delete after days (Overridable) | 30 (False) | 40 (True) | 30 | - -#### Example 3 -In this case, the longest retention value is 30, and the shortest deletion value is 20. -However, the `delete_after_days` value cannot be less than the `retain_for_days` value. -Therefore, Boundary sets the deletion value to the retention value. - -| | Global policy | Org policy | Result policy | -| ------------------------------ | ------------- | ---------- | ------------- | -| Retain for days (Overridable) | 30 (True) | 20 (True) | 30 | -| Delete after days (Overridable) | 50 (True) | 20 (True) | 30 | - -For more information, refer to the [storage policy attributes](/boundary/docs/domain-model/storage-policy#attributes) documentation. - -## Service API docs - -The following services are relevant to this resource: - -- [Session recording service](/boundary/api-docs/session-recording-service) - -[connections]: /boundary/docs/domain-model/session-connections -[credentials]: /boundary/docs/domain-model/credentials -[host catalogs]: /boundary/docs/domain-model/host-catalogs -[host sets]: /boundary/docs/domain-model/host-sets -[hosts]: /boundary/docs/domain-model/hosts -[target]: /boundary/docs/domain-model/targets -[user]: /boundary/docs/domain-model/users -[organization]: /boundary/docs/domain-model/scopes#organizations -[session]: /boundary/docs/domain-model/sessions -[storage bucket]: /boundary/docs/domain-model/storage-buckets -[storage policies]: /boundary/docs/domain-model/storage-policy \ No newline at end of file diff --git a/website/content/docs/domain-model/sessions.mdx b/website/content/docs/domain-model/sessions.mdx deleted file mode 100644 index a2044c305..000000000 --- a/website/content/docs/domain-model/sessions.mdx +++ /dev/null @@ -1,113 +0,0 @@ ---- -layout: docs -page_title: Session resource -description: >- - Learn how the session resource is a set of connections between users and hosts that may include credentials. Understand how sessions are created and terminated. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Sessions - -A session is -a set of related [connections][] -between a [user][] and a [host][]. -A session may include a set of [credentials][] -which define the permissions granted to the [user][] on the [host][] for the duration -of the session. - -A user initiates a session -by requesting access to a [target][]. -If a user has the proper [permissions][], -a session is created -and the [expiration time][] and [connection limit][] -are set based on the [target's attributes][]. -If the target is associated with [credential libraries][], -credentials are retrieved and returned from each -credential library. -A snapshot of the data -relevant to authorizing the session -is also captured and stored in the Boundary data warehouse -when the session is created. - -Sessions are created in the [project][] of the corresponding target. -Deleting a project will terminate all of the active sessions in the project -but will not effect any session data in the data warehouse. -Historical data in the data warehouse is never deleted. - -## Termination - -A session is forcefully terminated when one of the following occurs: - -- The session reaches the time limit and expires. - -- An authorized user manually cancels the session. - -- Any resource associated with the session is deleted - or removed from the target. - This includes: the host, the [host set][], the [host catalog][], - a credential, a credential library, a [credential store][], - the target itself, the project, the [organization][], - the user, the user's [account][], or the account's [authentication method][]. - -In addition to the above, -a session terminates non-forcefully -when the user closes all connections -and no additional connections are allowed -because of a connection limit. - -Any credentials associated with the session are revoked when the session is -terminated. - -Permissions are only evaluated at session establishment. -Changes to a user's permissions do not effect existing sessions. - -## Referenced by - -- [Project][] -- [Credential][] -- [Host set][] -- [Target][] - -[expiration time]: /boundary/docs/domain-model/targets#session_max_seconds -[connection limit]: /boundary/docs/domain-model/targets#session_connection_limit -[target's attributes]: /boundary/docs/domain-model/targets#tcp-target-attributes -[account]: /boundary/docs/domain-model/accounts -[accounts]: /boundary/docs/domain-model/accounts -[authentication method]: /boundary/docs/domain-model/auth-methods -[authentication methods]: /boundary/docs/domain-model/auth-methods -[connections]: /boundary/docs/domain-model/session-connections -[credential library]: /boundary/docs/domain-model/credential-libraries -[credential libraries]: /boundary/docs/domain-model/credential-libraries -[credential store]: /boundary/docs/domain-model/credential-stores -[credential stores]: /boundary/docs/domain-model/credential-stores -[credential]: /boundary/docs/domain-model/credentials -[credentials]: /boundary/docs/domain-model/credentials -[host catalog]: /boundary/docs/domain-model/host-catalogs -[host catalogs]: /boundary/docs/domain-model/host-catalogs -[host set]: /boundary/docs/domain-model/host-sets -[host sets]: /boundary/docs/domain-model/host-sets -[host]: /boundary/docs/domain-model/hosts -[hosts]: /boundary/docs/domain-model/hosts -[target]: /boundary/docs/domain-model/targets -[targets]: /boundary/docs/domain-model/targets -[user]: /boundary/docs/domain-model/users -[users]: /boundary/docs/domain-model/users -[organization]: /boundary/docs/domain-model/scopes#organizations -[organizations]: /boundary/docs/domain-model/scopes#organizations -[project]: /boundary/docs/domain-model/scopes#projects -[projects]: /boundary/docs/domain-model/scopes#projects -[permissions]: /boundary/docs/rbac - -## Service API docs - -The following services are relevant to this resource: - -- [Session service](/boundary/api-docs/session-service) - -## Tutorial - -Refer to the [Manage Sessions with HCP Boundary](/boundary/tutorials/hcp-administration/hcp-manage-sessions) tutorial to learn how to start, view, and cancel a session. diff --git a/website/content/docs/domain-model/storage-buckets.mdx b/website/content/docs/domain-model/storage-buckets.mdx deleted file mode 100644 index ab09de876..000000000 --- a/website/content/docs/domain-model/storage-buckets.mdx +++ /dev/null @@ -1,99 +0,0 @@ ---- -layout: docs -page_title: Storage bucket resource -description: >- - Learn how to use the storage bucket resource to retain session recordings for compliance. Understand storage bucket attributes and how scopes affect storage. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Storage buckets - -This feature requires HCP Boundary or Boundary Enterprise - -A resource known as a storage bucket is used to store the [session recordings][]. -The storage bucket represents a bucket in an external object store. -A storage bucket's name is optional, but it must be unique if you define one. -Storage buckets can be associated with zero to many [targets][]. - -A storage bucket exists in either the Global scope or an Org scope. -A storage bucket that is associated with the Global scope can be associated with any target. -However, a storage bucket in an Org scope can only be associated with targets in a project from the same Org scope. -Any storage buckets associated with an Org scope are deleted when the Org itself is deleted. - -Deleting a storage bucket in Boundary does not delete the bucket in the external object store, nor does it delete the recorded sessions in the bucket. -The storage bucket's lifecycle does not affect the lifecycle of the bucket in the external object store. -Any session recording metadata that is attached to the storage bucket is deleted, when the storage bucket is deleted. - -## Attributes - -A storage bucket has the following configurable attributes: - -- `name` - (Optional) The name of the resource in Boundary. -The name is optional, but if you set it, it must be unique within the scope ID. -- `description` - (Optional) A description of the resource. -- `bucket_name` - (Required) The name of the bucket in the external object store. -You must provide a name for the bucket in the external object store. -- `bucket_prefix` - (Optional) The prefix used to organize the data that is stored in the external object store. -- `plugin_name` - (Required) The plugin name must reference an installed plugin. -- `worker_filter` - (Required) A filter to identify the worker or workers that can process requests for the storage bucket. -- `attributes` - (Optional) A collection of fields the plugin uses to interface with the backing service. -- `secrets` - (Optional) A collection of sensitive fields, like [credentials][], which the plugin uses to interface with the backing service. -These fields are write only. - -## AWS S3 attributes and secrets - -At this time, the only supported storage for storage buckets is AWS S3. -In AWS S3, a storage bucket contains the bucket name, region, and optional prefix, as well as any credentials needed to access the bucket, such as the secret key. - -The AWS S3 storage bucket can use static or dynamic credentials. -You can configure static credentials using an access key and secret key or dynamic credentials using the AWS [`AssumeRole` API](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole). - -### Attributes - -AWS S3 buckets have the following attributes: - -- `region` - (Required) The S3 region to configure the storage bucket in. -- `disable_credential_rotation` - (Optional for static credentials, Required for dynamic credentials) If set to `true`, credential rotation is not performed. -By default, the AWS plugin [rotates credentials](https://github.com/hashicorp/boundary-plugin-aws/blob/main/README.md#credential-rotation). -Note that this attribute is required, if you use dynamic credentials. -- `role_arn` - (Optional) The ARN (Amazon Resource Name) role that is attached to the EC2 instance that the self-managed worker runs on. -The Role ARN is required if the AWS S3 bucket is configured to use dynamic credentials using `AssumeRole`. -- `role_external_id` - (Optional) A required value if you delegate third party access to your AWS resources. -You can configure this value if your AWS S3 bucket is configured to use dynamic credentials. -For more information, refer to the AWS documentation for [How to use an external ID when granting access to your AWS resources to a third party](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html). -- `role_session_name`: (Optional) A unique identifier for the AWS session. -You can use this value to control how IAM principals and applications name their role sesions when they assume an IAM role. -By providing a session name, you enable tracking session actions in AWS CloudTrail logs. -You can configure this value if your AWS S3 bucket is configured to use dynamic credentials. -For more information, refer to the AWS documentation for [Logging IAM and AWS STS API calls with AWS CloudTrail](https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html). -- `role_tags`: (Optional) An object with key-value pair attributes that is passed when you assume an IAM role. -For more information, refer to the AWS documentation for [Passing session tags in AWS STS](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html). - -### Secrets - -AWS S3 buckets can have the following secrets: - -- `access_key_id` - (Optional) The access key ID for the IAM user to use with this storage bucket. -Access keys are required if the AWS S3 bucket is configured to use static credentials. -- `secret_access_key` - (Optional) The secret access key for the IAM user to use with this storage bucket. -Secret access keys are required if the AWS S3 bucket is configured to use static credentials. - -## Referenced by - -- [Session recordings](/boundary/docs/domain-model/session-recordings) -- [Create a storage bucket](/boundary/docs/session-recording/configuration/create-storage-bucket) - -## Service API docs - -The following services are relevant to this resource: - -- [Session recording service](/boundary/api-docs/session-recording-service) - -[session recordings]: /boundary/docs/domain-model/session-recordings -[credentials]: /boundary/docs/domain-model/credentials -[targets]: /boundary/docs/domain-model/targets -[scope]: /boundary/docs/domain-model/scopes \ No newline at end of file diff --git a/website/content/docs/domain-model/storage-policy.mdx b/website/content/docs/domain-model/storage-policy.mdx deleted file mode 100644 index ad9219f07..000000000 --- a/website/content/docs/domain-model/storage-policy.mdx +++ /dev/null @@ -1,66 +0,0 @@ ---- -layout: docs -page_title: Storage policy resource -description: >- - Learn about using the storage policy resource to manage session recording retention. Understand how to configure policies for scopes and specify retention. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Storage policies - -This feature requires HCP Boundary or Boundary Enterprise - -A resource known as a storage policy is used to codify how long [session recordings][] must be kept and when they should be deleted. -A storage policy's name is optional, but it must be unique if you define one. -Storage policies can only be assigned to the global [scope][] or an org scope. -You must [attach][] storage policies to a scope (global or a specific org) to take effect. - -A storage policy exists in either the global scope or an org scope. -Storage policies that are created in the global scope can be associated with any org scope. -However, a storage policy created in an org scope can only be associated with that org scope. -Any storage policies associated with an org scope are deleted when you delete the org itself. - -## Attributes - -A storage policy has the following configurable attributes: - -- `name` - (Optional) The name of the resource in Boundary. -The name is optional, but if you set it, it must be unique within the scope ID. -If you do not provide a name, Boundary uses the storage policy ID as the default name. -- `description` - (Optional) A description of the resource. -- `retain_for_days` - (Optional) The number of days a session recording must be kept. -A value of `-1` indicates an infinite retention. -- `retain_for_days_overridable` - (Optional) Indicates that a lower scope can override the `retain_for_days` attribute value. -The default value is `true`. -- `delete_after_days` - (Optional) The number of days after which a session recording should be deleted. -- `delete_after_days_overridable` - (Optional) Indicates that a lower scope can override the `delete_after_days` attribute value. -The default value is `true`. - -## Retention and deletion guidelines - -- Setting the `retain_for_days` value to `-1` (infinity) requires the `delete_after_days` value to be set to `0`. -- If you set the `delete_after_days` value, it must be greater than or equal to 0. -- The `delete_after_days` value must be greater than or equal to the `retain_for_days` value, unless you set `delete_after_days` to `0`. -- You cannot set the `retain_for_days` and `delete_after_days` values to 0. -- Changing an attribute of a storage policy that is assigned to a scope can impact the resultant set of policy. -However, such a change only affects future recordings created within that scope or using that storage policy. - -## Referenced by - -- [Scopes](/boundary/docs/domain-model/scopes) -- [Session recordings](/boundary/docs/domain-model/session-recordings) - -## Service API docs - -The following services are relevant to this resource: - -- [Scope service](/boundary/api-docs/scope-service) -- [Policy service](/boundary/api-docs/policy-service) - -[attach]: /boundary/docs/session-recording/compliance/configure-storage-policy#attach-storage-policies-to-a-scope -[session recordings]: /boundary/docs/domain-model/session-recordings -[scope]: /boundary/docs/domain-model/scopes diff --git a/website/content/docs/domain-model/targets.mdx b/website/content/docs/domain-model/targets.mdx deleted file mode 100644 index d1c77b9ff..000000000 --- a/website/content/docs/domain-model/targets.mdx +++ /dev/null @@ -1,196 +0,0 @@ ---- -layout: docs -page_title: Target resource -description: >- - Learn about using the target resource to configure a networked service a user can connect to. Understand the TCP and SSH target type requirements and attributes. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Targets - -A target is a resource -that represents a networked service -with an associated set of permissions -a [user][] can connect to -and interact with -through Boundary -by way of a session. - -A target can only be defined within a [project][]. -A target can contain references to [host sets][] from [host catalogs][] -which belong to the same project as the target. -A target can contain references to [credential libraries][] -from [credential stores][] which belong to the same project as the target. - -A target can contain an address -which is used by a session to connect to a networked resource. -A target cannot have an address and also reference host sources. - -A user must be assigned a [role][] with the `authorize-session` [permission][] -for the target to -establish a session with a networked resource by way of an address, -or host in any host set referenced by the target. - -## Attributes - -A target has the following configurable attributes: - -- `name` - (required) - The `name` must be unique within the target's project. - -- `description` - (optional) - An optional description of the target for identificaiton purposes. - -- `address` - (optional) - This value represents a network resource address and is used when establishing a session. - It does not accept a port, only an IP address or DNS name. - - If you set a target address for RDP targets that use Kerberos authentication, use the target's hostname and append the domain to it, for example `target-hostname.mydomain.com`. For RDP targets that use NTLM authentication, set the target address to the target's IP address. - -- `default_client_port` - (optional) - Represents a local port that you want Boundary to listen to by default when someone initiates a session on the client. - -- `egress_worker_filter` - (optional) - A boolean expression to [filter][] which egress workers can handle sessions - for this target. - Egress worker filters determine which workers are used to access targets. - You can configure an egress filter to enable [multi-hop](/boundary/docs/workers/multi-hop) connections. - If you do not configure an egress filter, then Boundary uses a single worker to connect to the controller. - -- `ingress_worker_filter` - (optional) HCP/ENT - A boolean expression to [filter][] which ingress workers can handle sessions - for this target. - Ingress worker filters determine which workers you connect with to initiate a session. - If you do not configure an ingress filter, Boundary selects a front line worker for the session. - A front line worker is any worker directly connected to the control plane; for HCP Boundary this will be an HCP worker. - -- `session_connection_limit` - (required) - The cumulative number of connections allowed during a session. - A -1 value means no limit. - The default is -1. - The value must be greater than 0 or exactly -1. - -- `session_max_seconds` - (required) - The maximum duration of an individual session between the user and the target. - All connections for a session are closed - and the session is terminated - when a session reaches the maximum duration. - The default is 8 hours (28800 seconds). - This value must be greater than 0. - If you do not specfiy a maximum duration, Boundary uses the default value. - -- `with-alias-authorize-session-host-id` (Optional) - The authorize session host ID flag that an alias uses when you create the alias at the same time as you create the target. - -- `with-alias-scope-id` (Optional) - The scope ID for the alias to be created in, when you create it at the same time as you create the target. - The default scope is global. - -- `with-alias-value` (Optional) - The string that you want to use as the alias to represent the target, when you create an alias at the same time as you create the target. - -## Target types - -Boundary supports RDP, SSH, and TCP target types. -RDP and SSH targets **must** have at least one injected application credential to establish the connection. -A TCP target **cannot** have any injected application credentials. - -Note the following target type requirements: - -- **To use brokered credentials to connect to a target that runs SSH**: you must use a `tcp` target type. -- **To use injected application credentials to connect to a target that runs SSH**: you must use an `ssh` target type. -- **To enable session recording for a target that runs SSH**: you must use injected application credentials and an `ssh` target type. - -You can configure brokered credentials for use with SSH targets for purposes other than establishing the initial SSH connection. - -### RDP target attributes - -This feature requires HCP Boundary or Boundary Enterprise - -RDP targets use injected application credentials to authenticate an RDP session between the client and end host in Windows environments that use Active Directory authentication. -Injected credentials allow users to securely connect to remote hosts using RDP, while never being in the possession of a valid credential for that target host. - -For more information about known limitations, configuration requirements, and software compatibility for the RDP credential injection beta, refer to [RDP credential injection compatibiity](/boundary/docs/credentials/rdp-testing-and-compatibility-matrix). - -RDP targets have the following additional attribute: - -- `default_port` - (optional) - The default port to set on this target. - If this is not specified the default port will be 3389. - -### SSH target attributes - -This feature requires HCP Boundary or Boundary Enterprise - -SSH targets use injected application credentials to authenticate an SSH session between the client and end host. -Injected credentials allow users to securely connect to remote hosts using SSH, while never being in the possession of a valid credential for that target host. -The injected credentials can be a username/password or username/private key credential from Vault credential libraries or they can be static [credentials][] or an SSH certificate from Vault SSH credential libraries. - -SSH targets require you to configure injected credentials to create a session. -If you attempt to create a session against an SSH target without configuring injected credentials, it results in an error. -However, you can use brokered credentials with SSH targets for purposes other than establishing the initial SSH connection. - -SSH targets have the following additional attributes: - -- `default_port` - (optional) - The default port to set on this target. - If this is not specified the default port will be 22. - -- `enable_session_recording` - (optional) - Set to `true` to enable [session recordings][] for a target. - If you enable session recording, the `storage_bucket_id` is required. - -- `storage_bucket_id` - (optional) - Designates the storage bucket to be used for session recording. - This attribute is required if you set `enable_session_recording` to `true`. - -### TCP target attributes - -TCP targets have the following additional attribute: - -- `default_port` - (required) - The default port to set on this target. - -## Referenced by - -- [Credential library][] -- [Host set][] -- [Project][] -- [Session][] -- [Session recordings][] -- [Worker filtering][] - -[credentials]: /boundary/docs/domain-model/credentials -[credential library]: /boundary/docs/domain-model/credential-libraries -[credential libraries]: /boundary/docs/domain-model/credential-libraries -[credential store]: /boundary/docs/domain-model/credential-stores -[credential stores]: /boundary/docs/domain-model/credential-stores -[host catalog]: /boundary/docs/domain-model/host-catalogs -[host catalogs]: /boundary/docs/domain-model/host-catalogs -[host set]: /boundary/docs/domain-model/host-sets -[host sets]: /boundary/docs/domain-model/host-sets -[host]: /boundary/docs/domain-model/hosts -[hosts]: /boundary/docs/domain-model/hosts -[permission]: /boundary/docs/rbac -[permissions]: /boundary/docs/rbac -[project]: /boundary/docs/domain-model/scopes#projects -[projects]: /boundary/docs/domain-model/scopes#projects -[role]: /boundary/docs/domain-model/roles -[roles]: /boundary/docs/domain-model/roles -[session]: /boundary/docs/domain-model/sessions -[sessions]: /boundary/docs/domain-model/sessions -[session recordings]: /boundary/docs/domain-model/session-recordings -[filter]: /boundary/docs/workers/worker-tags -[worker filtering]: /boundary/docs/workers/worker-tags -[user]: /boundary/docs/domain-model/users -[users]: /boundary/docs/domain-model/users - -## Service API docs - -The following services are relevant to this resource: - -- [Target service](/boundary/api-docs/target-service) diff --git a/website/content/docs/domain-model/users.mdx b/website/content/docs/domain-model/users.mdx deleted file mode 100644 index 84da1c648..000000000 --- a/website/content/docs/domain-model/users.mdx +++ /dev/null @@ -1,65 +0,0 @@ ---- -layout: docs -page_title: User resource -description: >- - Learn how the user resource identifies a person or entity for access control purposes. Understand how to assign groups and roles so users inherit permissions. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Users - -A user is a resource -that represents an individual person or entity -for the purposes of access control. -A user can be associated with zero or more [accounts][]. -A user authenticates to Boundary through an associated account -and must be associated with at least one account before they can access Boundary. - -A user is also a principal -which allows it to be assigned to [roles][]. -A user receives all the [permissions][] -of the roles assigned directly to the user -and all the permissions of roles assigned to [groups][] the user is in. - -Users can be defined at either a [global][] or [organization][] [scope][]. -A user can only be associated with accounts from an [auth method][] -configured in the same scope. - -## Attributes - -A user has the following configurable attributes: - -- `name` - (optional) - If set, the `name` must be unique within the user's immediate parent scope. - -- `description` - (optional) - -## Referenced by - -- [Account][] -- [Global][] -- [Group][] -- [Organization][] -- [Role][] - -[account]: /boundary/docs/domain-model/accounts -[accounts]: /boundary/docs/domain-model/accounts -[auth method]: /boundary/docs/domain-model/auth-methods -[global]: /boundary/docs/domain-model/scopes#global -[group]: /boundary/docs/domain-model/groups -[groups]: /boundary/docs/domain-model/groups -[organization]: /boundary/docs/domain-model/scopes#organizations -[permissions]: /boundary/docs/rbac -[role]: /boundary/docs/domain-model/roles -[roles]: /boundary/docs/domain-model/roles -[scope]: /boundary/docs/domain-model/scopes - -## Service API docs - -The following services are relevant to this resource: - -- [User service](/boundary/api-docs/user-service) diff --git a/website/content/docs/enterprise/automated-license-reporting.mdx b/website/content/docs/enterprise/automated-license-reporting.mdx deleted file mode 100644 index 60c7eeb6a..000000000 --- a/website/content/docs/enterprise/automated-license-reporting.mdx +++ /dev/null @@ -1,160 +0,0 @@ ---- -layout: docs -page_title: Automated license utilization reporting -description: >- - Learn what data HashiCorp collects to meter Enterprise license utilization. Enable reporting or opt out. Review sample payloads and logs. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Automated license utilization reporting - -Automated license utilization reporting sends license utilization data to HashiCorp without requiring you to manually collect and report them. It also lets you review your license usage with the monitoring solution you already use (for example Splunk, Datadog, or others) so you can optimize and manage your deployments. Use these reports to understand how much more you can deploy under your current contract, protect against overutilization, and budget for predicted consumption. - -Automated reporting shares the minimum data required to validate license utilization as defined in our contracts. They consist of mostly computed metrics and will never contain Personal Identifiable Information (PII) or other sensitive information. Automated reporting shares the data with HashiCorp using a secure, unidirectional HTTPS API and makes an auditable record in the product logs each time it submits a report. The reporting process is GDPR compliant and submits reports roughly once every 24 hours. - -## Enable automated reporting - -To enable automated reporting, you need to make sure that outbound network traffic is configured correctly and [upgrade](#2-upgrade) your enterprise product to a version that supports it. If your installation is air-gapped or network settings are not in place, automated reporting will not work. - -### 1. Allow outbound HTTPS traffic on port 443 - -Make sure that your network allows HTTPS egress on port 443 from https://reporting.hashicorp.services by allow-listing the following IP addresses: - -- 100.20.70.12 -- 35.166.5.222 -- 23.95.85.111 -- 44.215.244.1 - -### 2. Upgrade - -Upgrade to a release that supports license utilization reporting. These releases include: Release 0.13.0 and later. - -### 3. Check logs - -Automatic license utilization reporting will start sending data within roughly 24 hours. Check the product logs for records that the data sent successfully. -The records are sent as system events. -You can use [`file sync`](/boundary/docs/configuration/events/file) to configure a file where Boundary logs events. - -```json -{ - "id": "ZWqRK7XlnN", - "source": "https://hashicorp.com/boundary/Test_InitSysEventer", - "specversion": "1.0", - "type": "system", - "data": { - "version": "v0.1", - "op": "census.(censusJob).Run", - "data": { - "msg": "the following snapshot has been generated {\"snapshot_version\":1,\"id\":{\"ULID\":\"0001J50MM0QGR5KN21FVGYJVP9\",\"Timestamp\":\"2023-05-02T00:00:00Z\"},\"schema_version\":\"1.0.0\",\"service\":\"boundary\",\"process_id\":\"01H2B2KY823KYPVAVC02V65TZV\",\"metrics\":{\"boundary.sessions\":{\"key\":\"boundary.sessions\",\"value\":2,\"kind\":\"counter\",\"mode\":\"write\",\"description\":\"Number of pending sessions from previous day\"}}}" - } - }, - "datacontentype": "application/cloudevents", - "time": "2023-06-07T10:01:53.158933-04:00" -} -``` - -If your installation is air-gapped or your network doesn’t allow the correct egress, logs will show an error. - -```json -{ - "id": "VQyF5VzbTT", - "source": "https://hashicorp.com/boundary/Test_InitSysEventer", - "specversion": "1.0", - "type": "error", - "data": { - "error": "census.(censusJob).Run: unable to export snapshot through agent: unknown: error #0", - "error_fields": { - "Code": 0, - "Msg": "unable to export snapshot through agent", - "Op": "census.(censusJob).Run", - "Wrapped": null - }, - "id": "e_BgPs9hUMxw", - "version": "v0.1", - "op": "census.(censusJob).Run" - }, - "datacontentype": "application/cloudevents", - "time": "2023-06-07T10:21:48.221494-04:00" -} -``` - -In this case, reconfigure your network to allow egress and check back in roughly 24 hours. - -## Opt out - -If your installation is air-gapped or you want to manually collect and report on the same license utilization metrics, you can opt-out of automated reporting. - -Manually reporting these metrics can be time consuming. Opting out of automated reporting does not mean that you also opt out from sending license utilization metrics. Customers who opt out of automated reporting will still be required to manually collect and send license utilization metrics to HashiCorp. - -If you are considering opting out because you’re worried about the data, we strongly recommend that you review the [example payloads](#example-payloads) before opting out. If you have concerns with any of the automatically-reported data please bring them to your account manager. - -You have two options to opt out of automated reporting: -HCL configuration (recommended) -Environment variable (requires restart) - -Opting out in your product’s configuration file doesn’t require a system restart, and is the method we recommend. Add the following block to your `configuration.hcl` file. - -```hcl -reporting { - license { - enabled = false - } -} -``` - -If you need to, you can also opt out using an environment variable, which will provide a startup message confirming that you have disabled automated reporting. This option requires a system restart. - -Set the following environment variable. - -``` -$ export OPTOUT_LICENSE_REPORTING=true -``` - -Now restart your system. - -Check your product logs roughly 24 hours after opting out to make sure that the system isn’t trying to send reports. - -If your configuration file and environment variable differ, the environment variable setting will take precedence. - -## Example payloads - -HashiCorp collects the following utilization data as JSON payloads: -`exporter_version` - The version of the licensing exporter. - -Product payload description: - -Sessions is queried from the Boundary store, counts over the last X days. - -```json -"metrics": { - "boundary.sessions": { - "key": "boundary.sessions", - "value": 0, - "mode": "write" - } -} -``` -Product payload description: - -Monthly active users tracks the number of unique, active users in a month. -It is a cumulative value for the entire month. -The start time is included in the value, the end time is excluded. - -```json -"metrics": { - "boundary.monthly_active_users": { - "key": "boundary.monthly_active_users", - "value": 8, - "mode": "write", - } -}, -"metadata": { - "complete": "true", - "end_time": "2023-04-01T00:00:00Z", - "start_time": "2023-03-01T00.00:00Z" -} -``` \ No newline at end of file diff --git a/website/content/docs/enterprise/index.mdx b/website/content/docs/enterprise/index.mdx deleted file mode 100644 index d08165b5b..000000000 --- a/website/content/docs/enterprise/index.mdx +++ /dev/null @@ -1,37 +0,0 @@ ---- -layout: docs -page_title: Boundary Enterprise overview -description: >- - Learn about Boundary Enterprise. Discover resources to upgrade from Community Edition or request assistance. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary Enterprise - -Boundary Enterprise has features that are not available in the Community Edition of the product, as well as support. -The Enterprise version is self-managed in your environment, making it the perfect choice for agencies that are not able to use SaaS products for compliance or regulatory reasons. -The [Deploy Boundary](/boundary/docs/deploy/self-managed) section can help you build a self-managed production environment using Boundary Enterprise. - -You must obtain a [license](/boundary/docs/enterprise/licensing) to use Boundary Enterprise. - -You can enable or opt out of automated license reporting. -Refer to [Automated license utilization reporting](/boundary/docs/enterprise/automated-license-reporting) for more information. - -## Upgrade from Boundary Community Edition - -To upgrade from the Community Edition of Boundary to Boundary Enterprise, complete the following steps: - -1. [Contact sales](https://hashicorp.com/contact-sales) to procure a Boundary Enterprise license. -1. [Upgrade Boundary](/boundary/tutorials/self-managed-deployment/upgrade-version) using a Boundary Enterprise binary. -1. [Activate the license](/boundary/docs/enterprise/licensing). - -## Support - -The best way to get assistance is to open a ticket through our [support portal](https://support.hashicorp.com). -Sign in or create an account to create a ticket. - -For further assistance, scroll down the support page to find other resources including reference guides, deployment guides, tutorials, and a community forum. \ No newline at end of file diff --git a/website/content/docs/enterprise/licensing.mdx b/website/content/docs/enterprise/licensing.mdx deleted file mode 100644 index 201ab4094..000000000 --- a/website/content/docs/enterprise/licensing.mdx +++ /dev/null @@ -1,61 +0,0 @@ ---- -layout: docs -page_title: License Boundary Enterprise -description: >- - Learn how to enable Boundary Enterprise with a valid license. Request access from an account team to enable enterprise features. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# License Boundary Enterprise - -The Boundary Enterprise binaries require a license key to enforce entitlements and time restrictions according to your contractual agreement. -Once purchased, your HashiCorp account team send you a valid Boundary license for environment activation. -If you don't yet have an acccount team, but are interested in Boundary Enterprise, you can [contact sales](https://www.hashicorp.com/contact-sales). - -Once you have received your valid Boundary license, there are two options for enabling Boundary Enterprise: - -1. You may set the enterprise license for Boundary using an environment variable. -Set the `BOUNDARY_LICENSE` environment variable to the license key value you received: - - `$ export BOUNDARY_LICENSE=02MV4UU43BK5...` - - or - - `$ BOUNDARY_LICENSE=file:///folder_path/license.hclic` - -1. You may specify the enterprise license key in the Boundary controller configuration using the `license` attribute in the `controller` block. -You can either specify the raw license key or the path to a file containing the license key. -Refer to the sample configurations below: - - **Sample #1** - - ```hcl - controller { - name = "controller" - description = "controller" - database { - url = "postgresql://boundary:PASSWORD@127.0.0.1:5432/boundary" - } - public_cluster_addr = "boundary.domain" - license = "file:///folder_path/license.hclic" - } - ``` - **Sample #2** - - ```hcl - controller { - name = "controller" - description = "controller" - database { - url = "postgresql://boundary:PASSWORD@127.0.0.1:5432/boundary" - } - public_cluster_addr = "boundary.domain" - license = "02MV4UU43BK5..." - } - ``` - - Refer to the [controller](/boundary/docs/configuration/controller) configuration documentation for more information. \ No newline at end of file diff --git a/website/content/docs/enterprise/supported-versions.mdx b/website/content/docs/enterprise/supported-versions.mdx deleted file mode 100644 index f2e35ddde..000000000 --- a/website/content/docs/enterprise/supported-versions.mdx +++ /dev/null @@ -1,67 +0,0 @@ ---- -layout: docs -page_title: Boundary Enterprise supported version policies -description: >- - Learn about Enterprise support policies. Includes information about support periods, control plane and worker compatibility, and PostgreSQL database versions. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary Enterprise supported versions policy - -Self-managed Boundary Enterprise environments function optimally when workers and controllers are running the same version. -The following sections outline support periods, control plane & worker compatibility and Postgres DB version support. - -## Support periods - -Generally Available (GA) releases of Boundary Enterprise are consistent with [HashiCorp’s Support Period and End-of-Life (EOL) Policy](https://support.hashicorp.com/hc/en-us/articles/360021185113-Support-Period-and-End-of-Life-EOL-Policy). -Boundary Enterprise releases will be supported for up to two (2) years since release. -Eligible code-fixes and hot-fixes are provided via a new minor release (Z) on top of the latest “major release” branch, for up to two (2) releases from the most current major release. -A major release is identified by a change in the first (X) or second (Y) digit in the following versioning nomenclature: Version X.Y.Z. - -As a best practice, HashiCorp expects customers to stay current within two (2) releases from the latest major release in order to receive optimal support. -Release updates for Boundary Enterprise can be found at https://releases.hashicorp.com. - -## Control plane and worker compatibility - -Although major releases are supported as outlined within the support periods section above, within a Boundary Enterprise deployment API backwards compatibility is only supported between the control plane and workers from the prior “major release”. Using a worker with version that is newer than the control plane they connect to is not supported. -All workers within an environment must be on the same version. - -For example, Boundary workers version 0.17.0 are compatible with a Boundary control plane running Boundary 0.18.0. -However, they will not have compatibility once the control plane is updated to version 0.19.0 or above. -Customers are recommended to run the latest versions of Boundary in order to leverage the newest features and bug fixes. - -## Control plane and client/cli compatibility - -The supported version compatibility between Boundary's control plane and Boundary clients/CLI is the same as control plane and worker compatibility. Within a Boundary Enterprise deployment API backwards compatibility is only supported between the control plane and clients from the prior “major release”. Using clients on newer versions than the control plane they are registered with is not supported. - -For example, Boundary clients version 0.17.0 are compatible with a Boundary control plane running Boundary 0.18.0. -However, they will not have compatibility once the control plane is updated to version 0.19.0 or above. -Boundary clients version 0.19.0 are not compatible with a Boundary control plane running Boundary 0.18.0 or lower. -Customers are recommended to run the latest versions of Boundary in order to leverage the newest features and bug fixes. - -The Desktop client uses a different numbering scheme than the CLI and control plane. -Refer to the table for the Desktop version that corresponds to the control plane version. - -| Desktop version | Control plane version | -| --------------- | ----------- | -| 2.3.0 | 0.19.0 | -| 2.2.0 | 0.18.0 | -| 2.1.0 | 0.17.0 | -| 2.0.3 | 0.16.0 | -| 2.0.2 | 0.15.3 | -| 2.0.1 | 0.15.1 | -| 2.0.0 | 0.15.0 | - -For example, the Desktop version 2.1.0 is compatible with version 0.18.0 of the control plane. -But when the control plane is upgraded to 0.19.0, version 2.1.0 is no longer officially supported. - -To view the Desktop version along with the corresponding CLI and control plane version, click **Boundary**, and then click **About Boundary** in the Desktop client. - -## PostgreSQL support policy - -Boundary Enterprise will only support PostgreSQL version 13 and above at launch. -On an ongoing basis, Boundary will end support for a PostgreSQL version one (1) year prior to its EOL as documented on PostgreSQL’s versioning policy website. diff --git a/website/content/docs/errors/index.mdx b/website/content/docs/errors/index.mdx deleted file mode 100644 index f1c2c4a04..000000000 --- a/website/content/docs/errors/index.mdx +++ /dev/null @@ -1,124 +0,0 @@ ---- -layout: docs -page_title: Common error messages -description: >- - View common Boundary error messages and learn how to troubleshoot them. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Common error messages - -When installing and running Boundary, there are some common messages you might see. Usually they indicate an issue in your network or in your IAM -configuration. Some of the more common errors and their solutions are listed below. If you think you have found a bug, please report the issue on -[github](https://github.com/hashicorp/boundary/issues/new/choose). - -To troubleshoot specific issues with the Client Agent or transparent sessions, refer to the following topics: - -- [Troubleshoot issues with the Client Agent](/boundary/docs/client-agent/troubleshoot) -- [Client Agent software conflicts](/boundary/docs/client-agent/conflicting-software) -- [Transparent sessions interoperability matrix](/boundary/docs/interoperability-matrix) - -## Cannot connect to target: error from controller when performing authorize-session action against given target - -``` -$ boundary targets authorize-session -Error from controller when performing authorize-session action against given target - -Error information: - Kind: PermissionDenied - Message: Forbidden. - Status: 403 - context: Error from controller when performing authorize-session action against given target -``` - -This error message indicates the user does not have permission to access the requested target. Ensure the right IAM policies are configured for the -user attempting to create a session. Users need to belong to a role in the target's scope with an authorize-session grant to access the target. -The [Resource tables](/boundary/docs/rbac/resource-table) page is a great reference for how to configure -the right permission grants for Boundary roles. - -## Error from controller when performing authorize-session action against given target - -``` -$ boundary connect -target-id $TARGET_ID -Error from controller when performing authorize-session action against given target - -Error information: - Kind: FailedPrecondition - Message: No workers are available to handle this session, or all have been filtered. - Status: 400 - context: Error from controller when performing authorize-session action against given target -``` - -This error message indicates the worker is unable to proxy connections to the target. This could be caused by a number of issues. - -**Network misconfiguration:** ensure that worker, target, and clients have the required network configurations -- Targets - - Need to allow inbound connections from workers -- Workers - - Need to allow outbound connections to a Boundary trusted control point (either the Boundary control plane or another trusted worker) - - Need to allow outbound connections to targets - - Need to allow inbound connections from clients -- Client devices - - Need to allow outbound (client->worker) connections to workers - - The target is accessible by the Worker. The same error message is thrown if the target IP is either misconfigured or inaccessible by the worker - -**Worker tag and filter misconfiguration:** If your target is using a worker filter -- Ensure the worker filter selects the intended worker(s) to proxy connections to the target. -- Ensure your intended worker(s) have the intended tags to match your target's filter - -## Error from controller when performing authorize-session action against given target: unsupported credential *vault.baseCred - -``` -$ boundary connect ssh -target-id tssh_dmcFiVIakM -Error from controller when performing authorize-session action against given target - -Error information: - Kind: Internal - Message: targets.(Service).AuthorizeSession: targets.dynamicToWorkerCredential: unsupported credential *vault.baseCred: - parameter violation: error #100 - Status: 500 - context: Error from controller when performing authorize-session action against given target -``` -You may experience this error when attempting credential injection via Vault. Currently username_password and ssh_private_key credential -types are supported for credential injection, but only username_password can be set up using the Web UI. If you experience this error, -attempt to create the Vault ssh_private_key credential library using the CLI instead of the UI. - -## Error from controller when performing authorize-session action against given target: No ingress workers with valid next-hop paths could be found for this multi-hop session - -``` -boundary connect ssh -target-id ttcp_3DxjpP9Y3o Error from controller when performing authorize-session action against given target - -Error information: - Kind: FailedPrecondition - Message: No ingress workers with valid next-hop paths could be found for this multi-hop session. - Status: 400 - context: Error from controller when performing authorize-session action against given target -``` - -You may experience this error when deploying multiple Boundary controllers in high availability (HA) mode if you have not assigned a unique name to each controller. Ensure each controller has a [unique name](/boundary/docs/configuration/controller#name) in the controller stanza. - -## Error from worker when attempting to run worker in docker container on AWS: Error issuing command - -``` -Error: error creating storage bucket: {"kind":"Internal","message":"storage_buckets.(EntService).createInRepo: unable to create storage bucket: plugin.(Repository).CreateStorageBucket: in scope: global: db.DoTx: plugin.(Repository).CreateStorageBucket: storage.(ProxyClient).OnCreateStorageBucket: routing.(CommandClientProducer).IssueCommand: unknown, - unknown: error #0: rpc error: code = InvalidArgument desc = from worker w_xxx: from worker w_xxx: Error issuing command: storage_bucket.(storageService).OnCreateStorageBucket: plugin error, - external system issue: error #3001: rpc error: code = InvalidArgument desc = error getting S3 client: failed to retrieve credentials: failed to refresh cached credentials, no EC2 IMDS role found, operation error ec2imds: GetMetadata, canceled, context deadline exceeded\n"} -``` - -You may experience this error when deploying Boundary controllers in Docker when enabling IMDSv2. The fix is to extend the `http-put-response-hop-limit` option key to a value of 2 or greater. - -For more information, refer to [Boundary Client in Docker Additional Configuration When Using IMDSv2](https://support.hashicorp.com/hc/en-us/articles/36515134051859-Boundary-Client-in-Docker-Additional-Configuration-When-Using-IMDSv2).``` - -## More information - -Refer to [Filtering and listing resources](/boundary/docs/filtering) for more information about Boundary's filter syntax and best practices. - -To troubleshoot specific issues with the Client Agent or transparent sessions, refer to the following topics: - -- [Troubleshoot issues with the Client Agent](/boundary/docs/client-agent/troubleshoot) -- [Client Agent software conflicts](/boundary/docs/client-agent/conflicting-software) -- [Transparent sessions interoperability matrix](/boundary/docs/interoperability-matrix) diff --git a/website/content/docs/filtering/index.mdx b/website/content/docs/filtering/index.mdx deleted file mode 100644 index 8b4453eba..000000000 --- a/website/content/docs/filtering/index.mdx +++ /dev/null @@ -1,205 +0,0 @@ ---- -layout: docs -page_title: Filtering -description: >- - Learn how to create filter expressions and use filters to match and find data or to reduce the set of resources returned when you list resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Filtering and listing resources - -Filter expressions can be used by various parts of Boundary to provide useful functionality. -Each filter expression has matching operators composed with selectors and values. -This page describes the overall syntax and provides information on the specific values available for filtering for various features, including examples. - -For more information about creating filters for events, workers, targets, and credential stores, refer to the following topics: - -- [Filter events](/boundary/docs/monitor/events/filter-events) -- [Route traffic through a worker](/boundary/docs/workers/worker-tags) -- [Configure a worker filter](/boundary/docs/workers/filters) -- [Filter managed groups](/boundary/docs/rbac/users/managed-groups) - -## Create expressions - -A single expression is a matching operator with a selector and value. They are -written in plain text format, and Boolean logic and parenthesization are -supported. In general whitespace is ignored, except within literal strings. - -### Matching operators - -All matching operators use a selector or value to choose what data should be -matched. Each endpoint that supports filtering accepts a potentially different -list of selectors and is detailed in the API documentation for those endpoints. - -```text -// Equality & Inequality checks - == "" - != "" - -// Emptiness checks - is empty - is not empty - -// Contains checks or Substring Matching -"" in -"" not in - contains "" - not contains "" - -// Regular Expression Matching - matches "" - not matches "" -``` - -### Selectors - -Selectors are used by matching operators to create an expression. Inputs to -filter expressions are JSON (or JSON-derived); selectors therefore use [JSON -Pointer](https://tools.ietf.org/html/rfc6901) to select values from the input. -Each selector must be enclosed in quotes and contain a valid JSON Pointer path, -including leading slash (`/`). - -```text -// Selects the value `zipzap` from the input `{ "foo": { "bar": "zipzap" } }` -"/foo/bar" -``` - -### Values - -Values are used by matching operators to create an expression. Values can be any -valid selector, a number, or a string. It is best practice to quote values. - -Numbers can be base 10 integers or floating point numbers. - -When quoting strings, they may either be enclosed in double quotes or backticks. -When enclosed in backticks they are treated as raw strings and escape sequences -such as `\n` will not be expanded. - -## Connect expressions - -There are several methods for connecting expressions, including - -- Logical `or` -- Logical `and` -- Logical `not` -- Grouping with parenthesis -- Matching expressions - -```text -// Logical Or - evaluates to true if either sub-expression does - or - -// Logical And - evaluates to true if both sub-expressions do - and - -// Logical Not - evaluates to true if the sub-expression does not -not - -// Grouping - Overrides normal precedence rules -( ) - -// Inspects data to check for a match - -``` - -Standard operator precedence can be expected for the various forms. For example, -the following two expressions would be equivalent. - -```text - and not or - -( and (not )) or -``` - -## Performance - -Filters are executed on the controllers and therefore will consume some amount -of CPU time on the controller. - -## Listing resources - -This section describes how to use filters when listing resources. This can be used -to reduce the returned set of resources when performing a list operation. - - - -This feature is intended to provide a userful service to clients; it does not -affect the database queries generated for the operation and as such is not -designed to provide greater efficiency. - - - -When you run a list action, you can specify a filter. It uses the standard filter syntax used -elsewhere in Boundary. Unless otherwise specified for a given list endpoint, the -list of items being returned is looped through and the filter is run on the JSON -representation of that item. A good way to see what that data looks like is by -looking at representative JSON output on the command line; for example, the -following is the output of `boundary targets list -scope-id p_1234567890 -format json` on a dev instance (piped through `jq` for readability): - -```json -[ - { - "id": "ttcp_1234567890", - "scope_id": "p_1234567890", - "scope": { - "id": "p_1234567890", - "type": "project", - "name": "Generated project scope", - "description": "Provides an initial project scope in Boundary", - "parent_scope_id": "o_1234567890" - }, - "name": "Generated target", - "description": "Provides an initial target in Boundary", - "created_time": "2021-02-24T22:19:50.640476Z", - "updated_time": "2021-02-24T22:19:50.640476Z", - "version": 1, - "type": "tcp", - "session_max_seconds": 28800, - "session_connection_limit": -1, - "attributes": { - "default_port": 22 - }, - "authorized_actions": [ - "read", - "update", - "delete", - "add-host-sources", - "set-host-sources", - "remove-host-sources", - "authorize-session" - ] - } -] -``` - -As the filter tests each entry being returned, it places the data under test -within the filter at `/item`. - -On the CLI a filter can be given via `-filter`. - -Double quotes are part of the filter syntax; when using the CLI, it is likely -easier to surround the filter with single quotes than to deal with escaping -double quotes. - -When using the HTTP API, it is a `filter` query parameter. - -Ensure that the query parameter is properly escaped! Most HTTP libraries will -do this for you. If you're having trouble, try using the `-output-curl-string` -flag with the Boundary CLI: - -``` -$ boundary targets list -scope-id p_1234567890 -format json -filter '"authorize-session" in "/item/authorized_actions"' -output-curl-string -curl -H "Authorization: Bearer $(boundary config get-token -keyring-type pass -token-name default)" -H "Content-Type: application/json" 'http://127.0.0.1:9200/v1/targets?filter=%22authorize-session%22+in+%22%2Fitem%2Fauthorized_actions%22&scope_id=p_1234567890' -``` - -Following are some examples. - -- Resources in which the user is allowed to run an "update" action: - `"update" in "/item/authorized_actions"` - -- Resources matching a name pattern, but only those within an organization - scope: `"/item/name" matches "groupa-*" and "/item/scope/type" == "org"` diff --git a/website/content/docs/getting-started/dev-mode/connect-to-dev-target.mdx b/website/content/docs/getting-started/dev-mode/connect-to-dev-target.mdx deleted file mode 100644 index eade95c56..000000000 --- a/website/content/docs/getting-started/dev-mode/connect-to-dev-target.mdx +++ /dev/null @@ -1,133 +0,0 @@ ---- -layout: docs -page_title: Connect to your first target -description: >- - Learn how to connect to targets using Boundary, and optionally use connect helpers, exec flag, SSH ProxyCommand, and Desktop Client features. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Connect to your first target - -The default target is a `tcp` target with a default port of `22` (which -corresponds to the default SSH port using TCP). This target is set up with -`127.0.0.1` as its address. When you execute `boundary connect` against this -target, a local authenticated proxy to the address is established on the -target's default port (`127.0.0.1:22`). - -```shell-session -$ boundary connect -target-id ttcp_1234567890 -``` - -There is also a secondary `tcp` target with (`ttcp_0987654321`) which uses host -sets instead of an address. The host sets for this target contain the default -host, which has the address 127.0.0.1. When you execute `boundary connect` -against this target, the single available host will be selected and a local -authenticated proxy to the host is also established on the target's default port -(127.0.0.1:22). - -```shell-session -boundary connect -target-id ttcp_0987654321 -``` - -For the purpose of this guide, both of these targets accomplish the same goal, -however they have different purposes. Refer to the -[domain model](/boundary/docs/domain-model/) documentation for more information. - -For the rest of this guide, assume the default is used. - -The output displays the address and port that your SSH client must utilize. In -the next section the `ssh` connect helper is used to make it easier to connect -to the target with a client. - -The `boundary connect` command has a number of notable options, such as -`-listen-port` to choose the port on which the connect command will listen for -an incoming connection. This is convenient for allowing Boundary to work with -applications that allow you to select the connection address but not the port. -For many applications, there are still some extra hurdles that can exist, which -is why connect helpers can be useful. - -The dev-mode default target allows you to make as many connections as you want -within the authorized session. When you are finished making connections, simply -`Ctrl-C/Command-C` the `boundary connect` process to shut down the session. - -## Select targets - -When using `boundary connect` you must identify the target used for connecting. -Convention in this documentation is to use the target ID because it refers to a -single explicit value, however other flags are supported: - -- `target-name`: The name of the target -- `target-scope-id`: The ID of the scope in which the target lives -- `target-scope-name`: The name of the scope in which the target lives - -Note however that these are not uniquely identifying, as names can be re-used -across scopes. As a result, when not using the target ID, you must use the -target's name in conjunction with the scope name or scope ID so that Boundary -can correctly identify the desired target. - -Here is an SSH example in dev mode: - -```shell-session -$ boundary connect ssh -target-name "Generated target" -target-scope-name "Generated project scope" -``` - -## Connect helpers - -Boundary includes connect helpers that automatically accept host SSH key prompts -for you. -These are written as `boundary connect ` and are supported for the following connection types: - -- HTTP -- Kubernetes -- PostgreSQL -- RDP -- SSH - -Refer to the [Connect helpers](/boundary/docs/targets/connections/connect-helpers) documentation for more information. - -## Built-in vs. exec - -In addition to the built-in connect helpers, `boundary connect` -can accommodate executing clients even when there is no built-in support -for a specific client using `-exec`. The `-exec` flag is a very powerful -tool, allowing you to wrap Boundary TCP sessions in your preferred -client. You can use this flag to create an authenticated proxy to almost -anything. - -Refer to the [Exec flag](/boundary/docs/targets/connections/exec-flag) documentation for more information. - -## SSH ProxyCommand - -SSH `ProxyCommand` lets you proxy an SSH connection to a target according to a configuration file that you create. -It can help simplify common developer and operator workflows. -You can configure the file to connect to the target ID or the target domain. - -Refer to the [SSH ProxyCommand](/boundary/docs/targets/connections/workflow-ssh-proxycommand) documentation for more information. - -## Desktop client - -While using the desktop client, choose the target and connect to retrieve local -proxy details. - - - -## Next steps - -See our [basic administration -workflow](/boundary/tutorials/community-administration) tutorials -for in depth discussion on managing scopes, targets, identities, and sessions. diff --git a/website/content/docs/getting-started/dev-mode/index.mdx b/website/content/docs/getting-started/dev-mode/index.mdx deleted file mode 100644 index d317bad4b..000000000 --- a/website/content/docs/getting-started/dev-mode/index.mdx +++ /dev/null @@ -1,76 +0,0 @@ ---- -layout: docs -page_title: What is dev mode? -description: >- - Learn about Boundary's dev mode and how it enables you to quickly deploy a temporary, pre-configured Boundary environment for testing and learning purposes. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# What is dev mode? - -Dev mode is a method for getting started with Boundary quickly for testing and -learning purposes. As the name implies, dev mode is not a production -installation method, and provides a way to get Boundary running with a Postgres -database easily. - -Do not use dev mode in a production environment, refer to the following sections for production-ready deployment methods: - -- [Deploy Boundary in a self-managed environment](/boundary/docs/deploy/self-managed) -- [Deploy HCP Boundary](/boundary/docs/hcp/get-started/deploy-and-login) -- [Terraform patterns for Boundary](/boundary/docs/deploy/terraform-patterns) - -Dev mode brings up a fully-functioning instance of Boundary, including: - -- A controller server -- A worker server -- A Postgres database - -These components should all be considered ephemeral - no data persistence occurs -across dev mode restarts. Along with these external components, dev mode also -creates several resources within Boundary to make it easier and faster to -connect to your first target: - -1. An org [scope](/boundary/docs/domain-model/scopes) and a project scope with a - default ID of `o_1234567890` and `p_1234567890` respectively. -1. A password [auth method](/boundary/docs/domain-model/auth-methods) with a - default auth method ID of `ampw_1234567890`. -1. An OIDC [auth method](/boundary/docs/domain-model/auth-methods) with a - default auth method ID of `amoidc_1234567890`. -1. An admin user with login name `admin` and password `password`. -1. An unprivileged user with login name `user` and password `password`. -1. A static [host catalog](/boundary/docs/domain-model/host-catalogs) with a - default ID of `hcst_1234567890`. -1. A static [host](/boundary/docs/domain-model/hosts) and [host - set](/boundary/docs/domain-model/host-sets) with default ID's of - `hst_1234567890` and `hsst_1234567890` respectively. -1. A TCP [target](/boundary/docs/domain-model/targets) with a default ID of - `ttcp_1234567890`, directly set-up with an address and port. -1. A TCP [target](/boundary/docs/domain-model/targets) with a default ID of - `ttcp_0987654321` using the previously mentioned static host set. - -The default ID suffixes can be overwritten or randomly generated, and there are -many other dev mode controls. To see a complete list of these override flags, -consult `boundary dev -h`. - -If you plan on provisioning a large number of resources in dev mode, it's -strongly recommended that users leverage our [Terraform Provider for -Boundary](https://github.com/hashicorp/terraform-provider-boundary) for managing -configuration of Boundary. This will simplify starting up and shutting down your -Boundary dev instance. - -## Requirements - -There are a few requirements for running dev mode: - -- [Docker](https://docs.docker.com/get-docker/) is installed -- A route to download the [Postgres Docker - image](https://hub.docker.com/_/postgres) is available or a local image cache - is available -- A [Boundary binary](/boundary/downloads) in your `$PATH` -- _Optionally_, an [installation of Boundary - Desktop](/boundary/tutorials/oss-getting-started/oss-getting-started-desktop-app) - if you want to use the desktop examples \ No newline at end of file diff --git a/website/content/docs/getting-started/dev-mode/run-and-login.mdx b/website/content/docs/getting-started/dev-mode/run-and-login.mdx deleted file mode 100644 index c921dc957..000000000 --- a/website/content/docs/getting-started/dev-mode/run-and-login.mdx +++ /dev/null @@ -1,123 +0,0 @@ ---- -layout: docs -page_title: Run and log in to Boundary -description: >- - Run and authenticate to Boundary in dev mode using pre-configured credentials. Dev mode lets you try Boundary in an environment with ephemeral sample resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Run and log in to Boundary - -To start Boundary in dev mode: - -```shell-session -$ boundary dev -``` - -## Log in to Boundary - -Boundary uses a predictable login name (`admin`) and password (`password`) in -dev mode. These can be overridden, or randomly generated, with flags to -`boundary dev`. The auth method resource in the global scope is set as the primary auth method for that scope. This allows you to omit the auth method ID when authenticating, enabling the short-form `boundary authenticate`: - - - - - -```shell-session -$ boundary authenticate -Please enter the login name (it will be hidden): -Please enter the password (it will be hidden): -``` - -If you are on Windows or macOS, the system password store will be used to store -the new token. On any other operating system, you may get an error indicating -that the token could not be stored. Boundary defaults to using -[pass](https://www.passwordstore.org/) on these machines, which uses [GNU -Privacy Guard](https://gnupg.org/) to encrypt values. If it is not available, -the token will be displayed and can be stored in a system of your choice and -passed in via the `BOUNDARY_TOKEN` environment variable. - -It is recommended to make use of `pass` or another alternative (such as any -implementation of the freedesktop.org Secret Service feature). Installation and -configuration of `pass` or other alternatives is beyond the scope of this -article; consult the documentation for `pass` or your specific OS distribution -help pages. - -Note that if `-format json` is used on this command, Boundary will not save the -token to the system password store. In this case, the authentication information -will only be printed to your terminal in JSON format. You can use the -`BOUNDARY_TOKEN` environment variable or `-token` flag to provide the token in -subsequent commands. - - - - - -To authenticate to the Admin UI, open -[http://127.0.0.1:9200](http://127.0.0.1:9200) in a browser and enter the login -name and password: - - - - - - - - -To authenticate using the Boundary desktop client, launch the Boundary desktop client -and connect to Boundary using [http://127.0.0.1:9200](http://127.0.0.1:9200), -then enter the login name and password: - - - - - - - - - -You can also use these overrides to configure the [Terraform provider for -Boundary](https://github.com/hashicorp/terraform-provider-boundary): - -```hcl -provider "boundary" { - base_url = "http://127.0.0.1:9200" - auth_method_id = "ampw_1234567890" - auth_method_username = "admin" - auth_method_password = "password" -} -``` - -Note in the example above we're setting `base_url` to `http` and not `https` as -the Boundary server does not use TLS in development mode. - - - - - -## Next steps - -See [connecting to your first -target](/boundary/docs/getting-started/dev-mode/connect-to-dev-target) for how to use Boundary to -run your first SSH session. diff --git a/website/content/docs/getting-started/index.mdx b/website/content/docs/getting-started/index.mdx deleted file mode 100644 index 584941c63..000000000 --- a/website/content/docs/getting-started/index.mdx +++ /dev/null @@ -1,50 +0,0 @@ ---- -layout: docs -page_title: Get started -description: >- - Understand the difference between HCP Boundary, Boundary Enterprise, and Boundary Community Edition to determine which is best for your needs. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Get started - -This section walks through how to get started with Boundary. You’ll learn how -Boundary provides secure access to private endpoints. - -There are three options to get started with Boundary: - -- **HCP Boundary** is a managed offering of Boundary that streamlines deployment and operations. - HCP Boundary allows users to run their own - worker proxies, preventing exposure of your network to HashiCorp or clients. - HCP Boundary has features that are not available in the Community Edition of the product, as well as support. - It has full feature-parity with Boundary Enterprise. - Review the [Get - started with HCP Boundary](/boundary/docs/getting-started/deploy-and-login) section to - learn more. -- **Boundary Enterprise** is a customer-hosted offering of Boundary with Enterprise support. -It has full feature-parity with HCP Boundary. -The Enterprise version is self-managed in your environment, making it the perfect choice for agencies that are not able to use SaaS products for compliance or regulatory reasons. -The [Deploy Boundary](/boundary/docs/deploy/self-managed) section can help you build a self-managed production environment using Boundary Enterprise. -- **Boundary Community Edition** is a free distribution of Boundary that users can run - in their own environments. The [Dev Mode quick start](/boundary/docs/getting-started/dev-mode) section discusses running Boundary - in Dev mode on your local machine, allowing you to get started with the Community Edition distribution quickly. - -We recommend you use the Boundary model that best meets your intended use case. -If you’re not sure what’s best for you, we recommend reviewing the [Getting -started with HCP Boundary](/boundary/docs/getting-started/deploy-and-login) section. - -## Key concepts - -Before getting started with Boundary, it's important to understand a few key concepts. -Please consult any of the following Boundary concepts pages to familiarize yourself with Boundary's architecture and terminology: - -- [Auditing](/boundary/docs/concepts/auditing) -- [Identity and access management](/boundary/docs/concepts/iam) -- [Credential management](/boundary/docs/concepts/credential-management) -- [Workers](/boundary/docs/concepts/workers) -- [Aliases](/boundary/docs/concepts/aliases) -- [Transparent sessions](/boundary/docs/concepts/transparent-sessions) diff --git a/website/content/docs/go-sdk/index.mdx b/website/content/docs/go-sdk/index.mdx deleted file mode 100644 index 2725d4b69..000000000 --- a/website/content/docs/go-sdk/index.mdx +++ /dev/null @@ -1,220 +0,0 @@ ---- -layout: docs -page_title: Go SDK overview -description: >- - Learn about Boundary's Go SDK. Use the Go SDK to authenticate to Boundary with an auth method or a recovery KMS workflow. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Go SDK - -Boundary has a Go SDK that sports full coverage of Boundary's API. This SDK is mostly auto-generated, so the patterns are predictable from package to package. For the most part, browsing [pkg.go.dev](https://pkg.go.dev/github.com/hashicorp/boundary/api) is a great way to get started. - - - -The Boundary API is configured with [rate limiting](/boundary/docs/api/rate-limiting), by default. -If the Boundary SDK client is unable to process a request due to a rate limit being met, it sends the API a `429` or `523` [status code](/boundary/docs/api#status-codes) and limits the request. -By default the client will wait for the amount of time specified in the `Retry-After` header and then try again for a maximum of 2 retries. - - - -Below, an example walks through using the SDK to authenticate against an auth method or perform recovery workflows. The patterns for creating a resource-typed client are the same across packages. - -## Authenticating to Boundary with the Go SDK - -Authenticating to Boundary starts with an [auth method](/boundary/docs/domain-model/auth-methods). An auth method provides -the basic identity delegation needed for Boundary to generate a token for a client. There are two primary methods for -authenticating to Boundary: - -1. Via an auth method -1. Via the recovery KMS workflow - -We'll cover how to authenticate to Boundary via both of these workflows. - -### Auth method - -This is the most common way for a client to authenticate to Boundary. To demonstrate this, we'll -use the [authmethods](https://github.com/hashicorp/boundary/tree/main/api/authmethods) library to generate -a valid token for a client in Go. - -For this example, we're going to use the [password auth method](/boundary/docs/domain-model/auth-methods#password-auth-method-attributes). This example -assumes there's already a valid user and an associated account in Boundary -against which the client can authenticate. To simplify this example, we're -assuming you're running a Boundary instance in dev mode, where the default auth -method, login name, and password are pre-configured. - -First, we need to create a client from the Boundary API and set the address to reach Boundary: - -```go -// The default address points to the default dev mode address -client, err := api.NewClient(nil) -if err != nil { - return err -} -``` - -The [authenticate -method](https://github.com/hashicorp/boundary/blob/main/api/authmethods/authenticate.go) -uses a basic `map[string]interface{}` to pass credential information, in order -to eventually support multiple auth method types. For this example, we assume -you're using the password auth method, and so we create an attributes -map to pass this data: - -```go -credentials := map[string]interface{}{ - "login_name": "admin", - "password": "password", -} -``` - -Now let's create an auth method client using the base client from above: - -```go -amClient := authmethods.NewClient(client) -``` - - - -This creates a shallow copy of the base client. Modifications made to the client via `am.ApiClient()` will not be reflected in the base client. - - - -The last thing you'll need is the ID of the auth method in Boundary. You can get this on the CLI -with: - -```bash -$ boundary auth-methods list - -Auth Method information: - ID: ampw_1234567890 - Description: Provides initial administrative authentication into Boundary - Name: Generated global scope initial auth method - Type: password - Version: 1 -``` - -Note the ID in the output above, we're going to use that in the next step. - -We can use the credentials object we created to execute `Authenticate()` on this client: - -```go -authenticationResult, err := amClient.Authenticate(context.Background(), "ampw_1234567890", "login", credentials) -if err != nil { - return err -} -``` - -Lastly, let's update the original client with the token we got from the `Authenticate()` call: - -```go -// pass this client to any other resource specific API resources -client.SetToken(fmt.Sprint(authenticationResult.Attributes["token"])) -``` - -Putting this all together: - -```go -import ( - "context" - - "github.com/hashicorp/boundary/api" - "github.com/hashicorp/boundary/api/authmethods" -) - -credentials := map[string]interface{}{ - "login_name": "admin", - "password": "password", -} - -// The default address points to the default dev mode address -client, err := api.NewClient(nil) -if err != nil { - return err -} - -amClient := authmethods.NewClient(client) -authenticationResult, err := amClient.Authenticate(context.Background(), "ampw_1234567890", "login", credentials) -if err != nil { - return err -} - -// pass this client to any other resource specific API resources -client.SetToken(fmt.Sprint(authenticationResult.Attributes["token"])) -``` - -### Recovery KMS workflow - -The recovery KMS workflow allows you to use a valid [KMS -configuration](/boundary/docs/configuration/kms) to authenticate and authorize calls -within the Boundary API. For this example, we're going to assume you've read the -above and know how to get a base Boundary API client. - -Lets start with a valid KMS configuration for recovery that uses a hard coded -AEAD key as the basis. To authenticate with Boundary using this config we're -assuming you have an instance of Boundary that declares this as the recovery KMS -in the Boundary controller config as well. - -```go -import "github.com/hashicorp/boundary/sdk/wrapper" - -const kmsConfig = ` -kms "aead" { - purpose = "recovery" - aead_type = "aes-gcm" - key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ=" - key_id = "recovery_kms" -} -` -``` - -Now lets use this config to configure our Boundary API client: - -```go -w, err := wrapper.GetWrapperFromHcl(kmsConfig, "recovery") -if err != nil { - return err -} - -client.SetRecoveryKmsWrapper(w) -``` - -The client will now use the recovery KMS wrapper for all authenticated calls -(even if you have previously set a token). You can remove it by instantiating a -new client, or by passing `nil` into `SetRecoveryKmsWrapper`. - -Putting this all together: - -```go -import ( - "context" - - "github.com/hashicorp/boundary/api" - "github.com/hashicorp/boundary/sdk/wrapper" -) - -const kmsConfig = ` -kms "aead" { - purpose = "recovery" - aead_type = "aes-gcm" - key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ=" - key_id = "recovery_kms" -} -` - -// The default address points to the default dev mode address -client, err := api.NewClient(nil) -if err != nil { - return err -} - -w, err := wrapper.GetWrapperFromHcl(kmsConfig, "recovery") -if err != nil { - return err -} - -client.SetRecoveryKmsWrapper(w) -``` diff --git a/website/content/docs/hcp/get-started/connect-to-target.mdx b/website/content/docs/hcp/get-started/connect-to-target.mdx deleted file mode 100644 index 73c8f134a..000000000 --- a/website/content/docs/hcp/get-started/connect-to-target.mdx +++ /dev/null @@ -1,138 +0,0 @@ ---- -layout: docs -page_title: Connect to a target -description: >- - Understand how to connect to targets using HCP Boundary. Learn how to select targets and use your choice of client and connect helpers to facilitate connections. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Connect to your first target - -The [Quick setup -wizard](/boundary/docs/hcp/get-started/deploy-and-login#log-in-to-hcp-boundary) -is the fastest way to onboard a target to HCP Boundary. - -![Setup Wizard](/img/setup-wizard-address-target.png) - -The Quick setup wizard creates a default `tcp` target with the address `127.0.0.1` and the port `22` (the default SSH port using TCP). -When you execute `boundary connect` against this target, Boundary establishes a local, authenticated proxy to the address on the target's default port (`127.0.0.1:22`.) - -![Setup Wizard](/img/quick-start-targets.png) - -## Connect using the CLI - -To connect to the initial EC2 Instances target: - -1. Copy the **EC2 Instances** target ID (such as `ttcp_ZnHEU9h8qX`). - -1. Open a terminal session. Export the Boundary **Cluster URL** as an environment - variable. - - ```shell-session - $ export BOUNDARY_ADDR= - ``` - -1. Connect to the target. - - ```shell-session - $ boundary connect -target-id ttcp_eTcZMueUYv - ``` - - The output displays the address and port that your SSH client must use. - -The `boundary connect` command has a number of notable options, such as -`-listen-port` to choose the port on which the connect command will listen for -an incoming connection. This is convenient for allowing Boundary to work with -applications that allow you to select the connection address, but not the port. -For some applications there are still some extra hurdles that can exist, which -is why connect helpers can be useful. - -The dev-mode default target allows you to make as many connections as you want -within the authorized session. When you finish making connections, a -`Ctrl-C/Command-C` to the `boundary connect` process shuts down the session. - -## Select targets - -When you use `boundary connect`, you must identify the target used for connecting. -The convention in this documentation is to use the target ID because it refers to a -single explicit value. - -Other supported flags include: - -- `target-name`: The name of the target -- `target-scope-id`: The ID of the scope in which the target lives -- `target-scope-name`: The name of the scope in which the target lives - -Note however that these other flags are not uniquely identifying, as you may reuse names -across scopes. Therefore, if you don't use the target ID, you must use the target's name in conjunction with the scope name or scope ID so that Boundary can identify the correct target. - -Here is an SSH example in dev-mode: - -```shell-session -$ boundary connect ssh -target-name "Generated target" -target-scope-name "Generated project scope" -``` - -## Connect helpers - -Connect helpers automatically accept host SSH key prompts for you. -The connect helper format is `boundary connect `. -Boundary includes connect helpers for the following connection types: - -- HTTP -- Kubernetes -- PostgreSQL -- RDP -- SSH - -Refer to the [Connect helpers](/boundary/docs/targets/connections/connect-helpers) documentation for more information. - -## Exec flag - -In addition to the built-in connect helpers, `boundary connect` -can accommodate executing clients even when there is no built-in support -for a specific client using `-exec`. The `-exec` flag is a powerful -tool, allowing you to wrap Boundary TCP sessions in your preferred -client. You can use this flag to create an authenticated proxy to almost -anything. - -Refer to the [Exec flag](/boundary/docs/targets/connections/exec-flag) documentation for more information. - -## SSH ProxyCommand - -SSH `ProxyCommand` lets you proxy an SSH connection to a target according to a configuration file that you create. -It can help simplify common developer and operator workflows. -You can configure the file to connect to the target ID or the target domain. - -Refer to the [SSH ProxyCommand](/boundary/docs/targets/connections/workflow-ssh-proxycommand) documentation for more information. - -## Desktop client - -While you use the desktop client, choose the target and connect to retrieve local -proxy details. - - - -## Tutorial - -Refer to the [Connect to your First Target](/boundary/tutorials/hcp-getting-started/hcp-getting-started-connect) tutorial for steps on how to create a host catalog, host set, and a target in Boundary. - -## Next steps - -Refer to the [basic administration -workflows](/boundary/tutorials/hcp-administration) tutorial series -for in depth discussions on managing scopes, targets, identities, and sessions. \ No newline at end of file diff --git a/website/content/docs/hcp/get-started/deploy-and-login.mdx b/website/content/docs/hcp/get-started/deploy-and-login.mdx deleted file mode 100644 index d818021e8..000000000 --- a/website/content/docs/hcp/get-started/deploy-and-login.mdx +++ /dev/null @@ -1,234 +0,0 @@ ---- -layout: docs -page_title: Deploy and log in -description: >- - Learn about the requirements for using HCP Boundary. Deploy a cluster, and log in for the first time. Discover resources to learn more. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Deploy HCP Boundary and log in - -HCP Boundary provides secure access to remote hosts and infrastructure -endpoints. Boundary enables secure connectivity to cloud service catalogs, -on-premise infrastructure, and Kubernetes clusters without needing to manage any -of the underlying systems or operations. - -## Requirements - -The Getting Started section uses HCP Boundary, a HashiCorp hosted and -fully-managed version of the Boundary product. - -To get started with HCP Boundary, users need: - -- A [HashiCorp Cloud Platform](https://portal.cloud.hashicorp.com/sign-up) - account -- [Installation](/boundary/tutorials/hcp-getting-started/hcp-getting-started-install) - of the Boundary CLI -- A [Boundary binary](/boundary/downloads) in your `$PATH` -- Optionally, an [installation of Boundary - Desktop](/boundary/tutorials/hcp-getting-started/hcp-getting-started-desktop-app) - -If you prefer to test Boundary on your local machine, refer to [Run and log in to Boundary](/boundary/docs/oss/installing/run-and-login). For more information on Boundary -Community Edition and self-managed installations, refer to [Which edition of Boundary is right for me?](/boundary/docs/what-is-boundary#which-edition-of-boundary-is-right-for-me) or [Deploy Boundary in a self-managed environment](/boundary/docs/deploy/self-managed). - -## Deploy an HCP Boundary cluster - -To deploy an HCP Boundary instance: - -1. Navigate to [HashiCorp Cloud Platform](https://portal.cloud.hashicorp.com/) - and login using your credentials. - -1. Click the **Boundary** tab, and then and click **Deploy Boundary** on the - right-hand pane. - -1. Fill out the following form details: - - - Instance Name - - Administrator Username - - Administrator Password - -1. Store the administrator username and password in a safe location. These - credentials will be used when authenticating using the Admin Console, CLI, or - Terraform. - -1. Click **Deploy** after completing the form. It may take a few minutes to - initialize the HCP Boundary instance. - -![Deploy boundary](/img/hcp-deploy-form.png) - -## Log in to HCP Boundary - -Once the deployment is complete, the HCP Boundary instance can be accessed -directly from the HCP Boundary portal using the credentials created during -setup. - -1. From the HCP Boundary portal page, click the **Open Admin UI** button. - -1. Enter the admin username and password you created when you deployed the new -instance, and click **Authenticate**. - -1. The **Welcome to Boundary** setup wizard will launch automatically. - - There are two options for Boundary’s initial setup: - - - Quick setup - - Manual - - ![Setup Wizard](/img/setup-wizard.png) - - The **Quick setup** is recommended for new users, and generates a set of initial - resources to assist in connecting to your first target. - - ![Setup Wizard](/img/setup-wizard-address-target.png) - - The **Manual** setup drops the user directly into Boundary, without any - provisioned resources. - - Upon completion of the setup wizard, you will be logged into your HCP Boundary - instance's Global scope via the web UI. This is the default scope for all new - Boundary clusters. - - - - -1. In the HCP Boundary portal, open the **Boundary Overview** page, and click -the **copy icon** in the **Copy this into Boundary Desktop** section. This -copies your environment’s Boundary **Cluster URL**. - -1. Open a terminal session and set the `BOUNDARY_ADDR` environment variable to -the copied Cluster URL. - - ```shell-session - $ export BOUNDARY_ADDR= - ``` - -1. Log in with the administrator credentials you created when you deployed the -HCP Boundary instance. - - ```shell-session - $ boundary authenticate - Please enter the login name (it will be hidden): - Please enter the password (it will be hidden): - - Authentication information: - Account ID: acctpw_VOeNSFX8pQ - Auth Method ID: ampw_wxzojlKJLN - Expiration Time: Mon, 13 Feb 2023 12:35:32 MST - User ID: u_1vUkf5fPs9 - - The token was successfully stored in the chosen keyring and is not displayed here. - ``` - -You are now logged into your HCP Boundary instance's Global scope via the CLI. -This is the default scope for all new Boundary clusters. - -If you are on Windows or macOS, the system password store will be used to store -the new token. On any other operating system, you may get an error indicating -that the token could not be stored. Boundary defaults to using -[pass](https://www.passwordstore.org/) on these machines, which uses [GNU -Privacy Guard](https://gnupg.org/) to encrypt values. If it is not available, -the token will be displayed and can be stored in a system of your choice and -passed in via the `BOUNDARY_TOKEN` environment variable. - -It is recommended to make use of `pass` or another alternative (such as any -implementation of the freedesktop.org Secret Service feature). Installation and -configuration of `pass` or other alternatives is beyond the scope of this -article; consult the documentation for `pass` or your specific OS distribution -help pages. - -Note that if `-format json` is used on this command, Boundary will not save the -token to the system password store. In this case, the authentication information -will only be printed to your terminal in JSON format. You can use the -`BOUNDARY_TOKEN` environment variable or `-token` flag to provide the token in -subsequent commands. - - - - - -[Boundary Desktop](/boundary/downloads) can be used to -connect to HCP Boundary. - -To get started with Boundary Desktop: - -1. Install Boundary Desktop. -1. Enter your HCP Boundary instance’s Cluster URL. -1. Enter the login name and password. - -To authenticate using the Boundary desktop client, launch Boundary desktop -client and connect to boundary to using your environment's **Cluster URL**. - -You can find your environment’s Cluster URL In the HCP portal. Open the -**Boundary Overview** page and click the **copy icon** in the **Copy this into -Boundary Desktop** section. This copies your environment’s Boundary **Cluster -URL**. - -The admin username and password from instance creation can be used for initial -setup. Once additional users have been created, they can also log in to HCP -Boundary using the Boundary Desktop app. - - - - - - - - -You can also use these overrides to configure the [Terraform provider for -Boundary](https://registry.terraform.io/providers/hashicorp/boundary): - -```hcl -provider "boundary" { - base_url = "hcp-boundary-cluster-url" - auth_method_id = "auth-method-id" - auth_method_username = "admin-username" - auth_method_password = "admin-password" -} -``` - -To find your environment’s `base_url`: - -1. In the HCP portal, open the **Boundary Overview** page. -1. Click the **copy icon** in the **Copy this into Boundary Desktop** section. - This copies your environment’s Boundary **Cluster URL**. - -To find your environment’s default `auth_method_id`: - -1. In your HCP Boundary portal, click the Admin UI button. -1. Log in to the Admin Console by entering the admin username and password you - created when you deployed the HCP Boundary instance, and click **Authenticate**. -1. Click **Auth Methods**. -1. Click the **copy icon** for the Password **Auth Method ID** - - - - -## Tutorial - -- Refer to the [Create a Boundary Instance on - HCP](/boundary/tutorials/hcp-getting-started/hcp-getting-started-create) - tutorial to learn how to deploy a Boundary instance. -- Refer to the [Install Boundary - Desktop](/boundary/tutorials/hcp-getting-started/hcp-getting-started-desktop-app) - tutorial to learn how to use the Boundary desktop to connect to a running HCP - Boundary instance. - - -## Next steps - -Refer to [Connect to your first target](/boundary/docs/getting-started/connect-to-target) to use HCP Boundary to run your first SSH session. diff --git a/website/content/docs/hcp/index.mdx b/website/content/docs/hcp/index.mdx deleted file mode 100644 index 4246dd039..000000000 --- a/website/content/docs/hcp/index.mdx +++ /dev/null @@ -1,22 +0,0 @@ ---- -layout: docs -page_title: HCP Boundary overview -description: >- - Discover resources to learn about and try HCP Boundary. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# HCP Boundary - -HCP Boundary provides secure access to remote hosts and infrastructure endpoints. -Boundary enables secure connectivity to cloud service catalogs, on-premises infrastructure, and Kubernetes clusters without needing to manage any of the underlying systems or operations. - -HCP Boundary reduces the complexity of managing access to infrastructure, and enables the user to simply log in, select the desired host or system, and connect. -HCP Boundary handles the routing, connections, and credential brokering on the backend. -Users securely connect to their remote systems or hosts without exposing a credential, address, or network. - -To try out HCP Boundary, proceed to [Deploy and login](/boundary/docs/hcp/get-started/deploy-and-login). \ No newline at end of file diff --git a/website/content/docs/hosts/aws.mdx b/website/content/docs/hosts/aws.mdx deleted file mode 100644 index bdc8820e7..000000000 --- a/website/content/docs/hosts/aws.mdx +++ /dev/null @@ -1,399 +0,0 @@ ---- -layout: docs -page_title: AWS dynamic host catalogs -description: >- - Use dynamic host catalogs to automatically discover AWS EC2 instances and add them as hosts. Create a host catalog and host set for AWS resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -# AWS dynamic host catalogs -Boundary uses dynamic host catalogs to automatically discover AWS EC2 instances and add them as hosts. - -## Create a host catalog to connect with AWS -Boundary uses plugins to integrate with a variety of providers. To use -a dynamic host catalog to integrate with AWS, you create a host catalog of the `plugin` type -and set the `plugin-name` value to `aws`. You must also provide the specific -fields needed for Boundary to authenticate with AWS. - -Boundary supports two methods of authenticating to AWS: - -1. **Static credentials** using an IAM user and its access key -1. **Dynamic credentials** using credentials generated by `AssumeRole` - -HashiCorp recommends using dynamic credentials when possible. Select a credential type to continue: - - - - -### Required IAM Privileges - -Boundary needs the following IAM privileges, at the very least, to be attached to a configured IAM user. - -Configure `DescribeInstances` to `*`. `DescribeInstances` cannot be scoped to a resource ARN. - -Example policy: - -```json -{ - "Version": "2012-10-17", - "Statement": [ - { - "Action": [ - "ec2:DescribeInstances" - ], - "Effect": "Allow", - "Resource": "*" - } - ] -} -``` - -To allow static credential rotation, add the `iam:GetUser`, `iam:CreateAccessKey`, and `iam:DeleteAccessKey` policies: - -```json -{ - "Version": "2012-10-17", - "Statement": [ - { - "Action": [ - "iam:DeleteAccessKey", - "iam:GetUser", - "iam:CreateAccessKey" - ], - "Effect": "Allow", - "Resource": "arn:aws:iam::123456789012:user/JohnDoe" - } - ] -} -``` - - - - - - - [Cross-account access](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies-cross-account-resource-access.html) for AWS IAM roles is not currently supported. - - - -This feature requires a self-managed Boundary [worker](/boundary/docs/deploy/self-managed/deploy-workers). - -To set up a dynamic host catalog using an AWS role, a self-managed worker must assume the role. You must assign the role to the self-managed worker AWS instance, and then supply a worker filter that matches the AWS worker when you set up the dynamic host catalog. - -Perform the following steps to set up a host catalog using [AssumeRole](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html): - -1. Deploy a self-managed worker in your AWS account. The worker must be in the same VPC as the hosts you want to access using the dynamic host catalog. Consider [adding worker tags](/boundary/docs/workers/worker-tags) to make it easier to route traffic through it using a worker filter later on. - -1. Create an IAM role with the `AmazonEC2ReadOnlyAccess` policy attached, or define a custom policy with the `ec2:DescribeInstances` action allowed for all resources. This policy should contain the following, at least: - - ```json - { - "Version": "2012-10-17", - "Statement": [ - { - "Action": [ - "ec2:DescribeInstances" - ], - "Effect": "Allow", - "Resource": "*" - } - ] - } - ``` - - Refer to the AWS [Create a role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html) documentation to learn more. - -1. Attach the role to the IAM instance configured as your self-managed worker. Follow the AWS [Attach an IAM role to an instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/attach-iam-role.html) to learn more. - -1. Continue to the next step to set up the dynamic host catalog. You must add a worker tag when setting up the host catalog to route traffic through the worker that is assuming the role. - - - - -Complete the following steps to create a dynamic host catalog for AWS: - - - - -1. Log in to Boundary. -1. Select the org, and then select the project you want to create a host catalog for. -1. Select **Host Catalogs**. -1. Select **New Host Catalog**. -1. Complete the following fields: - - **Name**: (Optional) An optional name for identification purposes. - If you enter a name, it must be unique. - - **Description**: (Optional) An optional description of the host catalog for identification purposes. - - **Type**: (Required) Select **Dynamic** to create a dynamic host catalog. - - **Provider**: (Required) Select **AWS** to create a dynamic host catalog for your AWS resources. - - **AWS Region**: (Required) Enter the AWS region of the hosts you want to add to the host catalog. - - **Credential type**: (Required) Select the type of credential you want to use to authenticate to the host catalog. The required fields for configuring the host catalog vary depending on whether you configure static or dynamic credentials: - - **Use an access key (Static Credentials)**: Authenticates to the host catalog using an access key that you generate in AWS. - - **Use Assume Role (Dynamic Credentials)**: Authenticates to the host catalog using credentials that AWS `AssumeRole` generates. - - - - - - **Access Key ID**: (Required) The access key ID for the IAM user to use with this host catalog. - - **Secret Access Key**: (Required) The secret access key for the IAM user to use with this host catalog. - - **Worker Filter**: (Optional) An optional filter to route requests to a designated worker. - - - - - - **Role ARN**: (Required) - The AWS role ARN to use for `AssumeRole` authentication. - If you provide a `role_arn` value, you must also set `disable_credential_rotation` to `true`. - - **Role external ID**: (Optional) - The external ID for the `AssumeRole` provider. - - **Role session name**: (Optional) - The session name for the `AssumeRole` provider. - - **Role tags**: (Optional) - The key-value pair tags for the `AssumeRole` provider. - - **Worker Filter**: (Optional) - An optional filter to route requests to a designated worker. The filter should match the worker assigned the IAM role. - - **Disable credential rotation**: - When enabled, Boundary does not rotate the credentials with AWS automatically. - Credential rotation is automatically disabled when you use dynamic credentials. - - - - -1. Select **Save**. - - - - -The required fields for creating a dynamic host catalog depend on whether you configure static or dynamic credentials. - - - - -1. Log in to Boundary. -1. Use the following command to create a dynamic host catalog for AWS using static credentials: - - ```shell-session - $ boundary host-catalogs create plugin \ - -scope-id $BOUNDARY_PROJECT_ID \ - -plugin-name aws \ - -attr disable_credential_rotation=true \ - -attr region=us-east-1 \ - -secret access_key_id=env://AWS_ACCESS_KEY_ID \ - -secret secret_access_key=env://AWS_SECRET_ACCESS_KEY - ``` - - The `scope-id` and `plugin-name` fields are required when you create a - dynamic host catalog. - - The fields following the `attr` and `secret` flags are specific to AWS and are required by - Boundary for authentication. - Replace the values in the command with the following required AWS secrets and any attributes you want to associate with the host catalog: - - - `disable_credential_rotation`: When set to `true`, Boundary does not rotate the credentials with AWS automatically. - - `region`: The region to configure the host catalog for. All host sets in this catalog are configured for this region. - - `access_key_id`: The access key ID for the IAM user to use with this host catalog. - - `secret_access_key`: The secret access key for the IAM user to use with this host catalog. - - Refer to the [host catalogs](/boundary/docs/domain-model/host-catalogs) domain model documentation for additional fields that you can use when you create host catalogs. - - - - - -1. Log in to Boundary. -1. Use the following command to create a dynamic host catalog using dynamic credentials: - - ```shell-session - $ boundary host-catalogs create plugin \ - -scope-id $BOUNDARY_PROJECT_ID \ - -plugin-name aws \ - -attr disable_credential_rotation=true \ - -attr region=us-east-1 \ - -attr role_arn=AWS_ROLE_ARN_VALUE \ - -attr role_external_id=AWS_ROLE_EXTERNAL_ID_VALUE \ - -attr role_session_name=AWS_ROLE_SESSION_NAME_VALUE \ - -attr role_tags=AWS_ROLE_TAGS_VALUE \ - -worker-filter '"aws" in "/tags/type"' - ``` - - The `scope-id` and `plugin-name` fields are required when you create a dynamic host catalog. - - Replace the values in the command with the following required AWS secrets and any attributes you want to associate with the host catalog: - - - `disable_credential_rotation`: When set to `true`, Boundary does not rotate the credentials with AWS automatically. - You must disable credential rotation to use dynamic credentials. - - `region`: The region to configure the host catalog for. All host sets in this catalog will be configured for this region. - - `role_arn`: The AWS role ARN used for `AssumeRole` authentication. If you provide a `role_arn` value, you must also set `disable_credential_rotation` to `true`. - - `role_external_id`: The external ID that you configured for the `AssumeRole` provider. - - `role_session_name`: The session name that you configured for the `AssumeRole` provider. - - `role_tags`: The key-value pair tags that you configured for the `AssumeRole` provider. - - `worker-filter` A boolean expression to filter which workers can handle dynamic host catalog commands for this host catalog. This should match a valid filter expression for the self-managed worker deployed in AWS. Refer to worker [Filter examples](/boundary/docs/workers/worker-tags#filter-workers-using-tags) to learn more. - - Refer to the [host catalogs](/boundary/docs/domain-model/host-catalogs) domain model documentation for additional fields that you can use when you create host catalogs. - - - - - - - - -The required fields for creating a dynamic host catalog depend on whether you configure static or dynamic credentials. - -Refer to the [Boundary Terraform provider documentation](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs) to learn about the requirements for the following example attributes. - - - - -Apply the following Terraform policy: - - ```hcl - resource "boundary_host_catalog_plugin" "aws_host_catalog" { - name = "AWS Catalog" - description = "AWS Host Catalog" - scope_id = boundary_scope.project.id - plugin_name = "aws" - - # recommended to pass in aws secrets using a file() or using environment variables - attributes_json = jsonencode({ - "region" = "eu-west-2", - "disable_credential_rotation" = true }) - secrets_json = jsonencode({ - "access_key_id" = "AWS_ACCESS_KEY_ID_VALUE", - "secret_access_key" = "AWS_SECRET_ACCESS_KEY_VALUE"}) - } - ``` - -The `scope_id` and `plugin_name` fields are required when you create a dynamic host catalog. - -Replace the values in the configuration with the following required AWS secrets and any attributes you want to associate with the host catalog: - - - `disable_credential_rotation`: When set to `true`, Boundary does not rotate the credentials with AWS automatically. - - `region`: The region to configure the host catalog for. All host sets in this catalog are configured for this region. - - `access_key_id`: The access key ID for the IAM user to use with this host catalog. - - `secret_access_key`: The secret access key for the IAM user to use with this host catalog. - -Refer to the [host catalogs](/boundary/docs/domain-model/host-catalogs) domain model documentation for additional fields that you can use when you create host catalogs. - - - - -Apply the following Terraform policy: - - ```hcl - resource "boundary_host_catalog_plugin" "aws_host_catalog" { - name = "AWS Catalog" - description = "AWS Host Catalog" - scope_id = boundary_scope.project.id - plugin_name = "aws" - worker_filter = "\"aws\" in \"/tags/type\"" - - attributes_json = jsonencode({ - "region" = "eu-west-2", - "disable_credential_rotation" = true, - "role_arn" = "AWS_ROLE_ARN_VALUE", - "role_external_id" = "AWS_ROLE_EXTERNAL_ID_VALUE", - "role_session_name" = "AWS_ROLE_SESSION_NAME_VALUE", - "role_tags" = "AWS_ROLE_TAGS_VALUE" - }) - } - ``` - -The `scope_id` and `plugin_name` fields are required when you create a dynamic host catalog. - -Replace the values in the configuration with the following required AWS secrets and any attributes you want to associate with the host catalog: - - - `worker_filter`: A boolean expression to filter which workers can handle dynamic host catalog commands for this host catalog. This should match a valid filter expression for the self-managed worker deployed in AWS. Refer to worker [Filter examples](/boundary/docs/workers/worker-tags#filter-workers-using-tags) to learn more. - - `disable_credential_rotation`: When set to `true`, Boundary does not rotate the credentials with AWS automatically. - You must disable credential rotation to use dynamic credentials. - - `region`: The region to configure the host catalog for. All host sets in this catalog are configured for this region. - - `role_arn`: The AWS role ARN used for `AssumeRole` authentication. If you provide a `role_arn` value, you must also set `disable_credential_rotation` to `true`. - - `role_external_id`: The external ID that you configured for the `AssumeRole` provider. - - `role_session_name`: The session name that you configured for the `AssumeRole` provider. - - `role_tags`: The key-value pair tags that you configured for the `AssumeRole` provider. - -Refer to the [host catalogs](/boundary/docs/domain-model/host-catalogs) domain model documentation for additional fields that you can use when you create host catalogs. - - - - - - - -## Create a host set to connect with AWS - -[Host sets](/boundary/docs/domain-model/host-sets) specify which AWS filters should be used to identify the discovered hosts that should be added as members. - -Complete the following steps to create a host set: - - - - -1. Log in to Boundary. -1. Select the org, and then select the project you want to create a host set for. -1. Select **Host Catalogs**. -1. Select the dynamic host catalog to which you want add a host set. -1. Click the **Host Sets** tab, and then click **New**. -1. Complete the following fields: - - **Name**: (Optional) An optional name for identification purposes. - If you enter a name, it must be unique. - - **Description**: (Optional) An optional description of the host catalog for identification purposes. -1. Click **Save**. - - - - - -1. Log in to Boundary. -1. Use the following command to create a host set: - - ```shell-session - $ boundary host-sets create plugin \ - -host-catalog-id $BOUNDARY_HOST_CATALOG_ID \ - -attr filters=tag-key=foo,bar \ - -attr filters=tag-key=baz - ``` - - The `host-catalog-id` value is a required field that specifies in which host catalog to create this host set. - - Like with the host catalog, the fields passed in after the `attr` flag are specific to AWS. - - The `filters` field contains string filters in the format key=val1,val2. The key corresponds to a filter option, and the value(s) are a comma-separated list. - For a list of filter options, refer to the [describe-instances in the AWS CLI reference](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html). - - When the values in a single `filters` field are separated by a comma, either can be true for the host to match. - When multiple filters fields are provided, they must all match for a host to match. - In the example above, an instance must have either tags `foo` or `bar`, and must have the tag `baz`. - - Refer to the [host catalogs](/boundary/docs/domain-model/host-catalogs) domain model documentation for additional fields that you can use when you create host catalogs. - - - - -Apply the following Terraform policy: - -```hcl -resource "boundary_host_set_plugin" "aws_host_set" { - name = "AWS Host Set" - description = "AWS Host Set" - host_catalog_id = boundary_host_catalog_plugin.aws_host_catalog.id - attributes_json = jsonencode({ - "filters" = ["tag-key=foo,bar", "tag-key=baz"] }) -} -``` - -The `host_catalog_id` value is a required field that specifies in which host catalog to create this host set. - -The `filters` field contains string filters in the format key=val1,val2. -The key corresponds to a filter option, and the value(s) are a comma-separated list. -For a list of filter options, refer to the [describe-instances in the AWS CLI reference](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html). - -When the values in a single `filters` field are separated by a comma, either can be true for the host to match. -When multiple filters fields are provided, they must all match for a host to match. -In the example above, an instance must have either tags `foo` or `bar`, and must have the tag `baz`. - -Refer to the [host catalogs](/boundary/docs/domain-model/host-catalogs) domain model documentation for additional fields that you can use when you create host catalogs. - - - - - -## More information - -Refer to [Filtering and listing resources](/boundary/docs/filtering) for more information about Boundary's filter syntax and best practices. diff --git a/website/content/docs/hosts/azure.mdx b/website/content/docs/hosts/azure.mdx deleted file mode 100644 index 7c2583691..000000000 --- a/website/content/docs/hosts/azure.mdx +++ /dev/null @@ -1,205 +0,0 @@ ---- -layout: docs -page_title: Azure dynamic host catalogs -description: >- - Use dynamic host catalogs to automatically discover Azure resources and add them as hosts. Create a host catalog and host set for Azure resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -# Azure dynamic host catalogs -Boundary uses dynamic host catalogs to automatically discover Azure resources available through Azure Resource Manager (ARM) and add them as hosts. - -The Azure plugin supports Azure Virtual Machines and Azure Virtual Machine Scale Sets in both Flexible and Uniform orchestration modes. -It automatically discovers any individual virtual machines included in the scale sets and adds them as hosts. - -## Create a host catalog to connect with Azure -Boundary uses plugins to integrate with a variety of providers. To use a -dynamic host catalog to integrate with Azure, you create a host catalog of the -`plugin` type and set the `plugin-name` value to `azure`. You must also provide the -specific fields needed for Boundary to authenticate with Azure. - -Complete the following steps to create a dynamic host catalog for Azure: - - - - -1. Log in to Boundary. -1. Select the org, and then select the project you want to create a host catalog for. -1. Select **Host Catalogs**. -1. Select **New Host Catalog**. -1. Complete the following fields: - - **Name**: (Optional) An optional name for identification purposes. - If you enter a name, it must be unique. - - **Description**: (Optional) An optional description of the host catalog for identification purposes. - - **Type**: (Required) Select **Dynamic** to create a dynamic host catalog. - - **Provider**: (Required) Select **Azure** to create a dynamic host catalog for your Azure resources. - - **Tenant/Directory ID**: (Required) The ARM tenant (directory) ID for your Azure Active Directory application. - - **Subscription ID**: (Required) The ARM subscription ID for the subscription that has read access. - - **Client/Application ID**: (Required) The client (application) ID of the Azure service principal that Boundary should use to authenticate and discover hosts. - - **Client Secret Value**: (Required) The ARM client secret value that Azure generates for authentication. - - **Disable credential rotation**: When enabled, Boundary does not rotate the credentials with Azure automatically. - Azure host catalogs do not currently support credential rotation. -1. Select **Save**. - - - - -1. Log in to Boundary. -1. Use the following command to create a dynamic host catalog for Azure: - - ```shell-session - $ boundary host-catalogs create plugin \ - -scope-id $PROJECT_ID \ - -plugin-name azure \ - -attr disable_credential_rotation=true \ - -attr tenant_id=env://ARM_TENANT_ID \ - -attr subscription_id=env://ARM_SUBSCRIPTION_ID \ - -attr client_id=env://ARM_CLIENT_ID \ - -secret secret_value=env://ARM_CLIENT_SECRET - ``` - - The `scope-id` and `plugin-name` fields are required when you create a dynamic host catalog. - - The fields following the `attr` and `secret` flags are specific to Azure and are required by Boundary for authentication. - - - `disable_credential_rotation`: When set to `true`, Boundary does not rotate the credentials automatically. - Azure host catalogs do not currently support credential rotation. - - `tenant_id`: (Required) The ARM tenant (directory) ID for your Azure Active Directory application. - - `subscription_id`: (Required) The ARM subscription ID for the subscription that has read access. - - `client_id`: (Required) The client (application) ID of the Azure service principal that Boundary should use to authenticate and discover hosts. - - `secret_value`: (Required) The ARM client secret value that Azure generates for authentication. - - Refer to the [host catalogs](/boundary/docs/domain-model/host-catalogs) domain model documentation for additional fields that you can use when you create host catalogs. - - - - -Refer to the [Boundary Terraform provider documentation](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs) to learn about the requirements for the following example attributes. - -Apply the following Terraform policy: - -```hcl -resource "boundary_host_catalog_plugin" "azure_host_catalog" { - name = "Azure Catalog" - description = "Azure Host Catalog" - scope_id = boundary_scope.project.id - plugin_name = "azure" - - # recommended to pass in aws secrets using a file() or using environment variables - attributes_json = jsonencode({ - "tenant_id" = "ARM_TENANT_ID", - "subscription_id" = "ARM_SUBSCRIPTION_ID" - "client_id" = "ARM_CLIENT_ID" - "disable_credential_rotation" = true }) - secrets_json = jsonencode({ - "secret_value" = "ARM_CLIENT_SECRET"}) -} -``` - -The `scope_id` and `plugin_name` fields are required when you create a -dynamic host catalog. - -The fields following the `attributes_json` and `secrets_json` flags are specific to Azure and are required by - Boundary for authentication. - -- `disable_credential_rotation`: When set to `true`, Boundary does not rotate the credentials automatically. -Azure host catalogs do not currently support credential rotation. -- `tenant_id`: (Required) The ARM tenant (directory) ID for your Azure Active Directory application. -- `subscription_id`: (Required) The ARM subscription ID for the subscription that has read access. -- `client_id`: (Required) The client (application) ID of the Azure service principal that Boundary should use to authenticate and discover hosts. -- `secret_value`: (Required) The ARM client secret value that Azure generates for authentication. - -Refer to the [host catalogs](/boundary/docs/domain-model/host-catalogs) domain model documentation for additional fields that you can use when you create host catalogs. - - - - -## Create a host set to connect with Azure -[Host sets](/boundary/docs/domain-model/host-sets) specify which Azure -Resource Manager (ARM) filters should be used to identify the discovered hosts that should be added as members. - -Complete the following steps to create a host set: - - - - -1. Log in to Boundary. -1. Select the org, and then select the project you want to create a host set for. -1. Select **Host Catalogs**. -1. Select the dynamic host catalog to which you want add a host set. -1. Click the **Host Sets** tab, and then click **New**. -1. Complete the following fields: - - **Name**: (Optional) An optional name for identification purposes. - If you enter a name, it must be unique. - - **Description**: (Optional) An optional description of the host catalog for identification purposes. -1. Click **Save**. - - - - - -1. Log in to Boundary. -1. Use the following command to create a host set: - - ```shell-session - $ boundary host-sets create plugin \ - -name database \ - -host-catalog-id $HOST_CATALOG_ID \ - -attr filter="tagName eq 'service-type' and tagValue eq 'database'" - ``` - - The `host-catalog-id` value is a required field that specifies in which host catalog to create this host set. - - The fields following the `attr` flag are specific to Azure. - - The `filter` field represents the ARM filter used to select resources that should be a part of this host set. - There are some limitations with the filtering syntax. - Specifically, when you use tags, other types of filters (such as on resource type) are not allowed. - As a result, it is generally useful to filter directly on tag names or values as in the following examples: - - `tagName eq 'application'` - - `tagName eq 'application' and tagValue eq 'app2'` - - Refer to the [host catalogs](/boundary/docs/domain-model/host-catalogs) domain model documentation for additional fields that you can use when you create host catalogs. - - - - - -Refer to the [Boundary Terraform provider documentation](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs) to learn about the requirements for the following example attributes. - -Apply the following Terraform policy: - -```hcl - resource "boundary_host_set_plugin" "azure_host_set" { - name = "Azure Set" - description = "Azure Host Set" - host_catalog_id = boundary_scope.azure_host_catalog.id - attributes_json = jsonencode({ - "filter" = "tagName eq 'service-type' and tagValue eq 'database'" }) -} -``` - -The `host_catalog_id` value is a required field that specifies in which host catalog to - create this host set. - -The fields following the `attributes_json` flag are specific to Azure. - -The `filter` field represents the ARM filter used to select resources that should be a part of - this host set. There are some limitations with the filtering syntax. - Specifically, when you use tags, other types of filters (such as on resource - type) are not allowed. As a result, it is generally useful to filter - directly on tag names or values as in the following examples: - - `tagName eq 'application'` - - `tagName eq 'application' and tagValue eq 'app2'` - -Refer to the [host catalogs](/boundary/docs/domain-model/host-catalogs) domain model documentation for additional fields that you can use when you create host catalogs. - - - - -## More information - -Refer to [Filtering and listing resources](/boundary/docs/filtering) for more information about Boundary's filter syntax and best practices. \ No newline at end of file diff --git a/website/content/docs/hosts/gcp.mdx b/website/content/docs/hosts/gcp.mdx deleted file mode 100644 index 8184740af..000000000 --- a/website/content/docs/hosts/gcp.mdx +++ /dev/null @@ -1,503 +0,0 @@ ---- -layout: docs -page_title: GCP dynamic host catalogs -description: >- - Use dynamic host catalogs to automatically discover GCP Compute Engine VM instances and add them as hosts. Create a host catalog and host set for GCP resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -# GCP dynamic host catalogs - -Boundary uses dynamic host catalogs to automatically discover GCP Compute Engine VM instances and add them as hosts. - -You can authenticate to GCP using a service account, service impersonation, or the GCP Application Default Credentials (ADC): - - - - -To authenticate using the service account, create a service account in GCP and download the private key file. - -The service account should have the following roles: - - - `roles/compute.viewer`: (Required) To list Compute Engine VM instance in the project. - - `roles/iam.serviceAccountKeyAdmin`: (Optional) To rotate the service account key if `disable_credential_rotation` is set to `false`. - - - - - -Service account impersonation allows Boundary to authenticate with GCP using a service account that impersonates another service account. -Impersonation is useful when you want to restrict the permissions of the service account Boundary uses. - -You must create two service accounts to authenticate using service impersonation: - -- `Base service account`: The service account Boundary uses to authenticate with GCP. The service account should have the following roles: - - `roles/iam.serviceAccountTokenCreator`: (Required) To create a token for the target service account. - - `roles/iam.serviceAccountKeyAdmin`: (Optional) To rotate the service account key if `disable_credential_rotation` is set to `false`. - -- `Target service account`: The service account to impersonate. The service account should have the following role: - - `roles/compute.viewer`: (Required) To list Compute Engine VM instance in the project. - - - - - -If you run Boundary on a GCP VM instance, you can use Application Default Credentials (ADC) to authenticate with GCP. -Boundary uses the service account associated with the VM instance to authenticate with GCP. - - - - - - -If you downloaded the private key from GCP, it may contain extra `/n` characters that cause an error. -You can use the `jq` utility to remove the extra `/n` characters. For example: - -```shell-session -$ jq -r '.private_key' my-gcp-private-key.json -``` - - - -## Create a host catalog to connect with GCP - -Boundary uses plugins to integrate with a variety of providers. -To use a dynamic host catalog to integrate with GCP, you create a host catalog of the `plugin` type and set the `plugin-name` value to `gcp`. - -You must also provide the specific fields needed for Boundary to authenticate with GCP. -The required fields depend on whether you authenticate using the service account, service impersonation, or the GCP Application Default Credentials (ADC). - -Complete the following steps to create a dynamic host catalog for GCP: - - - - -1. Log in to Boundary. -1. Select the org, and then select the project you want to create a host catalog for. -1. Select **Host Catalogs**. -1. Select **New Host Catalog**. -1. Complete the following fields: - - **Name**: (Optional) An optional description of the host catalog for identification purposes. - If you enter a name, it must be unique. - - **Description**: (Optional) An optional description of the host catalog for identification purposes. - - **Type**: (Required) Select **Dynamic** to create a dynamic host catalog. - - **Provider**: (Required) Select **GCP** to create a dynamic host catalog for your GCP resources. - - The required fields for creating a dynamic host catalog depend on the type of authentication you configure. - - - - - - **Project ID**: (Required) The project ID of any instances that you want to add to the host catalog. - - **Zone**: (Required) The GCP zone of the instances that you want to add to the host catalog. - - **Client Email**: The unique email address that is used to identify the service account. - It is required when you authenticate using the service account. - - **Target Service Account ID**: Skip this field when you configure authentication using the service account. - It is only used when you authenticate using service account impersonation. - - **Private Key ID**: The unique identifier of the private key. - It is required when you authenticate using the service account. - - **Private Key**: The private key used to obtain an OAuth 2.0 access token. - The key must be PEM encoded. - It is required when you authenticate using the service account. - - If you downloaded the private key from GCP, it may contain extra `/n` characters that cause an error. - You can use `jq` to remove the extra `/n` characters. - - - - - - - **Project ID**: (Required) The project ID of any instances that you want to add to the host catalog. - - **Zone**: (Required) The GCP zone of the instances that you want to add to the host catalog. - - **Client Email**: The unique email address that is used to identify the base service account. - It is required when you authenticate using service account impersonation. - - **Target Service Account ID**: The unique identifier for the service account that is impersonated. - It is required when you authenticate using service account impersonation. - - **Private Key ID**: The unique identifier of the private key for the base service account. - It is required when you authenticate using service account impersonation. - - **Private Key**: The private key used to obtain an OAuth 2.0 access token. - The key must be PEM encoded. - It is required when you authenticate using service account impersonation. - - If you downloaded the private key from GCP, it may contain extra `/n` characters that cause an error. - You can use `jq` to remove the extra `/n` characters. - - - - - - - **Project ID**: (Required) The project ID of any instances that you want to add to the host catalog. - - **Zone**: (Required) The GCP zone of the instances that you want to add to the host catalog. - - **Client Email**: (Optional) The unique email address that is used to identify the base service account. - - **Target Service Account ID**: Skip this field when you configure authentication using the ADC. - It is only used when you authenticate using service account impersonation. - - **Private Key ID**: (Optional) The unique identifier of the private key for the base service account. - - **Private Key**: (Optional) The private key used to obtain an OAuth 2.0 access token. - The key must be PEM encoded. - - If you downloaded the private key from GCP, it may contain extra `/n` characters that cause an error. - You can use `jq` to remove the extra `/n` characters. - - - - - - **Worker Filter**: (Optional) An optional filter to route requests to a designated worker. - - **Disable credential rotation**: (Optional) When enabled, Boundary does not rotate the credentials with GCP automatically. -1. Select **Save**. - - - - - -The required fields for creating a dynamic host catalog depend on the type of authentication you configure. - - - - -1. Log in to Boundary. -1. Use the following command to create a dynamic host catalog for GCP: - - ```shell-session - $ boundary host-catalogs create plugin \ - -scope-id $BOUNDARY_PROJECT_ID \ - -plugin-name gcp \ - -attr disable_credential_rotation=true \ - -attr zone=us-central1-a \ - -attr project_id=env://GCP_PROJECT_ID \ - -attr client_email=env://CLIENT_EMAIL \ - -secret private_key_id=env://PRIVATE_KEY_ID \ - -secret private_key=file://$PRIVATE_KEY_FILE_PATH - ``` - - The `scope-id` and `plugin-name` fields are required when you create a dynamic host catalog. - - The fields following the `attr` and `secret` flags are specific to GCP and are used by Boundary for authentication: - - - `disable_credential_rotation`: (Optional) When set to `true`, Boundary does not rotate the credentials automatically. - - `zone`: (Required) The GCP zone of the instances that you want to add to the host catalog. - - `project_id`: (Required) The project ID of any instances that you want to add to the host catalog. - - `client_email`: The unique email address that is used to identify the service account. - It is required when you authenticate using the service account. - - `private_key_id`: The unique identifier of the private key. - It is required when you authenticate using the service account. - - `private_key`: The private key used to obtain an OAuth 2.0 access token. - The key must be PEM encoded. - It is required when you authenticate using the service account. - - If you downloaded the private key from GCP, it may contain extra `/n` characters that cause an error. - You can use `jq` to remove the extra `/n` characters. - - Refer to the [host catalogs](/boundary/docs/domain-model/host-catalogs) domain model documentation for additional fields that you can use when you create host catalogs. - - - - - -1. Log in to Boundary. -1. Use the following command to create a dynamic host catalog for GCP: - - ```shell-session - $ boundary host-catalogs create plugin \ - -scope-id $BOUNDARY_PROJECT_ID \ - -plugin-name gcp \ - -attr disable_credential_rotation=true \ - -attr zone=us-central1-a \ - -attr project_id=env://GCP_PROJECT_ID \ - -attr client_email=env://BASE_SERVICE_ACCOUNT_EMAIL \ - -attr target_service_account_id=env://TARGET_SERVICE_ACCOUNT_EMAIL \ - -secret private_key_id=env://BASE_SERVICE_ACCOUNT_PRIVATE_KEY_ID \ - -secret private_key=file://$BASE_SERVICE_ACCOUNT_PRIVATE_KEY_FILE_PATH - ``` - - The `scope-id` and `plugin-name` fields are required when you create a dynamic host catalog. - - The fields following the `attr` and `secret` flags are specific to GCP and are required by Boundary for authentication: - - - `disable_credential_rotation`: (Optional) When set to `true`, Boundary does not rotate the credentials with GCP automatically. - - `zone`: (Required) The deployment area within a region. - All host sets in this catalog are configured for this zone. - - `project_id`: (Required) The project ID associated with the service account. - - `client_email`: The email address used to uniquely identify the base service account. - It is required when you authenticate using service account impersonation. - - `target_service_account_id`: The email address of the service account to impersonate. - It is required when you authenticate using service account impersonation. - - `private_key_id`: The ID of the private key for the base service account to use with this host catalog. - It is required when you authenticate using service account impersonation. - - `private_key`: The private key for the base service account to use with this host catalog. - It is required when you authenticate using service account impersonation. - - If you downloaded the private key from GCP, it may contain extra `/n` characters that cause an error. - You can use `jq` to remove the extra `/n` characters. - - Refer to the [host catalogs](/boundary/docs/domain-model/host-catalogs) domain model documentation for additional fields that you can use when you create host catalogs. - - - - - -1. Log in to Boundary. -1. Use the following command to create a dynamic host catalog for GCP: - - ```shell-session - $ boundary host-catalogs create plugin \ - -scope-id $BOUNDARY_PROJECT_ID \ - -plugin-name gcp \ - -attr disable_credential_rotation=true \ - -attr zone=us-central1-a \ - -attr project_id=env://GCP_PROJECT_ID - ``` - - The `scope-id` and `plugin-name` fields are required when you create a dynamic host catalog. - - The fields following the `attr` flag are specific to GCP and are required by Boundary for authentication: - - - `disable_credential_rotation`: (Optional) When set to `true`, Boundary does not rotate the credentials with GCP automatically. - - `zone`: (Required) The deployment area within a region. - All host sets in this catalog are configured for this zone. - - `project_id`: (Required) The project ID associated with the service account. - - Refer to the [host catalogs](/boundary/docs/domain-model/host-catalogs) domain model documentation for additional fields that you can use when you create host catalogs. - - - - - - - - -The required fields for creating a dynamic host catalog depend on the type of authentication you configure. - - - - -Refer to the [Boundary Terraform provider documentation](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs) to learn about the requirements for the following example attributes. - -Apply the following Terraform policy: - - ```hcl - resource "boundary_host_catalog_plugin" "gcp_host_catalog" { - name = "GCP Catalog" - description = "GCP Host Catalog" - scope_id = boundary_scope.project.id - plugin_name = "gcp" - - # recommended to pass in aws secrets using a file() or using environment variables - attributes_json = jsonencode({ - "zone" = "us-central1-a ", - "project_id" = "GCP_PROJECT_ID_VALUE", - "client_email" = "GCP_CLIENT_EMAIL_VALUE", - "disable_credential_rotation" = true }) - secrets_json = jsonencode({ - "private_key_id" = "GCP_PRIVATE_KEY_ID_VALUE", - "private_key" = "GCP_PRIVATE_KEY_VALUE"}) - } - ``` - - The `scope_id` and `plugin_name` fields are required when you create a dynamic host catalog. - - The fields following `attributes_json` and `secrets_json` are specific to GCP and are used by Boundary for authentication: - - - `zone`: (Required) The GCP zone of the instances that you want to add to the host catalog. - - `project_id`: (Required) The project ID of any instances that you want to add to the host catalog. - - `client_email`: The unique email address that is used to identify the service account. - It is required when you authenticate using the service account. - - `disable_credential_rotation`: (Optional) When set to `true`, Boundary does not rotate the credentials automatically. - - `private_key_id`: The unique identifier of the private key. - It is required when you authenticate using the service account. - - `private_key`: The private key used to obtain an OAuth 2.0 access token. - The key must be PEM encoded. - It is required when you authenticate using the service account. - - If you downloaded the private key from GCP, it may contain extra `/n` characters that cause an error. - You can use `jq` to remove the extra `/n` characters. - -Refer to the [host catalogs](/boundary/docs/domain-model/host-catalogs) domain model documentation for additional fields that you can use when you create host catalogs. - - - - - -Refer to the [Boundary Terraform provider documentation](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs) to learn about the requirements for the following example attributes. - -Apply the following Terraform policy: - - ```hcl - resource "boundary_host_catalog_plugin" "gcp_host_catalog" { - name = "GCP Catalog" - description = "GCP Host Catalog" - scope_id = boundary_scope.project.id - plugin_name = "gcp" - - # recommended to pass in aws secrets using a file() or using environment variables - attributes_json = jsonencode({ - "zone" = "us-central1-a ", - "project_id" = "GCP_PROJECT_ID_VALUE", - "client_email" = "GCP_BASE_SERVICE_ACCOUNT_EMAIL_VALUE", - "target_service_account_id" = "GCP_TARGET_SERVICE_ACCOUNT_EMAIL_VALUE", - "disable_credential_rotation" = true }) - secrets_json = jsonencode({ - "private_key_id" = "BASE_SERVICE_ACCOUNT_PRIVATE_KEY_ID_VALUE", - "private_key" = "BASE_SERVICE_ACCOUNT_PRIVATE_KEY_VALUE"}) - } - ``` - -The `scope_id` and `plugin_name` fields are required when you create a dynamic host catalog. - -The fields following `attributes_json` and `secrets_json` are specific to GCP and are required by Boundary for authentication: - -- `zone`: (Required) The deployment area within a region. All host sets in this - catalog are configured for this zone. -- `project_id`: (Required) The project ID associated with the service account. -- `client_email`: The email address used to uniquely identify the base service account. -It is required when you authenticate using service account impersonation. -- `target_service_account_id`: The email address of the service account to impersonate. -It is required when you authenticate using service account impersonation. -- `disable_credential_rotation`: (Optional) When set to `true`, Boundary does not rotate the credentials with GCP automatically. -- `private_key_id`: The ID of the private key for the base service account to use with this host catalog. -It is required when you authenticate using service account impersonation. -- `private_key`: The private key for the base service account to use with this host catalog. -It is required when you authenticate using service account impersonation. - - If you downloaded the private key from GCP, it may contain extra `/n` characters that cause an error. - You can use `jq` to remove the extra `/n` characters. - -Refer to the [host catalogs](/boundary/docs/domain-model/host-catalogs) domain model documentation for additional fields that you can use when you create host catalogs. - - - - - -Refer to the [Boundary Terraform provider documentation](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs) to learn about the requirements for the following example attributes. - -Apply the following Terraform policy: - - ```hcl - resource "boundary_host_catalog_plugin" "gcp_host_catalog" { - name = "GCP Catalog" - description = "GCP Host Catalog" - scope_id = boundary_scope.project.id - plugin_name = "gcp" - - # recommended to pass in aws secrets using a file() or using environment variables - attributes_json = jsonencode({ - "zone" = "us-central1-a ", - "project_id" = "GCP_PROJECT_ID_VALUE", - "disable_credential_rotation" = true }) - } - ``` - -The `scope_id` and `plugin_name` fields are required when you create a dynamic host catalog. - -The fields following `attributes_json` are specific to GCP and are required by Boundary for authentication: - -- `zone`: (Required) The GCP zone of the instances that you want to add to the host catalog. -- `project_id`: (Required) The project ID of any instances that you want to add to the host catalog. -- `disable_credential_rotation`: (Optional) When set to `true`, Boundary does not rotate the credentials with GCP automatically. - -Refer to the [host catalogs](/boundary/docs/domain-model/host-catalogs) domain model documentation for additional fields that you can use when you create host catalogs. - - - - - - - -## Create a host set to connect with GCP - -[Host sets](/boundary/docs/domain-model/host-sets) specify which GCP filters Boundary should use to identify which discovered hosts that should be added as members. - -Complete the following steps to create a host set: - - - - -1. Log in to Boundary. -1. Select the org, and then select the project you want to create a host set for. -1. Select **Host Catalogs**. -1. Select the dynamic host catalog to which you want to add a host set. -1. Click the **Host Sets** tab, and then click **New**. -1. Complete the following fields: - - - **Name**: (Optional) An optional name for identification purposes. - If you enter a name, it must be unique. - - **Description**: (Optional) An optional description of the host catalog for identification purposes. -1. Click **Save**. - - - - - -1. Log in to Boundary. -1. Use the following command to create a host set: - - ```shell-session - $ boundary host-sets create plugin \ - -host-catalog-id $BOUNDARY_HOST_CATALOG_ID \ - -attr filters=labels.env:prod \ - -attr filters=labels.app:web - ``` - - The `host-catalog-id` value is a required field that specifies in which host catalog to create this host set. - - Like with the host catalog, the fields passed in after the `attr` flag are specific to GCP. - - The `filters` field contains string filters in the format key=val. - The key corresponds to a filter option. - For a list of filter options, refer to the [GCP API documentation](https://cloud.google.com/compute/docs/reference/rest/v1/instances/list#filter). - When you apply multiple filters, the plugin applies a logical `AND` operation to combine the filters. - - If there is no explicit instance status filter, the default status is set to `status="RUNNING"`. - The default status ensures that Boundary only filters running instances, saving time when processing results. - - We recommend using labels as filters because they are more flexible and can filter on multiple values as in the following examples: - - - `-attr filters=labels.env:dev` - - `-attr filters="labels.env:prod AND labels.app:web"` - - Refer to the [host catalogs](/boundary/docs/domain-model/host-catalogs) domain model documentation for additional fields that you can use when you create host catalogs. - - - - -Refer to the [Boundary Terraform provider documentation](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs) to learn about the requirements for the following example attributes. - -Apply the following Terraform policy: - -```hcl -resource "boundary_host_set_plugin" "gcp_host_set" { - name = "GCP Host Set" - description = "GCP Host Set" - host_catalog_id = boundary_host_catalog_plugin.gcp_host_catalog.id - attributes_json = jsonencode({ - "filters" = ["labels.env:prod", "labels.app:web"] }) -} -``` - -The `host_catalog_id` value is a required field that specifies in which host catalog to create this host set. - -Like with the host catalog, the fields passed in after `attributes_json` flag are specific to GCP. - -The `filters` field contains string filters in the format key=val1. -The key corresponds to a filter option. -For a list of filter options, refer to the [GCP API documentation](https://cloud.google.com/compute/docs/reference/rest/v1/instances/list#filter). -When you apply multiple filters, the plugin applies a logical `AND` operation to combine the filters. - -If there is no explicit instance status filter, the default status is set to `status="RUNNING"`. -The default status ensures that Boundary only filters running instances, saving time when processing results. - -We recommend using labels as filters because they are more flexible and can filter on multiple values as in the following examples: - - - `-attr filters=labels.env:dev` - - `-attr filters="labels.env:prod AND labels.app:web"` - -Refer to the [host catalogs](/boundary/docs/domain-model/host-catalogs) domain model documentation for additional fields that you can use when you create host catalogs. - - - - -## More information - -Refer to [Filtering and listing resources](/boundary/docs/filtering) for more information about Boundary's filter syntax and best practices. \ No newline at end of file diff --git a/website/content/docs/hosts/index.mdx b/website/content/docs/hosts/index.mdx deleted file mode 100644 index eb7fc9a7b..000000000 --- a/website/content/docs/hosts/index.mdx +++ /dev/null @@ -1,70 +0,0 @@ ---- -layout: docs -page_title: Host discovery -description: >- - Learn how host discovery workflows let Boundary discover and onboard new resources. Understand how dynamic host catalogs enable automated host discovery. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Host discovery - -Traditionally, connecting to remote hosts and services requires knowledge of -the endpoint’s connection info (e.g. the IP address and port of the service). -This creates complexity when managing the onboarding of new resources at scale -or dealing with dynamic, ephemeral services whose connection info frequently changes. -Furthermore, the increased operational overhead of having to manually manage and update -new or old resources is an inefficient use of time. -Resources should be tagged appropriately so that, depending on their identity, users -automatically have the resources that they are allowed to connect to. - -**Host discovery** focuses on automating the process of onboarding new or -changed infrastructure resources – and their connection info – to Boundary -as hosts. - -## Automated host discovery in Boundary - -Boundary supports target/host discovery in three primary workflows: - -**[Manual configuration](/boundary/tutorials/community-administration/community-manage-targets)**: -Boundary administrators can manually configure static -hosts and targets via the administrator UI and CLI. Manual configuration of -targets with static hosts requires knowledge of the IP address or endpoint used -to connect to a host. - -**[Host discovery via configuration as code with Terraform](/boundary/tutorials/get-started-community/community-get-started-config)**: -Boundary is fully programmatically instrumented and the discovery and configuration of new -infrastructure targets can be automated with -[Boundary’s Terraform provider](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs). -This allows for dynamic configuration of a host and target without the need -for prior knowledge of the target’s connection info. - -**[Runtime host discovery via dynamic host catalogs](/boundary/tutorials/host-management/aws-host-catalogs)**: -Boundary dynamic host catalogs automate the ingestion of resources from -infrastructure providers into Boundary. Boundary hosts are automatically -created, updated and added to host sets in order to reflect the connection -information maintained in these providers. This removes the need to know -host connection info or reapply infrastructure as code templates to -configure new or changed resources. - -## Dynamic host catalogs -Dynamic host catalogs are an agentless workflow for Boundary to -securely query infrastructure providers at runtime to discover and configure -new services. Boundary administrators can define rules for which -external resources should be ingested into the catalog by -[creating a host set](/boundary/docs/domain-model/host-sets) -with an attributes filter. These filters specify which discovered hosts -should be members of the host set. - -Boundary currently supports dynamic host catalog for AWS, Azure, and GCP. -We will continue to grow this ecosystem to support additional providers. - -## Next steps -To get started with dynamic host catalogs, refer to the following topics: - -- [AWS dynamic host catalogs](/boundary/docs/hosts/aws) -- [Azure dynamic host catalogs](/boundary/docs/hosts/azure) -- [GCP dynamic host catalogs](/boundary/docs/hosts/gcp) diff --git a/website/content/docs/index.mdx b/website/content/docs/index.mdx deleted file mode 100644 index 334968f39..000000000 --- a/website/content/docs/index.mdx +++ /dev/null @@ -1,19 +0,0 @@ ---- -layout: docs -page_title: Documentation -description: Boundary reference documentation ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary reference documentation - -Welcome to the Boundary reference documentation. The documentation is reference -material for Boundary's concepts and available features. - -- Get started using Boundary with our [step-by-step onboarding tutorials](/boundary/tutorials). -- Deploy Boundary in a [self-managed environment](/boundary/docs/deploy/self-managed) or on the [HashiCorp Cloud Platform (HCP)](/boundary/docs/hcp/get-started/deploy-and-login). -- Learn about [what Boundary is](/boundary/docs/what-is-boundary/) or refer to the [domain model](/boundary/docs/domain-model) to understand how identities, permissions, and resources are organized. diff --git a/website/content/docs/interoperability-matrix/index.mdx b/website/content/docs/interoperability-matrix/index.mdx deleted file mode 100644 index fc93c77f4..000000000 --- a/website/content/docs/interoperability-matrix/index.mdx +++ /dev/null @@ -1,182 +0,0 @@ ---- -layout: docs -page_title: Transparent sessions interoperability matrix -description: >- - Refer to a matrix to determine which partner products and applications are supported by the Boundary components required for transparent sessions. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Transparent sessions interoperability matrix - -@include 'alerts/enterprise-only.mdx' - -Transparent sessions require you to use the Boundary installer to install the Boundary Client Agent. -To support a variety of use cases, HashiCorp verifies implementation and integrations with partner products and applications. - -HashiCorp engineering has tested and confirmed that you can use the following third-party products with the specific versions of the Boundary installer, Boundary Client Agent, and any operating systems listed in the table. -Transparent sessions may operate with other versions of the products listed below or with other products, but they have not been tested. -We will update the list of products as we test them. - - - -On May 27, 2025 new versions of the Boundary Client Agent and installer were released with a numbering scheme that more closely follows Boundary's release numbers. -Those versions were released as 0.19.5 to match the major Boundary version 0.19.x. -Going forward, the Client Agent and installer will use the same major number as the current Boundary release. -Any patches or updates will be reflected in the minor number. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ProductBoundary installer versionsBoundary Client Agent versionsOS versions testedConflicts and workarounds
- CloudFlare WARP -

- MacOS version: 2025.2.600.0 -
- Windows version: 2025.2.600.0 - 		- 0.1.4, 0.19.5, 0.19.6 - - 0.1.4, 0.19.5, 0.19.6 - - MacOS: 14.6, 15.3 -
- Windows: 10 Pro, 11 Pro - 		- Refer to Conflicting software -
- Huntress -

- MacOS version: 0.14.10 -
- Windows version: 0.14.14 - 		- 0.1.4 - - 0.1.4 - - MacOS: 14.6, 15.3 -
- Windows: 10 Pro, 11 Pro - 		- Refer to Conflicting software -
- Microsoft Defender for Endpoint - - 0.1.4, 0.19.5, 0.19.6 - - 0.1.4, 0.19.5, 0.19.6 - - MacOS: 14, 15 -
- Windows: 10, 11 Pro - 		-   -
- Palo Alto GlobalProtect - - 0.19.5, 0.19.6 - - 0.19.5, 0.19.6 - - MacOS: 14, 15 -
- Windows: 10, 11 - 		-   -
- SentinelOne Singularity - - 0.1.4, 0.19.5, 0.19.6 - - 0.1.4, 0.19.5, 0.19.6 - - MacOS: 14, 15.2 -
- Windows: 10, 11 - 		-   -
- Zscaler ZPA - - 0.1.4, 0.19.5, 0.19.6 - - 0.1.4, 0.19.5, 0.19.6 - - MacOS: 15 -
- Windows: 11 - 		-   -
- -## More information - -For more information, refer to the following topics: - -- [Transparent sessions](/boundary/docs/concepts/transparent-sessions) -- [Configure transparent sessions](/boundary/docs/targets/configuration/configure-transparent-sessions) -- [Boundary Client Agent](/boundary/docs/client-agent) \ No newline at end of file diff --git a/website/content/docs/monitor/events/common.mdx b/website/content/docs/monitor/events/common.mdx deleted file mode 100644 index 591483e56..000000000 --- a/website/content/docs/monitor/events/common.mdx +++ /dev/null @@ -1,27 +0,0 @@ ---- -layout: docs -page_title: Controller/worker - events - common sink parameters -description: |- - The common sink parameters for all sink types. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Common sink parameters - -@include '/configuration-reference/events/common-sink-intro.mdx' - -## `audit_config` parameters - -@include '/configuration-reference/events/common-audit_config-parameters.mdx' - -### `audit_filter_overrides` parameters - -@include '/configuration-reference/events/common-audit_filter_overrides-parameters.mdx' - -## `audit_config` examples - -@include '/configuration-reference/events/common-audit_config-examples.mdx' diff --git a/website/content/docs/monitor/events/events.mdx b/website/content/docs/monitor/events/events.mdx deleted file mode 100644 index 268f542b1..000000000 --- a/website/content/docs/monitor/events/events.mdx +++ /dev/null @@ -1,19 +0,0 @@ ---- -layout: docs -page_title: Controller/worker - events -description: |- - The events stanza configures events-specific parameters. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# `events` stanza - -@include '/configuration-reference/events/events-stanza-intro.mdx' - -## Default events stanza - -@include '/configuration-reference/events/default-events-stanza.mdx' diff --git a/website/content/docs/monitor/events/file.mdx b/website/content/docs/monitor/events/file.mdx deleted file mode 100644 index 1c4820da6..000000000 --- a/website/content/docs/monitor/events/file.mdx +++ /dev/null @@ -1,23 +0,0 @@ ---- -layout: docs -page_title: Controller/worker - events - file sink - configuration -description: |- - The file sink configures Boundary to send events to a file. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# `file` sink - -@include '/configuration-reference/events/file-sink-intro.mdx' - -## Common parameters - -These parameters are shared across all sink types: [common sink parameters](/boundary/docs/monitor/events/common) - -## `file` parameters - -@include '/configuration-reference/events/file-parameters.mdx' \ No newline at end of file diff --git a/website/content/docs/monitor/events/filter-events.mdx b/website/content/docs/monitor/events/filter-events.mdx deleted file mode 100644 index 3c8419ad4..000000000 --- a/website/content/docs/monitor/events/filter-events.mdx +++ /dev/null @@ -1,99 +0,0 @@ ---- -layout: docs -page_title: Filtering - events -description: >- - Learn how to filter audit, observation, system, and telemetry events to find information written to any event sinks you configured. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Filter events - -This page describes how to filter events written to Boundary event sinks. -Refer to [Filtering and listing resources](/boundary/docs/filtering) for more information about Boundary's filter syntax and best practices. - -A variety of event types (error, observation, -system, etc) are emitted from Boundary. Boundary events can be emitted in -several formats including [cloudevents](https://github.com/cloudevents/spec) and -[hclog](https://github.com/hashicorp/go-hclog), and can be encoded as text and -json. - -Boundary allows you to configure any number of sinks where these events will be -written. When configuring an event sink, you can specify [common sink -parameters](/boundary/docs/monitor/events/common) which include both -`allow_filters` and `deny_filters` which use the standard [filter -syntax](/boundary/docs/filtering) used elsewhere in Boundary. - -Example events encoded as cloudevents-text. The first event is a system event -and the second event is an observation event. - -```json -{ - "id": "DU7u227Jhc", - "source": "https://hashicorp.com/boundary/dev-controller/boundary-dev", - "specversion": "1.0", - "type": "system", - "data": { - "version": "v0.1", - "op": "worker.(Worker).createClientConn", - "data": { - "address": "127.0.0.1:9201", - "msg": "connected to controller" - } - }, - "datacontentype": "text/plain", - "time": "2021-08-05T18:00:05.303435-04:00" -} -{ - "id": "s5ESg6CckX", - "source": "https://hashicorp.com/boundary/dev-controller/boundary-dev", - "specversion": "1.0", - "type": "observation", - "data": { - "latency-ms": 202.995176, - "request_info": { - "id": "gtraceid_WiLnGzc2UHmNAYlcQ0sK", - "method": "POST", - "path": "/v1/auth-methods/ampw_1234567890:authenticate" - }, - "start": "2021-08-05T18:00:34.032333-04:00", - "status": 200, - "stop": "2021-08-05T18:00:34.235335-04:00", - "version": "v0.1" - }, - "datacontentype": "text/plain", - "time": "2021-08-05T18:00:34.235357-04:00" -} -``` - -To filter an event sink which was configured for every event type to -only include the above events, use the following sink configuration: -``` -sink "stderr" = { - name = "all-events" - description = "All events sent to stderr" - event_types = ["*"] - format = "cloudevents-text" - allow_filters = [ - "\"/data/request_info/path\" contains \":authenticate\"", - "\"/data/op\" contains \".createClientConn\"", - ] - # note: deny_filters are also supported. -} -``` - -When running `boundary dev` the example allow filter can be given via: -```bash -boundary dev \ - -event-allow-filter '"/data/request_info/path" contains ":authenticate"' \ - -event-allow-filter '"/data/op" contains ".createClientConn"' -``` -Double quotes are part of the filter syntax; when using the CLI, it is likely -easier to surround the filter with single quotes than to deal with escaping -double quotes. - -~> **Note:** Both `-event-allow-filter` and `-event-deny-filter` command flags are -supported for the `boundary dev` command. diff --git a/website/content/docs/monitor/events/stderr.mdx b/website/content/docs/monitor/events/stderr.mdx deleted file mode 100644 index 8896a394a..000000000 --- a/website/content/docs/monitor/events/stderr.mdx +++ /dev/null @@ -1,23 +0,0 @@ ---- -layout: docs -page_title: Controller - events - stderr sink - configuration -description: |- - The stderr sink configures Boundary to send events to a stderr. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# `stderr` sink - -@include '/configuration-reference/events/stderr-intro.mdx' - -## Common parameters - -These parameters are shared across all sink types: [common sink parameters](/boundary/docs/monitor/events/common) - -## `stderr` parameters - -@include '/configuration-reference/events/stderr-parameters.mdx' diff --git a/website/content/docs/monitor/health.mdx b/website/content/docs/monitor/health.mdx deleted file mode 100644 index 873e5736d..000000000 --- a/website/content/docs/monitor/health.mdx +++ /dev/null @@ -1,138 +0,0 @@ ---- -layout: docs -page_title: Boundary health endpoints -description: >- - Learn about using health endpoints to verify controller and worker server status. Check their health using wget. View an example response and configuration. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary health endpoints - -Boundary provides health monitoring through the `/health` path using a listener with the `"ops"` purpose. By default, a listener with that purpose runs on port `9203`. See the [example configuration](#example-configuration) section for an example listener stanza in a `config.hcl` file. - -## Requirements - -To enable the controller health endpoint, any Boundary instance must be started with a controller. That is, a `controller` block and a `purpose = "api"` -listener must be defined in Boundary's configuration file. Additionally, a `purpose = "ops"` listener must also be defined in Boundary's configuration file. Under these conditions, the `ops` server (which hosts the controller health api) will be exposed. - -## Shutdown grace period - -Optionally, when the controller health endpoint is enabled, you can configure the controller health response to `503 Service Unavailable` upon receiving a shutdown signal, and wait a configurable amount of time before starting the shutdown process. - -This feature supports load balancing by reducing the risk of an outgoing Boundary instance causing disruption to incoming requests. - -In this state, Boundary is still capable of processing requests as normal, but will report as unhealthy through the controller health endpoint. In load-balanced environments, this would cause this "unhealthy" instance to be removed from the pool of instances eligible to handle requests, reducing the likelihood that it will receive a request to handle during shutdown. - -This feature is disabled by default, even if the controller health endpoint is enabled. You can enable it by defining `graceful_shutdown_wait_duration` in the `controller` block of Boundary's configuration file. The value should be set to a string that is parseable by [ParseDuration](https://pkg.go.dev/time#ParseDuration). - -## API - -The controller health service introduces a single read-only endpoint: - -| Status | Description | -|--------------|----------------------------------------------------------------| -| `200` | `GET /health` returns HTTP status 200 OK if the controller's api gRPC Server is up | -| `5xx` | `GET /health` returns HTTP status `5XX` or request timeout if unhealthy | -| `503` | `GET /health` returns HTTP status `503 Service Unavailable` status if the controller is shutting down | - -All responses return empty bodies. `GET /health` does not support any input. - -## Check the health endpoint using `wget` - -The Boundary Docker image includes `wget`. You can use it to check the health endpoint. Enterprise and Community edition users can check the health of controllers and workers. HCP Boundary users can check the health of their self-managed workers. - -Use the following command to check a worker's status to determine if it is healthy: - -```shell-session -$ wget -q -O - http://localhost:9203/health?worker_info=1 | grep -c 'READY' -``` - -- `-q` - Prints the response instead of saving it to a file. -- `-0` - Allows Boundary to pass the worker's URL. - -If the command prints 1 to `stdout` or exits with exit code 0, it means the worker is healthy. If the exit code is greater than 0, the worker is unhealthy. - -You can also use the following command without `grep -c 'READY'` to print a more verbose response that includes the worker's state, active session count, and connection state: - -```shell-session -$ wget -q -O - http://localhost:9203/health?worker_info=1 -``` - -## Example response - -When you check the health endpoint using `wget`, Boundary returns a response with the following worker information: - -```shell-session -$ wget -q -O - http://localhost:9203/health?worker_info=1 | grep -c 'READY' -{"worker_process_info":{"state":"active", "active_session_count":0, "upstream_connection_state":"READY"}} -``` - -When you check the health endpoint using `curl`, Boundary returns a response with the following worker information: - -```shell-session -$ curl "worker:9403/health?worker_info=1" -{ - "worker_process_info":{ - "state":"active", - "active_session_count":0, - "upstream_connection_state":"READY" - } -} -``` - -The response contains the following fields: - -- `state` - The operational state of the worker. Possible worker states include active, shutdown, and unknown. -- `active_session_count` - The number of active sessions on the worker. -- `upstream_connection_state` - The connection state of the worker. This value indicates whether the worker can connect to an upstream address or connection. It can be any of the following states: - - `CONNECTING` - The channel is trying to make a connection and is waiting for name resolution or the connection establishment. - - `READY` - The channel has successfully established a connection, and any attempts to communicate have succeeded. - - `TRANSIENT_FAILURE` - The channel suffered a transient failure such as a time out or socket error. - A channel in this state will switch to the `CONNECTING` state and try to establish a connection. - - `IDLE` - The channel is not attempting to create a connection because there are no calls. - - `SHUTDOWN` - The channel is shutting down. - Any new calls fail immediately. - Pending calls may continue running until Boundary cancels them. - -## Example configuration - -Health checks are available for a controller defined with a `purpose = "ops"` listener stanza. For details on what fields are allowed in this stanza, refer to the documentation about [TCP Listener](/boundary/docs/monitor/listeners/tcp). - -An example listener stanza: - -```hcl -controller { - name = "boundary-controller" - database { - url = "postgresql://:@10.0.0.1:5432/" - } -} - -listener "tcp" { - purpose = "api" - tls_disable = true -} - -listener "tcp" { - purpose = "ops" - tls_disable = true -} -``` - -To enable a shutdown grace period, update the `controller` block with a defined wait duration: - -```hcl -controller { - name = "boundary-controller" - database { - url = "env://BOUNDARY_PG_URL" - } - graceful_shutdown_wait_duration = "10s" -} -``` - -A complete example can be found under the [Controller configuration](/boundary/docs/configuration/controller#complete-configuration-example) docs. \ No newline at end of file diff --git a/website/content/docs/monitor/index.mdx b/website/content/docs/monitor/index.mdx deleted file mode 100644 index 5d961d7da..000000000 --- a/website/content/docs/monitor/index.mdx +++ /dev/null @@ -1,61 +0,0 @@ ---- -layout: docs -page_title: Monitor Boundary -description: >- - Discover resources to help you learn more about maintaining and operating Boundary, including information about metrics and health. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Monitor Boundary - -Visibility into various components of Boundary plays an important role in -ensuring the health of its controllers and workers. - -You can export metrics for controllers -and workers and then configure them to be collected by Prometheus. Metrics -provide insight into the current state of a Boundary deployment by enabling the -diagnosis of deployed controllers and workers. Enabling metrics assists in the -detection and mitigation of anomalies in a deployment. -These docs describe the available metrics and the naming and labeling standards -used. - -Additionally, the health of controllers can be monitored using the -`/health` endpoint. The health endpoint is enabled by defining a listener in -Boundary's configuration file, and a health response may be configured to add a -shutdown grace period process. - -You can also configure Boundary to monitor events. -You can choose to monitor audit, observation, system, and telemetry events. -Boundary supports both file and stderr sinks for events and you can send events to multiple sinks. - -Listeners let you configure the addresses and ports on which Boundary responds to requests. -You can configure TCP and Unix listeners. -Boundary also supports custom response headers for any requests made on controllers. -You can define headers based on the status code that is returned. - -## Tutorials - -To learn how to configure event filtering and sinks, complete the [Event filtering and sink configuration](/boundary/tutorials/self-managed-deployment/event-logging) tutorial. - -To learn how to configure metrics collection, complete the [Visualize metrics with Prometheus](/boundary/tutorials/self-managed-deployment/prometheus-metrics) tutorial. - -## More information - -Refer to the following topics for the parameters you use to configure the addresses and ports on which Boundary responds to requests: - -- [Listeners](/boundary/docs/monitor/listeners) - - [TCP listeners](/boundary/docs/monitor/listeners/tcp) - - [Unix listeners](/boundary/docs/monitor/listeners/unix) - -Refer to the following topics for more information on the various ways to monitor Boundary: - -- [Monitor metrics](/boundary/docs/monitor/metrics) -- [Monitor health](/boundary/docs/monitor/health) -- [Filter events](/boundary/docs/monitor/events/filter-events) - - [Common sink parameters](/boundary/docs/monitor/events/common) - - [File sink](/boundary/docs/monitor/events/file) - - [Stderr sink](/boundary/docs/monitor/events/stderr) diff --git a/website/content/docs/monitor/listeners/index.mdx b/website/content/docs/monitor/listeners/index.mdx deleted file mode 100644 index d1eb091b3..000000000 --- a/website/content/docs/monitor/listeners/index.mdx +++ /dev/null @@ -1,22 +0,0 @@ ---- -layout: docs -page_title: Listener configuration -description: >- - Learn about TCP and Unix listener configuration settings. Understand where to change the default addresses and ports on which Boundary responds to requests. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# `listener` stanza - -The `listener` stanza configures the addresses and ports on which Boundary will -respond to requests. At this time, there are two listener types: -[TCP](/boundary/docs/monitor/listeners/tcp) and [Unix](/boundary/docs/monitor/listeners/unix). - - -## `listener` purpose - -@include '/configuration-reference/listeners/listener-purpose.mdx' \ No newline at end of file diff --git a/website/content/docs/monitor/listeners/tcp.mdx b/website/content/docs/monitor/listeners/tcp.mdx deleted file mode 100644 index bd3b451cd..000000000 --- a/website/content/docs/monitor/listeners/tcp.mdx +++ /dev/null @@ -1,60 +0,0 @@ ---- -layout: docs -page_title: TCP listener configuration -description: >- - Learn about using the TCP listener on a TCP address and port, and view configurable parameters. Understand custom response headers. View example configurations. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# `tcp` listener - -@include '/configuration-reference/listeners/tcp-intro.mdx' - -## Listener's custom response headers - -@include '/configuration-reference/listeners/tcp-custom-response-headers.mdx' - -## `tcp` listener parameters - -Refer to the following sections for `tcp` listener parameters. - -### General - -@include '/configuration-reference/listeners/tcp-general-parameters.mdx' - -### `custom_api_response_headers` parameters - -@include '/configuration-reference/listeners/tcp-custom-api-response-headers.mdx' - -### `custom_ui_response_headers` parameters - -@include '/configuration-reference/listeners/tcp-custom-ui-response-headers.mdx' - -### TLS - -@include '/configuration-reference/listeners/tcp-tls.mdx' - - - -## `tcp` listener examples - -Refer to the following sections for examples of `tcp` listeners. - -### Configure TLS - -@include '/configuration-reference/listeners/tcp-configure-tls.mdx' - -### Configure custom http response headers - -@include '/configuration-reference/listeners/tcp-configure-custom-http-response-headers.mdx' - -### Listen on mulitple interfaces - -@include '/configuration-reference/listeners/tcp-listen-on-mulitple-interfaces.mdx' \ No newline at end of file diff --git a/website/content/docs/monitor/listeners/unix.mdx b/website/content/docs/monitor/listeners/unix.mdx deleted file mode 100644 index e60007837..000000000 --- a/website/content/docs/monitor/listeners/unix.mdx +++ /dev/null @@ -1,50 +0,0 @@ ---- -layout: docs -page_title: Unix domain socket listener configuration -description: >- - Learn about using the Unix listener on a specified Unix domain socket, and view configurable parameters. View example Unix listener configurations. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# `unix` listener - -@include '/configuration-reference/listeners/unix-intro.mdx' - -## `unix` listener parameters - -Refer to the following sections for the supported `unix` listener parameters. - -### General - -@include '/configuration-reference/listeners/unix-general-parameters.mdx' - -### TLS - -@include '/configuration-reference/listeners/unix-tls-parameters.mdx' - - - -## `unix` listener examples - -Refer to the following sections for examples of `unix` listeners. - -### Configure TLS - -@include '/configuration-reference/listeners/unix-configure-tls.mdx' - -### Listen on multiple interfaces - -@include '/configuration-reference/listeners/unix-listen-on-multiple-interfaces.mdx' - -[golang-tls]: https://golang.org/src/crypto/tls/cipher_suites.go -[api-addr]: /boundary/docs/configuration#api_addr -[cluster-addr]: /boundary/docs/configuration#cluster_addr diff --git a/website/content/docs/monitor/metrics.mdx b/website/content/docs/monitor/metrics.mdx deleted file mode 100644 index 7915abfd2..000000000 --- a/website/content/docs/monitor/metrics.mdx +++ /dev/null @@ -1,108 +0,0 @@ ---- -layout: docs -page_title: Boundary metrics -description: >- - Learn about using a metrics listener to monitor your Boundary components. View the available controller and worker metrics, and an example configuration. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary metrics - -Boundary provides metrics through the `/metrics` path using a listener with the -`"ops"` purpose. By default, a listener with that purpose runs on port `9203`. -See the [example configuration](#example-configuration) section for an example -listener stanza in a `config.hcl` file. - -Metrics are important for understanding what is happening in a Boundary -deployment, enabling diagnoses of deployed controllers and workers. The exported -metrics grant greater visibility into the various components of a running -Boundary deployment through Prometheus. - -The metrics uses the [OpenMetric -exposition](https://prometheus.io/docs/instrumenting/exposition_formats/#openmetrics-text-format) -format which can be read by -[Prometheus](https://prometheus.io/docs/introduction/overview/). - -## Controller - -The following table lists the current names and descriptions of metrics provided -by controllers. - -| Name | Description | -|---------------------------------------------------------------|-----------------------------------------------| -| `boundary_controller_api_http_request_duration_seconds` | Histogram of latencies for HTTP requests. | -| `boundary_controller_api_http_request_size_bytes` | Histogram of request sizes for HTTP requests. | -| `boundary_controller_api_http_response_size_bytes` | Histogram of response sizes for HTTP requests. | -| `boundary_controller_api_ratelimiter_quota_storage_capacity` | A gauge of storage capacity for API rate limiting quotas. | -| `boundary_controller_api_ratelimiter_quota_storage_usage` | A gauge of storage usage for API rate limiting quotas. | -| `boundary_controller_cluster_grpc_request_duration_seconds` | Histogram of latencies for requests made to the gRPC service running on the cluster listener. | - -## Worker - -The following table lists the current names and descriptions of metrics provided -by workers. - -| Name | Description | -|---------------------------------------------------------------|-----------------------------------------------| -| `boundary_worker_proxy_http_write_header_duration_seconds` | Histogram of time elapsed after the TLS connection is established to when the first http header is written back from the server. | -| `boundary_worker_proxy_websocket_active_connections` | A gauge of the current count of open proxy connections on the worker. | -| `boundary_worker_proxy_websocket_received_bytes_total` | Count of received bytes sent over all proxy connections handled by the worker. | -| `boundary_worker_proxy_websocket_sent_bytes_total` | Count of sent bytes sent over all proxy connections handled by the worker. | - -## Other - -The following table lists the current miscellaneous metrics provided by Boundary. - -| Name | Description | -|---------------------------------------------------------------|-----------------------------------------------| -| `boundary_build_info` | A gauge set to 1 with label values detailing the current Go version, git revision, and Boundary version. | - -## Metric labels - -Each metric uses labels to help organize and narrow its scope so that users can -filter for different characteristics, allowing more flexible analysis of the -measurements collected. - -### Metrics for HTTP requests include the following labels: - -| Label | Description | -|--------------|----------------------------------------------------------------| -| `code` | The HTTP status code of the request (e.g., “200”, “400”, etc.). | -| `path` | The path, excluding query parameters, associated with the request. The value for this label replaces resource IDs with "{id}" (for example, `/v1/groups/{id}` is a possible value for this label). Any unexpected paths receive the value "unknown." | -| `method` | The name of the method on the HTTP request. For example "GET", “POST”, “DELETE”. | - - -### Metrics for gRPC requests include the following labels: - -| Label | Description | -|-----------------|-----------------------------------------------------------------| -| `grpc_method` | The name of the method on the grpc service (e.g., `GetGroup`). | -| `grpc_service` | The proto service name including the package (e.g., `controller.api.services.v1.GroupService`). | -| `grpc_code` | The grpc [status code](https://github.com/grpc/grpc-go/blob/master/codes/codes.go) in human-readable format. For example, `OK`, `IllegalArgument`, `Unknown`. | - - -## Example configuration - -Defining a listener stanza in the config file is sufficient for enabling metrics -reporting in Boundary. For details on what fields are allowed in this stanza, -refer to the documentation about [TCP -listener](/boundary/docs/monitor/listeners/tcp). - -An example listener stanza: - -```hcl -listener "tcp" { - purpose = "ops" - tls_disable = true -} -``` - -## Tutorial - -Refer to the [Prometheus -Metrics](/boundary/tutorials/oss-configuration/prometheus-metrics) -tutorial for a step-by-step introduction to metrics. diff --git a/website/content/docs/overview/bastion-hosts.mdx b/website/content/docs/overview/bastion-hosts.mdx deleted file mode 100644 index acbb6744e..000000000 --- a/website/content/docs/overview/bastion-hosts.mdx +++ /dev/null @@ -1,37 +0,0 @@ ---- -layout: docs -page_title: Boundary vs. bastion hosts -description: >- - Learn how Boundary compares to bastion hosts by providing tightly controlled, just-in-time access to infrastructure using role-based access controls (RBAC). ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary vs. bastion hosts - -If you want to set up your cloud environment securely, you may choose to run all of your important workloads behind a NAT Gateway, and provision a DMZ with a set of hardened bastion servers. - -Bastion host security groups are often not locked down at the network layer. -Additionally, users who log into a bastion host using SSH are typically dropped into a privileged account. -Maintaining security groups, network ACLs, and IAM controls on a bastion host at a per-user level is nearly impossible, unless you create and maintain multiple bastion hosts per user or group. -IT departments now have to manage updates for another server and the sprawl of infrastructure continues, increasing your attack surface, and requiring your IT department to be perfect. - -Boundary is not a traditional bastion host. -Boundary streamlines just-in-time access to privileged sessions for users, and tightly controls access to infrastructure with role-based access controls (RBAC). -Boundary validates a user's identity using your identity provider of choice, and then dynamically grants them access to the resources they need using their associated permissions. -Boundary's worker nodes, the resources that proxy connections to private endpoints, are fundamentally stateless and can be easily scaled elastically using modern development tools. - -You can use SSH or RDP to inject the credentials of any target resources that you want to connect to using Boundary, so that the credentials are never exposed to the user while establishing a connection. -Alternatively, Boundary can return brokered credentials back to users (if permitted), which could take the form of API tokens, usernames and passwords, public keys, etc. - -**Can Boundary replace a bastion/jumphost access model?** - -Yes, in many cases you can use Boundary as a replacement for an existing bastion host-based access model to infrastructure. -The advantages to Boundary's access model are outlined above. - -**Can Boundary extend a bastion/jumphost access model?** - -Yes, some users may see value in Boundary providing access to an existing bastion host deployment. diff --git a/website/content/docs/overview/faq.mdx b/website/content/docs/overview/faq.mdx deleted file mode 100644 index e5b526e6e..000000000 --- a/website/content/docs/overview/faq.mdx +++ /dev/null @@ -1,78 +0,0 @@ ---- -layout: docs -page_title: FAQ -description: >- - View frequently asked questions about Boundary ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Frequently asked questions - -Refer to the following for answers to frequently asked questions about Boundary. - -## Q: What are the networking requirements for Boundary? Do my workers need to be exposed to the public internet? - -Boundary workers require inbound access from clients. This does not necessarily require that workers be exposed to the public internet. -If the client is coming from a private network (eg a corporate network), the worker needs to allow connectivity from the private network. -If the client is coming from the public internet, the worker needs to allow connectivity from the public internet. For more information, -check out the [worker networking requirements](/hcp/docs/boundary/self-managed-workers). - -## Q: Does Boundary require Vault? What is the integration story? - -While Vault isn't a *required* secrets backend for Boundary sessions, the potential for Boundary | Vault integration is a core part of Boundary's overall -value proposition for identity-based access. There are three primary points of integration with Vault: -1. Vault can be used as a secrets backend for Boundary, offering single signon to end target systems via credential brokering. This was covered in Boundary's -[0.4 announcement](https://www.hashicorp.com/blog/announcing-hashicorp-boundary-0-4) and there are ample -[tutorials](/boundary/tutorials/credential-management/community-vault-cred-brokering-quickstart) of this scenario. -2. Boundary can use Vault as an OIDC provider to enable sign-in with Vault's supported auth methods (even non-OIDC auth methods like Active Directory kerberos/LDAP). -This scenario is walked through in this [tutorial](/vault/tutorials/auth-methods/oidc-identity-provider). -3. Boundary Community Edition can use Vault as the external KMS that serves as Boundary's root of trust. More information on this use case can be found -[here](/boundary/docs/configuration/kms/transit). - -## Q: What identity providers does Boundary support? - -Boundary supports [OIDC authentication](/boundary/tutorials/access-management/oidc-auth), which allows support for many popular IdPs -like Okta, Azure AD, Auth0, etc. For non-OIDC authentication protocols (such as LDAP), users can also log in with an OIDC bridge identity provider -such as [Vault's OIDC bridge](/vault/docs/concepts/oidc-provider) capabilities released in 1.9, [Dex](https://dexidp.io), or various others. - -## Q: Does Boundary support multi-factor authentication (MFA)? - -Boundary Open-ID Connect (OIDC)-based authentication supports MFA if the IdP being used enforces MFA. This allows users to authenticate with an identity -provider supporting MFA, such as Azure AD, Okta, Auth0, etc. -Boundary also supports syncing permission claims between an IDP-managed identity and Boundary. This can be very useful when you want to sync group memberships -from an IDP to Boundary to assign role assignments dynamically. See Boundary's [managed groups capabilities](/boundary/tutorials/identity-management/oidc-idp-groups). - -## Q: Does Boundary automate the discovery and configuration of new targets (e.g. servers)? What happens if a host IP address changes? - -Yes, this is one of the core competencies of Boundary. Boundary can discover new targets in two primary ways -1. Boundary's [Terraform provider](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs) supports discovery of targets provisioned by Terraform -2. Boundary's [dynamic host catalog](/boundary/docs/hosts#dynamic-host-catalogs) -agentlessly queries infrastructure providers to automate the onboarding and configuration of hosts - -All of these methods will automate the discovery and configuration of targets when their ip addresses change. Of course, static hosts can still be manually added via Boundary admin UI and CLI. - -For more information on dynamic host catalogs, refer to: - -- [AWS dynamic host catalogs](/boundary/docs/hosts/aws) -- [Azure dynamic host catalogs](/boundary/docs/hosts/azure) -- [GCP dynamic host catalogs](/boundary/docs/hosts/gcp) - -## Q: Session management capabilities - Does Boundary support live session monitoring and termination? - -**Session Logging/Monitoring:** Supported. Boundary creates a session log of all sessions created between identities and targets that have been onboarded to -Boundary. You can learn how to monitor these sessions in the [Manage sessions tutorial](/boundary/tutorials/community-administration/community-manage-sessions). -Boundary supports audit logs for [Boundary Community Edition](/boundary/tutorials/oss-configuration/event-logging) and [audit log streaming](/hcp/docs/boundary/audit-logging) -for HCP Boundary. Audit logs for both distributions can be exported to SIEM or BI tools. - -**Session Termination:** Supported. Session termination for Boundary administrators is a supported capability, as demonstrated in this -[Manage sessions tutorial](/boundary/tutorials/community-administration/community-manage-sessions). - -## Q: As an AWS user, can IAM roles be used to configure Boundary's dynamic host catalog? - -At this time, it is not possible to configure Boundary's dynamic host catalog using IAM roles. -You can configure the dynamic host catalog using an IAM user, however. -For more information, refer to the [Dynamic host catalogs on AWS](/boundary/tutorials/host-management/aws-host-catalogs) tutorial. diff --git a/website/content/docs/overview/pam.mdx b/website/content/docs/overview/pam.mdx deleted file mode 100644 index f42f81309..000000000 --- a/website/content/docs/overview/pam.mdx +++ /dev/null @@ -1,36 +0,0 @@ ---- -layout: docs -page_title: Boundary vs. privileged access management -description: >- - Learn how Boundary compares to privileged access management (PAM) solutions by providing automation for user and credential management and service discovery. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary vs. privileged access management - -Privileged access management (PAM) tools secure access to critical systems by managing and monitoring access to privileged accounts. -PAM assists an organization in reducing their attack surface in an attempt to mitigate damage caused from internal or external incidents. -Traditionally, a focus is put on the management of privileged credentials, and the monitoring of sessions and commands that enable detection and response teams to respond to incidents. - -Boundary enables many of the security controls traditionally filled by PAM tools. -Boundary can manage network access to privileged systems and audit access. -It can be used with credential management providers, like Vault, to manage access to privileged accounts and credentials. - -Where Boundary differs from traditional PAM solutions is in its automation-friendly workflows. -Boundary is instrumented programmatically via REST, CLI, and [Terraform](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs). -It provides automation-friendly workflows for managing users and credentials, as well as the discovery and configuration of new services: - -- **Automated credential management**: Boundary and Vault can create workflows with automated credential management in which user sessions are secured with [single-use dynamic credentials that are injected into sessions](/boundary/tutorials/credential-management/hcp-private-vault-cred-injection) such that secrets are never returned to users. -- **Context-based access**: When users' business context changes, you want to ensure their permissions reflect the new business context. -As an example, on-call engineers might require different permissions than when they end their on-call shifts. -[Boundary's managed groups](/boundary/tutorials/access-management/oidc-idp-groups) enable user permission workflows to be assigned dynamically based on identity provider MFA checks, group memberships, and other IDP-level context. -- **[Host discovery](/boundary/docs/hosts)**: Boundary's [dynamic host catalogs](/boundary/tutorials/host-management/aws-host-catalogs) are advanced workflows for automating the process of onboarding new or changed infrastructure resources and their connection information, and applying pre-configured security policies. - -**Can Boundary replace a PAM solution?** - -Yes, Boundary provides many of the security controls traditionally delivered by PAM tools. -Boundary can also be used with an existing PAM tool, particularly the ones that emphasize agent-based security where Boundary's proxy-based security can be a natural complement. \ No newline at end of file diff --git a/website/content/docs/overview/sdp.mdx b/website/content/docs/overview/sdp.mdx deleted file mode 100644 index ace4384d1..000000000 --- a/website/content/docs/overview/sdp.mdx +++ /dev/null @@ -1,17 +0,0 @@ ---- -layout: docs -page_title: Boundary vs. software-defined perimeter -description: >- - Learn how Boundary compares to software-defined perimeter (SDP) tools using dynamic credentials, context-based access, automated host discovery, and auditing. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary vs. software-defined perimeter - -Software-defined perimeter (SDP) solutions secure access to applications and infrastructure based on user identity. -Boundary is fundamentally an SDP solution that takes a zero trust approach to security design for system access; access to services is granted based on the scoped identity and intent of a user. -Boundary is a scalable proxy that enables identity-based access with multiple layers of security controls including [dynamic credentials](/boundary/tutorials/hcp-administration/hcp-ssh-cred-injection), [context-based access](/boundary/tutorials/access-management/oidc-idp-groups), [automated host discovery](/boundary/docs/hosts), and [access auditing](/hcp/docs/boundary/audit-logging) to name a few. \ No newline at end of file diff --git a/website/content/docs/overview/secrets-management.mdx b/website/content/docs/overview/secrets-management.mdx deleted file mode 100644 index 716fef00b..000000000 --- a/website/content/docs/overview/secrets-management.mdx +++ /dev/null @@ -1,29 +0,0 @@ ---- -layout: docs -page_title: Boundary vs. secrets management tools (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, etc.) -description: >- - Learn how Boundary compares to secrets management tools and how it can compliment them to provide identity-based access, automated host discovery, and auditing. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary vs. secrets management tools (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, etc.) - -Secrets management is the use of tools and methods to manage digital authentication credentials. -This includes passwords, API keys, PKI, TOTP codes, etc. -Popular tools in this space includes HashiCorp Vault, Azure Key Vault, AWS Secrets Manager, Cloud KMS, and CyberArk Conjur. - -Boundary itself is not a secrets manager for your infrastructure. -A core step in Boundary's access workflow is integrating with your existing secrets management providers, such as HashiCorp Vault, to retrieve dynamic credentials, and return them to end users when they attempt to establish connections. -For customers who may not yet have a credential management solution, or are looking to easily onboard, Boundary can function as a rudimentary static credential store. -Boundary provides a comprehensive access workflow that integrates with secrets management providers, enforces secure and granular network and credential access based on identity, audits all access, and automates the discovery and configuration of new target endpoints. - -**Does Boundary replace a secrets management solution?** - -Boundary is not intended to replace an existing secrets management solution. -Boundary is designed to work with your secrets management solution to comprehensively secure infrastructure access. -For many users, Boundary's native static credential management capabilities may be sufficient. -For those that require more advanced credential workflows, such as dynamic credentials, [HashiCorp Vault](https://developer.hashicorp.com/vault/) is a natural complement to Boundary. \ No newline at end of file diff --git a/website/content/docs/overview/use-cases.mdx b/website/content/docs/overview/use-cases.mdx deleted file mode 100644 index 93491c219..000000000 --- a/website/content/docs/overview/use-cases.mdx +++ /dev/null @@ -1,54 +0,0 @@ ---- -layout: docs -page_title: Use cases -description: >- - Learn how HashiCorp Boundary can help you with zero trust access, multi-cloud access, single-sign on with integrated secrets management, and session monitoring. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Use cases - -Before understanding use cases, it's useful to know [what Boundary is](/boundary/docs/what-is-boundary). This page lists some concrete use cases for Boundary, but the possible use cases are much broader than what we cover. - -## Zero trust access - -Boundary’s access-on-demand workflow securely connects trusted identities to infrastructure services based on granular, admin-defined permission grants. Boundary removes the need to create or store credentials when accessing services. In this way, Boundary can be used to extend or replace many traditional access solutions like VPNs. - -Traditional access solutions do not employ the Zero-Trust philosophy - meaning they fail to authenticate and authorize users’ access and actions continuously, and often lack granular access controls. - -## Multi-cloud access - -Having different access workflows for various infrastructure and identity providers doesn’t scale well for administrators or users. Multi-cloud organizations have a growing need to standardize access through a single workflow. Boundary creates a centralized layer of identity-based authentication and authorization to manage access to the infrastructure, regardless of the platform on which it resides. - -## Single sign-on with integrated secrets management - -Boundary enables a single sign-on access model with authentication from trusted identity providers, such as Azure Active Directory, Auth0, and Okta. Once authenticated, users may create sessions with integrated credential management from HashiCorp Vault without the need to re-authenticate. - -## Session monitoring - -Boundary provides session monitoring capabilities that give security administrators visibility into user access. Sessions are logged and consumable via the Boundary administrator UI as well as business intelligence (BI) and security information and event management (SIEM) tools. - -Further, administrators can enable session recording on targets. -When you enable session recording on a target, a worker records any sessions that access that target from the time the user requests access to when that access is terminated. -Administrators can view the recordings later using a session player that runs in a browser. - -## Boundary vs. other software - -It can be difficult to understand how to compare the different remote access security solutions that are available on the market. -Is one a replacement for another? -Are they complementary? -Refer to the following topics for a more detailed comparison of Boundary to specific technologies: - -- [Zero trust](/boundary/docs/overview/zero-trust) -- [Bastion hosts](/boundary/docs/overview/bastion-hosts) -- [VPNs](/boundary/docs/overview/vpn) -- [Privileged access management](/boundary/docs/overview/pam) -- [Software-defined-perimeter](/boundary/docs/overview/sdp) -- [Secrets management tools](/boundary/docs/overview/secrets-management) - -The comparisons are philosophical in nature, and are not intended to be oppositional. -Our goal is to provide readers with a better understanding of how access management solutions overlap with Boundary, and where Boundary does things differently. \ No newline at end of file diff --git a/website/content/docs/overview/vpn.mdx b/website/content/docs/overview/vpn.mdx deleted file mode 100644 index 45875e5ae..000000000 --- a/website/content/docs/overview/vpn.mdx +++ /dev/null @@ -1,35 +0,0 @@ ---- -layout: docs -page_title: Boundary vs. VPNs -description: >- - Learn how Boundary compares to VPNs by using an Identity Provider (IdP) to grant users remote access to specific permitted services, but not the entire network. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary vs. VPNs - -Virtually every company today uses network firewalls to enforce perimeter security. -To establish a remote connection within the perimeter, organizations often use some form of virtual private network (VPN) to authenticate users, establish a secure tunnel to the private network (such as a corporate or data center network), and allow users to enter the gated walls. - -VPNs enable the remote access architecture that is most often used to allow identities on unsecured networks to gain access to key internal organizational services in a secure fashion. -Data is encrypted in transit, a network connection is established, and the user's access on the network is now predicated on the granularity of 802.1x authentication to the appropriate VLANs and network and application layer firewall rules. -In practice, this often means that once users log in to a network using a VPN, they have access to far more than they should. - -While Boundary can establish remote connections to services within an organization's perimeter, Boundary is **not** a VPN. -Instead, Boundary proposes an improvement to the current remote access model, where remote access is granted granularly and established to specific permitted services, but **not** the entire network. -Boundary uses a non-repudiable user identity that is established by your integrated Identity Provider (IdP) of choice, as opposed to relying on network layer concepts such as IP address for access management. - -A traditional VPN provides users with **network access**. -Boundary provides users with **delegated access to services within the network**. - -**Can Boundary replace a VPN?** - -For many organizations, Boundary's granular network access will be a security improvement from traditional data center VPN solutions that lack granular controls. - -**Can Boundary work with a VPN?** - -Boundary can work with existing corporate VPNs to provide heightened security when accessing privileged networks such as data centers and cloud VPCs. \ No newline at end of file diff --git a/website/content/docs/overview/zero-trust.mdx b/website/content/docs/overview/zero-trust.mdx deleted file mode 100644 index 0a58779ca..000000000 --- a/website/content/docs/overview/zero-trust.mdx +++ /dev/null @@ -1,25 +0,0 @@ ---- -layout: docs -page_title: Boundary and zero trust -description: >- - Learn how Boundary enables a zero trust approach to security in which all access transactions are authenticated and authorized based on trusted identity. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary and zero trust - -Malware lands on the machine of an engineer working for an HVAC vendor. -Credentials are harvested, and many of them belong to external clients. -The attackers use the vendor's system as an entry point into the large corporations they service. -They move laterally throughout the client's network, eventually using the vendor's admin credentials to access a point-of-sale system that contains PII (personally identifiable information), and the credit card information of millions of customers. - -Zero trust was born out of the concept that people should have only the necessary levels of access to do their jobs, and all access transactions should be authenticated and authorized based on a trusted identity. -Zero trust is not a specific solution or class of solutions, it's a design philosophy for how access to digital systems should be secured. -Embracing a zero trust mindset assists an organization in reducing their attack surface. - -You can use Boundary and other HashiCorp tools such as Vault and Consul to create a zero trust access model for infrastructure endpoints in which all transactions are authenticated, authorized, and audited. -Boundary focuses on giving developers a consistent workflow for zero trust access to their infrastructure, wherever it resides. \ No newline at end of file diff --git a/website/content/docs/rbac/assignable-permissions.mdx b/website/content/docs/rbac/assignable-permissions.mdx deleted file mode 100644 index 94faf70cc..000000000 --- a/website/content/docs/rbac/assignable-permissions.mdx +++ /dev/null @@ -1,109 +0,0 @@ ---- -layout: docs -page_title: Assignable permissions -description: >- - Learn about using actions and output fields to grant users permissions to any resources that are identified by ID or Type. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Assignable permissions - -You can grant users permissions to any Boundary resources that are identified by ID or Type selectors. -There are two types of assigned permissions: - -- An `actions` field indicating which actions to allow the client to perform on - the resources matched by `id` and `type` -- An `output_fields` field indicating which top-level fields to return in the - response. - -## Actions - -Actions convey the ability to perform some operation against a resource or -collection. -They include common CRUD operations (`create`, `read`, `update`, -`delete`), but some resources also have actions that are specific to their type. - -For example, a `target` has an `authorize-session` action that allows you to request -making a connection to that target. -The `auth-method` resources have an `authenticate` action that allows you to authenticate to Boundary. -Most actions represent common operations, however there are some special cases to note. - -### Subactions - -Some subactions are also supported. Subactions have a format -`top_level_action:subaction`, such as `read:self`. -When you grant a top level action to a principal, they also inherit all subactions. - -For example, if a grant conveys `read`, it also matches the API actions `read` and `read:self`. -However, if a grant conveys `read:self`, it does not grant the top-level action `read`. - -### The `no-op` action and listing visibility - -Boundary contains a `no-op` action that is not used for any real operations. -However, you can use the `no-op` action for listing visibility. - -When a user runs a `list` operation, Boundary only shows the resources for which a user has been granted at least one action. -Without the `no-op` action, you would have to grant the user another action such as `read` to ensure they could view the resource. -Granting additional actions to users could result in exposing more information to the user than intended. -This is especially true for listing scopes and authentication methods, such as when users perform the initial authentication to Boundary. - -Instead, you can grant the `no-op` action to users to ensure that they can view the output of a list command, without granting them other unnecessary actions. - -### Anonymous user restrictions - -There are limits to the actions that you can assign to the anonymous user `u_anon`. -The limitations are meant to prevent you from accidentally adding the anonymous user to a role that provides more privileges than you would intend to grant to an unauthenticated user. - -For anonymous users, actions are restricted to listing scopes and auth methods, -and authentication to auth methods. -You can also grant the `no-op` action for listing visibility. - -Boundary does not return a special error message when access is denied to an action because it is not allowed for an anonymous user. -You can still assign grants to a role on which the anonymous user is a principal, but they can never match the anonymous user. - -## Output fields - -Grant strings can contain an `output_fields` value. This setting gives you fine-grained -control over the visibility of data returned to users. - -The `output_fields` reference the field names of the JSON object reponse. -They are composed just like other parts of the RBAC model, and are action-specific. -For example, the following grant: - -`ids=*;type=auth-methods;actions=list,no-op;output_fields=scope_id,name,description` - -results in the three identified output fields (scope ID, name, and description) applying to any `list` and `no-op` actions for all auth methods in the scope. -If a user performed a `list` operation under this example grant, each item returned would only have the three fields populated: `scope_id`, `name`, and `description`. -Any other actions, such as `read` or `update`, would be unaffected and would return the default information. - -This grant: - -`ids=*;type=auth-methods;output_fields=id` - -means that only the `id` will be returned for any action performed against auth methods in this scope. - -Grants are composable. -Therefore, if both of the example grants above are added, the final set of output fields would be `id`, `scope_id`, `name`, and `description` for the `list` and `no-op` actions. -For all other actions, the output field would be `id`. - -### Default output fields - -If none of the grants applicable to the resource or action for a given request contain `output_fields` definitions, Boundary uses the default settings. -The default settings vary based on whether the user is anonymous: - -- If the user is anonymous, Boundary returns a restricted set of fields. -They include `id`, `scope_id`, `scope`, `name`, and `description`. -- If the user is authenticated, Boundary returns the full set of fields. - -## More information - -1. Refer to [Permission grant formats](/boundary/docs/rbac/permission-grant-formats) for more information about grant strings and example formats. -1. Refer to the [Resource tables](/boundary/docs/rbac/resource-table) for a cheat sheet to help you manage your permissions. - -## Next steps - -Refer to [Manage access with roles](/boundary/docs/rbac/manage-roles) for instructions to configure roles and grant scopes for principals. diff --git a/website/content/docs/rbac/index.mdx b/website/content/docs/rbac/index.mdx deleted file mode 100644 index 07276504a..000000000 --- a/website/content/docs/rbac/index.mdx +++ /dev/null @@ -1,90 +0,0 @@ ---- -layout: docs -page_title: Permissions index -description: >- - Learn about Boundary's RBAC (Role-based access control), allow-only permissions model. Understand how permissions are configured using grant strings and roles. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Permissions in Boundary - -Boundary's permissions model is a composable, role-based access control (RBAC), allow-only model that -attempts to marry flexibility with usability. -The following pages discuss the permission model's fundamental concepts, provide examples of the specific forms of allowed grants, and contain a table that acts as a cheat sheet to help you craft roles. - -Boundary's [domain model](/boundary/docs/domain-model) is based on resource -types. You can implement resource types directly, such as with targets, or they can be -abstract types that you implement using concrete types within the system. As an -example of the latter, a host catalog is an abstract type and a static host -catalog is a concrete type. - -From a permissions standpoint, all actions take place against directly -implemented or abstract types. There may be actions that are only implemented by -some concrete types, for example, not all `auth-method` implementations support a -`change-password` action. But the permissions model still defines these -capabilities at the abstract type level. - -At a very high level, permissions within Boundary are declared via grant strings -and mapped to users via roles. - -## Grant strings - -Each grant string is a mapping that describes a resource or set of resources and -the permissions that should be granted on them. - -A grant string has a form similar to: - -`ids=;type=;actions=;output_fields=` - -Selectors are used to indicate the resources on which the grant should apply, -using specific IDs or wildcard IDs and type selectors. - -You can supply grant strings using a human-friendly string syntax or using JSON. - -### Assigned permissions - -You can grant users permissions to any Boundary resources that are identified by ID or Type selectors. -There are two types of assigned permissions: - -- An `actions` field indicating which actions to allow the client to perform on - the resources matched by `id` and `type` - -- An `output_fields` field indicating which top-level fields to return in the - response. - -## Roles - -Roles map grant strings to principals, which are users, groups, and managed groups. -Every role assigns grants within a scope, as determined by the role's grant scope IDs. - -You can assign roles to multiple scopes to grant permissions to users who need access to resources across multiple scopes. -Child scopes can inherit roles from parents. -For example, the global scope could have multiple child scopes called "orgs". -When you create a role in the global scope, you can configure it to apply to those children org scopes. - -When a user makes a request, the client may provide the scope or Boundary may look it up using the resource's ID. -This scope ID, along with the user's ID and the IDs of the groups the user belongs to, control which roles Boundary fetches to provide grants for the request. - -A role provides grants for a request if the grant scope ID matches the request's -scope ID and one or more of the following are true: - -- The user's ID is contained in the principal IDs set on the role -- A group the user belongs to is contained in the principal IDs set on the role -- The user is logged in and the `u_auth` user is contained in the principal IDs - set on the role -- The role contains the `u_anon` user in the in the principal IDs set on the - role - -Roles are composable; a user's final set of grants will be composed of grants -that originate from all matching roles. - -## Next steps - -1. Refer to [Assignable permissions](/boundary/docs/rbac/assignable-permissions) for more information about the permissions you can assign to Boundary principals. -1. Refer to [Permission grant formats](/boundary/docs/rbac/permission-grant-formats) for more information about grant strings and example formats. -1. Refer to [Manage access with roles](/boundary/docs/rbac/manage-roles) for instructions to configure roles and grant scopes for principals. -1. Refer to the [Resource tables](/boundary/docs/rbac/resource-table) for a cheat sheet to help you manage your permissions. \ No newline at end of file diff --git a/website/content/docs/rbac/manage-roles.mdx b/website/content/docs/rbac/manage-roles.mdx deleted file mode 100644 index ffcebb658..000000000 --- a/website/content/docs/rbac/manage-roles.mdx +++ /dev/null @@ -1,424 +0,0 @@ ---- -layout: docs -page_title: Manage access with roles -description: >- - Use roles to manage permissions assigned to users and groups. Create roles and assign principals and grants to them. Add grant scopes and configure inheritance. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Manage access with roles - -[Roles](/boundary/docs/domain-model/roles) in Boundary manage the permissions assigned to principals: - -- [Users](/boundary/docs/domain-model/users) -- [Groups](/boundary/docs/domain-model/groups) -- [Managed groups](/boundary/docs/domain-model/managed-groups) - -You can define a role in the global, org, or project scopes. - -In this topic, we show how to create a role in Boundary, assign that role a permission set using grants, and assign principals to the role. - - - -All resource IDs in this guide are examples. Boundary generates unique IDs for every resource, with the exception of the resources that are created when you use Boundary's `dev` mode. Make sure you substitute your own resource IDs when you follow this example. For example, if you execute `boundary roles create`, use the resource ID of the role in your stdout, not the ID in the example command. - - - -## Create a role - -Roles can live in the global, org, or project scopes. In this example, we create a role in the generated org scope in [Boundary's `dev` mode](/boundary/docs/getting-started/dev-mode). - - - - -```shell-session -$ boundary roles create -scope-id o_1234567890 -name list_all_resources -description "List all resources" - -Role information: - Created Time: Thu, 25 Jul 2024 17:21:22 MDT - Description: List all resources - Grant Scope ID: this - ID: r_22sVJoKZj3 - Name: list_all_resources - Updated Time: Thu, 25 Jul 2024 17:21:22 MDT - Version: 2 - - Scope: - ID: o_1234567890 - Name: Generated org scope - Parent Scope ID: global - Type: org - - Authorized Actions: - add-principals - set-grants - remove-grants - no-op - remove-principals - set-grant-scopes - read - update - add-grant-scopes - delete - add-grants - set-principals - remove-grant-scopes - - Grant Scope IDs: - ID: this -``` - - - - -Complete the following steps in the Boundary Admin UI. - -1. Log in to Boundary. -1. Navigate to an org, then select **Roles** on the navigation pane. -1. Click the **New** button. -1. Fill in the role details, including the name `List all resources`. -1. Click **Save**. You are then directed to the role's **Settings** page. - -![The Create a new role dialog lets you name and describe the new role.](/img/ui/new-role_light.png#light-theme-only) -![The Create a new role dialog lets you name and describe the new role.](/img/ui/new-role_dark.png#dark-theme-only) - - - - -Before you create a role, ensure that the principals you want to assign to the role exist. - -For example, to create an org, project, user, and a group in an org scope, use the following resources: - -```hcl -resource "boundary_scope" "org" { - name = "org_one" - description = "My org scope" - scope_id = "global" - auto_create_admin_role = true - auto_create_default_role = true -} - -resource "boundary_scope" "project" { - name = "project_one" - description = "My project scope" - scope_id = boundary_scope.org.id - auto_create_admin_role = true -} - -resource "boundary_user" "foo" { - name = "Foo user" - scope_id = boundary_scope.org.id -} - -resource "boundary_group" "bar" { - name = "Bar group" - scope_id = boundary_scope.org.id -} -``` - -Next, add the `boundary_role` resource, adding the org scope for `scope_id`: - -```hcl -resource "boundary_role" "listonly" { - name = "listonly" - description = "A list only role" - scope_id = boundary_scope.org.id -} -``` - - - - -## Assign principals to a role - -You can grant users, groups, and managed groups permissions to perform actions by assigning them as a role principal. - - - - -Examples of principal IDs include: - -- User: `u_tfRrCUIpGH` -- Group: `g_qu2V5QMGQD` -- Managed group: `mgldap_98UNHEqtmD` - -The following example adds a group as a role principal. - -```shell-session -$ boundary roles add-principals -id r_22sVJoKZj3 -principal g_qu2V5QMGQD - -Role information: - Created Time: Thu, 25 Jul 2024 17:21:22 MDT - Description: List all resources - Grant Scope ID: this - ID: r_22sVJoKZj3 - Name: list_all_resources - Updated Time: Thu, 25 Jul 2024 17:33:33 MDT - Version: 3 - - Scope: - ID: o_1234567890 - Name: Generated org scope - Parent Scope ID: global - Type: org - - Authorized Actions: - set-grant-scopes - no-op - read - update - set-principals - add-principals - set-grants - remove-principals - remove-grant-scopes - delete - add-grants - add-grant-scopes - remove-grants - - Principals: - ID: g_qu2V5QMGQD - Type: group - Scope ID: global - - Grant Scope IDs: - ID: this -``` - - - - -1. Log in to Boundary. -1. Select **Roles** in the navigation pane, and then select the role you want to assign principals to. -1. From the role's **Setting** page, click on the **Principals** tab. -1. Click the **Add Principals** button, or select it from the **Manage** dropdown. -1. Select one or more users, groups, or managed groups to associate with the role. -1. Click the **Add Principals** button. The role's **Principals** page should now show the principals you selected before. - -![The Principals tab lets you assign principals to a role.](/img/ui/add-role-principal_light.png#light-theme-only) -![The Principals tab lets you assign principals to a role.](/img/ui/add-role-principal_dark.png#dark-theme-only) - - - - -You can assign principals with the `principal_ids` attribute. - -The following example adds the `boundary_user.foo` and `boundary_group.bar` principals to the role. - -```hcl -resource "boundary_role" "listonly" { - name = "listonly" - description = "A list only role" - principal_ids = [boundary_user.foo.id,boundary_group.bar.id] - scope_id = boundary_scope.org.id -} -``` - - - - -## Assign grants to a role - -Grants describe the actions that the principals are allowed to perform. For more information on how to format grants, refer to [Permission grant formats](/boundary/docs/rbac/permission-grant-formats). - -In this example, we give a role read and list permissions for all resources. The grant we apply for the role is: - -```text -ids=*;type=*;actions=no-op,list -``` - -The `no-op` action enables users that don't have any other assigned permissions, like read or update, the ability to list resources they cannot take any actions on. - - - - -```shell-session -$ boundary roles add-grants -id r_22sVJoKZj3 -grant 'ids=*;type=*;actions=no-op,list' - -Role information: - Created Time: Thu, 25 Jul 2024 17:21:22 MDT - Description: List all resources - Grant Scope ID: this - ID: r_22sVJoKZj3 - Name: list_all_resources - Updated Time: Thu, 25 Jul 2024 17:42:46 MDT - Version: 4 - - Scope: - ID: o_1234567890 - Name: Generated org scope - Parent Scope ID: global - Type: org - - Authorized Actions: - remove-grant-scopes - add-grants - add-grant-scopes - delete - add-principals - set-grant-scopes - set-principals - remove-principals - set-grants - remove-grants - no-op - read - update - - Principals: - ID: g_qu2V5QMGQD - Type: group - Scope ID: global - - Canonical Grants: - ids=*;type=*;actions=list,no-op - - Grant Scope IDs: - ID: this -``` - - - - -1. Log in to Boundary. -1. Select **Roles** in the navigation pane, and the select the role you want to assign grants to. -1. From the role's **Settings** page, click on the **Grants** tab. -1. In the **New Grant** field, paste in the example grant: `ids=*;type=*;actions=no-op,list` -1. Click **Add**. -1. Click **Save** to commit your grant changes. - -![The Grants tab on the Roles page lets you add grants to principals.](/img/ui/add-role-grant_light.png#light-theme-only) -![The Grants tab on the Roles page lets you add grants to principals.](/img/ui/add-role-grant_dark.png#dark-theme-only) - - - - -You assign grants using the `grant_strings` attribute. - -```hcl -resource "boundary_role" "listonly" { - name = "listonly" - description = "A list only role" - principal_ids = [boundary_user.foo.id,boundary_group.bar.id] - grant_strings = ["ids=*;type=*;actions=no-op,list"] - scope_id = boundary_scope.org.id -} -``` - - - - -## Add grant scopes - -You can assign roles to multiple scopes and configure role inheritance. - -Role can have a combination of the following grant scope IDs: - -- `this` (this scope) -- `children` (all direct children of the assigned scope, `global` and org scopes only) -- `descendants` (all descendants of a scope, `global only`) -- ID (such as `o_v2MpV4vBHN` or `p_0vfvaQPwhD`. Roles accept multiple grant scope IDs) - -Boundary automatically assigns grants the `this` scope, when you create them. - - - - -The following command adds the IDs of a project scope and the direct children of the role's scope to the role. This includes projects within `o_1234567890` in this example. - -```shell-session -$ boundary roles add-grant-scopes -id r_22sVJoKZj3 -grant-scope-id "p_1234567890" -grant-scope-id "children" - -Role information: - Created Time: Thu, 25 Jul 2024 17:21:22 MDT - Description: List all resources - ID: r_22sVJoKZj3 - Name: list_all_resources - Updated Time: Thu, 25 Jul 2024 18:06:08 MDT - Version: 6 - - Scope: - ID: o_1234567890 - Name: Generated org scope - Parent Scope ID: global - Type: org - - Authorized Actions: - remove-principals - set-grants - remove-grants - delete - add-principals - add-grants - set-grant-scopes - set-principals - add-grant-scopes - no-op - read - update - remove-grant-scopes - - Principals: - ID: g_qu2V5QMGQD - Type: group - Scope ID: global - - Canonical Grants: - ids=*;type=*;actions=list,no-op - - Grant Scope IDs: - ID: children - ID: p_1234567890 - ID: this -``` - - - - -1. Log in to Boundary. -1. Select **Roles** in the navigation pane, and then select the role. -1. Click on the **Scopes** tab. The `this` scope will already be applied to the grant. -1. From the **Manage** dropdown, click **Manage Scopes**. -1. Click **Manage custom scopes**. -1. Select any additional scopes that you want to assign this grant, such as `p_1234567890` in Boundary's `dev` mode. - - The settings you define for the role's children or descendants will apply to any scope you assign to this role. - -1. Click **Apply changes to org**. -1. Toggle the switch beside **Add all children**. -1. Click **Save**. The selected scope IDs and `children` are listed under the **Scopes** tab. - -![The Manage Scopes dialog lets you customize which scopes are associated with a role.](/img/ui/add-role-scopes_light.png#light-theme-only) -![The Manage Scopes dialog lets you customize which scopes are associated with a role.](/img/ui/add-role-scopes_dark.png#dark-theme-only) - - - - -You can declare scope inheritance with the `grant_scope_ids` attribute. - -The following example adds the assigned scope's ID with `this`, the ID of a project scope, and the direct children of the role's scope to the role. This includes projects within `org_one` in this example. - -```hcl -resource "boundary_role" "listonly" { - name = "listonly" - description = "A list only role" - principal_ids = [boundary_user.foo.id,boundary_group.bar.id] - grant_strings = ["ids=*;type=*;actions=no-op,list"] - scope_id = boundary_scope.org.id - grant_scope_ids = ["this",boundary_scope.project.id,"children"] -} -``` - - - - -## More information - -1. Refer to [Assignable permissions](/boundary/docs/rbac/assignable-permissions) for more information about the permissions you can assign to Boundary principals. -1. Refer to [Permission grant formats](/boundary/docs/rbac/permission-grant-formats) for more information about grant strings and example formats. -1. Refer to the [Resource tables](/boundary/docs/rbac/resource-table) for a cheat sheet to help you manage your permissions. diff --git a/website/content/docs/rbac/permission-grant-formats.mdx b/website/content/docs/rbac/permission-grant-formats.mdx deleted file mode 100644 index dc69bce48..000000000 --- a/website/content/docs/rbac/permission-grant-formats.mdx +++ /dev/null @@ -1,163 +0,0 @@ ---- -layout: docs -page_title: Permission grant formats -description: >- - Learn how to construct grant strings that map resources and permissions. Understand ID, Type, Pinned, and Wildcard grant formats. View possible grant templates. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Permission grant formats - -Each grant string is a mapping that describes a resource or set of resources and -the permissions that should be granted on them. - -Refer to [Assignable permissons](/boundary/docs/rbac/assignable-permissions) for more information about the permissions you can include in grants. - -A grant string has a form similar to: - -`ids=;type=;actions=;output_fields=` - -There are two types of selectors: - -- An `ids` field that indicates a specific resource or a wildcard to match all. -You can enter multiple comma-separated ID values in a grant string. -- A `type` field that indicates a specific resource type or a wildcard to match - all; this might also be used to grant permissions on collections of resources. - -Selectors are used to indicate the resources on which the grant should apply, -using specific IDs or wildcard IDs and type selectors. - -You can supply grant strings using a human-friendly string syntax or using JSON. -The following examples use the canonical string syntax. -The JSON equivalents are an object with a string `id` value, a string `type` value, a string array `actions` value, and a string array `output_fields` value. - -In the following examples, `output_fields` is omitted for brevity, but they are valid for each example. -It is also valid to omit `actions` and specify only `output_fields`. - -## ID only - -The simplest form of grant allows the specified actions for a given resource. -Refer to the following example: - -`ids=hsst_1234567890;actions=read,update` - -This example grants `read` and `update` actions to the resource `hsst_1234567890`. It is invalid -to specify `create` or `list` as actions in this format, because this format -explicitly identifies a resource. -The `create` and `list` actions are only supported for collections. - -You can enter multiple comma-separated ID values in a grant string: - -`ids=hsst_1234567890,hsst_0987654321;actions=read,update` - -This example grants the `read` and `update` actions to both resources `hsst_1234567890` and `hsst_0987654321`. - -## Type only - -You can configure a grant to allow the specified actions for a given type. -Refer to the following example: - -`type=host-catalog;actions=create,list` - -Because type specifies only a collection as opposed to specific resources within -that collection, only collection actions are allowed in this format. Currently, -this includes the `create` and `list` actions. - -There is one additional restriction: this grant format is only valid against "top-level" -resource types, which include: - -- Auth methods -- Auth tokens -- Groups -- Host catalogs -- Roles -- Scopes -- Sessions -- Targets -- Users - -The reason for this is that other types of resources are contained within one of -these resource types. -For example, accounts are instantiated within an auth -method. To specify actions against an auth method, you must also specify the -specific containing resource you want to apply the grants to. -You can update those resources using the pinned format shown below. - -## Pinned ID - -This form "pins" actions to a non-top-level type within a specific ID. -Refer to the following example: - -`ids=hcst_1234567890;type=host-set;actions=create,read,update` - -In this example, the user is able to create, read, or update host sets within -the scope, but only the host sets belonging to host catalog `hcst_1234567890`. -Pinning is essentially a way to use top-level resources to create mini -permission boundaries for their subordinate resources. - -## Wildcards - -You can use wildcards in grants. -Refer to the following sections for the various wildcard possibilities that are supported. - -### Wildcard ID - -When just the ID is `*`, it matches all IDs of the given type. You can use this grant format -with both top-level resource types and non-top-level resource types. -Refer to the following example: - -`ids=*;type=host-set;actions=create,read,update,set-hosts` - -### Wildcard type - -For non-top-level resources with pinned IDs, the `type` can be a wildcard. -Refer to the following example: - -`ids=hcst_1234567890;type=*;actions=create,read,update` - -This grant format would allow `create`, `read`, and `update` actions for all types of -subordinate resources underneath the host -catalog with ID `hcst_1234567890`. -In this example, that would include host sets and hosts. - -### Wildcard ID and type - -If the ID and type are both wildcards, the grant is essentially a catch-all that matches any resource of any type within the scope and allows the given actions. -Refer to the following example: - -`ids=*;type=*;actions=read,list` - -### Wildcard ID, type, and actions - -ID, type, and actions can all be wildcards. -Refer to the following example: - -`ids=*;type=*;actions=*` - -Such a grant is essentially a full administrator grant for a scope. - -## Templates - -A few template possibilities exist for grants. -The following templates substitute a given value into the ID field of the grant string at evaluation time: - -- `{{.Account.Id}}`: The substituted value is the account ID associated with the - token used to perform the action. As an example, - `ids={{.Account.Id}};actions=read,change-password"` is one of Boundary's - default grants to allow users that have authenticated with the Password auth - method to change their own password. -- `{{.User.Id}}`: The substituted value is the user ID associated with the token - used to perform the action. - -## More information - -1. Refer to [Assignable permissions](/boundary/docs/rbac/assignable-permissions) for more information about the permissions you can assign to Boundary principals. -1. Refer to the [Resource tables](/boundary/docs/rbac/resource-table) for a cheat sheet to help you manage your permissions. - -## Next steps - -Refer to [Manage access with roles](/boundary/docs/rbac/manage-roles) for instructions to configure roles and grant scopes for principals. diff --git a/website/content/docs/rbac/users/manage-users-groups.mdx b/website/content/docs/rbac/users/manage-users-groups.mdx deleted file mode 100644 index cf51c9e18..000000000 --- a/website/content/docs/rbac/users/manage-users-groups.mdx +++ /dev/null @@ -1,324 +0,0 @@ ---- -layout: docs -page_title: Manage users and groups -description: How to manage Boundary users and groups ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Managing principals - -Users and Groups in Boundary are collectively known as principals. Assigning -[grants](/boundary/docs/rbac#grant-strings) on -[roles](/boundary/docs/domain-model/roles) is performed through principal IDs; -that is, the unique IDs of either users, groups, or both. - -This page will walk you through managing users within Boundary. (Groups will be -added at a later time.) - -## Users - -Users in Boundary represent an _internal_ notion of a particular entity (human, -machine, etc.). Users can be correlated with one or more -[account](/boundary/docs/domain-model/accounts) resources via [auth -methods](/boundary/docs/domain-model/auth-methods). Accounts represent -_external_ notions of a particular entity. Among other use-cases, this mechanism -allows for an easy way to switch users to new IdPs within the organization -deploying Boundary. - -In this example, we're going to show you how to create an account and user for -an auth method to allow that user to login to Boundary. Because an auth method -can be at the org and global scopes, we're going to create an org-scoped auth -method in the default generated org in a `dev` mode server. (If you're not -running `dev` mode, you'll need to substitute appropriate generated IDs in the -steps below.) - -~> Currently, all auth methods auto-vivify users on authentication; that is, on -successful authentication against an account, if there is no user already linked -with that account, a user will be automatically created. This may be a nice -time-saver, but in other situations (such as when you want Terraform to fully -describe the Boundary resources) this may be undesirable, so the steps below -walk you through manually making these resources and linking them. A future -Boundary update will allow turning off auto-vivification on a per-auth-method -basis. - -## Create an auth method - -Create a password-type auth method in the generated default org: - - - - - -```bash -$ boundary auth-methods create password -scope-id o_1234567890 -name org_auth_method -description 'Org auth method' - -Auth Method information: - Created Time: Tue, 29 Sep 2020 08:32:04 PDT - Description: Org auth method - ID: ampw_PbE6nNT72a - Name: org_auth_method - Type: password - Updated Time: Tue, 29 Sep 2020 08:32:04 PDT - Version: 1 - - Scope: - ID: o_1234567890 - Name: Generated org scope - Parent Scope ID: global - Type: org - - Attributes: - Minimum Login Name Length: 3 - Minimum Password Length: 8 -``` - - - - - -1. Navigate to an org, then to auth methods. -1. Choose the **New** button. -1. Fill in the auth method details. -1. Choose **Save** and view the auth method edit form page. - - - - - - - -```hcl -resource "boundary_auth_method" "password" { - name = "org_auth_method" - description = "Password auth method for org" - type = "password" - scope_id = "o_1234567890" -} -``` - - - - - -## Create an account - -Create an account for the org-scoped auth method. Note that by default, user -names must be all lowercase alphanumeric of at least 3 characters and the -password must be 8 or more characters. (The minimum lengths can be changed in -the attributes for the auth method, if desired.) - - - - - -```bash -boundary accounts create password -auth-method-id ampw_PbE6nNT72a -login-name 'myuser' -name my_account -description 'My password account' - -Account information: - Auth Method ID: ampw_PbE6nNT72a - Created Time: Tue, 29 Sep 2020 08:35:02 PDT - Description: My password account - ID: acctpw_BOn3EcqQfe - Name: my_account - Type: password - Updated Time: Tue, 29 Sep 2020 08:35:02 PDT - Version: 1 - - Scope: - ID: o_1234567890 - Name: Generated org scope - Parent Scope ID: global - Type: org - - Attributes: - Login Name: myuser -``` - - - - - -1. Navigate to orgs > auth methods > auth method, then to the **Accounts** tab. -1. Choose the **New** button. -1. Fill the account details. -1. Choose **Save** and view the account edit form page. - - - - - - - -```hcl -resource "boundary_account" "my_user" { - name = "myuser" - description = "Login account for my user" - type = "password" - login_name = "myuser" - password = "supersecure" - auth_method_id = "ampw_PbE6nNT72a" -} -``` - - - - - -## Create a user - -Next, create a user at the org scope. - - - - - -First, create the user resource: - -```bash -$ boundary users create -name "myuser" -description "My user resource" -scope-id o_1234567890 - -User information: - Created Time: Tue, 29 Sep 2020 06:37:12 PDT - Description: My user resource - ID: u_yXhZpt5PX3 - Name: myuser - Updated Time: Tue, 29 Sep 2020 06:37:12 PDT - Version: 1 - - Scope: - ID: o_1234567890 - Name: Generated org scope - Parent Scope ID: global - Type: org -``` - -Then associate the user with the account previously created: - -```bash -$ boundary users set-accounts -id u_yXhZpt5PX3 -account acctpw_BOn3EcqQfe - -User information: - Created Time: Tue, 29 Sep 2020 08:43:43 PDT - Description: My org user - ID: u_yXhZpt5PX3 - Name: my_user - Updated Time: Tue, 29 Sep 2020 08:54:11 PDT - Version: 2 - - Scope: - ID: o_1234567890 - Name: Generated org scope - Parent Scope ID: global - Type: org - - Accounts: - ID: acctpw_BOn3EcqQfe - Scope ID: o_1234567890 -``` - - - - - -1. Navigate to an org, then to users. -1. Choose the **New** button. -1. Fill the user details. -1. Choose **Save** and view the user edit form page. - - - -Then associate the user with an account: - -1. From the user edit form, navigate to the **Accounts** tab. -1. Choose **Add Accounts** from the **Manage** dropdown. -1. Select one or more accounts to associate with the user. -1. Choose the **Add Accounts** button and view the user accounts list. - - - - - - - -```hcl -resource "boundary_user" "myuser" { - name = "myuser" - description = "My user resource" - - # taken from the example account resource defined above - account_ids = [ boundary_account.myuser.id ] - scope_id = "o_1234567890" -} -``` - - - - - -## Log in - -Now you can test logging in. - - - - - -```bash -$ boundary authenticate password -auth-method-id ampw_PbE6nNT72a -``` - - - - - -1. Navigate to the authenticate page. -1. Choose an org scope with which to authenticate. -1. Fill the credentials. -1. Choose **Authenticate** and view the projects overview for the org. - - - - - - - -```hcl -provider "boundary" { - addr = "http://127.0.0.1:9200" - auth_method_id = "ampw_PbE6nNT72a" - password_auth_method_login_name = "myuser" - password_auth_method_password = "supersecure" -} -``` - - - diff --git a/website/content/docs/rbac/users/managed-groups.mdx b/website/content/docs/rbac/users/managed-groups.mdx deleted file mode 100644 index b162106e2..000000000 --- a/website/content/docs/rbac/users/managed-groups.mdx +++ /dev/null @@ -1,171 +0,0 @@ ---- -layout: docs -page_title: Filtering - managed groups -description: >- - Learn how to configure filters for managed groups. View search filter attributes and examples of filters for OIDC and LDAP managed groups. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Filter managed groups - -This page describes how to use filters with OIDC or LDAP managed groups. It assumes that you are familiar with the Boundary's general filter syntax as well as [OpenID Connect](https://openid.net/specs/openid-connect-core-1_0.html) or [LDAP](https://ldap.com/ldap-specifications/). - -Refer to [Filtering and listing resources](/boundary/docs/filtering) for more information about Boundary's filter syntax and best practices. - -## OIDC filters - -Currently, two blocks of data are available for OIDC filters: - -- `/token/` contains claims from the JSON web token (JWT) that is returned by the OIDC Identity - Provider (IdP). For example, `/token/sub` is the `"sub"` claim from the token. - -- `/userinfo/` contains claims from the - [UserInfo](https://openid.net/specs/openid-connect-core-1_0.html#UserInfo) - endpoint. - -### OIDC examples - -The specific content of the claims is unique to the IdP, besides any claims that are part of the OIDC specification. -We provide some examples in this section using sample claims. -Refer to your IdP for the specific syntax. - -Example JWT claims: - - - -```json -{ - "iss": "https://server.example.com", - "sub": "24400320", - "aud": "s6BhdRkqt3", - "nonce": "n-0S6_WzA2Mj", - "exp": 1311281970, - "iat": 1311280970, - "auth_time": 1311280969, - "custom": { - "department": "infosec" - } -} -``` - - - -Example UserInfo claims: - - - -```json -{ - "roles": ["user", "operator"], - "sub": "alice@example.com", - "email": "rabbithole@example.com", - "name": "Alice of Wonderland" -} -``` - - - -The following are some examples of using these values in filters: - -- `"operator" in "/userinfo/roles"` matches users (like Alice) that have - `"operator"` in the roles returned by UserInfo. - -- `"/token/custom/department" == "infosec" or "/token/custom/department" == "ops"` matches users (like Alice) that are either in the `ops` or `infosec` departments. - -## LDAP managed groups - -Membership is determined by matching the LDAP group names against an LDAP account's associated groups. -Every authentication updates the group membership comparison. - -To enable managed groups, set the LDAP auth method `enable_groups` attribute to `true`. - -After you enable groups on the auth method, the managed group membership is defined as a list with the `group-names` attribute on the managed group itself. - -### LDAP auth method search filter attributes - -When you define the auth method, you can set a number of group and user attributes to resolve group membership according to the structure of your directory schema. - -You can set an optional `group_dn` to define the base distinguished name (DN) to perform a group search under. A common example is: - -`ou=Groups,dc=example,dc=com` - -Because the directory schema can vary, you may specify a `group_filter` that constructs a group membership query from a template. The following default template is compatible with several common directory schemas: - -`(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))` - -You may also set a `group_attr` value that enumerates group membership based on the objects returned from the `group_filter`. Common examples include: - -- `group_filter` queries returning group objects, use: `cn`. This is the default. -- `group_filter` queries returning user objects, use: `memberOf`. - -### LDAP examples - -Directory schemas can vary according to your implementation. -We provide some examples in this section using the schema declared for the [Online LDAP Test Server](https://www.forumsys.com/2022/05/10/online-ldap-test-server/) provided by ForumSystems. -Refer to your directory schema for the specific syntax. - -LDAP server information (read-only access): -Server: `ldap.forumsys.com ` -Port: `389` -Bind DN: `cn=read-only-admin,dc=example,dc=com` -Bind password: `password` - -All user passwords are `password`. You may also bind to individual Users (uid) or the two Groups (ou) that include: - -Mathematicians: `ou=mathematicians,dc=example,dc=com` -- riemann -- gauss -- euler -- euclid - -Scientists: `ou=scientists,dc=example,dc=com` -- einstein -- newton -- galieleo -- tesla - -Example LDAP auth method attributes: - - - -```text -Attributes: - bind_dn: cn=read-only-admin,dc=example,dc=com - bind_password_hmac: IC29KNPDTPC57nc2aT9UFthOh4Kh1i3660_euBsgL7Y - enable_groups: true - group_dn: dc=example,dc=com - state: active-public - urls: [ldap://ldap.forumsys.com] - user_attr: uid - user_dn: dc=example,dc=com -``` - - - -In this example, the following attributes are set on the LDAP auth method: - -- `urls:` `"ldap://ldap.forumsys.com"` -- `bind-dn`:` "cn=read-only-admin,dc=example,dc=com"` -- `bind-password`:` file://bind-pass.txt` (passed directly if you use Terraform) -- `user-dn`:` "dc=example,dc=com"` -- `user-attr`:` "uid"` -- `group-dn`:` "dc=example,dc=com"` - -Example managed group attributes: - - - -```text -Attributes: - group_names: [Mathematicians] -``` - - - -In this example, the following attribute is set on the managed group: - -- `group-names`: `"Mathematicians"` \ No newline at end of file diff --git a/website/content/docs/release-notes/v0_10_0.mdx b/website/content/docs/release-notes/v0_10_0.mdx deleted file mode 100644 index 7f3214678..000000000 --- a/website/content/docs/release-notes/v0_10_0.mdx +++ /dev/null @@ -1,54 +0,0 @@ ---- -layout: docs -page_title: v0.10.0 release notes -description: >- - Learn more about the features included in the Boundary 0.10.0 release and discover what has changed. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary v0.10.0 - -The release notes below contain information about new functionality available in the Boundary v0.10.0 release. -To see a granular record of when each item was merged into the Boundary project, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md). -To learn about what Boundary consists of, we highly recommend you start at the [Getting Started Page](/boundary/docs/getting-started). - -Lastly, for instructions on how to upgrade an existing Boundary deployment to v0.10.0, please review Boundary's [general upgrade guide](/boundary/tutorials/oss-configuration/upgrade-version). - -## Boundary v0.10.0 highlights - -**Credential Management of SSH Keys:** Boundary 0.10 includes enhancements to credential management, including added support for management of SSH private keys. - - -**SSH Brokering Helper Function:** We’ve expanded support for the SSH brokering helper function that allows users to seamlessly connect to machines remotely -without having to manually enter their brokered credentials. - -**Enhanced IAM Workflows in the Boundary Admin UI:** Boundary 0.10 introduces enhanced IAM associations to Boundary’s Admin UI, allowing users to expand IAM associations in a -project scope to resources such as group members and principals that reside in other scopes. - -**SSH Credential Injection via Password and Public Key Authentication:** HCP Boundary now supports SSH Credential Injection, an active method of injecting credentials into an -established connection, so that credentials are never exposed to users. [Learn more here](/boundary/tutorials/hcp-administration/hcp-ssh-cred-injection). - -## What's changed - -* `ssh` Target Type With Credential Injection (HCP Boundary only): Boundary has - gained a new `ssh` target type. Using this type, username/password or SSH - private key credentials can be sourced from `vault` credential libraries or - `static` credentials and injected into the SSH session between a client and - end host. This allows users to securely SSH to remote hosts while never being - in possession of a valid credential for that target host. -* SSH Private Key Credentials: There is now an `ssh_private_key` credential type - that allows submitting a username/private key (and optional passphrase) to - Boundary for use with credential injection or brokering workflows. -* `boundary connect ssh` Credential Brokering Enhancements: we have extended - support into the `boundary connect ssh` helper for brokered credentials of - `ssh_private_key` type; the command will automatically pass the credentials to - the `ssh` process ([PR](https://github.com/hashicorp/boundary/pull/2267)). -* `boundary authenticate`, `boundary accounts`: Enables use of `env://` and - `file://` syntax to specify location of a password - - -**For more detailed information of all changes since 0.9.0, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md)** diff --git a/website/content/docs/release-notes/v0_11_0.mdx b/website/content/docs/release-notes/v0_11_0.mdx deleted file mode 100644 index 8c73bf22f..000000000 --- a/website/content/docs/release-notes/v0_11_0.mdx +++ /dev/null @@ -1,43 +0,0 @@ ---- -layout: docs -page_title: v0.11.0 release notes -description: >- - Learn more about the features included in the Boundary 0.11.0 release and discover what has changed. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary v0.11.0 - -The release notes below contain information about new functionality available in the Boundary v0.11.0 release. To see a granular record of when each item was -merged into the Boundary project, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md). To learn about what Boundary -consists of, we highly recommend you start at the [Getting Started Page](/boundary/docs/getting-started). - -Lastly, for instructions on how to upgrade an existing Boundary deployment to v0.11.0, please review Boundary's -[general upgrade guide](/boundary/tutorials/oss-configuration/upgrade-version). - -## Boundary v0.11.0 highlights - -**HCP Boundary General Availability:** Boundary is now available on the HashiCorp Cloud Platform! HCP Boundary provides an easy way to securely access critical -systems with fine-grained authorizations based on trusted identities. Boundary on HashiCorp Cloud Platform provides a fully managed, single workflow to securely -connect to hosts and critical systems across Kubernetes clusters, cloud service catalogs, and on-premises infrastructure - -**Private Vault Access:** HCP Boundary users are now able to integrate their on-premises instance of Vault without having to publicly expose Vault. This is -accomplished by deploying a Boundary worker binary within the same private network as the Vault instance and peering with the HCP Boundary control plane. -[Learn more here](/boundary/tutorials/access-management/hcp-vault-cred-brokering-quickstart). - -**SSH Credential Injection:** SSH Targets can now be set up through the Admin UI, making the Credential Injection workflow more seamless and easy to use. -[Learn more here](/boundary/tutorials/hcp-administration/hcp-ssh-cred-injection). - -**Improved Worker Management:** Administrators are now able to register and manage Boundary workers through the Admin UI. Admin users can view session counts, -IP addresses and release versions of all registered workers through the 'Workers' tab. - -**Support for Generic Credentials:** Boundary now supports brokering of 'generic credentials'. This will enable users to broker any kind of key/value pair type -credentials when they are connecting to a remote host. - -## What's changed - -**For more detailed information of all changes since 0.10.0, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md)** \ No newline at end of file diff --git a/website/content/docs/release-notes/v0_12_0.mdx b/website/content/docs/release-notes/v0_12_0.mdx deleted file mode 100644 index e783dad55..000000000 --- a/website/content/docs/release-notes/v0_12_0.mdx +++ /dev/null @@ -1,111 +0,0 @@ ---- -layout: docs -page_title: v0.12.0 release notes -description: >- - Learn more about the new features included in the Boundary 0.12.0 release and understand deprecations and changes. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary v0.12.0 - -The release notes below contain information about new functionality available in the Boundary v0.12.0 release. -To see a granular record of when each item was merged into the Boundary project, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md). -To learn about what Boundary consists of, we highly recommend you review the [Getting Started Page](/boundary/docs/getting-started). - -For instructions on how to upgrade an existing Boundary deployment to v0.12.0, refer to Boundary's [general upgrade guide](/boundary/tutorials/oss-configuration/upgrade-version). - -## Boundary v0.12.0 highlights - -The 0.12.0 release adds major new functionality to Boundary. -Highlights include: - -- Reversed-proxying to target networks through multi-hop sessions (HCP only) -- Credential injection using Vault SSH signed certificates (HCP only) -- Addresses on targets -- Authentication improvements - -## New features - -**Reverse proxying to target networks using multi-hop sessions (HCP only)**: You can deploy Boundary workers in any public or private network to enable secure access to resources. -In previous versions workers needed outbound network access to the HCP Boundary control plane, and those workers needed inbound network access from the client that was trying to establish the session. -However, many users do not want any inbound access to their private networks, which means that remote users would need to be on the same corporate network or use a VPN to reach the Boundary worker. - -We are introducing a feature called multi-hop sessions in version 0.12.0. -This new feature allows multiple workers to chain together to form reverse-proxy connections. -Now a worker in a private network only requires outbound network access to reach upstream workers or the control plane. -Remote users no longer require network access to the private network. -They only need network access to the client-facing (or "frontline") worker. - -For more information, refer to the [multi-hop session](/boundary/docs/configuration/worker/pki-worker#multi-hop-sessionshcp-only) documentation. - -**Credential injection using Vault SSH signed certificates (HCP only)**: You can now configure SSH credential injection using Vault's secret engine to create the SSH certificate credentials. -SSH certificate-based authentication extends key-based authentication using digital signatures -Your users' authenticity is determined by a certificate signed by a trusted certificate authority (CA). -You configure Vault's secrets engine to act as the CA. -Vault is the only supported CA in Boundary version 0.12.0. - -SSH certificates let you specify how long they are valid for, who can gain access to a target, how users can log in, and what commands can be used on the target machine. -SSH certificates are short-lived and self-destructive unlinke SSH key pairs. - -For more information, refer to the [Vault SSH certificate credential library attributes](/boundary/docs/domain-model/credential-libraries#vault-ssh-certificate-credential-library-attributeshcp-only) documentation. - -**Addresses on targets**: HashiCorp Boundary offers an extensible domain model that allows administrators to organize target resources in a way that best compliments how their organization manages its computing infrastructure. -But that flexibility could become a hindrance when setting up a quick proof-of-concept and defining a target to create a session. - -Version 0.12.0 introduces a quick way to set up a target. -Previously, you would need to define [hosts](/boundary/docs/domain-model/hosts) within a [host set](/boundary/docs/domain-model/host-sets), and then assign that to a [target](/boundary/docs/domain-model/targets). -The hosts contain the hostname or IP address of the computing resources, and the target definition contains various connection parameters for those hosts. -Starting with version 0.12.0 the hostname or IP address can be specified directly within the target definition, without having to create hosts, host sets, or a host catalog. - -This functionality allows you to get started with Boundary quickly while still maintaining the same flexibility for more complex and production-like scenarios. - -For more information, refer to the [Target and Host Resources](/boundary/docs/domain-model#target-and-host-resources) documentation. - -**Authentication improvements**: In previous versions, authenticating through the CLI required you to provide an [**Auth Method ID**](/boundary/docs/domain-model/auth-methods). -This value could be difficult to find if you did not previously save it. -Starting in version 0.12.0 the Boundary CLI no longer requires an **Auth Method ID**, and will use the default **Auth Method ID** if none is provided. -The built-in password auth method is now marked as **Primary** when an HCP Boundary cluster is deployed. - -**JSON credentials**: In previous versions Boundary only supported two types of static credentials: Username/Password and SSH Private Key. -In version 0.12.0, we are releasing a new type of credential to the static credential store. -You can now create and broker JSON blobs to authorized users at session establishment time. - -For more information, refer to the [JSON credentials](/boundary/docs/domain-model/credentials#json) documentation. - -**Job run table maintenance**: A new job was added to automatically clean up completed runs from the `job_run` table. -It deletes any existing completed jobs on a regular interval to help manage the size of your Boundary database. - -## Deprecations and changes - -Boundary version 0.12.0 has the following deprecations or changes: - -- A vulnerability in Boundary was identified such that when a Key Management Service (KMS) was defined in Boundary's configuration file with the intent of using the KMS to encrypt the credentials stored on disk, new credentials created after a rotation may not have been encrypted via the intended KMS. -This would result in the credentials being stored in plain text on the Boundary PKI worker's disk. -This vulnerability, [CVE-2023-0690](https://discuss.hashicorp.com/t/hcsec-2023-03-boundary-workers-store-rotated-credentials-in-plaintext-even-when-key-management-service-configured/49907), was fixed in Boundary 0.12.0. - -- In this release there is a change to the initial components that are created when you run Boundary in dev mode. -The `boundary dev` command now creates two TCP targets: one is created using the host source, and the other is created using the `address` field. -Note that this may affect you if you use the default target for testing. - -- In Boundary 0.9.0, targets were updated to require a default port value. -This had been the original intention; it was a mistake that it was optional. -Unfortunately, due to a separate defect in the update verification logic for static hosts, it was possible for a host to be updated (but not created) with a port. -This meant that targets could use ports attached to host addresses, which was not the intention and lead to confusing behavior across different installations. - - In this version, updating static hosts no longer allows ports to be part of the address. - Any port on such a host will be ignored in favor of the default port on the target when you authorize a session. - In Boundary 0.14.0 this will become an error instead. - This means that the fallback logic for targets that did not have a default port defined is no longer in service. - All targets must now have a default port defined. - -- With the introduction of `vault-ssh-certificate` credential libraries, the Vault credential library subtype is being renamed to `vault-generic` to denote it as a credential library that can be used in a generalized way to issue credentials from Vault. -Existing credential libraries with the subtype of `vault` will be updated to `vault-generic`. -The `vault` subtype will still be accepted as a valid subtype in API requests to the credential library's endpoints, but it is deprecated and will be removed in Boundary 0.14.0. -We recommend that you use `vault-generic` instead. - - In addition, the Boundary credential library sub-commands `create vault` and `update vault` will still function, but are deprecated. - Instead, you should use the Boundary credential library sub-commands `create vault-generic` and `update vault-generic`. \ No newline at end of file diff --git a/website/content/docs/release-notes/v0_13_0.mdx b/website/content/docs/release-notes/v0_13_0.mdx deleted file mode 100644 index 9f349634b..000000000 --- a/website/content/docs/release-notes/v0_13_0.mdx +++ /dev/null @@ -1,159 +0,0 @@ ---- -layout: docs -page_title: v0.13.0 release notes -description: >- - Learn more about the new features included in the Boundary 0.13.0 release. Understand any deprecations, changes, and known issues. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary v0.13.0 - -The release notes below contain information about new functionality available in the Boundary v0.13.0 release. -To see a granular record of when each item was merged into the Boundary project, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md). -To learn about what Boundary consists of, we highly recommend you review the [Getting Started Page](/boundary/docs/getting-started). - -For instructions on how to upgrade an existing Boundary deployment to v0.13.0, refer to Boundary's [general upgrade guide](/boundary/tutorials/oss-configuration/upgrade-version). - -## Boundary v0.13.0 highlights - -The 0.13.0 release adds major new functionality to Boundary. -Highlights include: - -- Boundary Enterprise version -- SSH session recording -- LDAP authentication method (beta) -- HCP Boundary maintenance window -- OIDC authentication improvements -- Shared KMS workers -- Static ports for targets -- Dynamic host catalog external name - -## New features - -**Boundary Enterprise**: Organizations are now able to deploy Boundary Enterprise within their self-managed infrastructure to let their teams securely access hosts and services consistently across any environment. -The introduction of Boundary Enterprise allows organizations in highly regulated industries who are prohibited from adopting cloud based solutions to leverage Boundary's secure remote access functionalities. -Boundary Enterprise has the same feature set as HCP Boundary and seamless migrations from Community Edition deployments are supported as well. - -For more information, refer to [Boundary Enterprise](/boundary/docs/enterprise). - - - -The version of Go that was used in Boundary Enterprise release 0.13.0 contained CVE-2023-39326. -Refer to the [advisory](https://github.com/advisories/GHSA-9f76-wg39-x86h) for more information. -The issue was fixed in Go versions 1.21.5. Boundary was updated to use the new Go versions in Boundary Enterprise release 0.13.5. -You should [upgrade Boundary](/boundary/tutorials/self-managed-deployment/upgrade-version) to version 0.13.5 or later. - -Community users should upgrade to version 0.14.3 or later. - - - -**SSH session recording HCP/ENT**: A fundamental challenge of securing access to sensitive computing resources is creating a system of record around users' access and actions over remote sessions. -This release introduces session recording to help you address your compliance and threat management needs. - -When you enable session recording for a target, any sessions in which a user requests access to that target are recorded. -Recorded sessions are stored in an external data store so that you can access and manage them outside of Boundary for long-lasting data retention. -You can view recorded sessions using a session player that runs in a browser. - -For more information, refer to [Auditing](/boundary/docs/concepts/auditing). -To configure session recording for targets, refer to the session recording [overview](/boundary/docs/configuration/session-recording). - -**LDAP authentication method Beta**: This release introduces a new Lightweight Directory Access Protocol (LDAP) authentication method as a preview feature. -LDAP is an open, vendor-neutral application protocol for accessing and maintaining directory information. - -You can now configure Boundary to delegate authentication to an LDAP directory. -The first time a user successfully authenticates using an LDAP auth method, a new LDAP account is created. -LDAP-managed groups let you assign roles in Boundary based on the LDAP account's group memberships. - -Create, read, update, and delete (CRUD) support for the new LDAP features is available through the CLI, API, and SDK, as well as HashiCorp Terraform. -You can use LDAP to log in through any of the Boundary clients, including the CLI, Boundary Desktop, and the Boundary admin UI. -Support for LDAP CRUD operations via the Boundary admin UI is planned for an upcoming release. - -For more information, refer to the LDAP domain model documentation: - -- [Accounts](/boundary/docs/domain-model/accounts#ldap-account-attributes-beta) -- [Auth methods](/boundary/docs/domain-model/auth-methods#ldap-auth-method-attributes-beta) -- [Managed groups](/boundary/docs/domain-model/managed-groups#ldap-managed-group-information-and-attributes-beta) - -**HCP Boundary maintenance window HCP only**: HCP Boundary automatically updates your environment when a new version of Boundary is released. -You can now schedule when that maintenance occurs to ensure that it does not interrupt peak work hours. -When you schedule a maintenance window, HCP Boundary waits util the day and time window you selected to apply any patch or major version updates. - -For more information, refer to [Maintenance windows](/hcp/docs/boundary/maintenance-window). - -**OIDC authentication improvements**: The Boundary CLI now supports user authentication against an OIDC source in locked down environments where a browser may not be available to complete the auth flow. -During authentication, the CLI will output the auth URL which can be used to complete the flow on another device and the resulting token is automatically passed to the CLI. - -**Shared KMS workers**: KMS workers now have feature parity with PKI workers. -You can use more than one KMS for registering downstreams across different networks. - -For more information, refer to the [worker configuration](/boundary/docs/configuration/worker) documentation. - -**Static ports for targets**: Administrators can now configure a default, static port for clients when connecting to targets using the optional `default_client_port` attribute. -Any workers that connect to a target will use the default port, if one is specified, unless overidden by the client attribute `-listen-port`. - -**Dynamic host catalog external name**: You can now view the AWS or Azure host name when listing hosts in CLI, admin console, and desktop client. - -## Deprecations and changes - -Boundary version 0.13.0 has the following deprecations and changes: - -- Due to the update to KMS workers, the previous KMS worker registration method is deprecated. -You must opt in to use it. -You should only use the deprecated behavior if compatibility with workers running a version less than 0.13.0 is required. -To opt in, add `use_deprecated_kms_auth_method = true` to the `worker` configuration block. - - Note that when a worker using KMS and running version 0.13.0 or later connects to a controller using KMS and running version 0.13.0 or later, they transition to the new method automatically. - To revert to the previous method after that, you must delete the worker and recreate it with the `use_deprecated_kms_auth_method` field specified. - -- Boundary now performs additional validity checking when you add grants to roles. -The checks are designed to reject grants that are not properly configured. -Previously, these would have been accepted without error, but the permissions would not be granted. -An error message is provided now, with hints for resolution. - -- `WithAutomaticVersioning` for auth tokens from the Go SDK was incorrectly being generated for auth token resources, which do not support versioning. -It has now been removed. - -- With the introduction of new plugin services, the Azure and AWS Host plugin repositories have been renamed to drop the word `host`: - - - The https://github.com/hashicorp/boundary-plugin-host-aws repository was renamed to https://github.com/hashicorp/boundary-plugin-aws. - - - The https://github.com/hashicorp/boundary-plugin-host-azure repository was renamed to https://github.com/hashicorp/boundary-plugin-azure. - -- PostgreSQL 12 or greater is now required. -PostgreSQL 11 is no longer supported. - -## Known issues - -**Vulnerability to session hijacking through TLS certificate tampering**: Boundary and Boundary Enterprise since version 0.8.0 are vulnerable to session hijacking through TLS certificate tampering. - -An attacker who has privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use or TOFU token may exploit the vulnerability. -It allows the attacker to create a TLS certificate that hijacks an active session to gain access to the underlying service or application. -The vulnerability, CVE-2024-1052, is fixed in Boundary version 0.15.0 and patched in Boundary Enterprise versions 0.13.6 and 0.14.4. - -Boundary Enterprise users should upgrade to Boundary Enterprise 0.13.6 or 0.14.4. -Community users should evaluate the risk associated with this issue and consider upgrading to Boundary 0.15.0 or later. - -For more information, refer to [HCSEC-2024-02 - Boundary vulnerable to session hijacking through TLS certificate tampering](https://discuss.hashicorp.com/t/hcsec-2024-02-boundary-vulnerable-to-session-hijacking-through-tls-certificate-tampering/62458). - -[Upgrade to the latest version of Boundary](/boundary/tutorials/self-managed-deployment/upgrade-version) - -**Rotation of AWS access and secret keys during a session results in stale recordings**: In Boundary version 0.13.0, when you rotate a storage bucket's secrets, any new sessions use the new credentials. -However, previously established sessions continue to use the old credentials. - -As a best practice, administrators should rotate credentials in a phased manner, ensuring that all previously established sessions are completed before revoking the stale credentials. -Otherwise, you may end up with recordings that aren't stored in the remote storage bucket and are unable to be played back. - -**Unsupported recovery workflow during worker failure**: If a worker fails during a recording, there is no way to recover the recording. -This could happen due to a network connectivity issue or because a worker is scaled down, for example. -There are a number of currently unsupported failure cases, including when the worker: - -- Crashes and restarts while servicing connections and channels for session to an SSH target -- Crashes and restarts while closing a channel, before all files are synced to remote storage -- Crashes and restarts while closing a connection recorder, before all files are synced to remote storage -- Crashes and restarts while closing a session recorder, before all files are synced to remote storage -- Crashes and never restarts or is seen again while closing a channel/connection recorer/session recorder -- Loses its connection to the controller and cancels sessions, it must resend the information when communication resumes diff --git a/website/content/docs/release-notes/v0_14_0.mdx b/website/content/docs/release-notes/v0_14_0.mdx deleted file mode 100644 index ea9d2ca38..000000000 --- a/website/content/docs/release-notes/v0_14_0.mdx +++ /dev/null @@ -1,394 +0,0 @@ ---- -layout: docs -page_title: v0.14.0 release notes -description: >- - Learn more about the new features included in the Boundary 0.14.0 release. Understand any deprecations, changes, and known issues. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary 0.14.0 release notes - -**GA date:** October 11, 2023 - -@include 'release-notes/intro.mdx' - -## New features - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FeatureDescription
- Boundary Desktop embedded terminal - - An embedded terminal has been added to the Boundary Desktop client for convenience. Now you can use the CLI directly from within Boundary Desktop. -

- Learn more:  - Install Boundary Desktop tutorial -
- LDAP authorization method - - The LDAP auth method is no longer in beta, it is now fully supported. Administrators can now create, manage, and delete LDAP auth methods along with managed groups and accounts using the admin console UI. -

- Learn more:  - Auth methods -
- Dynamic credential support for storage buckets HCP/ENT - - You can now configure dynamic credentials for AWS S3 storage buckets using the Amazon Web Services (AWS) AssumeRole API. We recommend that you configure credentials using AssumeRole instead of access keys when possible. -

- Learn more:  - Create a storage bucket -
- Remote pass-through commands for SSH - - A new SSH flag, remote-command was introduced to the boundary connect ssh helper. It lets you run the specified commands on the remote-machine using pass-through arguments. -

- Learn more:  - connect ssh command -
- New worker health metric - - A new metric was added to the health endpoint to check the connection state of the worker and whether it can connect to an upstream controller. The result is automatically included in the response when you run the health endpoint. -

- Learn more:  - Boundary health endpoints -
- Improved telemetry - - Improved telemetry was added to Boundary. You can enable telemetry to gather information about your Boundary cluster. -

- Learn more:  - events stanza -
- Valid principals for Vault SSH signed certificates -

- (Added in version 0.14.2) - 		- You can now add additional valid principals when you create a Vault SSH signed certificate credential library. The additional principals list the names for which the certificate is valid. -

- Learn more:  - Vault SSH certificate credential library attributes -
- OIDC prompts -

- (Added in version 0.14.3) - 		- You can now use OIDC prompts to customize the authentication and authorization flow to suit your specific needs. For more information about the OIDC specification, refer to the OIDC authentication request documentation. -

- Learn more:  - OIDC auth method attributes -
- API rate limiting -

- (Added in version 0.14.3) - 		- You can now configure rate limits on the controller API to help manage your system resources. Boundary supports separate configurable limits for each resource and action. Rate limiting is enabled by default. -

- Learn more:  - API rate limiting -
- -## Known issues and breaking changes - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
VersionIssueDescription
- 0.13.0+ - - Rotation of AWS access and secret keys during a session results in stale recordings - - In Boundary version 0.13.0+, when you rotate a storage bucket's secrets, any new sessions use the new credentials. However, previously established sessions continue to use the old credentials. -

- As a best practice, administrators should rotate credentials in a phased manner, ensuring that all previously established sessions are completed before revoking the stale credentials. - Otherwise, you may end up with recordings that aren't stored in the remote storage bucket, and are unable to be played back. -
- 0.13.0+ - - Unsupported recovery workflow during worker failure - - If a worker fails during a recording, there is no way to recover the recording. This could happen due to a network connectivity issue or because a worker is scaled down, for example. -

- Learn more:  - Unsupported recovery workflow -
- 0.14.0 -

- (Fixed in 0.14.1) - 		- Go CVE-2023-39325 and Go CVE-2023-39326 - - The version of Go that was used in Boundary release 0.14.0 contained security vulnerabilities. The vulnerabilities were fixed in Go version 1.21.3. Boundary was updated to use the new Go version in release 0.14.1, and the issue is resolved. -

- Learn more:  -

- Go CVE-2023-39325: HTTP/2 rapid reset can cause excessive work in net/http -

- Go CVE-2023-39326: A malicious HTTP sender can use chunk extensions -

- Upgrade to the latest version of Boundary -
- 0.14.0 -

- (Fixed in 0.14.3 and 0.13.5 HCP/ENT) - 		- Go CVE-2023-39322 and Go CVE-2022-45285 - - The version of Go that was used in Boundary release 0.14.0 contained security vulnerabilities. The vulnerabilities were fixed in Go version 1.21.5. Boundary was updated to use the new Go version in release 0.14.3, and the issue is resolved. -

- Note that version 0.13.5 of HCP Boundary and Boundary Enterprise was also updated to use the new Go version. -

- Learn more:  -

- Go CVE-2023-39322: QUIC connections do not set an upper bound on the amount of data buffered -

- Go CVE-2022-45285: Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to insecure protocol -

- Upgrade to the latest version of Boundary -
- 0.8.0 - 0.14.0 -

- (Fixed in 0.14.4 and 0.13.6 ENT) - 		- HCSEC-2024-02 - - Boundary and Boundary Enterprise since version 0.8.0 are vulnerable to session hijacking through TLS certificate tampering. -

- An attacker who has privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use or TOFU token may exploit the vulnerability. - It allows the attacker to create a TLS certificate that hijacks an active session to gain access to the underlying service or application. - The vulnerability, CVE-2024-1052, is fixed in Boundary version 0.15.0 and patched in Boundary Enterprise versions 0.13.6 and 0.14.4. -

- Boundary Enterprise users should upgrade to Boundary Enterprise 0.14.4. - Community users should evaluate the risk associated with this issue and consider upgrading to Boundary 0.15.0 or later. -

- Learn more:  -

- HCSEC-2024-02: Boundary vulnerable to session hijacking through TLS certificate tampering -

- Upgrade to the latest version of Boundary -
- 0.14.0 -

- (Fixed in 0.14.5) - 		- Go CVE-2024-24783, Go CVE-2024-24784, Go CVE-2024-24785, Go CVE-2024-24786, Go CVE-2023-45289, Go CVE-2023-45290 - - The version of Go that was used in Boundary release 0.14.0 contained security vulnerabilities. The vulnerabilities were fixed in Go version 1.21.8. Boundary was updated to use the new Go version in release 0.14.5, and the issue is resolved. -

- Learn more:  -

- CVE-2024-24783: Verify panics on certificates with an unknown public key algorithm in crypto/x509 -

- CVE-2024-24784: Comments in display names are incorrectly handled in net/mail -

- CVE-2024-24785: Errors returned from JSON marshaling may break template escaping in html/template -

- CVE-2024-24786: Infinite loop in JSON unmarshaling in google.golang.org/protobuf -

- CVE-2023-45289: Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http -

- CVE-2023-45290: Memory exhaustion in multipart form parsing in net/textproto and net/http -

- Upgrade to the latest version of Boundary -
- 0.14.0+ -

- (Fixed in 0.15.3) - 		- Cannot delete IAM access key resource - - When you delete an AWS S3 storage bucket that had credential rotation enabled, Boundary cannot delete the associated IAM access key resource. -

- This issue is fixed in version 0.15.3. -

- Upgrade to the latest version of Boundary -

- Learn more:  - Create a storage bucket -
- 0.14.0 -

- (Fixed in 0.14.6) - 		- Go CVE-2023-45288 - - The version of Go that was used in Boundary release 0.14.0 contained security vulnerabilities. The vulnerabilities were fixed in Go version 1.21.9. Boundary was updated to use the new Go version in release 0.14.6, and the issue is resolved. -

- Learn more:  -

- CVE-2023-45288: HTTP/2 CONTINUATION flood in net/http -

- Upgrade to the latest version of Boundary -
- -## Feature deprecations and EOL - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EOLDescription
- vault credential library subtype - - As noted in the v0.12.0 release notes, the vault credential library subtype was renamed to vault-generic. The vault subtype is removed in this release, you must use vault-generic now. -

- Learn more:  - Credential libraries -
- status field - - As noted in the v0.12.0 changelog, using the -format=json option with the CLI produced inconsistent results. The status field is removed in this release. The status_code field is now used for both successful requests and errors. -
- Default port value - - As noted in the v0.12.0 release notes, targets now require a default port value. Previously, any ports that you defined as part of a host address were ignored, but allowed as part of the target definition. From this version on, if you define a port on a host address it results in an error. -

- Learn more:  - Targets -
- Application credentials parameter - - As noted in the v0.10.0 changelog, the target subcommands for application credentials were renamed to brokered credentials. The application credentials subcommands are removed in this release. You must use the brokered credential subcommands instead. -

- Learn more:  - targets -
diff --git a/website/content/docs/release-notes/v0_15_0.mdx b/website/content/docs/release-notes/v0_15_0.mdx deleted file mode 100644 index 7ae139ac3..000000000 --- a/website/content/docs/release-notes/v0_15_0.mdx +++ /dev/null @@ -1,385 +0,0 @@ ---- -layout: docs -page_title: v0.15.0 release notes -description: >- - Learn more about the new features included in the Boundary 0.15.0 release. Understand any deprecations, changes, and known issues. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary 0.15.0 release notes - -**GA date:** January 30, 2024 - -@include 'release-notes/intro.mdx' - -## New features - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FeatureDescription
- Session recording storage policies - - Storage policies codify how long session recordings must be kept, and when they should be deleted. You can configure retention periods based on your compliance needs. -

- Learn more: Storage policies and Configure storage bucket policies -
- Search and filter - - A new command was added, boundary search. It allows you to search a local cache for information about session and target resources. The local cache helps prevent your system resources from being overwhelmed. -

- Learn more: boundary search and Boundary list vs. search. -
- Boundary daemon - - The Boundary client daemon now runs on end users' computers and locally caches session and target resource information from Boundary instances. The cache helps expedite searches. -

- Learn more: boundary daemon and Client cache -
- List endpoint pagination - - All list endpoints now support pagination, except for worker resources. You can request a list of updated and deleted resources relative to the last result you received via the API. There are new controller flags page_size and max_page_size to set the default and max size of pages. -

- Learn more: API list pagination -
- Generic commands - - In this release, new generic commands were added for read, update, and delete. You can use these generic commands to operate directly on a resource by specifying the resource ID as the next parameter. You do not need to specify a sub-type. For example, the command boundary update ttcp_1234567890 automatically updates a target with that ID. -

- Learn more: delete, read, and update -
- Multiple grant scopes in roles - - Roles now support multiple grant scopes, along with the special values this, children (global/org scopes only) to apply to all direct children of a scope, and descendants (global only) to apply to all descendants of a scope. You can apply the new values by using the commands add-grant-scopes, set-grant-scopes, and remove-grant-scopes on roles. You can continue to use the existing grant_scope_id field for now, but it has been deprecated. -

- Learn more: add-grant-scopes, remove-grant-scopes, and set-grant-scopes -
- -## Known issues and breaking changes - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
VersionIssueDescription
- 0.13.0+ - - Rotation of AWS access and secret keys during a session results in stale recordings - - In Boundary version 0.13.0+, when you rotate a storage bucket's secrets, any new sessions use the new credentials. However, previously established sessions continue to use the old credentials. -

- As a best practice, administrators should rotate credentials in a phased manner, ensuring that all previously established sessions are completed before revoking the stale credentials. - Otherwise, you may end up with recordings that aren't stored in the remote storage bucket, and are unable to be played back. -
- 0.13.0+ - - Unsupported recovery workflow during worker failure - - If a worker fails during a recording, there is no way to recover the recording. This could happen due to a network connectivity issue or because a worker is scaled down, for example. -

- Learn more:  - Unsupported recovery workflow -
- 0.14.0+ -

- (Fixed in 0.15.3) - 		- Cannot delete IAM access key resource - - When you delete an AWS S3 storage bucket that had credential rotation enabled, Boundary cannot delete the associated IAM access key resource. -

- This issue is fixed in version 0.15.3. -

- Upgrade to the latest version of Boundary -

- Learn more:  - Create a storage bucket -
- 0.15.0 - - Permission grant string change - - The ability to add new grants via the id parameter has been removed. Grants now accept more than one ID per grant string or JSON entry using the ids parameter. This change was noted in the v0.13.1 Changelog, and goes into effect with this release. You must update any code or Terraform configuration that uses the id parameter. -

- Learn more:  - Add grants -
- 0.15.0 - - List result pagination - - All list endpoints now return the first 1,000 items instead of all items, if no parameters are provided. You can configure the number of items returned using the new controller configuration parameter max_page_size. The Admin UI, CLI, and API package automatically paginate results. -

- Learn more:  - API list pagination -
- 0.15.0 - - Storage bucket policy updates - - If you have session recording configured, you must update your IAM policy in AWS before you upgrade your worker to version 0.15.0 to ensure your session recordings continue to get uploaded to S3. The IAM policy now requires the DeleteObjects and ListBucket permissions. -

- Learn more:  - Create storage buckets -
- 0.15.0 -

- (Fixed in 0.15.1) - 		- Maximum number of connections allowed is incorrect - - A known issue causes Boundary to permit one less than the allowed number of connections that you configured for a given target. For example, if you configured the session connection limit for a target at 2, Boundary only permits 1 connection to the target. If the value is 1, Boundary does not allow any connections to the target. A value of -1 still means that connections to the target are unlimited. -

- This issue is fixed in version 0.15.1. -

- Upgrade to the latest version of Boundary -

- Learn more:  - Refer to the CLI docs for information about using targets create or targets update to configure a maximum number of connections. -

- Refer to the API docs for information about using Target service to configure a maximum number of connections. -
- 0.15.0 -

- (Fixed in 0.15.2) - 		- Go CVE-2024-24783, Go CVE-2024-24784, Go CVE-2024-24785, Go CVE-2024-24786, Go CVE-2023-45289, Go CVE-2023-45290 - - The version of Go that was used in Boundary release 0.15.0 contained security vulnerabilities. The vulnerabilities were fixed in Go version 1.21.8. Boundary was updated to use the new Go version in release 0.15.2, and the issue is resolved. -

- Learn more:  -

- CVE-2024-24783: Verify panics on certificates with an unknown public key algorithm in crypto/x509 -

- CVE-2024-24784: Comments in display names are incorrectly handled in net/mail -

- CVE-2024-24785: Errors returned from JSON marshaling may break template escaping in html/template -

- CVE-2024-24786: Infinite loop in JSON unmarshaling in google.golang.org/protobuf -

- CVE-2023-45289: Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http -

- CVE-2023-45290: Memory exhaustion in multipart form parsing in net/textproto and net/http -

- Upgrade to the latest version of Boundary -
- 0.15.0 -

- (Fixed in 0.15.3 and 2.0.2 Desktop) - 		- Boundary Desktop does not update - - The macOS Boundary Desktop client displays a prompt to update automatically, but it never actually updates. -

- This issue is fixed in Boundary version 0.15.3 and version 2.0.2 of the Desktop client. -

- Upgrade to the latest version of Boundary -
- 0.15.0 -

- (Fixed in 0.15.4) - 		- Go CVE-2023-45288 - - The version of Go that was used in Boundary release 0.15.0 contained security vulnerabilities. The vulnerabilities were fixed in Go version 1.21.9. Boundary was updated to use the new Go version in release 0.15.4, and the issue is resolved. -

- Learn more:  -

- CVE-2023-45288: HTTP/2 CONTINUATION flood in net/http -

- Upgrade to the latest version of Boundary -
- 0.15.0 -

- (Fixed in 0.15.5) - 		- Users cannot log in to Boundary Desktop - - A bug caused Boundary Desktop to incorrectly assume the controller was running an unsupported version. It would prevent users from being able to log in to the Desktop client. -

- Learn more:  -

- Boundary Desktop issue #4370 -

- This issue is fixed in Boundary version 0.15.5. -

- Upgrade to the latest version of Boundary -
- -## Feature deprecations and EOL - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EOLDescription
- kms worker method - - As noted in the v0.13.0 release notes, the kms worker method has been removed. Since version 0.13.0, you have had to opt in to use the deprecated method. Now it is no longer available and Boundary uses the new kms mechanism. -

- Learn more:  - KMS worker configuration -
- Default port value - - As noted in the v0.14.0 and v0.12.0 release notes, targets now require a default port value. Previously, any ports that you defined as part of a host address were ignored, but allowed as part of the target definition. Now, if you define a port on a host address it results in an error. As of this release, the restriction also affects existing addresses. Any existing addresses that contain a port cannot be used as part of a target's session authorization call. -

- Learn more:  - Targets -
- id field for grants - - As noted in the v0.13.1 Changelog, the ability to add new grants via the id parameter has been removed. Grants now accept more than one ID per grant string or JSON entry using the ids parameter. -

- Learn more:  - Add grants -
- grant-scope-id field for roles - - The grant-scope-id field is now deprecated in favor of multiple grant scope support. -

- Learn more: add-grant-scopes, remove-grant-scopes, and set-grant-scopes -
diff --git a/website/content/docs/release-notes/v0_16_0.mdx b/website/content/docs/release-notes/v0_16_0.mdx deleted file mode 100644 index 48f57a199..000000000 --- a/website/content/docs/release-notes/v0_16_0.mdx +++ /dev/null @@ -1,392 +0,0 @@ ---- -layout: docs -page_title: v0.16.0 release notes -description: >- - Learn more about the new features included in the Boundary 0.16.0 release. Understand any deprecations, changes, and known issues. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary 0.16.0 release notes - -**GA date:** April 30, 2024 - -@include 'release-notes/intro.mdx' - -## Important changes - - - - - - - - - - - - - - - - - - - - -
ChangeDescription
- Role creation - - In a future version Boundary will no longer automatically create roles when new scopes are created. This was implemented prior to multi-scope grants to ensure administrators and users had default permissions in new scopes. Since Boundary 0.15, initial roles created for new clusters provide these permissions by default to all scopes using multi-scope grants. -
- Docker image no longer contains curl - - As of version 0.16.3 and later, the curl binary is no longer included in the published Docker container image for Boundary. The image now includes wget, which you can alternatively use to check the health endpoint for a worker. If your workflow depends on having curl in the image, you can dynamically install it using apk. -

- Learn more:  Known issues and breaking changes -
- -## New features - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FeatureUpdateDescription
- Aliases - - GA - - A new resource was introduced in this release. Aliases let you associate a string with a Boundary target. You can then establish a session to the target by referencing its alias, instead of having to provide a target ID or target name and scope ID. -

- Learn more: Aliases. -
- MinIO support for session recording - - GA - - You can now configure external MinIO storage to store recorded sessions. MinIO support provides an on-premises storage option for users who do not use AWS. -

- Learn more: Session recording overview. -
- Admin UI enhanced search and filtering - - GA - - Enhanced search and filter support was added to the Boundary CLI and API through a new list pagination feature in release 0.15.0. This functionality has been extended to the Admin UI in release 0.16.0. -

- Learn more: List pagination. -
- Local storage state health - - GA - - Storage state values have been created to monitor the health of any local workers used for session recording. Boundary monitors the worker's available disk space and compares it to the value you configured for recording capacity. If the worker does not have adequate storage, it cannot be used for session recording. -

- Learn more: Local storage for session recording. -
- X-Correlation-ID HTTP header - - GA - - A new HTTP header was added to identify a transaction over a series of requests and responses. You can use the X-Correlation-ID header to correlate events between external systems and products. The initial release of the X-Correlation-ID header supports correlating events between Boundary and Vault. -

- Learn more: HTTP headers. -
- -## Known issues and breaking changes - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
VersionIssueDescription
- 0.13.0+ - - Rotation of AWS access and secret keys during a session results in stale recordings - - In Boundary version 0.13.0+, when you rotate a storage bucket's secrets, any new sessions use the new credentials. However, previously established sessions continue to use the old credentials. -

- As a best practice, administrators should rotate credentials in a phased manner, ensuring that all previously established sessions are completed before revoking the stale credentials. - Otherwise, you may end up with recordings that aren't stored in the remote storage bucket, and are unable to be played back. -
- 0.13.0+ - - Unsupported recovery workflow during worker failure - - If a worker fails during a recording, there is no way to recover the recording. This could happen due to a network connectivity issue or because a worker is scaled down, for example. -

- Learn more:  - Unsupported recovery workflow -
- 0.16.0 -

- (Fixed in 0.16.0) - 		- Users cannot log in to Boundary Desktop - - A bug caused Boundary Desktop to incorrectly assume the controller was running an unsupported version. It would prevent users from being able to log in to the Desktop client. -

- Learn more:  Boundary Desktop issue #4370 -

- This issue is fixed in Boundary version 0.16.0. -

- Upgrade to the latest version of Boundary -
- 0.16.0 -

- (Fixed in 0.16.1 for Community/Enterprise editions and 0.16.2 for HCP Boundary) - 		- Controller dead lock with database connections stuck in idle in transaction state - - If you configured a controller to have the maximum number of open connections and it was under enough load from worker requests, the controller could get stuck. Once the controller consumed all the database connections, it would leave them in an idle in transaction state. In extreme cases, this could cause Boundary clusters to become unresponsive. -

- The cause of this problem was due to a combination of issues. There was no request timeout for worker-to-controller GRPC requests. Also, the session repository attempted to use a separate database connection to retrieve a KMS wrapper after already starting a database transaction. -

- This issue is fixed in release 0.16.1 for the Community and Enterprise editions. It is fixed in release 0.16.2 for HCP Boundary. -

- Boundary now sets a max request duration for GRPC requests based on the cluster's listener configuration. KMS operations now occur outside of the transaction. -

- Upgrade to the latest version of Boundary -
- 0.16.0 -

- (Fixed in 0.16.2) - 		- TLS handshake error - - When you rotated credentials for a worker, sometimes the request succeeded on the controller, but the worker did not receive the response. Because the controller and worker used different sets of credentials, the worker was unable to connect to the controller and you received a TLS handshake error. -

- In release 0.16.2, we added a new NodeIDLoader interface. The worker uses the interface to check its key set and correct its stored credential set to match the controller, if necessary. This issue is now resolved. -

- Upgrade to the latest version of Boundary -
- 0.16.0 -

- (Fixed in 0.16.2) - 		- OIDC error codes - - In releases 0.16.0 and earlier, Boundary used internal error codes for OIDC errors. The internal error codes could cause confusion, since the codes were non-standard HTTP response codes. -

- In release 0.16.2, we updated the OIDC request handlers to return standard gRPC status codes for errors. The 4xx status codes are more descriptive of the error. -

- Upgrade to the latest version of Boundary -
- 0.16.3+ - - Docker image no longer contains curl - - As of version 0.16.3 and later, the curl binary is no longer included in the published Docker container image for Boundary. -

- The image now includes wget. You can use wget to check the health endpoint for workers. -

- Learn more:  Check the health endpoint using wget -

- If your workflow depends on having curl in the image, you can dynamically install it using apk. Refer to the following commands for examples of using apk to install curl: -

- <CONTAINER-ID> apk add curl -

- or -

- kubectl exec -ti <NAME> -- apk add curl -
- 0.16.0 -

- (Fixed in 0.16.3) - 		- Using an invalid alias results in a 401 message - - If you tried to connect to an invalid alias, Boundary returned a message with the 401 status code. The 401 status code could cause users to believe that they did not properly authenticate, rather than realizing the alias resource was invalid. -

- This issue is fixed in Boundary version 0.16.3. If you use an invalid alias, Boundary now properly returns a 404 status code, indicating that it could not find the alias resource. -

- Learn more:  Aliases -

- Upgrade to the latest version of Boundary -
- 0.16.0 -

(Fixed in 0.16.3) - 		- Session recording fails when you use Secure File Copy (SCP) - - If you tried to use SCP during a recorded session, the session recording details may shown the recording state as Failed, and you may not have been able to play back the session. -

- This issue occurs when a recorded session file is too large. It can happen when you use SCP to transfer large files during a recorded session, In Boundary version 0.16.3, we have increased the maximum size for recorded session files to 5 GB. This issue should happen less often now, but be careful when you use SCP during a recorded session, because it can result in large recorded session files. -

- Learn more:  Session recording storage considerations -

- Upgrade to the latest version of Boundary -
- 0.8.0 - 0.16.3 -

- (Fixed in Boundary Community Edition and Boundary Enterprise 0.16.4) - 		- Boundary controller incorrectly handles HTTP requests and stops prematurely (HCSEC-2024-28) - - Boundary Community Edition and Boundary Enterprise incorrectly handle HTTP requests while the Boundary controller is starting up, which may cause the controller to stop prematurely. Boundary is only vulnerable to this flaw during the controller's initialization, which usually occurs in milliseconds during Boundary's startup process. -

- This vulnerability, HCSEC-2024-28, is fixed in Boundary Community Edition and Boundary Enterprise versions 0.16.4, 0.17.3, and 0.18.2. -

- Learn more: HCSEC-2024-28: Boundary controller incorrectly handles http requests on initialization which may lead to a denial of service -

- Upgrade to the latest version of Boundary -
- -## Feature deprecations and EOL - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EOLDescription
- boundary daemon command - - The boundary daemon command has been deprecated in favor of the new boundary cache command. The functionality remains the same. -

- Learn more:  - boundary cache -
- include_terminated field removed - - The include_terminated field from the list sessions command has been deprecated and will be removed in an upcoming release. Boundary will return terminated sessions in all list session responses, unless they are filtered out using the filter field. For more information, refer to the filter resource documentation. -

- Learn more:  - sessions list command options and Filter resource listings -
- grant_scope_id field removed from roles - - The grant_scope_id field, which was deprecated in release 0.15.0, has been removed from roles. You can now manage roles using the add-grant-scopes, remove-grant-scopes, and set-grant-scopes commands. -

- Learn more: add-grant-scopes, remove-grant-scopes, and set-grant-scopes -
\ No newline at end of file diff --git a/website/content/docs/release-notes/v0_17_0.mdx b/website/content/docs/release-notes/v0_17_0.mdx deleted file mode 100644 index 91cca264e..000000000 --- a/website/content/docs/release-notes/v0_17_0.mdx +++ /dev/null @@ -1,337 +0,0 @@ ---- -layout: docs -page_title: v0.17.0 release notes -description: >- - Learn more about the new features included in the Boundary 0.17.0 release. Understand any deprecations, changes, and known issues. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary 0.17.0 release notes - -**GA date:** July 31, 2024 - -@include 'release-notes/intro.mdx' - -## Important changes - - - - - - - - - - - - - - - - - - - - -
ChangeDescription
- Role creation - - In a future version Boundary will no longer automatically create roles when new scopes are created. This was implemented prior to multi-scope grants to ensure administrators and users had default permissions in new scopes. Since Boundary 0.15, initial roles created for new clusters provide these permissions by default to all scopes using multi-scope grants. -
- Docker image no longer contains curl - - As of version 0.17.1 and later, the curl binary is no longer included in the published Docker container image for Boundary. The image now includes wget, which you can alternatively use to check the health endpoint for a worker. If your workflow depends on having curl in the image, you can dynamically install it using apk. -

- Learn more:  Known issues and breaking changes -
- -## New features - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FeatureUpdateDescription
- Centralized tag management for workers - - GA - - Prior to this version, if you wanted to edit or update worker tags, you had to do it using the worker configuration file, the CLI, or the API. Now, you can edit worker tags directly in the Boundary UI. -

- Learn more: Worker tags. -
- Multi-scope roles and inheritance - - GA - - You can now assign a single role to multiple scopes, making it easier to grant permissions to users who must access resources across multiple scopes. You can also configure children scopes to inherit roles. -

- Learn more: Permissions in Boundary. -
- Improved worker failure handling - - GA - - When you attempt to connect to a target, Boundary randomly selects a worker that has the matching tags to proxy the connection. Before release 0.17.0, unhealthy workers that had issues related to the external storage provider were eligible to proxy connections. The connections would fail, and users had to restart the connection until Boundary selected a healthy worker.

- In this release, Boundary removes workers from the pool of available workers if they have issues with the external storage provider for improved worker failure handling. -

- Learn more: Configure workers for session recording. -
- S3-compliant storage options for session recording - - GA - - As of Boundary 0.16.0, the MinIO plugin made it possible to use MinIO storage as a storage option for session recording. Starting in this release, you can use the MinIO plugin to configure storage using other S3-compliant storage providers. -

- Learn more: Configure S3-compliant storage for session recording. -
- -## Known issues and breaking changes - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
VersionIssueDescription
- 0.13.0+ - - Rotation of AWS access and secret keys during a session results in stale recordings - - In Boundary version 0.13.0+, when you rotate a storage bucket's secrets, any new sessions use the new credentials. However, previously established sessions continue to use the old credentials. -

- As a best practice, administrators should rotate credentials in a phased manner, ensuring that all previously established sessions are completed before revoking the stale credentials. - Otherwise, you may end up with recordings that aren't stored in the remote storage bucket, and are unable to be played back. -
- 0.13.0+ - - Unsupported recovery workflow during worker failure - - If a worker fails during a recording, there is no way to recover the recording. This could happen due to a network connectivity issue or because a worker is scaled down, for example. -

- Learn more:  - Unsupported recovery workflow -
- 0.17.1+ - - Docker image no longer contains curl - - As of version 0.17.1 and later, the curl binary is no longer included in the published Docker container image for Boundary. -

- The image now includes wget. You can use wget to check the health endpoint for workers. -

- Learn more:  Check the health endpoint using wget -

- If your workflow depends on having curl in the image, you can dynamically install it using apk. Refer to the following commands for examples of using apk to install curl: -

- <CONTAINER-ID> apk add curl -

- or -

- kubectl exec -ti <NAME> -- apk add curl -
- 0.17.0 -

- (Fixed in 0.17.1) - 		- Using an invalid alias results in a 401 message - - If you tried to connect to an invalid alias, Boundary returned a message with the 401 status code. The 401 status code could cause users to believe that they did not properly authenticate, rather than realizing the alias resource was invalid. -

- This issue is fixed in Boundary version 0.17.1. If you use an invalid alias, Boundary now properly returns a 404 status code, indicating that it could not find the alias resource. -

- Learn more:  Aliases -

- Upgrade to the latest version of Boundary -
- 0.17.0 -

- (Fixed in 0.17.1) - 		- Session recording fails when you use Secure File Copy (SCP) - - If you tried to use SCP during a recorded session, the session recording details may shown the recording state as Failed, and you may not have been able to play back the session. -

- This issue occurs when a recorded session file is too large. It can happen when you use SCP to transfer large files during a recorded session, In Boundary version 0.17.1, we have increased the maximum size for recorded session files to 5 GB. This issue should happen less often now, but be careful when you use SCP during a recorded session, because it can result in large recorded session files. -

- Learn more:  Session recording storage considerations -

- Upgrade to the latest version of Boundary -
- 0.8.0 - 0.17.2 -

- (Fixed in Boundary Community Edition and Boundary Enterprise 0.17.3) - 		- Boundary controller incorrectly handles HTTP requests and stops prematurely (HCSEC-2024-28) - - Boundary Community Edition and Boundary Enterprise incorrectly handle HTTP requests while the Boundary controller is starting up, which may cause the controller to stop prematurely. Boundary is only vulnerable to this flaw during the controller's initialization, which usually occurs in milliseconds during Boundary's startup process. -

- This vulnerability, HCSEC-2024-28, is fixed in Boundary Community Edition and Boundary Enterprise versions 0.16.4, 0.17.3, and 0.18.2. -

- Learn more: HCSEC-2024-28: Boundary controller incorrectly handles http requests on initialization which may lead to a denial of service -

- Upgrade to the latest version of Boundary -
- 0.16.0 - 0.17.3 -

- (Fixed in Boundary Enterprise 0.17.4) - 		- Performance is impacted by query - - A query that was added with the aliases feature performed a full table scan of the target table. The scan could negatively impact performance. -

- The scan was replaced with a more efficient method for scanning targets. This issue has been resolved. -

- Upgrade to the latest version of Boundary -

-
- 0.16.0 - 0.17.3 -

- (Fixed in Boundary Enterprise 0.17.4) - 		- Performance is impacted by database transactions - - Database transactions were not using the correct reader and writer functions or context. This issue could cause delays and negatively impact system performance. -

- A number of minor fixes were added to improve the way Boundary performs database transactions. This issue has been resolved. -

- Upgrade to the latest version of Boundary -

-
- 0.17.0 - 0.17.3 -

- (Fixed in Boundary Enterprise 0.17.4) - 		- GO-2024-3333 -

- CVE-2024-45338 -

- CVE-2024-45337 - 		- The Go dependencies that were used in Boundary release 0.17.x contained security vulnerabilities. Boundary Enterprise 0.17.4 was updated to use new versions of the dependencies. This issue is resolved. -

- Learn more: -

- GO-2024-3333: An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service. -

- CVE-2024-45338: Non-linear parsing of case-insensitive content in golang.org/x/net/html -

- CVE-2024-45337: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto -

- Upgrade to the latest version of Boundary -

-
- 0.17.0 - 0.17.4 -

- (Fixed in Boundary Enterprise and HCP Boundary 0.17.5) - 		- Canceled SSH connections cause performance issues - - When an SSH connection was canceled, it could cause a spike in CPU usage. In some cases, egress workers become unresponsive, leading to performance issues. The issue occurred when the connection context was canceled at specific times in the process, creating a busy loop that prevented workers from completing tasks. -

- This issue is resolved in Boundary Enterprise and HCP Boundary version 0.17.5. Workers no longer end up in a busy loop when SSH connections are canceled. -

- Upgrade to the latest version of Boundary -
\ No newline at end of file diff --git a/website/content/docs/release-notes/v0_18_0.mdx b/website/content/docs/release-notes/v0_18_0.mdx deleted file mode 100644 index d36605724..000000000 --- a/website/content/docs/release-notes/v0_18_0.mdx +++ /dev/null @@ -1,353 +0,0 @@ ---- -layout: docs -page_title: v0.18.0 release notes -description: >- - Learn more about the new features included in the Boundary 0.18.0 release. Understand any deprecations, changes, and known issues. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary 0.18.0 release notes - -**GA date:** October 15, 2024 - -@include 'release-notes/intro.mdx' - -## Important changes - - - - - - - - - - - - - - - - - - - - - - - - - - -
ChangeDescription
- Role creation - - In a future version Boundary will no longer automatically create roles when new scopes are created. This was implemented prior to multi-scope grants to ensure administrators and users had default permissions in new scopes. Since Boundary 0.15, initial roles created for new clusters provide these permissions by default to all scopes using multi-scope grants. -
- Docker image no longer contains curl - - As of version 0.17.1 and later, the curl binary is no longer included in the published Docker container image for Boundary. The image now includes wget, which you can alternatively use to check the health endpoint for a worker. If your workflow depends on having curl in the image, you can dynamically install it using apk. -

- Learn more:  Known issues and breaking changes -
- Go version 1.23 TLS handshake behavior changes - - Boundary version 0.18.x uses Go version 1.23, which introduced a new TLS handshake behavior. Some VPN providers struggle with the TLS handshake being sent over 2 frames instead of 1, which can lead to Boundary version 0.18.x controllers, workers, or clients being unable to establish connections. As a workaround, you can revert back to the previous TLS handshake behavior. -

- Learn more:  Known issues and breaking changes -
- -## New features - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FeatureUpdateDescription
- Transparent sessions - - BETA - - Transparent sessions allows users to eliminate steps in their current workflows using Boundary’s Client Agent, a component that operates in the background to intercept network traffic and automatically route this traffic through a session if the user is authenticated and authorized. -

- Platform teams and access management teams that administer Boundary can now build much faster, simpler secure remote access workflows that feel more intuitive and invisible to their developer customers. -

- Learn more: Transparent sessions and Client Agent. -
- Backblaze B2 support for storage buckets - - GA - - Backblaze B2 is now supported as a storage provider for session recording storage buckets. -

- Learn more: Configure an S3-compliant storage provider. -
- AssumeRole support for AWS dynamic host catalogs - - GA - - AWS host plugins now support AssumeRole. AssumeRole returns a set of temporary security credentials that you can use to access AWS resources. -

- Learn more: AWS dynamic host catalogs. -
- -## Known issues and breaking changes - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
VersionIssueDescription
- 0.13.0+ - - Rotation of AWS access and secret keys during a session results in stale recordings - - In Boundary version 0.13.0+, when you rotate a storage bucket's secrets, any new sessions use the new credentials. However, previously established sessions continue to use the old credentials. -

- As a best practice, administrators should rotate credentials in a phased manner, ensuring that all previously established sessions are completed before revoking the stale credentials. - Otherwise, you may end up with recordings that aren't stored in the remote storage bucket, and are unable to be played back. -
- 0.13.0+ - - Unsupported recovery workflow during worker failure - - If a worker fails during a recording, there is no way to recover the recording. This could happen due to a network connectivity issue or because a worker is scaled down, for example. -

- Learn more:  - Unsupported recovery workflow -
- 0.17.1+ - - Docker image no longer contains curl - - As of version 0.17.1 and later, the curl binary is no longer included in the published Docker container image for Boundary. -

- The image now includes wget. You can use wget to check the health endpoint for workers. -

- Learn more:  Check the health endpoint using wget -

- If your workflow depends on having curl in the image, you can dynamically install it using apk. Refer to the following commands for examples of using apk to install curl: -

- <CONTAINER-ID> apk add curl -

- or -

- kubectl exec -ti <NAME> -- apk add curl -
- 0.18.0 -

- (Fixed in 0.18.1) - 		- Users are incorrectly removed from managed groups - - If your organization has over 10,000 managed groups, Boundary may incorrectly remove users from the managed group memberships. -

- In version 0.18.0 and earlier, there was a maximum number of managed groups supported for an auth method. If you had over 10,000 managed groups, Boundary may have incorrectly removed a user from a group during authentication. This issue is fixed in version 0.18.1. There is no longer a maximum number of managed groups. -

- Learn more:  Managed groups -

- Upgrade to the latest version of Boundary -
- 0.18.0 -

- (Fixed in 0.18.2) - 		- Session recordings fail with an error - - When large numbers of sessions were created around the same time using the AssumeRole API, the AWS STS (Security Token Service) credentials sometimes failed to refresh and session recordings would fail. The failure occurred due to throttling from AWS. -

- Version 0.18.2 adds a cache for Amazon S3 clients to store temporary credentials and prevent AWS resources from being overwhelmed. This issue is now resolved. -

- Learn more:  Configure Amazon S3 as a storage provider -

- Upgrade to the latest version of Boundary -
- 0.8.0 - 0.18.1 -

- (Fixed in Boundary Community Edition and Boundary Enterprise 0.18.2) - 		- Boundary controller incorrectly handles HTTP requests and stops prematurely (HCSEC-2024-28) - - Boundary Community Edition and Boundary Enterprise incorrectly handle HTTP requests while the Boundary controller is starting up, which may cause the controller to stop prematurely. Boundary is only vulnerable to this flaw during the controller's initialization, which usually occurs in milliseconds during Boundary's startup process. -

- This vulnerability, HCSEC-2024-28, is fixed in Boundary Community Edition and Boundary Enterprise versions 0.16.4, 0.17.3, and 0.18.2. -

- Learn more: HCSEC-2024-28: Boundary controller incorrectly handles http requests on initialization which may lead to a denial of service -

- Upgrade to the latest version of Boundary -
- 0.18.x - - Boundary version 0.18.x CLI is unable to establish connections using the boundary connect command - - Boundary version 0.18.x uses Go version 1.23, which introduced a new TLS handshake behavior. Some VPN providers struggle with the TLS handshake being sent over 2 frames instead of 1, which can lead to Boundary version 0.18.x controllers, workers, or clients being unable to establish connections. As a workaround, you can revert back to the previous TLS handshake behavior. -

- To revert back to the previous TLS handshake behavior, add the tlskyber=0 parameters to the GODEBUG environment variable before the boundary connect command. For example: -

- GODEBUG=tlskyber=0 boundary connect ssh -target-id <ID> -

- Learn more: Go issue #70047 and Go 1.23 Release Notes -

-
- 0.16.0 - 0.18.2 -

- (Fixed in Boundary Enterprise 0.18.3) - 		- Performance is impacted by query - - A query that was added with the aliases feature performed a full table scan of the target table. The scan could negatively impact performance. -

- The scan was replaced with a more efficient method for scanning targets. This issue has been resolved. -

- Upgrade to the latest version of Boundary -

-
- 0.16.0 - 0.18.2 -

- (Fixed in Boundary Enterprise 0.18.3) - 		- Performance is impacted by database transactions - - Database transactions were not using the correct reader and writer functions or context. This issue could cause delays and negatively impact system performance. -

- A number of minor fixes were added to improve the way Boundary performs database transactions. This issue has been resolved. -

- Upgrade to the latest version of Boundary -

-
- 0.17.0 - 0.18.2 -

- (Fixed in Boundary Enterprise 0.18.3) - 		- GO-2024-3333 -

- CVE-2024-45338 -

- CVE-2024-45337 - 		- The Go dependencies that were used in Boundary release 0.18.x contained security vulnerabilities. Boundary Enterprise 0.18.3 was updated to use new versions of the dependencies. This issue is resolved. -

- Learn more: -

- GO-2024-3333: An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service. -

- CVE-2024-45338: Non-linear parsing of case-insensitive content in golang.org/x/net/html -

- CVE-2024-45337: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto -

- Upgrade to the latest version of Boundary -

-
- 0.17.0 - 0.18.3 -

- (Fixed in Boundary Enterprise and HCP Boundary 0.18.4) - 		- Canceled SSH connections cause performance issues - - When an SSH connection was canceled, it could cause a spike in CPU usage. In some cases, egress workers become unresponsive, leading to performance issues. The issue occurred when the connection context was canceled at specific times in the process, creating a busy loop that prevented workers from completing tasks. -

- This issue is resolved in Boundary Enterprise and HCP Boundary version 0.18.4. Workers no longer end up in a busy loop when SSH connections are canceled. -

- Upgrade to the latest version of Boundary -
\ No newline at end of file diff --git a/website/content/docs/release-notes/v0_19_0.mdx b/website/content/docs/release-notes/v0_19_0.mdx deleted file mode 100644 index aa8a8ed0b..000000000 --- a/website/content/docs/release-notes/v0_19_0.mdx +++ /dev/null @@ -1,460 +0,0 @@ ---- -layout: docs -page_title: v0.19.0 release notes -description: >- - Learn more about the new features included in the Boundary 0.19.0 release. Understand any deprecations, changes, and known issues. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary 0.19.0 release notes - -**GA date:** February 10, 2025 - -@include 'release-notes/intro.mdx' - -## Important changes - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ChangeDescription
- Role creation - - In a future version Boundary will no longer automatically create roles when new scopes are created. This was implemented prior to multi-scope grants to ensure administrators and users had default permissions in new scopes. Since Boundary 0.15, initial roles created for new clusters provide these permissions by default to all scopes using multi-scope grants. -
- Docker image no longer contains curl - - As of version 0.17.1 and later, the curl binary is no longer included in the published Docker container image for Boundary. The image now includes wget, which you can alternatively use to check the health endpoint for a worker. If your workflow depends on having curl in the image, you can dynamically install it using apk. -

- Learn more:  Known issues and breaking changes -
- Go version 1.23 TLS handshake behavior changes - - Boundary version 0.18.x uses Go version 1.23, which introduced a new TLS handshake behavior. Some VPN providers struggle with the TLS handshake being sent over 2 frames instead of 1, which can lead to Boundary version 0.18.x and later controllers, workers, or clients being unable to establish connections. As a workaround, you can revert back to the previous TLS handshake behavior. -

- Learn more:  Known issues and breaking changes -
- Error when sending requests to aliases using HCP Boundary - - A known issue that was caused by the way default grants were previously configured in HCP Boundary could cause you to receive 500 errors when you attempted to list resolvable aliases. The issue has been resolved. Any clusters that you created on or after April 26, 2025 should not have the issue. -

- You can add grants to resolve the error for any older clusters that exhibit this behavior. -

- Learn more:  Known issues and breaking changes -
- Boundary client version number realignment - - Previously, the Boundary Client Agent and installer used a numbering scheme that was inconsistent with Boundary's release numbers. This inconsistency could make it difficult to understand version support and compatibility. -

- On May 27, 2025 new versions of the Boundary Client Agent and installer were released with a new numbering scheme that more closely follows Boundary's release numbers. Those versions were released as 0.19.5 to match the major Boundary version 0.19.x. Going forward, the Client Agent and installer will use the same major number as the current Boundary release. Any patches or updates will be reflected in the minor number. -

- Learn more about control plane and client compatibility:  Boundary Enterprise supported versions policy -
- Redundant grant scopes are no longer permitted - - You may have redundant grant scopes if you applied a grant to a scope and the scope also inherited the grant from the this, children, or descendants options. As of Boundary version 0.19.3, redundant grant scopes are no longer permitted. -

- When you upgrade a Boundary Enterprise or Community edition cluster to version 0.19.3 or later, the migration will fail with a message if the database contains any redundant grant scopes. The migration tool provides a command that automatically removes any redundant grant scopes so that you can proceed with the upgrade. -

- For HCP Boundary users, the redundant grant scopes are automatically removed as part of the migration process. -

- Learn more about removing redundant grant scopes and upgrading to version 0.19.3 or later:  Known issues and breaking changes -
- -## New features - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FeatureUpdateDescription
- Dynamic host catalogs for GCP - - GA - - Boundary now supports dynamic host catalogs for GCP. -

- When you configure dynamic host catalogs, Boundary securely queries infrastructure providers at runtime to discover and configure new services. You can define rules for whether you want Boundary to automatically add any discovered hosts as members of the host set. -

- Learn more: Host discovery and GCP dynamic hosts. -
- Worker filter generator - - GA - - A new filter generator was added to the Admin Console UI, allowing you to more easily create worker filters for targets, credential stores, and storage buckets. -

- Learn more: Worker tags. -
- Vault brokered credentials format change - - GA - - Previously, when you brokered credentials from a Vault credential store, the credentials displayed in raw JSON and could contain special characters. It was difficult to consume the credentials in this format. Credentials are now displayed in a format that is easier to cut and paste. -

- Learn more: Create a Vault credential store. -
- Azure Virtual Machine Scale Set support for dynamic host catalogs - - GA in version 0.19.1 - - The Azure plugin now supports Azure Virtual Machine Scale Sets in both Flexible and Uniform orchestration modes for dynamic host catalogs. It automatically discovers any individual virtual machine instances that are part of the scale sets and adds them as hosts. -

- Learn more: Azure dynamic host catalogs. -
- Transparent sessions - - GA in version 0.19.2 - - The transparent sessions feature is now generally available to HCP Boundary and Boundary Enterprise users. -

- Transparent sessions allows users to eliminate steps in their current workflows using Boundary’s Client Agent, a component that operates in the background to intercept network traffic and automatically route this traffic through a session if the user is authenticated and authorized. -

- Platform teams and access management teams that administer Boundary can now build much faster, simpler secure remote access workflows that feel more intuitive and invisible to their developer customers. -

- Learn more: Transparent sessions and Client Agent. -
- -## Known issues and breaking changes - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
VersionIssueDescription
- 0.13.0+ - - Rotation of AWS access and secret keys during a session results in stale recordings - - In Boundary version 0.13.0+, when you rotate a storage bucket's secrets, any new sessions use the new credentials. However, previously established sessions continue to use the old credentials. -

- As a best practice, administrators should rotate credentials in a phased manner, ensuring that all previously established sessions are completed before revoking the stale credentials. - Otherwise, you may end up with recordings that aren't stored in the remote storage bucket, and are unable to be played back. -
- 0.13.0+ - - Unsupported recovery workflow during worker failure - - If a worker fails during a recording, there is no way to recover the recording. This could happen due to a network connectivity issue or because a worker is scaled down, for example. -

- Learn more:  - Unsupported recovery workflow -
- 0.17.1+ - - Docker image no longer contains curl - - As of version 0.17.1 and later, the curl binary is no longer included in the published Docker container image for Boundary. -

- The image now includes wget. You can use wget to check the health endpoint for workers. -

- Learn more:  Check the health endpoint using wget -

- If your workflow depends on having curl in the image, you can dynamically install it using apk. Refer to the following commands for examples of using apk to install curl: -

- <CONTAINER-ID> apk add curl -

- or -

- kubectl exec -ti <NAME> -- apk add curl -
- 0.18.x+ - - Boundary version 0.18.x and later CLI is unable to establish connections using the boundary connect command - - Boundary version 0.18.x uses Go version 1.23, which introduced a new TLS handshake behavior. Some VPN providers struggle with the TLS handshake being sent over 2 frames instead of 1, which can lead to Boundary version 0.18.x and later controllers, workers, or clients being unable to establish connections. As a workaround, you can revert back to the previous TLS handshake behavior. -

- To revert back to the previous TLS handshake behavior, add the tlskyber=0 parameters to the GODEBUG environment variable before the boundary connect command. For example: -

- GODEBUG=tlskyber=0 boundary connect ssh -target-id <ID> -

- Learn more: Go issue #70047 and Go 1.23 Release Notes -

-
- 0.19.0 -

- (Fixed in 0.19.1) - 		- Soft-deleted users are not properly authenticated - - Version 0.19.0 introduced a soft delete for when a cached user's auth tokens are deleted, but there is a valid refresh token that is less than 20 days old. Boundary considers those users as deleted. But it keeps their user information in the cache so that it can restore the information, if they log in again. -

- However, soft-deleted users were not being properly restored when they logged back in and it affected search capabilities. -

- This issue is resolved in version 0.19.1. Soft-deleted users are now properly restored as active when they log in again if the refresh token is less than 20 days old. -

- Upgrade to the latest version of Boundary -
- 0.17.0 - 0.19.0 -

- (Fixed in 0.19.2) - 		- Canceled SSH connections cause performance issues - - When an SSH connection was canceled, it could cause a spike in CPU usage. In some cases, egress workers become unresponsive, leading to performance issues. The issue occurred when the connection context was canceled at specific times in the process, creating a busy loop that prevented workers from completing tasks. -

- This issue is resolved in version 0.19.2. Workers no longer enter a busy loop when SSH connections are canceled. -

- Upgrade to the latest version of Boundary -
- 0.19.0 -

- (Fixed in 0.19.2) - 		- Unable to change key type for Vault SSH certificate credential library using the UI - - When you attempted to change the key type for a Vault SSH certificate credential library using the UI, the update failed. -

- This issue is resolved in version 0.19.2. You can now change the key type using the UI. -

- Upgrade to the latest version of Boundary -
- 0.19.0 -

- (Fixed in 0.19.2) - 		- CVE-2025-22873 - - The version of Go that was used in Boundary release 0.19.x contained a security vulnerability. Although this vulnerability did not affect Boundary, release 0.19.2 was updated to use a new version of Go. -

- Learn more: -

- CVE-2025-22873 -

- Upgrade to the latest version of Boundary -
- 0.19.0 -

- (Fixed in 0.19.2) - 		- 500 error when attempting to list resolvable aliases - - In HCP Boundary, you may receive a 500 error when you attempt to list resolvable aliases. This is a known issue that is caused by the way default grants were previously configured in HCP Boundary. The issue has been resolved, and any clusters that were created on or after April 26, 2025 should not have the issue. -

- For any clusters created before April 26, 2025, you can add grants to resolve the error: -
    -
  1. Create a role in the global scope and assign it to the u_auth user.
    2. -
  2. Configure the role to apply to all descendants in the global scope.
  3. Assign the following grants to the role: -

    - ids={{.User.Id}};type=user;actions=list-resolvable-aliases
    - ids=*;type=target;actions=list,read -
- Learn more: - -
- 0.18.0 - 0.19.0 -

- (Fixed in Boundary installer version 0.19.5) - 		- Windows shortcuts are mandatory - - Previously, the Boundary installer for Windows always required you to install Desktop and Start menu shortcuts. This issue has been resolved, and you can now choose whether to install the shortcuts. -

- Learn more: Transparent sessions -

- Upgrade to the latest version of Boundary -
- 0.15.0 - 0.19.2 -

- (Fixed in Boundary version 0.19.3) - 		- Redundant grant scopes cause performance issues - - You may have redundant grant scopes if you applied a grant to a scope and the scope also inherited the grant from the this, children, or descendants options. Redundant grant scopes could cause performance issues. As of Boundary version 0.19.3, redundant grant scopes are no longer permitted. -

- When you run the boundary database migrate command to upgrade a Boundary Enterprise or Community edition cluster to version 0.19.3 or later, the migration will fail with a message if the database contains any redundant grant scopes. The migration tool provides the following command to automatically repair the grant scopes: -

- boundary database migrate -repair=oss:97001 -

- Run the command to remove any redundant grant scopes from roles. Any individually granted scopes that are already covered by descendants or children grants are considered invalid and removed. When the migration is complete, the migration tool produces a message that details any changes. -

- HCP Boundary automatically removes the redudant grant scopes as part of the upgrade process. No further action is required. -

- Learn more: - - Upgrade to the latest version of Boundary -
- Client Agent 0.1.4 - 0.19.5 -

- (Fixed in Client Agent version 0.19.6) - 		- Transparent session connection and DNS resolution issues - - Two known issues that affected transparent sessions were resolved with the release of Client Agent version 0.19.6: -
    -
  • If you established an SSH transparent session and then canceled the connection, you may have had trouble reconnecting.
    • -
  • If you switched network interfaces between Wi-Fi and Ethernet while the Client Agent was running, you may have experienced connectivity issues with some applications.
    • -
- These connection issues have been resolved in Client Agent version 0.19.6, install the new version to ensure that you do not experience them. -

- Learn more: Transparent sessions -

- Upgrade to the latest version of the Boundary clients -
diff --git a/website/content/docs/release-notes/v0_1_0.mdx b/website/content/docs/release-notes/v0_1_0.mdx deleted file mode 100644 index 90c4022e1..000000000 --- a/website/content/docs/release-notes/v0_1_0.mdx +++ /dev/null @@ -1,28 +0,0 @@ ---- -layout: docs -page_title: v0.1.0 release notes -description: >- - Learn more about the features included in the Boundary 0.1.0 release. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary v0.1.0 - -v0.1.0 is the first release of Boundary. As a result there are no changes, improvements, or bugfixes from past versions. To learn about what Boundary consists of, we highly recommend you start at the [Getting Started Page](/boundary/docs/getting-started). - -## Boundary v0.1.0 highlights - -In this initial release, Boundary provides: - -- Password-based authentication -- Authenticated and authorized [TCP-based sessions](/boundary/docs/common-workflows/manage-sessions). -- Identity and access management providing [role-based controls](/boundary/docs/common-workflows/manage-roles) for principals. -- A user interface for administration of Boundary resources. -- A [Terraform provider](https://github.com/hashicorp/terraform-provider-boundary) for managing Boundary resources. -- A fully instrumented command line interface for managing Boundary and for establishing and managing sessions. -- A fully instrumented [Boundary golang SDK](/boundary/docs/api-clients/go-sdk). -- A log of Boundary sessions exposed through Boundary's administrator UI and postgres database. diff --git a/website/content/docs/release-notes/v0_20_0.mdx b/website/content/docs/release-notes/v0_20_0.mdx deleted file mode 100644 index 6efa366c3..000000000 --- a/website/content/docs/release-notes/v0_20_0.mdx +++ /dev/null @@ -1,217 +0,0 @@ ---- -layout: docs -page_title: v0.20.0 release notes -description: >- - Learn more about the new features included in the Boundary 0.20.0 release. Understand any deprecations, changes, and known issues. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary 0.20.0 release notes - -**GA date:** September 25, 2025 - -@include 'release-notes/intro.mdx' - -## Important changes - - - - - - - - - - - - - - - - - - - - - - - - - - -
ChangeDescription
- Error when sending requests to aliases using HCP Boundary - - A known issue that was caused by the way default grants were previously configured in HCP Boundary could cause you to receive 500 errors when you attempted to list resolvable aliases. The issue has been resolved. Any clusters that you created on or after April 26, 2025 should not have the issue. -

- You can add grants to resolve the error for any older clusters that exhibit this behavior. -

- Learn more:  Known issues and breaking changes -
- Boundary client version number realignment - - Previously, the Boundary Client Agent and installer used a numbering scheme that was inconsistent with Boundary's release numbers. This inconsistency could make it difficult to understand version support and compatibility. -

- On May 27, 2025 new versions of the Boundary Client Agent and installer were released with a new numbering scheme that more closely follows Boundary's release numbers. Those versions were released as 0.19.5 to match the major Boundary version 0.19.x. Going forward, the Client Agent and installer will use the same major number as the current Boundary release. Any patches or updates will be reflected in the minor number. -

- Learn more about control plane and client compatibility:  Boundary Enterprise supported versions policy -
- Redundant grant scopes are no longer permitted - - You may have redundant grant scopes if you applied a grant to a scope and the scope also inherited the grant from the this, children, or descendants options. As of Boundary version 0.19.3, redundant grant scopes are no longer permitted. -

- When you upgrade a Boundary Enterprise or Community edition cluster to version 0.19.3 or later, the migration will fail with a message if the database contains any redundant grant scopes. The migration tool provides a command that automatically removes any redundant grant scopes so that you can proceed with the upgrade. -

- For HCP Boundary users, the redundant grant scopes are automatically removed as part of the migration process. -

- Learn more about removing redundant grant scopes and upgrading to version 0.19.3 or later:  Known issues and breaking changes -
- -## New features - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FeatureUpdateDescription
- RDP targets - - GA - - Boundary now supports a new RDP target type. RDP targets let you use injected credentials to authenticate an RDP session between the client and end host in Windows environments that use Active Directory authentication. RDP targets use the new username password domain credential type. -

- Learn more: Target types and targets create command. -
- Username password domain credentials - - GA - - There is a new username password domain credential type for Windows environments that use Active Directory authentication. You can use username password domain credentials for credential injection when you connect to an RDP target. -

- Learn more: Credential management, Credentials in Boundary, and credentials create command. -
- RDP credential injection - - BETA - - Boundary now supports RDP credential injection as a beta feature. When users connect to RDP targets, Boundary can automatically inject credentials into the RDP session on behalf of the user. -

The initial beta release supports static credentials from Boundary's built-in static credential store or Vault's KV store. Refer to the documentation for known limitations, configuration requirements, and Windows compatibility. -

- Learn more: RDP credential injection compatibility. -
- -## Known issues and breaking changes - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
VersionIssueDescription
- 0.13.0+ - - Rotation of AWS access and secret keys during a session results in stale recordings - - In Boundary version 0.13.0+, when you rotate a storage bucket's secrets, any new sessions use the new credentials. However, previously established sessions continue to use the old credentials. -

- As a best practice, administrators should rotate credentials in a phased manner, ensuring that all previously established sessions are completed before revoking the stale credentials. - Otherwise, you may end up with recordings that aren't stored in the remote storage bucket, and are unable to be played back. -
- 0.13.0+ - - Unsupported recovery workflow during worker failure - - If a worker fails during a recording, there is no way to recover the recording. This could happen due to a network connectivity issue or because a worker is scaled down, for example. -

- Learn more:  - Unsupported recovery workflow -
- 0.17.1+ - - Docker image no longer contains curl - - As of version 0.17.1 and later, the curl binary is no longer included in the published Docker container image for Boundary. -

- The image now includes wget. You can use wget to check the health endpoint for workers. -

- Learn more:  Check the health endpoint using wget -

- If your workflow depends on having curl in the image, you can dynamically install it using apk. Refer to the following commands for examples of using apk to install curl: -

- <CONTAINER-ID> apk add curl -

- or -

- kubectl exec -ti <NAME> -- apk add curl -
- 0.18.x+ - - Boundary version 0.18.x and later CLI is unable to establish connections using the boundary connect command - - Boundary version 0.18.x uses Go version 1.23, which introduced a new TLS handshake behavior. Some VPN providers struggle with the TLS handshake being sent over 2 frames instead of 1, which can lead to Boundary version 0.18.x and later controllers, workers, or clients being unable to establish connections. As a workaround, you can revert back to the previous TLS handshake behavior. -

- To revert back to the previous TLS handshake behavior, add the tlskyber=0 parameters to the GODEBUG environment variable before the boundary connect command. For example: -

- GODEBUG=tlskyber=0 boundary connect ssh -target-id <ID> -

- Learn more: Go issue #70047 and Go 1.23 Release Notes -

-
diff --git a/website/content/docs/release-notes/v0_2_0.mdx b/website/content/docs/release-notes/v0_2_0.mdx deleted file mode 100644 index c944ed923..000000000 --- a/website/content/docs/release-notes/v0_2_0.mdx +++ /dev/null @@ -1,50 +0,0 @@ ---- -layout: docs -page_title: v0.2.0 release notes -description: >- - Learn more about the features included in the Boundary 0.2.0 release and discover what has changed. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary v0.2.0 - -The release notes below contain information about Boundary v0.2.0 as well as new features since Boundary's 0.1.0 that became available in 0.1.x releases. To see a granular record of when each item was merged into the Boundary project, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md). To learn about what Boundary consists of, we highly recommend you start at the [Getting Started Page](/boundary/docs/getting-started). - -Lastly, for instructions on how to upgrade an existing Boundary deployment to v0.2.0, please review Boundary’s [general upgrade guide](/boundary/tutorials/oss-configuration/upgrade-version). - -## Boundary v0.2.0 highlights - -**Open ID Connect (OIDC) Authentication**: Boundary 0.2 adds support for OIDC authentication methods, which allow users to delegate authentication to an OIDC provider. -This feature enables Boundary to integrate with popular identity providers like Microsoft Azure Active Directory, Okta, -cloud identity management systems such as AWS IAM, and others. To get started with creating OIDC auth methods to log into Boundary with common OIDC providers, -get started with the new [Boundary OIDC learn tutorial](/boundary/tutorials). - -**Boundary Desktop for MacOS:** Boundary Desktop enables users to use Boundary to access resources through a convenient GUI application. Boundary Desktop enables users to - -- **Login with available auth methods**: Users can now login to Boundary Desktop with all support auth methods, including OIDC. -- **Find targets:** Users can browse available targets. -- **Connect to targets:** Users can connect to targets via Boundary Desktop. -- **Manage sessions:** Users can manage all of their active sessions or drill down to sessions associated with a specific target. -- **AutoUpdate:** AutoUpdate the Boundary Desktop app as new versions become available. - -**Worker tags & filters (0.1.5):** Enable target traffic to be effectively “tied” to a given set of workers with [worker tags](/boundary/docs/workers/worker-tags), forcing the session to occur through specified workers for a specific target. - -Improvements to list actions:\*\* There have been numerous improvements to listing actions since Boundary 0.1.0. - -- **Resource filtering (0.1.8):** allows users to navigate their resources more easily by [filtering list actions based on resource information](/boundary/docs/filtering). -- **Recursive listing (0.1.5):** allows users to recursively list resources across a scope. -- **List authorizations (0.1.5):** allows users to see what actions they’re authorized to perform against the resources returned in a list command. - -**Database migrations (0.1.5):** Boundary provides an [easy upgrade path](/boundary/tutorials/oss-configuration/upgrade-version) with fail-safes in the event of migration issues. -This includes support for database upgrades in a single transaction. - -## What's changed - -- **Authentication:** The auth-methods \{id}:authenticate:login action is deprecated and will be removed in a few releases. (Yes, this was meant to deprecate the authenticate action; apologies for going back on this!) To better support future auth methods, and especially the potential for plugins, rather than defining custom actions on the URL path the authenticate action will consume both a map of parameters but also a command parameter that specifies the type of command. This allows workflows that require multiple steps, such as OIDC, to not require custom subactions. Additionally, the credentials map in the authenticate action has been renamed attributes to better match other types of resources. credentials will still work for now but will be removed in a few releases. Finally, in the Go SDK, the Authenticate function now requires a command value to be passed in. -- Related to the above change, the output of an API auth-methods \{id}:authenticate call will return the given command value and a map of attributes that depend on the given command. On the SDK side, the output of the Authenticate function returns a map, from which a concrete type can be easily umarshaled (see the updated authenticate password command for an example). - -**For more detailed information of all changes since 0.1.0, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md)** diff --git a/website/content/docs/release-notes/v0_3_0.mdx b/website/content/docs/release-notes/v0_3_0.mdx deleted file mode 100644 index 3d15c6cb0..000000000 --- a/website/content/docs/release-notes/v0_3_0.mdx +++ /dev/null @@ -1,29 +0,0 @@ ---- -layout: docs -page_title: v0.3.0 release notes -description: >- - Learn more about the features included in the Boundary 0.3.0 release and discover what has changed. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary v0.3.0 - -The release notes below contain information about Boundary v0.3.0, Boundary Desktop v1.1.0, as well as new features since Boundary's 0.2.0 that became available in 0.2.x releases. To see a granular record of when each item was merged into the Boundary project, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md). To learn about what Boundary consists of, we highly recommend you start at the [Getting Started Page](/boundary/docs/getting-started). - -Lastly, for instructions on how to upgrade an existing Boundary deployment to v0.3.0, please review Boundary’s [general upgrade guide](/boundary/tutorials/oss-configuration/upgrade-version). - -## Boundary v0.3.0 highlights - -**Boundary Desktop for Windows:** [Boundary Desktop v1.1.0](https://releases.hashicorp.com/boundary-desktop/) gives users the ability to connect to remote targets and view active session details. Boundary Desktop is now available for both Windows and MacOS. - -**Managed groups:** Managed groups allow the population of Boundary groups based on external IdP metadata. This feature allows users of our OIDC authentication method to automatically create groups based on the IdP they’re integrating with over OIDC. - -**OIDC configuration improvements:** Administrators can now configure Boundary authentication from OIDC identity providers in the Boundary admin console and Boundary's Terraform Provider. - -## What's changed - -For detailed information of all changes since 0.2.0, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md) diff --git a/website/content/docs/release-notes/v0_4_0.mdx b/website/content/docs/release-notes/v0_4_0.mdx deleted file mode 100644 index 32e29c350..000000000 --- a/website/content/docs/release-notes/v0_4_0.mdx +++ /dev/null @@ -1,31 +0,0 @@ ---- -layout: docs -page_title: v0.4.0 release notes -description: >- - Learn more about the features included in the Boundary 0.4.0 release and discover what has changed. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary v0.4.0 - -The release notes below contain information about new functionality available in Boundary v0.4.0. To see a granular record of when each item was merged into the Boundary project, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md). To learn about what Boundary consists of, we highly recommend you start at the [Getting Started Page](/boundary/docs/getting-started). - -Lastly, for instructions on how to upgrade an existing Boundary deployment to v0.4.0, please review Boundary’s [general upgrade guide](/boundary/tutorials/oss-configuration/upgrade-version). - -## Boundary v0.4.0 highlights - -**Session Credential Brokering:** Boundary 0.4, adds a Vault integration for the brokering of [Vault](https://www.vaultproject.io/) secrets to Boundary clients (both command line and desktop clients) for use -in Boundary sessions. Brokering of Vault secrets is the foundation of Boundary’s larger credential-management story for seamless single sign-on to infrastructure targets. This feature introduces new Boundary resources - [credential stores](/boundary/docs/domain-model/credential-stores), [credential libraries](/boundary/docs/domain-model/credential-libraries), and [credentials](/boundary/docs/domain-model/credentials) - -to support binding credentials with user sessions, as well as surfacing those credentials during session initialization on the command line and in Boundary Desktop. - -**`boundary connect` Credential Brokering Integration:** Additionally, we have started integration into the [boundary connect helpers](/boundary/docs/getting-started/connect-to-target), starting in this release with the Postgres helper; if the credential contains a username/password and boundary connect postgres is the helper being used, the command will automatically pass the credentials to the psql process. - -**Session Security Improvements:** Boundary workers will now close any existing proxy connections they're handling when they cannot make a status request to the worker. The timeout for this behavior is currenly 15 seconds. - -## What's changed - -For more detailed information of all changes since 0.3.0, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md) diff --git a/website/content/docs/release-notes/v0_5_0.mdx b/website/content/docs/release-notes/v0_5_0.mdx deleted file mode 100644 index 86fc8ed7a..000000000 --- a/website/content/docs/release-notes/v0_5_0.mdx +++ /dev/null @@ -1,34 +0,0 @@ ---- -layout: docs -page_title: v0.5.0 release notes -description: >- - Learn more about the features included in the Boundary 0.5.0 release and discover what has changed. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary v0.5.0 - -The release notes below contain information about new functionality available in Boundary v0.5.0. -To see a granular record of when each item was merged into the Boundary project, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md). -To learn about what Boundary consists of, we highly recommend you start at the [Getting Started Page](/boundary/docs/getting-started). - -Lastly, for instructions on how to upgrade an existing Boundary deployment to v0.5.0, please review Boundary’s [general upgrade guide](/boundary/tutorials/oss-configuration/upgrade-version). - -## Boundary v0.5.0 highlights - -**Event Logging:** 0.5.0 includes significant improvements to Boundary's event logging system with goal of giving operators greater visibility into system information in a well-defined, structured format. -When enabled, event logs are the only type of logging Boundary performs, meaning standard system information and debug logs will no longer appear in stdout. -The new structured event logs are filterable by event type and other expressions that users define. Legacy HCLog output is still supported through a user-configurable setting. - -For more about event logging usage, see our [documentation](/boundary/docs/configuration/events/overview). - -**Credential CRUD operations for Administrative Console:** The 0.5.0 release enables administration to configure Vault credential libraries and Vault credential set resources through the administrative console. -Vault credential resources allows users to create Boundary sessions with credentials brokered by a Vault deployment. - -## What's changed - -For more detailed information of all changes since 0.4.0, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md) diff --git a/website/content/docs/release-notes/v0_6_0.mdx b/website/content/docs/release-notes/v0_6_0.mdx deleted file mode 100644 index 8a91733d7..000000000 --- a/website/content/docs/release-notes/v0_6_0.mdx +++ /dev/null @@ -1,31 +0,0 @@ ---- -layout: docs -page_title: v0.6.0 release notes -description: >- - Learn more about the features included in the Boundary 0.6.0 release and discover what has changed. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary v0.6.0 - -The release notes below contain information about new functionality available in Boundary v0.6.0 and the corresponding Boundary Desktop v1.3.0 and Boundary Terraform Provider v1.0.5 releases. -To see a granular record of when each item was merged into the Boundary project, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md). -To learn about what Boundary consists of, we highly recommend you start at the [Getting Started Page](/boundary/docs/getting-started). - -Lastly, for instructions on how to upgrade an existing Boundary deployment to v0.6.0, please review Boundary’s [general upgrade guide](/boundary/tutorials/oss-configuration/upgrade-version). - -## Boundary v0.6.0 highlights - -**Permissions-based UI:** Boundary 0.6.0 dynamically tailors the administrator console to individual users’ permissions, ensuring users are presented only with actions and workflows that can succeed. - -**Linux Support for Boundary Desktop:** Boundary Desktop 1.3 adds support for Debian-based Linux distributions in addition to existing macOS and Windows support. - -**Managed group configurations via Terraform:** Managed groups can now be configured via Terraform using v1.0.5 of [Boundary's Terraform Provider](https://registry.terraform.io/providers/hashicorp/boundary/latest) - -## What's changed - -For more detailed information of all changes since 0.5.0, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md) diff --git a/website/content/docs/release-notes/v0_7_0.mdx b/website/content/docs/release-notes/v0_7_0.mdx deleted file mode 100644 index d6aef65fd..000000000 --- a/website/content/docs/release-notes/v0_7_0.mdx +++ /dev/null @@ -1,33 +0,0 @@ ---- -layout: docs -page_title: v0.7.0 release notes -description: >- - Learn more about the features included in the Boundary 0.7.0 release and discover what has changed. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary v0.7.0 - -The release notes below contain information about new functionality available in Boundary v0.7.0 and the corresponding Boundary Desktop v1.4.0 release. -To see a granular record of when each item was merged into the Boundary project, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md). -To learn about what Boundary consists of, we highly recommend you start at the [Getting Started Page](/boundary/docs/getting-started). - -Lastly, for instructions on how to upgrade an existing Boundary deployment to v0.7.0, please review Boundary’s [general upgrade guide](/boundary/tutorials/oss-configuration/upgrade-version). - -## Boundary v0.7.0 highlights - -**Dynamic Host Catalogs:** Boundary introduces a new resource type, dynamic host catalogs, which automate the discovery of host resources from a catalog provider. The 0.7 release includes -initial support for Azure and AWS host catalogs with more catalog providers to follow in future releases. Catalogs are implemented via Boundary's (currently internal) new go-plugin system. - -**Managed group configuration in the admin console**: Managed groups are a special type of IAM group which populate users based on administrator-defined filters of external identity provider (IdP) metadata. -Configuration of managed groups is now available in the Boundary admin console. - -**UI Support for Resource Filtering:** Users may now filter auth method and session resources in the admin console and Boundary Desktop. - -## What's changed - -For more detailed information of all changes since 0.6.0, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md) diff --git a/website/content/docs/release-notes/v0_8_0.mdx b/website/content/docs/release-notes/v0_8_0.mdx deleted file mode 100644 index 52352ab6f..000000000 --- a/website/content/docs/release-notes/v0_8_0.mdx +++ /dev/null @@ -1,37 +0,0 @@ ---- -layout: docs -page_title: v0.8.0 release notes -description: >- - Learn more about the features included in the Boundary 0.8.0 release and discover what has changed. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary v0.8.0 - -The release notes below contain information about new functionality available in the Boundary v0.8.0 release. -To see a granular record of when each item was merged into the Boundary project, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md). -To learn about what Boundary consists of, we highly recommend you start at the [Getting Started Page](/boundary/docs/getting-started). - -Lastly, for instructions on how to upgrade an existing Boundary deployment to v0.8.0, please review Boundary’s [general upgrade guide](/boundary/tutorials/oss-configuration/upgrade-version). - -## Boundary v0.8.0 highlights - -**Metrics and Health Endpoint:** Boundary is adding [Prometheus metrics](/boundary/docs/oss/operations/metrics) to monitor the operations of workers and controllers, -as well as a [health endpoint](/boundary/docs/oss/operations/health) for controllers. - -**Audit Event Logs:** We are expanding the audit event logs by increasing the captured [audit events](/boundary/docs/configuration/events/overview), -with support for sanitizing sensitive information from audit events. All of the events are now classified and events contain more usable data, with sensitive information redacted by default. - -**UI Support for Worker Tags:** Users can now set and edit [worker tag](/boundary/docs/workers/worker-tags) filters in the Boundary admin console. - -**Performance Improvements:** We have implemented changes to improve performance on larger deployments; such as adding a refresh button in the admin console and desktop client, -and improving response times listing sessions and targets. We plan to continue these efforts as Boundary users grow their deployments! - - -## What's changed - -For more detailed information of all changes since 0.7.0, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md) diff --git a/website/content/docs/release-notes/v0_9_0.mdx b/website/content/docs/release-notes/v0_9_0.mdx deleted file mode 100644 index 3834c61a7..000000000 --- a/website/content/docs/release-notes/v0_9_0.mdx +++ /dev/null @@ -1,46 +0,0 @@ ---- -layout: docs -page_title: v0.9.0 release notes -description: >- - Learn more about the features included in the Boundary 0.9.0 release and discover what has changed. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Boundary v0.9.0 - -The release notes below contain information about new functionality available in the Boundary v0.9.0 release. -To see a granular record of when each item was merged into the Boundary project, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md). -To learn about what Boundary consists of, we highly recommend you start at the [Getting Started Page](/boundary/docs/getting-started). - -Lastly, for instructions on how to upgrade an existing Boundary deployment to v0.9.0, please review Boundary's [general upgrade guide](/boundary/tutorials/oss-configuration/upgrade-version). - -## Boundary v0.9.0 highlights - -**HCP Boundary Public Beta:** Boundary is coming to the HashiCorp Cloud Platform! HCP Boundary provides an easy way to securely access -critical systems with fine-grained authorizations based on trusted identities. Boundary on HashiCorp Cloud Platform provides a fully managed, -single workflow to securely connect to hosts and critical systems across Kubernetes clusters, cloud service catalogs, and on-premises infrastructure. -You can now [try HCP Boundary](/boundary/tutorials/hcp-getting-started) for free during our [Public Beta](https://cloud.hashicorp.com/products/boundary). - -**Self-Managed Workers:** With HCP Boundary, administrators have the option of setting up private, self-managed workers for infrastructure access. This provides the -security of having privately managed workers while providing the low overhead of a managed service. Learn more about setting up self-managed workers -[here](/boundary/tutorials/hcp-administration/hcp-manage-workers). - -**Worker Registration Enhancements:** Administrators now have a second method of authenticating workers, and we call these PKI Workers (the original -authentication method is now called KMS Workers). PKI Workers authenticate to Boundary using a new certificate-based method, allowing for worker deployment -without using a shared KMS. - -**Static Credential Store:** In Boundary 0.9.0, we are introducing the static credential store, a basic -[credential store](/boundary/docs/domain-model/credential-stores) that is native to Boundary. These credentials -are encrypted and stored directly in Boundary. For users interested in integrated secrets management to Boundary targets, the new basic -credential store removes the dependency on HashiCorp Vault. Currently, the static credential store only supports username/password type credentials. Note: If you -wish to use the Desktop Client for credential brokering, version 1.4.4 and up is required. - -**Admin UI Quickstart:** Users can now access a quickstart tool on the Admin UI which sets up a target along with a host, project, and organization. - -## What's changed - -For more detailed information of all changes since 0.8.0, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md) diff --git a/website/content/docs/secure/encryption/connections-tls.mdx b/website/content/docs/secure/encryption/connections-tls.mdx deleted file mode 100644 index 8a18d5b1c..000000000 --- a/website/content/docs/secure/encryption/connections-tls.mdx +++ /dev/null @@ -1,315 +0,0 @@ ---- -layout: docs -page_title: Connections/TLS -description: >- - Learn how Boundary uses transport layer security (TLS) to secure connections and establish sessions. Understand how workers authenticate to resources. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# TLS in Boundary - -As a security product, Boundary has been designed from the ground up to ensure -its connections are secure. There are three types of connections in Boundary; -this page will describe how TLS works with each of them. - -Some of the ways that Boundary uses TLS, e.g. for client-to-worker connections, -are different from most other products. It may not be readily apparent that user -configuration of TLS on the listening port of Workers is not only not required, -but more secure; however, when it comes to TLS, Boundary tries to provide high -security by default with simplicity of operation. - -Details are in the individual sections below. - -## Client-to-controller TLS - -Boundary's API access (that is, the Controller server defaulting to port 9200) -uses standard PKI. TLS is configured by providing a valid certificate (and -optionally CA certificate or chain) and clients must trust that CA chain. This -provides broad compatibility with a wide array of clients. - -It is possible to require client certificates; see the configuration for -`listener` blocks to see the available TLS parameters. - -## Client-to-worker TLS - -Workers do not require any configuration for their client-facing listeners to -support a high degree of security. Instead, the TLS configuration to use is -determined dynamically via SNI, and the session is then mutually authenticated. -Here's how it works: - -TLS establishment is performed as follows: - -1. When the session is authorized, the Controller generates a TLS certificate - acting as a self-contained chain. This is similar to the Worker-to-Controller - flow above, but in this case the key is an Ed25519 key generated via - derivation from a base key within the Controller, which itself is protected - at rest via the "root" KMS for the scope that contains the target. The - derivation uses HKDF-SHA256 with the user ID and the session ID as inputs. - The lifetime of the certificate is tied to the lifetime of the session. - -2. The certificate and private key (along with other session authorization data, - notably the session ID) are returned to the client as part of the output of an - `authorize-session` action against a target, in the form of a marshaled object. - The controller persists the certificate in the database, but not the private - key. - -3. The client (that is, the `boundary connect` command) parses this session - authorization data and uses the certificate and private key to construct a TLS - stack. It then makes a TLS 1.3 connection to a Worker, passing the session ID as - the SNI value. - -4. The worker sees the SNI value and makes a call to the Controller to fetch - session authorization information, keyed by the session ID. - -5. The Controller looks for a session with the given ID and fetches the - information. Using the session ID and the user ID tied to the session, it - re-derives the private key and passes all of the information back to the Worker. - Notably, this may include a TOFU (Trust On First Use) token. - -6. The Worker uses the given data to construct a TLS stack with the same - certificate and key. - -7. The connection is mutually authenticated; on each end, only the single - self-signed CA certificate that was securely transmitted is configured as a - valid root CA for validation checking. - -8. If successful, the client and Worker perform a handshake, where the client - passes a TOFU (Trust On First Use) value to the Worker. This value is derived - when the client is created; that is, when `boundary connect` is run. This allows - for a single client to make multiple connections within a session, without the - credentials being usable via a different client: - -9. If the worker was not given a TOFU token in step 5, the worker submits the - value to the Controller. The Controller verifies (via a database transaction) - that the session has not had a different TOFU token submitted prior and stores - it. Otherwise it's rejected, and so is the connection, as a possible replay - attack. - -10. If the Worker was given a TOFU token in step 5, it checks to see whether the - token values match. If not, the connection is rejected as a possible replay - attack. - -In the future, to support other client paradigms, we may support user -configuration of the Worker's client-facing TLS. In this model, the shared -certificate/private key would instead act as credentials for the session, -similar to a username/password. - - -## Worker-to-upstream TLS - -Workers connect to upstreams (Controllers, or other Workers) via TLS -connections. In order to make these connections, Workers have to be -authenticated to the cluster. How this authentication and session establishment -takes place can happen in one of two ways: by a built-in X.509-based PKI system, -or by leveraging a KMS system to provide secure transport of authentication -information. - -The KMS-based mechanism provides zero-touch registration of Workers to a -cluster, while the PKI mechanism provides positive access control at -registration time. Currently, HCP Boundary deployments only support PKI -authentication for self-managed Workers. - -### PKI-based worker authentication - -In the PKI-based authentication mechanisms, Workers are registered to the -cluster by informing the cluster of a Worker's public signing and encryption -keys. The cluster then returns to the Worker a set of signed certificates and a -Controller public encryption key. This process is arbited by the operator (or a -provisioning system) to provide security for transport of the initial public key -material. - -The PKI mechanism is set up via transport of a single value from the Worker to -any cluster Controller. Once established, certificates and encryption keys are -automatically rotated periodically, currently at a period of two weeks. - -There are two variations on this mechanism: _worker-led_, where the Worker -produces the initial key material, and _controller-led_, where the Controller produces -the initial key material. - -Note that the mechanisms described in this section omit detail for clarity. - -#### Worker-led PKI-based registration - -Registration proceeds as follows: - -1. The Worker generates a signing public/private Ed25519 keypair and an - encryption public/private X25519 keypair, along with a registration nonce, - and provides these values in a bundle to the operator or orchestration - system. The bundle is signed with the Worker's private Ed25519 key (signing - ensures that a Meddler-in-the-Middle (MITM) that is able to snoop traffic - will be unable to masquerade as the Worker in requests sent to the - Controller, due to lacking the Worker's private signing key; as a result it - should never be properly registered or sent sessions to proxy). - -2. The operator or orchestration system submits this bundle to a Controller in - the cluster via an authenticated and authorized API call, requesting that a - Worker resource be created tied to the given key information. - -3. The Controller creates a Worker resource and associates it to the given key - material. The Controller also signs a _client-only_ certificate - authenticating the Worker's signing key and generates its own encryption - public/private keypair specific to that Worker. - -4. The Worker requests to its configured upstream(s) to fetch its issued - credentials. It provides its public keys and original registration nonce in - the request, which is signed via the Worker's private Ed25519 key. (Here - again this means that a MitM cannot masquerade as the Worker due to lacking - the signing key.) If the configured upstream is a Controller, it can respond - directly; otherwise the request is relayed up to the cluster Controllers. - -5. A Controller receiving the request validates that the provided nonce matches - the nonce in the bundle provided by the operator/orchestration system in step - 2, and that the keys also match. If so, the Controller uses its - Worker-specific encryption private key and the Worker's encryption public key - to derive a shared symmetric encryption key, and uses it to encrypt the - Worker certificate, its CA certificate, and the nonce, and returns it to the - Worker along with its encryption public key. - -6. The Worker uses the given Controller encryption public key and its private - key to derive the shared symmetric key; confirms it can decrypt the returned - bundle; and validates the nonce, storing the issued certificate and CA - certificate. - -#### Controller-led PKI-based registration - -Registration proceeds as follows: - -1. An operator requests a worker activation token. The Controller creates a Worker resource and generates a single-use -activation token and nonce, returning this value to the operator. - -2. The operator puts this token in the `controller_generated_activation_token` field of a worker's configuration -file. - -3. The Worker generates a signing public/private Ed25519 keypair and an -encryption public/private X25519 keypair, and signs this bundle. - -4. The Worker sends a request to its configured upstream(s) to fetch its issued -credentials. It provides its public keys and the activation token in -the request, which is signed via the Worker's private Ed25519 key. (A man-in-the-middle cannot masquerade as the Worker due to lacking -the signing key.) If the configured upstream is a Controller, it can respond -directly; otherwise the request is relayed to the cluster's Controllers. - -5. A Controller receiving the request validates the activation token generated in step 1. -If the token is validated, the Controller associates the given key material with the premade Worker resource. -The Controller also signs a _client-only_ certificate authenticating the Worker's signing key, -and generates its own encryption public/private keypair specific to that Worker. The keypair is used -to derive a shared symmetric encryption key, and to encrypt the -Worker certificate and its CA certificate. The Controller returns it to the -Worker along with its public encryption key. - -6. The Worker uses the given Controller encryption public key and its private -key to derive the shared symmetric key, confirms it can decrypt the returned -bundle, and stores the issued certificate and CA certificate. - -#### PKI-based session establishment - -Using the stored credentials, a PKI-based worker establishes a session as -follows: - -1. The Worker initiates a TLS connection to an upstream, presenting its TLS - certificate along with a signed bundle containing a nonce. - -2. The upstream requests a just-in-time server certificate (remember, - certificates issued during registration are client-only), either directly (if - a Controller) or via a proxied request to a Controller (if another Worker). - The request conveys the Worker's nonce as well as the key ID from the client - certificate. - -3. A cluster Controller validates the key ID to ensure it is a registered - worker, then creates a certificate with a short validation period that embeds - the Worker's nonce, signed with the cluster's CA certificate. The Controller - issuing this certificate has now authenticated the incoming Worker to the - upstream, as the Controller has now vouched for the validity of the Worker - tied to the client certificate. (Technically client certificate verification - happens later in the TLS handshake, but conceptually this is when the - incoming Worker is authenticated to the upstream.) - -4. The upstream presents this server certificate to the Worker. The Worker - validates that its nonce is embedded in the certificate and that the - certificate chain can be validated to one of its saved CAs. This - authenticates the upstream to the incoming Worker, since the trusted root has - issued a new certificate containing the expected nonce and provided it to the - upstream. - -5. The TLS connection is now established, and the upstream can handle the Worker - protocol. - -#### PKI-based credential rotation - -Periodically, a PKI-based Worker will trigger rotation of its credentials. The -mechanism is as follows: - -1. The Worker generates a new signing public/private Ed25519 keypair and a new - encryption X25519 public/private keypair. - -2. The Worker creates a request to fetch new credentials from the Controller, - providing its new public keys and an operation nonce in the request, - encrypted with the current shared symmetric encryption key via the current - X25519 parameters. As only the Controllers and the Worker can derive this - shared symmetric key, the Worker knows that for the request to be satisfied - it must be handled by an already-trusted Controller. - -3. The Controller decrypts the bundle and registers the new key information to - the Worker resource. It generates a new certificate and encryption - public/private keypair and returns the certificate, current CA, operation - nonce, and encryption public key to the worker. All but the encryption public - key are encrypted with the symmetric key derived from the new Controller - encryption private key/new Worker encryption public key. - -4. This information is itself encrypted with the existing symmetric encryption - key, and this value returned to the Worker. - -5. The Worker decrypts the outer bundle with its current information, uses that - to retrieve an authenticated new encryption public key from the Controller, - then uses that with its new encryption private key to derive the new shared - symmetric encryption key. That new key is used to decrypt the rest of the - parameters, and the nonce is checked to ensure that the response is for the - current operation started by the Worker in step 1. - -6. The Worker has validated that a trusted Controller provided the new - certificate information and encryption parameters and that those parameters - can be used to successfully derive a shared symmetric encryption key. The - Worker saves the new credentials and uses them going forwardl - -### KMS-based worker authentication - -Workers can take advantage of the [KMS](/boundary/docs/secure/encryption/data-encryption) -key designated for `worker-auth` within Boundary's configuration file, which -must point to the same key on the KMS for both the Controller and the Worker. -Security of the connection relies on secure transmission of a single set of -allowed TLS parameters, which forms the entire allowable CA chain for the -connection. - -TLS establishment is performed as follows: - -1. The Worker generates a TLS certificate acting as a self-contained chain, as - well as a nonce. The generated key type is currently Ed25519. The certificate is - valid for a total of 2.5 minutes: thirty seconds before the current time (to - allow for some minor clock drift) and two minutes after (to allow time to - establish the connection). - -2. The Worker marshals the TLS chain and nonce and encrypts the resulting bytes - via the shared KMS. This value is marshaled and split into chunks. - -3. The Worker establishes a TLS 1.3 connection to the Controller. The encrypted - value is transmitted to the Controller via the TLS ALPN field as numbered - chunks. - -4. The Controller reads the chunks and reassembles them into the original - encrypted value. - -5. The Controller decrypts this value via the shared KMS. If successful, the - Controller validates that the nonce is not known to ensure that this is not a - replay. The nonce value is checked against and stored into the database, - ensuring that nonce replay cannot occur across controllers. - -6. The Controller uses the decrypted parameters to configures its TLS stack with - the same certificate and key. - -7. The connection is mutually authenticated; on each end, only the single - self-signed CA certificate that was securely transmitted is configured as a - valid root CA for validation checking. diff --git a/website/content/docs/secure/encryption/data-encryption.mdx b/website/content/docs/secure/encryption/data-encryption.mdx deleted file mode 100644 index 1f940e86d..000000000 --- a/website/content/docs/secure/encryption/data-encryption.mdx +++ /dev/null @@ -1,196 +0,0 @@ ---- -layout: docs -page_title: Data encryption -description: >- - Learn how key management services protect the encryption keys used for securing data. Understand key lifecycle management best practices. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Data encryption in Boundary - -Boundary has multiple mechanisms to ensure secure end-to-end behavior of the -system. A key part of this is [support for various Key Management -Systems](/boundary/docs/configuration/kms) that protect the base encryption keys used -for various functions. This page describes the various KMS key purposes that -Boundary supports and how they are used within the system. - -## The `worker-auth-storage` KMS key - -The `worker-auth-storage` KMS key can be used by [Workers registered using worker-led or controller-led -methods](/boundary/docs/workers/registration#authorization-methods) for storage of authentication -keys. It is optional for workers; if not specified the authentication keys -will not be encrypted on disk. This can not used by workers registered using an external KMS. - -## The `root` KMS key and per-scope KEK/DEKs - -Following best practices of using different encryption keys for different -purposes, Boundary has a number of encryption keys generated within each scope. -Each key further contains versions, which hold the key material used to encrypt -data. You can create new key versions by _rotating_ the keys. A key version -can be destroyed, which will re-encrypt any existing data before destroying the -key material permanently. - -The `root` KMS key acts as a KEK (Key Encrypting Key) for the scope-specific -KEKs (also referred to as the scope's `root` key). The scope's `root` KEK -and the various DEKs (Data Encryption Keys) are created when a scope is created. -The DEKs are encrypted with the scope's `root` KEK, and this is in turn -encrypted with the KMS key marked for the `root` purpose. - -You can configure `root` KMS keys for self-managed Enterprise or Community edition deployments. - -The current scoped DEKs and their purposes are detailed below: - -- `audit`: This is used to encrypt secret values in the event log. For more - information about the event log, refer to - [the events config](/boundary/docs/monitor/events). - -- `database`: This is the general-purpose DEK used to encrypt values within the - database. Values that are encrypted are those generally considered to be - secret, such as API keys, third-party tokens, certificate private keys, and so - on. - -- `oidc`: This is used to encrypt OIDC information in cookies and authentication - requests. - -- `oplog`: This is used for encrypting oplog (operation log) values for the - given scope. - -- `tokens`: This is used for encrypting tokens generated by auth methods within - the given scope. - -- `sessions`: This is used as a base key against which to derive - session-specific encryption keys. - -### Key version lifecycle management - -You can control the lifecycles of the per-scope KEK and DEKs via the CLI or -API using the key endpoints under the scopes section. To rotate all the keys -in a scope, use the `rotate-keys` endpoint: - -```shell-session -$ boundary scopes rotate-keys -scope-id p_A4jfDjZ9jf -``` - -This endpoint creates new key versions for all keys in the scope -`p_A4jfDjZ9jf`, and makes these key versions the active key versions for -encrypting new data. The previous key version(s) will continue to be used for -decrypting existing data. You can use the `-rewrap` flag to immediately rewrap -all DEK versions with the new KEK version. Otherwise, the DEK versions remain -encrypted by the prior KEK version from when they were created. - -To list all keys in a scope and their versions, use the `list-keys` endpoint: - -```shell-session -$ boundary scopes list-keys -scope-id p_A4jfDjZ9jf -``` - -To destroy a key version, use the `destroy-key-version` endpoint: - -```shell-session -$ boundary scopes destroy-key-version -scope-id p_A4jfDjZ9jf -key-version-id kdkv_tr6ZN8opYr -``` - -The latest key version cannot be destroyed, so if you want to destroy the -latest key version, you will need to call the `rotate-keys` endpoint first, -to create a new set of key versions. The `oplog` purpose key versions also -cannot be destroyed at this time. - -Destroying a key version sometimes requires background work before it can be -completed. This is because DEK versions that currently encrypt data -necessitate re-encrypting that data with the latest DEK version for each -purpose before they can be deleted. You can monitor the progress of this -re-encryption job via the `list-key-destruction-jobs` endpoint: - -```shell-session -$ boundary scopes list-key-version-destruction-jobs -scope-id p_A4jfDjZ9jf -``` - -Once the job disappears from this list, the associated key version will have -been destroyed and any existing data will have been re-encrypted. - -## The `bsr` KMS key - -This feature requires HCP Boundary or Boundary Enterprise - -The `bsr` KMS key is required for [session recording](/boundary/docs/session-recording). -If you do not add a `bsr` key to your controller configuration, you will receive an error when you attempt to enable session recording. -The key is used for encrypting data and checking the integrity of recordings. - -## The `previous-root` KMS key - -The `previous-root` KMS key is used when migrating to a new `root` key. Adding -the `previous-root` KMS key to your configuration informs the Controller to use -it for decrypting the existing information in the database, allowing you to -rotate and rewrap the KEKs to complete the migration to the new root key. - -You can configure `previous-root` KMS keys for self-managed Enterprise or Community edition deployments. - -## The `worker-auth` KMS key - -The `worker-auth` KMS key is a key shared by the Controller and Worker in order -to authenticate a Worker to the Controller. Specifics of this mechanism can be -found on the [Connections/TLS page](/boundary/docs/secure/encryption/connections-tls). If -a worker is registered with [worker-led or controller-led -methods](/boundary/docs/workers/registration#authorization-methods) this is unnecessary. - -You can configure `worker-auth` KMS keys for HCP, Enterprise, and Community edition deployments. -However, you cannot configure `worker-auth` keys for the first set of workers that connect to your HCP workers. - -## The `recovery` KMS key - -The `recovery` KMS key is used for rescue/recovery operations that can be used -by a client to authenticate almost any operation within Boundary. Its mechanism -of operation is very similar to the `worker-auth` flow in terms of using a -shared KMS between the client and the Controller for authentication. A nonce and -creation time are included as an encrypted payload, formatted as a token and -sent to the Controller. The time and nonce are used to ensure that a value -cannot be replayed by an adversary, and also to ensure that each operation must -be individually authenticated by a client so that revoking access to the KMS has -an immediate result. - -You can configure `recovery` KMS keys for self-managed Enterprise or Community edition deployments. - - - -It is not required for this `kms` configuration block to exist in the -Controller's configuration file. It's best practice to leave it out except when -actually needed, and to use change control capabilities to ensure that the -configuration file modification is authorized. After it's no longer needed, the -block should be removed. - - - -On the client side, a user can use the `-recovery-config` flag with any -operation on the CLI to specify a configuration file containing a suitable `kms` -block. This functionality is also accessible via the Go SDK. - -Requests authorized via this mechanism will show a user of `u_recovery`. This -mechanism _cannot_ be used to authorize a session, as there is no uniquely -identifying user information available. - -There are some other situations where this mechanism can be useful. For example, -it is possible to use this mechanism, along with some defaults in the Terraform -provider, to ensure that _everything_ in Boundary is created through Terraform, -with the exception of resources that cannot themselves be deleted. (This -consists of built-in anonymous (`u_anon`), authenticated (`u_auth`), and -recovery (`u_recovery`) users and the `global` scope.). By initializing Boundary -with the options to skip creating default resources, Terraform can be used to -create the specific resources needed instead, with the `recovery` KMS used to -authenticate setting up the initial auth method(s). - -## The `config` KMS key - -This key can be used to encrypt values within Boundary's configuration file. By -sharing this block between Boundary and an operator, the operator can put -sensitive or secret values (such as cloud API keys for KMSes) in Boundary's -configuration file, run `boundary config encrypt` to encrypt the file, and then -safely pass the file to a change control system. Only another operator or system -with access to that KMS can decrypt the values. Boundary will check for a -`config` KMS block on startup, and if it exists, will use it to decrypt any -encrypted values found at startup time. - -You can configure `config` KMS keys for self-managed Enterprise or Community edition deployments. diff --git a/website/content/docs/secure/security-model.mdx b/website/content/docs/secure/security-model.mdx deleted file mode 100644 index f54e2510b..000000000 --- a/website/content/docs/secure/security-model.mdx +++ /dev/null @@ -1,147 +0,0 @@ ---- -layout: docs -page_title: Boundary security model -description: >- - Understand the mechanisms involved in a secure Boundary deployment, which threats are considered part of the security model, and HCP Boundary's architecture. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Security model - -Boundary brokers secure, auditable connections to infrastructure targets while keeping credentials hidden and enforcing least-privilege policy. -The security model ensures [confidentiality, integrity, authentication, and accountability](http://www.wikipedia.org/wiki/Information_security) for all access and session brokering operations. - -Defense in depth is crucial for secure privileged access management, and deployment requirements may differ dramatically depending on your use case. -This documentation may need to be adapted to your situation, but the general mechanisms for a secure Boundary deployment revolve around: - -- [mTLS](/boundary/docs/secure/encryption/connections-tls) - Mutual TLS authentication between client, controller, and worker components prevents unauthorized access by requiring all parties to present valid certificates. -This requirement protects internal communications and session brokering operations. -- [RBAC](/boundary/docs/rbac) - Boundary's allow-only permissions model enables authorization for authenticated connections by granting capabilities to roles which are then assigned to users, groups, or managed groups. -- [Scopes](/boundary/docs/domain-model) - Access to targets within organizations and projects can be controlled to allow for granular access to infrastructure resources. -- [Data encryption](/boundary/docs/secure/encryption/data-encryption) - Sensitive data stored in Boundary's database is protected using envelope encryption with external key management systems. - -The combination of these mechanisms creates a strong security posture, enabling administrators to enforce least-privilege access, decouple credentials from end users, maintain comprehensive audit logs, and ensure secure network traversal without direct connectivity to sensitive networks. - -## Threat model - -The following are the various parts of the Boundary threat model: - -- **Eavesdropping on any Boundary communication**. -All communication between clients, controllers, and workers is protected by TLS or mutually authenticated TLS, ensuring confidentiality and integrity. -- **Tampering with data at rest or in transit**. -Any unauthorized modification of session information, configuration, or persistent state should be detected, causing transaction abort or session termination. -- **Access to targets or controls without authentication or authorization**. -All requests must be authenticated and authorized according to defined granular policies. -- **Access to targets or controls without accountability**. -When audit logging is enabled, all access attempts and privileged operations must be logged before sensitive data is transmitted. -- **Confidentiality of managed credentials**. -Credentials brokered by Boundary must never be exposed to clients unless explicitly authorized, preventing credential leakage. -- **Availability of session brokering services**. -Boundary supports highly available deployments to maintain access in case of infrastructure failures. - -## Not in scope - -The following are explicitly not considered part of the Boundary threat model: - -- **Protecting against compromise of Boundary hosts (controllers, workers)**. -An attacker with arbitrary code execution or privileged access on controller or worker hosts can undermine security guarantees. -This includes access to: - - The Boundary data directory containing configuration and state - - Memory of running Boundary controller or worker processes - - The capability to run modified Boundary binaries - - The capability to redirect worker host network traffic -- **Protecting against compromise of end-user or administrator devices**. - - If an attacker compromises a user's device and obtains valid Boundary credentials, they can perform actions with those credentials' privileges. - - Brokered credentials may be returned to the user's device and displayed in plain text. - - Boundary Client Agent specifics: - - The Client Agent stores session credentials and related information in memory. - Boundary CLI persists auth tokens to platform-specific keyring storage. - If an attacker can read the memory of the Client Agent process or has compromised the OS user account under which the Client Agent is running and authenticated, they may be able to access these active session credentials. - - The Client Agent's security relies on the OS user context; an OS user can only connect to sessions managed by the Client Agent if they are the same OS user that initiated the DNS lookup that created the session. - Compromise of this OS user account bypasses the local protection. - - An attacker could subvert the Client Agent's DNS interception mechanism on the local host. -- **Protecting against vulnerabilities in external credential sources**. -Boundary integrates with systems like HashiCorp Vault, cloud IAM services, and other credential stores, but cannot protect against exploits targeting these external services. -- **Protecting against the leakage of the existence of resources**. -While Boundary protects credential details, an attacker with read access to the backend might be able to see that certain targets or auth methods exist, even if they cannot access them. -- **Protecting against network-level denial of service attacks**. -While Boundary supports high-availability configurations and provides rate limiting, it does not include inherent protections against volumetric DoS attacks targeting its network surfaces. -- **Protecting against target application vulnerabilities**. -Once a session is established to a target (SSH server, database, etc.), Boundary cannot protect against vulnerabilities in that target application. - -## HCP Boundary - -HCP Boundary is deployed onto a single AWS region across three availability zones in that region. -Each customer cluster is deployed as a Nomad job of Docker containers. -The Nomad jobs are controlled by an external service that accesses the Nomad cluster through the VPC's PrivateLink. - -![High-level diagram of HCP Boundary architecture](/img/security-model/boundary-architecture.png) - -For a given HCP Boundary cluster, the only user-accessible endpoints are the controllers, which have a randomly-generated 32-character cluster UUID, `https://.boundary.hashicorp.cloud`. -These machine-generated URLs provide no discernible patterns, guarding against the enumeration of controllers. - -### Tenancy model - -HCP Boundary uses a multi-tenant RDS Postgres cluster with a separate database per tenant. -This architecture uses security controls inherent to Postgres' database isolation. -All secret and sensitive row data is encrypted with scope-specific, per-tenant keys. - -This model is commonly referred to as a **siloed** multi-tenant database, as opposed to **bridge** or **pool** models. -A siloed model allows us to maintain the strictest security while simplifying the architecture. - -### Self-managed workers - -Self-managed workers are workers that are managed by administrators outside of the HCP infrastructure, in their cloud or on-premises environments. -Just like all Boundary worker-to-controller and client-to-worker communication, self-managed workers connect to the controller and clients over mutually-authenticated TLS. -For more information about how self-managed workers authenticate to the HCP Boundary controller, refer to [PKI-based worker authentication](/boundary/docs/secure/encryption/connections-tls#pki-based-worker-authentication). - -A compromised worker may result in the compromise of any targets assigned to the worker as well as the integrity of any log data provided by the compromised worker. - -### Storage - -The Boundary controller and worker infrastructure is stateless, whereby all state lives in the RDBMS. -Each HCP Boundary cluster is provided with a separate database inside of an Aurora Postgres cluster. -The [Vault database engine](/vault/docs/secrets/databases) provides access to the database using dynamic credentials that are regularly rotated. - -![High-level diagram of HCP Boundary data at rest](/img/security-model/data-at-rest.png) - -### Data encryption - -HCP Boundary clusters use the [Vault Transit secrets engine](/vault/docs/secrets/transit) for their root, recovery, and worker-auth KMS keys. -Boundary controllers are provided access to the Vault transit keys with a token that is assigned a policy that allows them to access only their individual keys. -These tokens are regularly rotated. - -Administrators may also use an external key management system, including Vault or HCP Vault, to manage the key-encrypting root key. -Refer to the [kms stanza](/boundary/docs/configuration/kms) documentation for more information about supported external KMS systems. - -### Data in transit - -All user-to-controller communication is performed over TLS. -Refer to the [TLS configuration options](/boundary/docs/configuration/listeners/tcp-listeners#tls) in the TCP listeners documentation. - -All other communication, including worker-to-controller and client-to-worker, is performed over mutually-authenticated TLS. -Boundary automatically generates and manages the TLS keys. - -![High-level diagram of HCP Boundary data in transit](/img/security-model/data-in-transit.png) - -### Identity - -The HCP Platform allows administrators to perform high-level cluster operations such as creation and deletion. -You can manage HCP users and their permissions using the [HCP Portal](https://portal.cloud.hashicorp.com). -Once you create an HCP Boundary cluster, you manage Boundary users and permissions within Boundary itself. - -When an administrator creates an HCP cluster tenant, they are prompted to create administrative credentials to bootstrap the cluster. -The administrator can then use Boundary-specific authentication methods to connect directly to the controller and perform administrative tasks. - -## More information - -Refer to the following topics for more information: - -- [TLS in Boundary](/boundary/docs/secure/encryption/connections-tls) -- [Permissions in Boundary](/boundary/docs/rbac) -- [Boundary domain model overview](/boundary/docs/domain-model) -- [Data encryption in Boundary](/boundary/docs/secure/encryption/data-encryption) \ No newline at end of file diff --git a/website/content/docs/session-recording/compliance/configure-storage-policy.mdx b/website/content/docs/session-recording/compliance/configure-storage-policy.mdx deleted file mode 100644 index e569ff4b9..000000000 --- a/website/content/docs/session-recording/compliance/configure-storage-policy.mdx +++ /dev/null @@ -1,704 +0,0 @@ ---- -layout: docs -page_title: Configure storage bucket policies -description: >- - Configure storage bucket policies to manage the lifecycles of session recordings. Specify retention and deletion policies to codify compliance periods. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Configure storage bucket policies - -This feature requires HCP Boundary Plus or Boundary Enterprise - -Retention policies can codify storage bucket lifecycle management for [session recordings][]. -A Boundary resource known as a [storage bucket][] is used to store recorded sessions. -A resource known as a [storage policy][] is used to codify how long session recordings must be kept and when they should be deleted. - -A storage policy exists in either the global scope or an org scope. -Storage policies that are created in the global scope can be associated with any org scope. -However, a storage policy created in an org scope can only be associated with that org scope. -Any storage policies associated with an org scope are deleted when you delete the org itself. - -For more information about using session recording to audit user sessions, refer to [Session recording](/boundary/docs/session-recording). - -## Requirements - -Before you can create a storage bucket in Boundary, you must ensure that your environment meets certain requirements. Session recording requires specific configuration for both the external storage provider and the Boundary worker. - -A Boundary worker configured for local storage is also required to set up session recording and configure recording bucket policies. - -Refer to [Create a storage bucket](/boundary/docs/session-recording/configuration/create-storage-bucket) to learn more about setting up storage for session recordings. - -## Example storage policies - -A storage policy defines how long the recording within a scope should retain its session recordings. Storage policy examples include: - -- Keep forever -- Do not delete -- Do not retain -- Custom retention period - -## Create a storage policy - -Complete the following steps to create a storage policy in Boundary for session recording: - - - - -1. Log in to Boundary. -1. Click **Storage Policies** in the navigation panel in the `global` scope. -1. Click **Create a new storage policy**. -1. Complete the following fields to create the Boundary storage policy: - - **Name**: (Optional) The name field is optional, but if you enter a name it must be unique. - - **Description**: (Optional) An optional description of the Boundary storage policy for identification purposes. - - **Retention Policy**: (Required) Specifies how long a recording must be stored, in days. - Policy values include: - - `Forever`: If enabled, the **Deletion Policy** field is disabled. - - `Custom`: Specify a custom retention policy in days. - - `Do not protect, allow deletion at any time` - - `SOC 2 (7 years)` - - `HIPPA (6 years)` - - **Deletion Policy**: (Required) Specifies when to delete a recording, in days. - Policy values include: - - `Do not delete`: Do not delete recordings, even after the retention policy is met. - - `Custom`: Specifies the number of days after creation when a session recording should be deleted. - - As an example, the following settings would create a SOC 2 compliant policy: - - - **Name**: `soc2-policy` - - **Description**: `SOC 2 compliant storage policy for session recordings` - - **Retention Policy**: `SOC 2 (7 years)` - - **Deletion Policy**: `Custom` - - Delete after: `2657` days - - Toggle the switch beside **Allow orgs to override**. - -1. Click **Save**. - - - - -1. Log in to Boundary. -1. Use the following command to create a storage policy in Boundary: - - ```shell-session - $ boundary policies create storage \ - -name soc2-policy \ - -description 'SOC 2 compliant storage policy for session recordings' \ - -scope-id global \ - -retain-for-days 2557 \ - -retain-for-overridable false \ - -delete-after-days 2657 \ - -delete-after-overridable true - ``` - - The following [attributes](/boundary/docs/domain-model/storage-policy) can be used when defining a storage policy: - - - `name`: (Optional) An optional human readable name. - - `description`: (Optional) An optional human readable description. - - `scope-id`: (Optional) The ID of the scope (global or an org) that owns the policy. Defaults to `global`. - - `retain-for-days`: (Optional) The number of days a session recording must be kept. A value of `-1` indicates an infinite retention. - - `retain-for-overridable`: (Optional) Indicates that a lower scope can override the `retain_for_days` attribute value. Defaults to `true`. - - `delete-after-days`: (Optional) The number of days after creation when a session recording should be deleted. - - `delete-after-overridable`: (Optional) Indicates that a lower scope can override the `delete_after_days` attribute value. Defaults to `true`. - - - - -Apply the following Terraform policy: - -```hcl -resource "boundary_policy_storage" "example" { - name = "soc2-policy" - description = "SOC 2 compliant storage policy for session recordings" - scope_id = data.boundary_scope.org.id - - retain_for_days = 2557 - retain_for_overridable = false - - delete_after_days = 2657 - delete_after_overridable = true -} -``` - - - - -The following API call is an example of creating a storage policy in Boundary: - -```shell-session -$ curl --header "Content-Type: application/json" \ - --header "Authorization: Bearer $(boundary config get-token)" \ - --request POST \ - --data '{"attributes":{"retain_for":{"days":2557,"overridable":false},"delete_after":{"days":2657,"overridable":true}},"scope_id":"global","description":"SOC 2 compliant storage policy for session recordings","name":"soc2-policy","type":"storage"}' \ - $BOUNDARY_ADDR/v1/policies | jq -``` - - - - This example uses [jq](https://stedolan.github.io/jq/download/) to process the JSON output for readability. - - - -**Example output:** - - - -```plaintext -{ - "id": "pst_wV4bWSYYwL", - "scope_id": "global", - "scope": { - "id": "global", - "type": "global", - "name": "global", - "description": "Global Scope" - }, - "name": "soc2-api-test", - "description": "SOC 2 compliant storage policy for session recordings", - "created_time": "2024-01-26T03:44:58.119640Z", - "updated_time": "2024-01-26T03:44:58.119640Z", - "type": "storage", - "version": 1, - "attributes": { - "delete_after": { - "days": 2657, - "overridable": true - }, - "retain_for": { - "days": 2557, - "overridable": false - } - }, - "authorized_actions": [ - "no-op", - "read", - "update", - "delete" - ] -} -``` - - - - - - -In this example, recordings stored within the global scope must be retained for 7 years (2557 days), and will be automatically deleted 100 days later (at 2657 days). Scopes beneath `global` will not be able to override this retention policy, but are able to override the deletion policy. - - - - Boundary does not support an undo action. Storage policies are meant to enforce compliance to a specific law or regulation. Updating the storage policy of a session recording can have immediate and possibly unexpected results such as the immediate deletion of session recordings. - - - -## Attach storage policies to a scope - -You must apply storage policies to a scope (`global` or a specific org) to take effect. Once attached, all recordings within the child scopes inherit the storage policy, unless overridden by a policy applied to the child scope. - -The following example applies the policy created above to an org named `prod-databases` with the org ID `o_aDkVBCDTvY`. - - - - -1. Log in to Boundary. -1. Click **Orgs** in the navigation panel and select the `prod-databases` org. -1. Click **Org Settings** in the navigation panel for the `prod-databases` org. -1. Under **Storage Policy**, click **Add Storage Policy**. -1. Select the `soc2-policy`. -1. Click **Save**. This applies the policy to this scope and its children. - - - - -1. Log in to Boundary. -1. Obtain the storage policy ID: - - - - ```shell-session - $ boundary policies list - Policy information: - ID: pst_WZ3SQSSYJY - Version: 1 - Type: storage - Name: soc2-policy - Description: SOC 2 compliant storage policy for session recordings - Authorized Actions: - read - update - delete - no-op - ``` - - - -1. Use the following command to apply the storage policy to the `prod-databases` org: - - ```shell-session - $ boundary scopes attach-storage-policy \ - -id o_aDkVBCDTvY \ - -storage-policy-id pst_WZ3SQSSYJY - ``` - - - - -Apply the following Terraform policy: - -```hcl -resource "boundary_scope_policy_attachment" "example" { - policy_id = boundary_policy_storage.example.id - scope_id = data.boundary_scope.org.id -} -``` - - - - -The following API call is an example of attaching a storage policy to a scope. - -First, obtain the storage policy ID. - -```shell-session -$ curl --header "Content-Type: application/json" \ - --header "Authorization: Bearer $(boundary config get-token)" \ - --request POST \ - $BOUNDARY_ADDR/v1/policies?scope_id=global' | jq -``` - -In this example, the storage policy ID is `pst_WZ3SQSSYJY`. - -Now attach the policy to the org. - -```shell-session -$ curl --header "Content-Type: application/json" \ - --header "Authorization: Bearer $(boundary config get-token)" \ - --request POST \ - --data '{"storage_policy_id":"pst_WZ3SQSSYJY","version":2}'' \ - $BOUNDARY_ADDR/v1/scopes/o_aDkVBCDTvY:attach-storage-policy' | jq -``` - -**Example output:** - - - -```plaintext -{ - "id": "o_aDkVBCDTvY", - "scope_id": "global", - "scope": { - "id": "global", - "type": "global", - "name": "global", - "description": "Global Scope" - }, - "name": "prod-databases", - "created_time": "2024-01-26T04:22:45.891800Z", - "updated_time": "2024-01-26T05:00:27.333892Z", - "version": 3, - "type": "org", - "authorized_actions": [ - "delete", - "attach-storage-policy", - "detach-storage-policy", - "no-op", - "read", - "update" - ], - "authorized_collection_actions": { - "auth-methods": [ - "create", - "list" - ], - "auth-tokens": [ - "list" - ], - "groups": [ - "create", - "list" - ], - "policies": [ - "list", - "create" - ], - "roles": [ - "list", - "create" - ], - "scopes": [ - "list", - "list-keys", - "rotate-keys", - "list-key-version-destruction-jobs", - "destroy-key-version", - "create" - ], - "session-recordings": [ - "list" - ], - "storage-buckets": [ - "list", - "create" - ], - "users": [ - "create", - "list" - ] - }, - "storage_policy_id": "pst_WZ3SQSSYJY" -} -``` - - - - - - -### Verify attached policies - -Check that the storage policy was successfully attached to the `prod-databases` scope. - - - - -1. Log in to Boundary. -1. Click **Orgs** in the navigation panel and select the `prod-databases` org. -1. Click **Org Settings** in the navigation panel for the `prod-databases` org. -1. Verify that the `soc2-policy` is listed under **Storage Policy**. - - - - -1. Log in to Boundary. -1. Read the details of the `prod-databases` org: - - - - ```shell-session - $ boundary scopes read -id o_aDkVBCDTvY - Scope information: - Created Time: Thu, 25 Jan 2024 21:22:45 MST - ID: o_aDkVBCDTvY - Name: prod-databases - Storage Policy ID: pst_WZ3SQSSYJY - Updated Time: Thu, 25 Jan 2024 22:00:27 MST - Version: 7 - - Scope (parent): - ID: global - Name: global - Type: global - - Authorized Actions: - detach-storage-policy - no-op - read - update - delete - attach-storage-policy - ... - ... More Output ... - ... - ``` - - - - Verify that the `soc2-policy` ID (`pst_WZ3SQSSYJY` in this example) is listed under **Storage Policy ID**. - - - - -The following API call is an example of reading the details of the `prod-databases` scope by ID (`o_aDkVBCDTvY` in this example). - -```shell-session -$ curl --header "Content-Type: application/json" \ - --header "Authorization: Bearer $(boundary config get-token)" \ - --request GET \ - $BOUNDARY_ADDR/v1/scopes/o_aDkVBCDTvY | jq -``` - -**Example output:** - - - -```plaintext -{ - "id": "o_aDkVBCDTvY", - "scope_id": "global", - "scope": { - "id": "global", - "type": "global", - "name": "global", - "description": "Global Scope" - }, - "name": "prod-databases", - "created_time": "2024-01-26T04:22:45.891800Z", - "updated_time": "2024-01-26T05:00:27.333892Z", - "version": 7, - "type": "org", - "authorized_actions": [ - "update", - "delete", - "attach-storage-policy", - "detach-storage-policy", - "no-op", - "read" - ], - "authorized_collection_actions": { - "auth-methods": [ - "create", - "list" - ], - "auth-tokens": [ - "list" - ], - "groups": [ - "create", - "list" - ], - "policies": [ - "list", - "create" - ], - "roles": [ - "list", - "create" - ], - "scopes": [ - "list", - "list-keys", - "rotate-keys", - "list-key-version-destruction-jobs", - "destroy-key-version", - "create" - ], - "session-recordings": [ - "list" - ], - "storage-buckets": [ - "create", - "list" - ], - "users": [ - "create", - "list" - ] - }, - "storage_policy_id": "pst_WZ3SQSSYJY" -} -``` - - - -Verify that the `soc2-policy` ID (`pst_WZ3SQSSYJY` in this example) is listed under `storage_policy_id`. - - - - -### Read and list session recordings - -New session recordings under the `prod-databases` scope should now show a `retain_until` and `delete_after` date corresponding to the `soc2-policy` storage policy. - - - - -1. Create a new session recording on a target within the `prod-databases` org. -1. Log in to Boundary. -1. Click **Session Recordings** in the navigation panel. -1. Click **View** for a new recording that was made after the storage policy was attached to the `prod-databases` scope. -1. Under **Session details**, verify that the *Retain until* and *Delete after* dates match the durations defined in the `soc2-policy`. - - - - -1. Create a new session recording on a target within the `prod-databases` org. -1. Log in to Boundary. -1. List the available session recordings: - - - - ```shell-session - $ boundary session-recordings list - - Session Recording information: - ID: sr_nt5dFeBYdh - Storage Bucket ID: sb_DC8SPb9uc2 - Created Time: Mon, 29 Jan 2024 23:25:31 MST - Updated Time: Tue, 30 Jan 2024 00:26:01 MST - Start Time: Mon, 29 Jan 2024 23:25:32 MST - End Time: Mon, 29 Jan 2024 23:25:53 MST - Type: ssh - State: available - Retain Until: Wed, 29 Jan 2031 23:25:53 MST - Delete After: Sat, 10 May 2031 00:25:53 MDT - Authorized Actions: - reapply-storage-policy - no-op - read - download - delete - ``` - - - - Copy the recording **ID** (such as `sr_nt5dFeBYdh`). - -1. Read the recording details by ID. - - - - ```shell-session - $ boundary session-recordings read -id sr_nt5dFeBYdh - - Session Recording information: - Bytes Down: 710 - Bytes Up: 36 - Created Time: Mon, 29 Jan 2024 23:25:31 MST - Delete After: Sat, 10 May 2031 00:25:53 MDT - Duration (Seconds): 21.01881 - Endpoint: ssh://xx.xxx.xxx.xxx:22 - ID: sr_nt5dFeBYdh - Retain Until: Wed, 29 Jan 2031 23:25:53 MST - Scope ID: global - Start Time: Mon, 29 Jan 2024 23:25:32 MST - State: available - Storage Bucket ID: sb_DC8SPb9uc2 - Type: ssh - Updated Time: Mon, 29 Jan 2024 23:25:53 MST - - ... - ... More Output ... - ... - ``` - - - - Verify that the `Retain Until` and `Delete After` dates match the durations defined in the 'soc2-policy'. - - - - -1. Create a new session recording on a target within the `prod-databases` org. -1. The following API call is an example of reading the details of a session recording with the `soc2-policy` storage policy applied to the `prod-databases` scope. - - List the available session recordings. This example recursively lists all recordings within the global scope. - - ```shell-session - $ curl --header "Content-Type: application/json" \ - --header "Authorization: Bearer $(boundary config get-token)" \ - --request GET \ - $BOUNDARY_ADDR/v1/session-recordings?recursive=true&scope_id=global | jq - ``` - - **Example output:** - - - - ```plaintext - { - "items": [ - { - "id": "sr_nt5dFeBYdh", - "scope": { - "id": "global", - "type": "global", - "name": "global", - "description": "Global Scope" - }, - "storage_bucket_id": "sb_DC8SPb9uc2", - "created_time": "2024-01-30T06:25:31.873628Z", - "updated_time": "2024-01-30T07:26:01.182513Z", - "start_time": "2024-01-30T06:25:32.412373Z", - "end_time": "2024-01-30T06:25:53.431183Z", - "duration": "21.018810s", - "type": "ssh", - "state": "available", - "endpoint": "ssh://xx.xxx.xxx.xxx:22", - "create_time_values": { - "user": { - "id": "u_lLWuYy70Wo", - "name": "admin_user", - "description": "Global admin user", - "scope": { - "id": "global", - "type": "global", - "name": "global", - "description": "Global Scope" - } - }, - "target": { - "id": "tssh_cjTsFSU10p", - "name": "recording-target", - "scope": { - "id": "p_ocJPxzrz2p", - "type": "project", - "name": "recording-project", - "parent_scope_id": "o_aDkVBCDTvY" - }, - "session_max_seconds": 28800, - "session_connection_limit": -1, - "egress_worker_filter": "\"recording-worker\" in \"/tags/type\"", - "type": "ssh", - "attributes": { - "default_port": 22 - } - } - }, - "authorized_actions": [ - "reapply-storage-policy", - "no-op", - "read", - "download", - "delete" - ], - "retain_until": "2031-01-30T06:25:53.431183Z", - "delete_after": "2031-05-10T06:25:53.431183Z" - } - ], - "response_type": "complete", - "list_token": "GnJNt3mPNy6Cp62MUBCnZPdrQF7cvh4udEoW4CjL5k2ufvesMfKAheSJyNHmKf3zwL5aVKHT4P6q", - "sort_by": "created_time", - "sort_dir": "desc", - "est_item_count": 1 - } - ``` - - - -1. Verify that the `retain_until` and `delete_after` dates match the durations defined in the `soc2-policy`. - -Alternatively, the recording details can also be queried directly by ID: - -```shell-session -$ curl --header "Content-Type: application/json" \ - --header "Authorization: Bearer $(boundary config get-token)" \ - --request GET \ - $BOUNDARY_ADDR/v1/session-recordings/sr_nt5dFeBYdh | jq -``` - - - - - - - Existing recordings within a scope or its children do not automatically have new or updated polices applied to them. Policies must be re-applied to existing recordings to take effect. Refer to the [Update storage bucket policies](/boundary/docs/session-recording/compliance/update-storage-policy) page for more details. - - - -### Manual deletion - -Deleting a session recording will set the `delete_after` field of a session recording to the current database time. Deleting a session recording will fail if the retention duration has not been met. - -If `delete_after` or `delete_time` is after the current time, the session recording will no longer be included in list responses; it also cannot be read, downloaded or played back. - -## Next steps - -After the storage policy is configured in Boundary, new recordings within the applied scope adhere to the defined policy. To retroactively apply the configured policy to existing recordings, refer to [update storage bucket policies](/boundary/docs/session-recording/compliance/update-storage-policy). - -[storage bucket]: /boundary/docs/domain-model/storage-buckets -[storage policy]: /boundary/docs/domain-model/storage-policy -[session recordings]: /boundary/docs/domain-model/session-recordings diff --git a/website/content/docs/session-recording/compliance/update-storage-policy.mdx b/website/content/docs/session-recording/compliance/update-storage-policy.mdx deleted file mode 100644 index 5de33c0a2..000000000 --- a/website/content/docs/session-recording/compliance/update-storage-policy.mdx +++ /dev/null @@ -1,355 +0,0 @@ ---- -layout: docs -page_title: Update storage bucket policies -description: >- - Update storage bucket policies to manage the lifecycles of session recordings. Understand how changing a policy affects existing and new recorded sessions. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Update storage bucket policies - -This feature requires HCP Boundary Plus or Boundary Enterprise - -A [storage policy][] codifies [storage bucket][] lifecycle management for [session recordings][]. - -A storage policy exists in either the global scope or an org scope. Storage policies that are created in the global scope can be associated with any org scope. - -When you update a storage policy, new session recordings within a scope where the policy is applied will conform to the updated policy. Existing recordings will maintain the previous policy unless the new policy is retroactively applied. - -This page describes the process for applying updated storage policies to existing recordings within a scope. - -For more information about setting up storage bucket policies, refer to the [configure storage bucket policies](/boundary/docs/session-recording/compliance/configure-storage-policy) page. - -## Requirements - -This page continues the workflows outlined in the [configure storage bucket policies](/boundary/docs/session-recording/compliance/configure-storage-policy) page. The requirements outlined in that page are prerequisites for the workflow defined below. - -To apply an updated storage policy to existing session recordings, you first need: - -1. An external storage provider configured to store session recordings. -1. A Boundary worker configured for local storage. -1. A Boundary storage bucket with a defined retention and/or deletion policy. -1. A scope with the storage policy attached. -1. A set of session recordings made when the storage policy was attached. - -The policies mentioned here demonstrate how to apply an updated storage policy to an existing set of [session recordings][]. - -## Storage policy changes - -A storage policy defines how long the recording within a scope should retain its session recordings. - -Over time, you may update storage policies to reflect new organizational requirements, compliance changes, or cost management strategies. While updated policies automatically apply to new session recordings within the scopes associated with that policy, existing recordings maintain the previous policies unless you apply the new policy directly to those recordings. - -In the [configure storage bucket policies](/boundary/docs/session-recording/compliance/configure-storage-policy) page, the following policy was created to implement compliance with SOC-2 retention requirement of 7 years: - -- Name: `soc2-policy` -- Description: `SOC 2 compliant storage policy for session recordings` -- Retention policy: `2557` days, Overridable: `false` -- Deletion policy: `2657` days, Overridable: `true` - -## Update a storage policy - -In the following example, the `soc2-policy` should be updated to the following: - -- Name: `soc2-policy` -- Description: `SOC 2 compliant storage policy for session recordings, V2` -- Retention policy: `2557` days, Overridable: `false` -- Deletion policy: `2757` days, Overridable: `false` - -The updated policy requires the deletion of recordings after `2757` days, 200 days after the standard SOC 2 retention requirements. It also changes Overridable to `false`, preventing lower scopes from overwriting the Deletion policy. - -The following is an example of updating the `soc2-policy` policy. - - - - -1. Log in to Boundary. -1. Select **Storage Policies** in the navigation panel and select the `global` scope. -1. Click on **`soc2-policy`**. -1. Click the **Edit Form** button and update the following fields: - - **Description**: `SOC 2 compliant storage policy for session recordings, V2` - - **Retention Policy**: `SOC 2 (7 years)` - - **Deletion Policy**: `Custom` - - **Delete after**: `2757` days - - Toggle the switch beside **Allow orgs to override** to the off position. - -1. Click **Save**. - - - - -1. Log in to Boundary. -1. List the available storage policies and copy the `soc2-policy` ID. - - - - ```shell-session - $ boundary policies list - Policy information: - ID: pst_WZ3SQSSYJY - Version: 1 - Type: storage - Name: soc2-policy - Description: SOC 2 compliant storage policy for session recordings - Authorized Actions: - read - update - delete - no-op - ``` - - - -1. Use the following command to update the `soc2-policy` storage policy to reflect the new deletion requirements: - - ```shell-session - $ boundary policies update storage \ - -id pst_WZ3SQSSYJY \ - -description 'SOC 2 compliant storage policy for session recordings, V2' \ - -scope-id global \ - -retain-for-days 2557 \ - -retain-for-overridable false \ - -delete-after-days 2757 \ - -delete-after-overridable false - ``` - - - - -Due to the declarative nature of Terraform, you update policies by modifying your existing Terraform configuration. To perform the requested changes, update your existing block of code as shown below, and then execute `terraform apply`. - -```hcl -resource "boundary_policy_storage" "example" { - name = "soc2-policy" - v2" - scope_id = data.boundary_scope.org.id - - retain_for_days = 2557 - retain_for_overridable = false - - delete_after_days = 2757 - delete_after_overridable = false -} -``` - - - - -The following API call is an example of updating a storage policy in Boundary: - -```shell-session -$ curl --header "Content-Type: application/json" \ - --header "Authorization: Bearer $(boundary config get-token)" \ - --request PATCH \ - --data '{"attributes":{"retain_for":{"days":2557,"overridable":false},"delete_after":{"days":2757,"overridable":false}},"scope_id":"global","description":"SOC 2 compliant storage policy for session recordings, V2","type":"storage","version":"2"}' \ - $BOUNDARY_ADDR/v1/policies/pst_WZ3SQSSYJY | jq -``` - - - - This example uses [jq](https://stedolan.github.io/jq/download/) to process the JSON output for readability. - - - -**Example output:** - - - -```plaintext -{ - "id": "pst_WZ3SQSSYJY", - "scope_id": "global", - "scope": { - "id": "global", - "type": "global", - "name": "global", - "description": "Global Scope" - }, - "name": "soc2-policy", - "description": "SOC 2 compliant storage policy for session recordings, V2", - "created_time": "2024-01-25T22:05:52.112677Z", - "updated_time": "2024-01-30T22:44:08.890715Z", - "type": "storage", - "version": 2, - "attributes": { - "delete_after": { - "days": 2757, - "overridable": false - }, - "retain_for": { - "days": 2557, - "overridable": false - } - }, - "authorized_actions": [ - "no-op", - "read", - "update", - "delete" - ] -} -``` - - - - - - -This policy was applied to the `prod-databases` org in the [configure storage bucket policies](/boundary/docs/session-recording/compliance/configure-storage-policy) page. - -New recordings within the `prod-databases` org will automatically have the updated version of the `soc2-policy` applied. - -### Reapply a storage policy - -Many organizations compliance standards will require that previous versions of storage policies remain applied to existing recordings. - - - - During the initial migration to a Boundary version that includes storage policies, all existing session recordings will have a `retain_for` attribute of `-1`, which retains the recording forever. - - - -In the event that an updated policy should be retroactively applied to existing session recordings, you must reapply the storage policy. - - - - -1. Log in to Boundary. -1. Select **Session Recordings** in the navigation panel in the `global` scope. -1. Click on **View** for a session recording that should have the storage policy re-applied. -1. Click the **Manage** dropdown and select **Re-apply storage policy**. -1. Verify the *Delete after* field has been updated under the recording's **Session details**. - - - - -1. Log in to Boundary. -1. Find the ID of the session recording that should have the storage policy re-applied. - - - - ```shell-session - $ boundary session-recordings list - Session Recording information: - ID: sr_nt5dFeBYdh - Storage Bucket ID: sb_DC8SPb9uc2 - Created Time: Mon, 29 Jan 2024 23:25:31 MST - Updated Time: Tue, 30 Jan 2024 16:14:13 MST - Start Time: Mon, 29 Jan 2024 23:25:32 MST - End Time: Mon, 29 Jan 2024 23:25:53 MST - Type: ssh - State: available - Retain Until: Wed, 29 Jan 2031 23:25:53 MST - Delete After: Mon, 18 Aug 2031 00:25:53 MDT - Authorized Actions: - no-op - read - download - delete - reapply-storage-policy - ``` - - - -1. Re-apply the storage policy to the session recording by providing its ID: - - - - ```shell-session - $ boundary session-recordings reapply-storage-policy -id sr_nt5dFeBYdh - Session Recording information: - Bytes Down: 710 - Bytes Up: 36 - Created Time: Mon, 29 Jan 2024 23:25:31 MST - Delete After: Mon, 18 Aug 2031 00:25:53 MDT - Duration (Seconds): 21.01881 - Endpoint: ssh://54.159.144.135:22 - ID: sr_nt5dFeBYdh - Retain Until: Wed, 29 Jan 2031 23:25:53 MST - Scope ID: global - Start Time: Mon, 29 Jan 2024 23:25:32 MST - State: available - Storage Bucket ID: sb_DC8SPb9uc2 - Type: ssh - Updated Time: Mon, 29 Jan 2024 23:25:53 MST - - ... - ... More Output ... - ... - ``` - - - - Verify that the `Delete After` attribute reflects the updated storage policy. - - - - -Once the policy changes have been applied with Terraform, you can reapply the policy as needed by following the CLI instructions in this section. - - - - -The following API call is an example of re-applying a storage policy to a session recording by providing the recording's ID: - -```shell-session -$ curl --header "Content-Type: application/json" \ - --header "Authorization: Bearer $(boundary config get-token)" \ - --request POST \ - $BOUNDARY_ADDR/v1/session-recordings/sr_nt5dFeBYdh:reapply-storage-policy | jq -``` - -**Example output:** - - - -```plaintext -{ - "id": "sr_nt5dFeBYdh", - "scope": { - "id": "global", - "type": "global", - "name": "global", - "description": "Global Scope" - }, - "storage_bucket_id": "sb_DC8SPb9uc2", - "bytes_up": "36", - "bytes_down": "710", - "created_time": "2024-01-30T06:25:31.873628Z", - "updated_time": "2024-01-30T23:14:13.881110Z", - "start_time": "2024-01-30T06:25:32.412373Z", - "end_time": "2024-01-30T06:25:53.431183Z", - "duration": "21.018810s", - "type": "ssh", - "state": "available", - "endpoint": "ssh://xx.xxx.xxx.xxx:22", - -... -... More Output ... -... - - "retain_until": "2031-01-30T06:25:53.431183Z", - "delete_after": "2031-08-18T06:25:53.431183Z" -} -``` - - - -Verify that the `delete_after` attribute reflects the updated storage policy. - - - - -### Detached or deleted storage policies - -If a scope's storage policy is detached or deleted, new session recordings within that scope will automatically be retained forever, unless there is an overriding policy. - -Existing session recordings will maintain their existing storage policy attributes until a new policy is re-applied, including any overriding policy from another scope. - -[storage bucket]: /boundary/docs/domain-model/storage-buckets -[storage policy]: /boundary/docs/domain-model/storage-policy -[session recordings]: /boundary/docs/domain-model/session-recordings diff --git a/website/content/docs/session-recording/compliance/validate-data-store.mdx b/website/content/docs/session-recording/compliance/validate-data-store.mdx deleted file mode 100644 index efaea6095..000000000 --- a/website/content/docs/session-recording/compliance/validate-data-store.mdx +++ /dev/null @@ -1,24 +0,0 @@ ---- -layout: docs -page_title: Validate data integrity in the external object store -description: >- - Learn about how Boundary validates the data integrity of the BSR file in the external data store to ensure that the file has not been tampered with. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -# How Boundary validates data integrity in the external object store - -This feature requires HCP Boundary or Boundary Enterprise - -When a Boundary worker uploads a BSR file to AWS S3 through the Boundary AWS plugin, the plugin calculates the SHA256 checksum of the contents of the BSR file and attaches this information to the object that is uploaded to S3. -The SHA256 checksum value attached to the S3 object is returned to the Boundary worker. -The Boundary worker calculates the SHA256 checksum value of the BSR file's content from -local disk and compares it to the plugin value. - -This process ensures that no tampering of BSR files occurs between the worker, plugin, and S3. -The SHA256 checksum value generated by the plugin is not a part of the BSR file structure and should not be confused with how Boundary cryptographically verifies the BSR directory's contents. - -For more information, refer to the [overview of session recording](/boundary/docs/session-recording). \ No newline at end of file diff --git a/website/content/docs/session-recording/compliance/validate-session-recordings.mdx b/website/content/docs/session-recording/compliance/validate-session-recordings.mdx deleted file mode 100644 index 5bc0903d2..000000000 --- a/website/content/docs/session-recording/compliance/validate-session-recordings.mdx +++ /dev/null @@ -1,68 +0,0 @@ ---- -layout: docs -page_title: Validate recorded session integrity -description: >- - View the components of the Boundary Session Recording (BSR) file. Verify the integrity of the contents of a BSR cryptographically to ensure security compliance. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Validate the integrity of session recordings - -This feature requires HCP Boundary or Boundary Enterprise - -BSR directories are validated based on the contents in the directory. -Boundary cryptographically verifies each individual Boundary Session Recording (BSR) file. -The keys used for verifying all Boundary Session Recording files are written to storage and wrapped by the KMS you configured. -Each session recording has its own individual key. -Boundary generates the following keys when a session recording is authorized: - -- The BSR key is a plaintext AES-GCM key. -It is not uploaded to the external object store. - -- The private and public key pair is a ed25519 key pair. -The key pair is not uploaded to the external object store. - -The following files are stored in the BSR file structure to ensure the integrity of a session recording: - -- `bsrKey.pub` is the public ed25519 key. -- `wrappedBsrKey` is the BSR key wrapped by the external KMS AES-GCM key that you configure. -- `wrappedPrivKey` is the private ed25519 key wrapped by the external KMS AES-GCM key that you configure. -- `pubKeySelfSignature.sign` is a self-signature of the plaintext public ed25519 key created with its private key. -- `pubKeyBsrSignature.sign` is a signature of the plaintext public ed25519 key created with the BSR key. -- `SHA256SUM.sig` is a signature of the plaintext `SHA256SUM` file created with the private key. - -Encrypting the BSR key with an external KMS means that Boundary is not responsible for the longevity of the keys. -The Boundary admin can always use that external KMS to unwrap the `wrappedBsrKey` and `wrappedPrivKey`. -A BSR’s key is encrypted using the `go-kms-wrapping` package, and therefore the encrypted BlobInfo includes the metadata required to identify the key-version used during encryption. -So if the wrapper is reinitialized properly, you can unwrap the keys even if the key has been rotated. - -Each BSR directory contains a SHA256SUM and SHA256SUM.sig file that you can use to cryptographically verify the BSR directory's contents. -The SHA256SUM file contains rows of file names paired with a checksum for the file contents. -The SHA256SUM.sig is a copy of the SHA256SUM file, signed with the BSR's private key. -Refer to the following example of a SHA256SUM file: - - ``` - dc8ce2c42553ce510197c99efe21d89d6229feb4b49170511f49965f2e3cf1a3 wrappedBsrKey - a5a91b1b52fb53c4bab661b2e5846bb2a836f050e3d745e436078871914a0bc2 wrappedPrivKey - 1ca281852ec0d447b94708f28a51b562d47b84affdba25e13a97b0fbd9126424 pubKeyBsrSignature.sign - 7b5e18e5930bb4cce12a3f203328d9065cae29f26aba3963bb5faece2cf97231 pubKeySelfSignature.sign - dc7c6b1316624c7c486a22bab157f947df92b9f2ce4a72469b1f335399a043d5 bsrKey.pub - 4d3966c458f4e5d67f9ac70b804540b927c718965267c3f36526bf0b18c40ad9 session-meta.json - 6fec2173d331828677fb5e77fc19168daad3c5f0e82517a82e5701e6c2bdcbe1 session-recording.meta - ad76483e7cf3e65391a3a1d0b86a3ad436333ee225bea042b13900abc188b226 session-recording-summary.json - ``` - -Follow these steps to validate a session recording: - -1. Unwrap `wrappedBsrKey` using the external KMS you configured to retrieve the BSR key. -2. Unwrap `wrappedPrivKey` using the external KMS you configured to retrieve the private key. -3. Use the BSR key or the private key to verify the `bsrKey.pub` key using `go-kms-wrapping` HmacSha256(...). -4. When the key is verified, use the `bsrKey.pub` key to verify the BSR SHA256SUM.sig file using `go-kms-wrapping` ed25519.Sign(...). -5. After verifying the SHA256SUM.sig file, use the `sha256` commandline tool to verify BSR checksums using `sha256sum -c SHA256SUM`. -6. Examine the *.meta files in the directory. For session-recording.meta, every connection logged in the meta file should -correspond to a connection folder in the directory. For a connection-recording.meta, every channel logged in the meta file should -correspond to a channel folder in the directory. diff --git a/website/content/docs/session-recording/configuration/configure-worker-storage.mdx b/website/content/docs/session-recording/configuration/configure-worker-storage.mdx deleted file mode 100644 index 4afad6a20..000000000 --- a/website/content/docs/session-recording/configuration/configure-worker-storage.mdx +++ /dev/null @@ -1,120 +0,0 @@ ---- -layout: docs -page_title: Configure workers for local storage -description: >- - Configure workers for session recording storage. View requirements and an example configuration. Understand possible storage states for local and remote storage. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Configure workers for session recording - -This feature requires HCP Boundary or Boundary Enterprise - -Session recording requires that you configure at least one worker for local storage. - - - - You cannot use an HCP managed worker for the local storage. HCP Boundary users must configure a self-managed worker to enable session recording. - - - -## Requirements - -Workers that you configure for storage must: - -- Have access to the external storage provider -- Have an accessible directory defined by `recording_storage_path` for storing session recordings while they are in progress. On session closure, Boundary moves the local session recording to remote storage and deletes the local copy. - - For HCP Boundary, refer to the [Self-managed worker configuration](/hcp/docs/boundary/self-managed-workers/session-recording) documentation. - - For Boundary Enterprise, refer to the refer to the [worker configuration](/boundary/docs/workers#session-recording) documentation. -- Have available disk space defined by `recording_storage_minimum_available_capacity`. If you do not configure the minimum available storage capacity, Boundary uses the default value of 500MiB. -For more information about how much space is required to store BSR files, refer to [storage considerations](/boundary/docs/session-recording#storage-considerations). -- Run Darwin, Windows, or Linux. The following binaries are not supported for session recording: NetBSD, OpenBSD, Solaris. - -## Local storage - -Workers require sufficient local disk space in the `recording_storage_path` to store session recordings while they are in progress. Local disk space is also required for session recording playback. - -The `recording_storage_minimum_available_capacity` vaule defines the minimum available disk space that must be available on the worker for session recording and session recording playback. This threshold determines the local storage state of the worker. - -The possible storage states determined by the `recording_storage_minimum_available_capacity` are: - -- `Available`: The worker is above the storage threshold and is available to proxy sessions that are enabled with session recording. - -- `Low storage`: The worker is below the storage threshold. Existing sessions can continue without interruption, but new sessions that are enabled with session recording cannot be proxied. The worker is not available to record new sessions or play back existing recordings. - -- `Critically low storage`: The worker is below half the storage threshold. Existing sessions that are enabled with session recording will be forcefully closed. The worker is not available to record new sessions or play back existing recordings. - -- `Out of storage`: The worker is out of local disk space. It is not available to record new sessions or play back existing recordings. The worker is in a unrecoverable state. An administrator must intervene to remedy the issue. - -- `Not configured`: The worker does not have a `recording_storage_path` configured. - -- `Unknown`: The default local storage state of a worker. This state indicates that the local storage state of a worker is not yet known. Older workers (< 0.16.0) will be in this state. - -If a worker is in an unhealthy local storage state, Boundary does not allow new session recordings or session recording playback until the worker is in an `available` local storage state. - -## Remote storage state - -The workers that you configure for session recording storage must have access to the external object store. Workers report permission states back to Boundary, depending on the availability of the external object store. -Boundary uses the permission states to determine what actions the worker can perform on the configured external storage. - -Workers can have the following permission states: - -- `read`: The worker can read from the external storage. It can also play back recorded sessions, if the permission state is `ok`. -- `write`: The worker can write to the external storage. It can also record sessions, if the permission state is `ok`. -- `delete`: The worker can delete data from the external storage. It can also clean up recorded sessions, if the permission state is `ok`. - -Boundary uses the permission states to determine the remote storage state of a worker. The worker can have the following remote storage states: -- `available`: All permission states are healthy. The worker has the required access to the external storage. -- `error`: One or more of the permission states are not healthy. Workers may not be able to perform certain actions on the external storage. - -Boundary periodically checks the states of any workers that use the external storage, and then reports them back to the controller. - -You can check the remote storage state of a worker using the `boundary workers read -id $WORKER_ID` command. - -``` -Worker information: - Active Connection Count: 0 - Address: 0.0.0.0:9202 - Created Time: Tue, 04 Jun 2024 13:52:27 PDT - ID: w_RPfBj239to - Last Status Time: 2024-06-04 20:55:35.589282 +0000 UTC - Local Storage State: available - Remote Storage State: - sb_fhde575e: - Status: available - Permissions: - Write: ok - Read: ok - Delete: ok - sb_jksdgh4: - Status: error - Permissions: - Write: error - Read: ok - Delete: ok - Release Version: Boundary v0.17.0+ent - Type: pki - Updated Time: Tue, 04 Jun 2024 13:55:35 PDT - Version: 1 -``` - -## Example configuration - -Refer to the following example configuration to configure workers for session recording storage: - -```hcl -worker { - auth_storage_path = "/boundary/demo-worker-1" - initial_upstreams = ["10.0.0.1"] - recording_storage_path = "/local/storage/directory" - recording_storage_minimum_available_capacity = "500MB" -} -``` - -## Next steps - -After you configure worker storage, you can configure the external storage for [Amazon S3](/boundary/docs/session-recording/configuration/storage-providers/configure-s3), [MinIO](/boundary/docs/session-recording/configuration/storage-providers/configure-minio), or an [S3-compliant provider](/boundary/docs/session-recording/configuration/storage-providers/configure-s3-compliant). \ No newline at end of file diff --git a/website/content/docs/session-recording/configuration/create-storage-bucket.mdx b/website/content/docs/session-recording/configuration/create-storage-bucket.mdx deleted file mode 100644 index aaaac2388..000000000 --- a/website/content/docs/session-recording/configuration/create-storage-bucket.mdx +++ /dev/null @@ -1,490 +0,0 @@ ---- -layout: docs -page_title: Create a storage bucket -description: >- - Create a storage bucket in an external storage provider to store recorded sessions. You can review recorded sessions later for compliance and threat management. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Create a storage bucket - -This feature requires HCP Boundary Plus or Boundary Enterprise - -You can record and audit user sessions. A Boundary resource known as a [storage bucket](/boundary/docs/domain-model/storage-buckets) is used to store the recorded sessions. -The storage bucket represents a bucket in an external storage provider. -Before you can enable session recording, you must create one or more storage buckets in Boundary and associate them with the external store. - -A storage bucket can only belong to the global scope or an org scope. A storage bucket that is associated with the global scope can be associated with any target. However, a storage bucket in an Org scope can only be associated with targets in a project from the same org scope. Any storage buckets associated with an Org scope are deleted when the org itself is deleted. - -## Requirements - -Before you create a storage bucket in Boundary, you must: - -- [Configure workers for storage](/boundary/docs/session-recording/configuration/configure-worker-storage) -- Configure one of the following storage providers: - - [Amazon S3](/boundary/docs/session-recording/configuration/storage-providers/configure-s3) - - [MinIO](/boundary/docs/session-recording/configuration/storage-providers/configure-minio) - - [S3-compliant](/boundary/docs/session-recording/configuration/storage-providers/configure-s3-compliant) - -## Create a storage bucket - -Select a storage provider. - - - - -Complete the following steps to create a storage bucket in Boundary. - - - - -1. Log in to Boundary. -1. Click **Storage Buckets** in the navigation bar. -1. Click **New Storage Bucket**. -1. Complete the following fields to create the Boundary storage bucket: - - **Name**: (Optional) The name field is optional, but if you enter a name it must be unique. - - **Description**: (Optional) An optional description of the Boundary storage bucket for identification purposes. - - **Scope**: (Required) A storage bucket can belong to the Global scope or an Org scope. - It can only associated with targets from the scope it belongs to. - - **Provider**: (Required) The external storage bucket provider. - - **Bucket name**: (Required) Name of the AWS bucket you want to associate with the Boundary storage bucket. - - **Bucket prefix**: (Optional) A base path where session recordings are stored. - - **Region**: (Required) The AWS region to use. - - **Credential type**: (Required) The type of credential you want to use to authenticate to the external storage. - The required fields for creating a storage bucket vary depending on whether you configured the Amazon S3 bucket with static or dynamic credentials: - - **Static**: Authenticates to the storage bucket using an access key that AWS generates. - - **Dynamic**: Authenticates to the storage bucket using credentials that were generated by AWS `AssumeRole`. - - - - - - **Access key ID**: (Required) The access key ID that AWS generates for the IAM user to use with the storage bucket. - - **Secret access key**: (Required) The secret access key that AWS generates for the IAM user to use with this storage bucket. - - **Worker filter**: (Required) A filter expression that indicates which Boundary workers have access to the storage. The filter must match an existing worker to create a Boundary storage bucket. This should be a boolean expression. To generate a worker filter in the correct format, toggle the **Show filter generator** switch. Refer to [the filter example for storage buckets](/boundary/docs/workers/filters#example-worker-filter-for-storage-buckets) to learn about worker tags and filters. - - **Disable credential rotation**: (Optional) Prevents the AWS plugin from automatically rotating credentials. - - Although credentials are stored encrypted in Boundary, by default the [AWS plugin](https://github.com/hashicorp/boundary-plugin-aws) attempts to rotate the credentials you provide. The given credentials are used to create a new credential, and then the original credential is revoked. - After rotation, only Boundary knows the client secret the plugin uses. - - - - - - **Role ARN**: (Required) The ARN (Amazon Resource Name) role that is attached to the EC2 instance that the self-managed worker runs on. - - **Role external ID**: (Optional) A required value if you delegate third party access to your AWS resources. - For more information, refer to the AWS documentation for [How to use an external ID when granting access to your AWS resources to a third party](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html). - - **Role session name**: (Optional) A unique identifier for the AWS session. - You can use this value to control how IAM principals and applications name their role sesions when they assume an IAM role. - By providing a session name, you enable tracking session actions in AWS CloudTrail logs. - For more information, refer to the AWS documentation for [Logging IAM and AWS STS API calls with AWS CloudTrail](https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html). - - **Role tags**: An object with key-value pair attributes that is passed when you assume an IAM role. - For more information, refer to the AWS documentation for [Passing session tags in AWS STS](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html). - - **Worker filter**: (Required) A filter expression that indicates which Boundary workers have access to the storage. The filter must match an existing worker to create a Boundary storage bucket. This should be a boolean expression. To generate a worker filter in the correct format, toggle the **Show filter generator** switch. Refer to [the filter example for storage buckets](/boundary/docs/workers/filters#example-worker-filter-for-storage-buckets) to learn about worker tags and filters. - - **Disable credential rotation**: (Required) Prevents the AWS plugin from automatically rotating credentials. - This option is required if you use dynamic credentials. - - - - -1. Click **Save**. - - - - -The required fields for creating a storage bucket depend on whether you configured the Amazon S3 bucket with static or dynamic credentials: - - - - - - - The preferred way to authenticate to the S3 bucket is by using dynamic credentials. The example below uses static credentials instead. - - - -1. Log in to Boundary. -1. Use the following command to create a storage bucket in Boundary: - - ```shell-session - $ boundary storage-buckets create \ - -bucket-name mybucket1 \ - -plugin-name aws \ - -scope-id o_1234567890 \ - -worker-filter ‘“aws-worker” in “/tags/type”’ \ - -secret ‘{“access_key_id”: “123456789” , “secret_access_key” : “123/456789/12345678”}’ \ - -attributes ‘{“region”:”us-east-1”,”disable_credential_rotation”:true}’ - ``` - - Replace the values above with the following required AWS secrets and any [attributes](/boundary/docs/domain-model/storage-buckets) you want to associate with the Boundary storage bucket: - - - `region`: (Required) The AWS region to use. - - `bucket-name`: (Required) The name of the AWS bucket you want to associate with the Boundary storage bucket. - - `plugin-name`: (Required) The name of the Boundary storage plugin. - - `scope_id`: (Required) A storage bucket can belong to the Global scope or an Org scope. - - `worker-filter`: (Required) A filter expression that indicates which Boundary workers have access to the storage. The filter must match an existing worker in order to create a Boundary storage bucket. Refer to [the filter example for storage buckets](/boundary/docs/workers/filters#example-worker-filter-for-storage-buckets) to learn about worker tags and filters. - - `secret`: (Required) The AWS credentials to use. - - `access_key_id`: (Required) The AWS access key to use. - - `secret_access_key_id`: (Required) The AWS secret access key to use. - This attribute contains the secret access key for static credentials. - - `attributes` or `-attr`: Attributes of the Amazon S3 storage bucket. - - `shared_credentials_file`: (Optional) The shared credentials file to use. - - `shared_credentials_profile`: (Optional) The profile name to use in the shared credentials file. - - `disable_credential_rotation`: (Optional) Prevents the AWS plugin from automatically rotating credentials. - - Although credentials are stored encrypted in Boundary, by default the [AWS plugin](https://github.com/hashicorp/boundary-plugin-aws) attempts to rotate the credentials you provide. The given credentials are used to create a new credential, and then the original credential is revoked. After rotation, only Boundary knows the client secret the plugin uses. - - - - - -1. Log in to Boundary. -1. Use the following command to create a storage bucket in Boundary: - - ```shell-session - $ boundary storage-buckets create \ - -bucket-name mys3bucket \ - -plugin-name aws \ - -scope-id o_1234567890 \ - -worker-filter ‘“s3” in “/tags/type”’ \ - -attributes ‘{“region”:”us-east-1”,”disable_credential_rotation”:true,"role_arn":"arn:aws:iam::123456789012:role/S3Access"}’ - ``` - - Replace the values above with the following required AWS secrets and any [attributes](/boundary/docs/domain-model/storage-buckets) you want to associate with the Boundary storage bucket: - - - `region`: (Required) The AWS region to use. - - `bucket-name`: (Required) The name of the AWS bucket you want to associate with the Boundary storage bucket. - - `plugin-name`: (Required) The name of the Boundary storage plugin. - - `scope_id`: (Required) A storage bucket can belong to the Global scope or an Org scope. - - `worker-filter`: (Required) A filter expression that indicates which Boundary workers have access to the storage. The filter must match an existing worker in order to create a Boundary storage bucket. Refer to [the filter example for storage buckets](/boundary/docs/workers/filters#example-worker-filter-for-storage-buckets) to learn about worker tags and filters. - - `attributes` or `-attr`: Attributes of the Amazon S3 storage bucket. - - `role_arn`: (Required) The ARN (Amazon Resource Name) role that is attached to the EC2 instance that the self-managed worker runs on. - - `role_external_id`: (Optional) A required value if you delegate third party access to your AWS resources. - For more information, refer to the AWS documentation for [How to use an external ID when granting access to your AWS resources to a third party](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html). - - `role_session_name`: (Optional) A unique identifier for the AWS session. - You can use this value to control how IAM principals and applications name their role sesions when they assume an IAM role. - By providing a session name, you enable tracking session actions in AWS CloudTrail logs. - For more information, refer to the AWS documentation for [Logging IAM and AWS STS API calls with AWS CloudTrail](https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html). - - `role_tags`: (Optional) An object with key-value pair attributes that is passed when you assume an IAM role. - For more information, refer to the AWS documentation for [Passing session tags in AWS STS](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html). - - - - - - - -The HCL code for creating a storage bucket is different depending on whether you configured the AWS S3 bucket with static or dynamic credentials. This page provides example configurations for a generic Terraform deployment. - -Refer to the [Boundary Terraform provider documentation](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs) to learn about the requirements for the following example attributes. - -Support for Amazon S3 storage providers leverages the [Boundary AWS plugin](https://github.com/hashicorp/boundary-plugin-aws). - - - - - - - The preferred way to authenticate to the S3 bucket is by using dynamic credentials. The code below uses static credentials instead. - - - -Apply the following Terraform policy: - -```hcl -resource "boundary_storage_bucket" "aws_static_credentials_example" { - name = "My aws storage bucket with static credentials" - description = "My first storage bucket" - scope_id = "o_1234567890" - plugin_name = "aws" - bucket_name = "mybucket1" - attributes_json = jsonencode({ "region" = "us-east-1" }) - - # recommended to pass in aws secrets using a file() or using environment variables - # the secrets below must be generated in aws using an iam user with programmatic access - secrets_json = jsonencode({ - "access_key_id" = "aws_access_key_id_value", - "secret_access_key" = "aws_secret_access_key_value" - }) - worker_filter = "\"aws-worker\" in \"/tags/type\"" -} - -output "storage_bucket_id" { - value = boundary_storage_bucket.aws_static_credentials_example.id -} -``` - - - - -Apply the following Terraform policy: - -```hcl -resource "boundary_storage_bucket" "aws_dynamic_credentials_example" { - name = "My aws storage bucket with dynamic credentials" - description = "My first storage bucket" - scope_id = "o_1234567890" - plugin_name = "aws" - bucket_name = "mybucket1" - - # the role_arn value should be the same arn used in the instance profile attached to the ec2 instance - # https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html - attributes_json = jsonencode({ - "region" = "us-east-1" - "role_arn" = "arn:aws:iam::123456789012:role/S3Access" - "disable_credential_rotation" = true - }) - worker_filter = "\"s3-worker\" in \"/tags/type\"" -} - -output "storage_bucket_id" { - value = boundary_storage_bucket.aws_dynamic_credentials_example.id -} -``` - - - - - - - - - - -Complete the following steps to create a storage bucket in Boundary. - - - - MinIO requires a service account and its associated access keys to set up a Boundary storage bucket. Refer to the [Configure MinIO](/boundary/docs/session-recording/configuration/storage-providers/configure-minio#minio-requirements) page to learn more. - - - - - - -1. Log in to Boundary. -1. Click **Storage Buckets** in the navigation bar. -1. Click **New Storage Bucket**. -1. Complete the following fields to create the Boundary storage bucket: - - **Name**: (Optional) The name field is optional, but if you enter a name it must be unique. - - **Description**: (Optional) An optional description of the Boundary storage bucket for identification purposes. - - **Scope**: (Required) A storage bucket can belong to the Global scope or an Org scope. - It can only be associated with targets from the scope it belongs to. - - **Provider**: (Required) The external storage bucket provider. - - **Endpoint URL**: (Required) The fully-qualified endpoint pointing to a MinIO S3 API, such as `https://my-minio-instance.dev:9000`. - - **Bucket name**: (Required) Name of the AWS bucket you want to associate with the Boundary storage bucket. - - **Region**: (Optional) The region to configure the storage bucket for. - - **Access key ID** (Required): The MinIO service account's access key to use with this storage bucket. - - **Secret access key** (Required): The MinIO service account's secret key to use with this storage bucket. - - **Worker filter**: (Required) A filter expression that indicates which Boundary workers have access to the storage. The filter must match an existing worker to create a Boundary storage bucket. This should be a boolean expression. To generate a worker filter in the correct format, toggle the **Show filter generator** switch. Refer to [the filter example for storage buckets](/boundary/docs/workers/filters#example-worker-filter-for-storage-buckets) to learn about worker tags and filters. - - **Disable credential rotation**: (Optional) Controls whether the plugin will rotate the incoming credentials and manage a new MinIO service account. If this attribute is set to false, or not provided, the plugin will rotate the incoming credentials, using them to create a new MinIO service account, then delete the incoming credentials. - -1. Click **Save**. - - - - -1. Log in to Boundary. -1. Use the following command to create a storage bucket in Boundary: - - ```shell-session - $ boundary storage-buckets create \ - -bucket-name myminiobucket \ - -plugin-name minio \ - -scope-id o_1234567890 \ - -bucket-prefix="foo/bar/zoo" \ - -worker-filter '"minio-worker" in "/tags/type"' \ - -attr endpoint_url="https://my-minio-instance.dev:9000" \ - -attr region="REGION" \ - -attr disable_credential_rotation=true \ - -secret access_key_id="KEY" \ - -secret secret_access_key="SECRET" - ``` - - Replace the values above with the following required secrets and any optional [attributes](/boundary/docs/domain-model/storage-buckets) you want to associate with the Boundary storage bucket: - - - `bucket-name`: (Required) Name of the MinIO bucket you want to associate with the Boundary storage bucket. - - `plugin-name`: (Required) The name of the Boundary storage plugin. - - `scope_id`: (Required) A storage bucket can belong to the Global scope or an Org scope. - - `worker-filter`: (Required) A filter expression that indicates which Boundary workers have access to the storage. The filter must match an existing worker in order to create a Boundary storage bucket. Refer to [the filter example for storage buckets](/boundary/docs/workers/filters#example-worker-filter-for-storage-buckets) to learn about worker tags and filters. - - `secret`: (Required) The MinIO credentials to use. - - `access_key_id` (Required): The MinIO service account's access key to use with this storage bucket. - - `secret_access_key` (Required): The MinIO service account's secret key to use with this storage bucket. - - `attributes` or `-attr`: Attributes of the MinIO storage bucket. - - `endpoint_url` (Required): Fully-qualified endpoint pointing to a MinIO S3 API. - - `region`: (Optional) The region to configure the storage bucket for. - - `disable_credential_rotation`: (Optional) Controls whether the plugin will rotate the incoming credentials and manage a new MinIO service account. If this attribute is set to `false`, or not provided, the plugin will rotate the incoming credentials to create a new MinIO service account, then delete the incoming credentials. - - This option must be set to `true` if you use dynamic credentials. - - - - -This page provides example configurations for a generic Terraform deployment. - -Refer to the [Boundary Terraform provider documentation](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs) to learn about the requirements for the following example attributes. - -Support for MinIO storage providers leverages the [Boundary MinIO plugin](https://github.com/hashicorp/boundary-plugin-minio). - -Apply the following Terraform policy: - -```hcl -resource "boundary_storage_bucket" "minio_credentials_example" { - name = "My MinIO storage bucket" - description = "My first storage bucket" - scope_id = "o_1234567890" - plugin_name = "minio" - bucket_name = "mybucket1" - - attributes_json = jsonencode({ - "endpoint_url" = "minio_access_key_id_value", - "disable_credential_rotation" = true - }) - - secrets_json = jsonencode({ - "access_key_id" = "minio_access_key_id_value", - "secret_access_key" = "minio_secret_access_key_value" - }) - worker_filter = "\"minio-worker\" in \"/tags/type\"" -} - -output "storage_bucket_id" { - value = boundary_storage_bucket.minio_credentials_example.id -} -``` - - - - - - - -Complete the following steps to create a storage bucket in Boundary using an S3-compliant storage provider. Hitachi Content Platform is used as an example below. - - - - S3-compliant storage requires a service account and its associated access keys to set up a Boundary storage bucket. Refer to the [Configure S3-compliant storage](/boundary/docs/session-recording/configuration/storage-providers/configure-s3-compliant#s3-compliant-storage-provider-requirements) page to learn more. - - - - - - -1. Log in to Boundary. -1. Click **Storage Buckets** in the navigation bar. -1. Click **New Storage Bucket**. -1. Complete the following fields to create the Boundary storage bucket: - - **Name**: (Optional) The name field is optional, but if you enter a name it must be unique. - - **Description**: (Optional) An optional description of the Boundary storage bucket for identification purposes. - - **Scope**: (Required) A storage bucket can belong to the Global scope or an Org scope. - It can only be associated with targets from the scope it belongs to. - - **Provider**: (Required) The external storage bucket provider. - For S3-compliant storage, select **MinIO**. - - **Endpoint URL**: (Required) The fully-qualified endpoint pointing to a storage provider's S3 API, such as `https://my-hitachi-instance.dev:9000`. - - **Bucket name**: (Required) Name of the S3-compliant storage bucket you want to associate with the Boundary storage bucket. - - **Region**: (Optional) The region to configure the storage bucket for. - - **Access key ID** (Required): The storage provider's service account's access key to use with this storage bucket. - - **Secret access key** (Required): The storage provider's service account's secret key to use with this storage bucket. - - **Worker filter**: (Required) A filter expression that indicates which Boundary workers have access to the storage. The filter must match an existing worker to create a Boundary storage bucket. This should be a boolean expression. To generate a worker filter in the correct format, toggle the **Show filter generator** switch. Refer to [the filter example for storage buckets](/boundary/docs/workers/filters#example-worker-filter-for-storage-buckets) to learn about worker tags and filters. - - **Disable credential rotation**: (Optional) Controls whether the plugin will rotate the incoming credentials and manage a new storage service account. If this attribute is set to false, or not provided, the plugin will rotate the incoming credentials, using them to create a new storage service account, then delete the incoming credentials. - - Note that credential rotation is not supported for Hitachi Content Platform, and it may not function for other S3-compatible providers. - -1. Click **Save**. - - - - -1. Log in to Boundary. -1. Use the following command to create a storage bucket in Boundary: - - ```shell-session - $ boundary storage-buckets create \ - -bucket-name mystoragebucket \ - -plugin-name minio \ - -scope-id o_1234567890 \ - -bucket-prefix="foo/bar/zoo" \ - -worker-filter '"storage-worker" in "/tags/type"' \ - -attr endpoint_url="https://my-hitachi-instance.dev:9000" \ - -attr region="REGION" \ - -attr disable_credential_rotation=true \ - -secret access_key_id="KEY" \ - -secret secret_access_key="SECRET" - ``` - - Replace the values above with the following required secrets and any optional [attributes](/boundary/docs/domain-model/storage-buckets) you want to associate with the Boundary storage bucket: - - - `bucket-name`: (Required) Name of the S3-compliant storage bucket you want to associate with the Boundary storage bucket. - - `plugin-name`: (Required) The name of the Boundary storage plugin. - Use the `minio` plugin for S3-compatible storage. - - `scope_id`: (Required) A storage bucket can belong to the Global scope or an Org scope. - - `worker-filter`: (Required) A filter expression that indicates which Boundary workers have access to the storage. The filter must match an existing worker in order to create a Boundary storage bucket. Refer to [the filter example for storage buckets](/boundary/docs/workers/filters#example-worker-filter-for-storage-buckets) to learn about worker tags and filters. - - `secret`: (Required) The storage provider's credentials to use. - - `access_key_id` (Required): The storage provider's service account's access key to use with this storage bucket. - - `secret_access_key` (Required): The storage provider's service account's secret key to use with this storage bucket. - - `attributes` or `-attr`: Attributes of the S3-compliant storage bucket. - - `endpoint_url` (Required): Fully-qualified endpoint pointing to an S3-compliant API. This example uses Hitachi, but you should substitute your storage provider's endpoint. - - `region`: (Optional) The region to configure the storage bucket for. - - `disable_credential_rotation`: (Optional) Controls whether the plugin will rotate the incoming credentials and manage a new storage service account. If this attribute is set to `false`, or not provided, the plugin will rotate the incoming credentials to create a new storage service account, then delete the incoming credentials. - - Note that credential rotation is not supported for Hitachi Content Platform, and it may not function for other S3-compatible providers. - - - - -This page provides example configurations for a generic Terraform deployment. - -Refer to the [Boundary Terraform provider documentation](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs) to learn about the requirements for the following example attributes. - -Support for S3-compliant storage providers leverages the [Boundary MinIO plugin](https://github.com/hashicorp/boundary-plugin-minio). - -Apply the following Terraform policy: - -```hcl -resource "boundary_storage_bucket" "storage_credentials_example" { - name = "My storage bucket" - description = "My first storage bucket" - scope_id = "o_1234567890" - plugin_name = "minio" - bucket_name = "mybucket1" - - attributes_json = jsonencode({ - "endpoint_url" = "minio_access_key_id_value", - "disable_credential_rotation" = true - }) - - secrets_json = jsonencode({ - "access_key_id" = "storage_access_key_id_value", - "secret_access_key" = "storage_secret_access_key_value" - }) - worker_filter = "\"storage-worker\" in \"/tags/type\"" -} - -output "storage_bucket_id" { - value = boundary_storage_bucket.storage_credentials_example.id -} -``` - - - - - - - -Boundary creates the storage bucket resource and provides you with the bucket's ID. - -## Next steps - -After the storage bucket is created in Boundary, you can use the bucket's ID to [enable session recording on targets](/boundary/docs/session-recording/configuration/enable-session-recording). - -## Resources - -The following docs are relevant to configuring storage buckets: - -- [Storage bucket attributes](/boundary/docs/domain-model/storage-buckets) -- [Storage bucket worker filter example](/boundary/docs/workers/filters#example-worker-filter-for-storage-buckets) -- [Boundary AWS plugin](https://github.com/hashicorp/boundary-plugin-aws) -- [Boundary MinIO plugin](https://github.com/hashicorp/boundary-plugin-minio) -- [Filtering and listing resources](/boundary//docs/filtering) \ No newline at end of file diff --git a/website/content/docs/session-recording/configuration/enable-session-recording.mdx b/website/content/docs/session-recording/configuration/enable-session-recording.mdx deleted file mode 100644 index cccc235fe..000000000 --- a/website/content/docs/session-recording/configuration/enable-session-recording.mdx +++ /dev/null @@ -1,121 +0,0 @@ ---- -layout: docs -page_title: Enable session recording on a target -description: >- - Enable session recording for targets so that user sessions are recorded for compliance and threat management. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Enable session recording on a target - -This feature requires HCP Boundary Plus or Boundary Enterprise - -You must enable session recording for any targets that you want to record sessions on. -When you [create a storage bucket](/boundary/docs/session-recording/configuration/create-storage-bucket), Boundary provides you with an ID. -You use the storage bucket's ID to associate a target with the storage bucket. - -## Requirements - -- One or more storage buckets to store the recordings. -- Session recording is only supported for SSH targets at this time. -- A KMS key with the purpose `bsr` must be added to the controller configuration. -The key is used for encrypting data and checking the integrity of recordings. -Refer to [Create the controller configuration](/boundary/docs/deploy/self-managed/configure-controllers#create-the-controller-configuration) and [the `bsr` KMS key](/boundary/docs/secure/encryption/data-encryption#the-bsr-kms-key) documentation for more information about configuring a KMS block. -- The targets must be configured with an ingress or egress worker filter that includes a worker with access to the storage bucket you created. -Refer to [SSH target attributes](/boundary/docs/domain-model/targets#ssh-target-attributes) for more information. -- You must enable injected application credentials on any target that you want to use for session recording. -Refer to [Configure targets with credential injection](/boundary/docs/credentials/configure-credential-injection) for more information about injecting application credentials. - -Complete the following steps to enable session recording on a target. - - - - -1. Log in to Boundary. -1. Click **Orgs** in the navigation pane. -1. Select the org that contains the target you want to enable for session recording. -1. Select the project that contains the target you want to enable for session recording. -1. Select **Targets** in the navigation pane. -1. Do one of the following: - - - To create a new target, select **New Target**. - - To edit an existing target, select the target, and then select **Edit Form**. -1. Configure the target with any relevant [attributes](/boundary/docs/domain-model/targets). -The following setting is required for session recording: - - - Select **SSH** for the **Type**. - -1. Click **Save**. -1. Click **Enable recording**. - - ![Example of enabling session recording](/img/ui/enable-session-recording_light.png#light-theme-only) - ![Example of enabling session recording](/img/ui/enable-session-recording_dark.png#dark-theme-only) - -1. Enable the **Record sessions for this target** option. -1. Select the storage bucket where you want to store recordings from this target. - - You can also [create a new storage bucket](/boundary/docs/session-recording/configuration/create-storage-bucket). - -1. Click **Save**. - - - - -1. Log in to Boundary. -1. Do one of the following: - - - To enable an existing SSH target for session recording, run the following commmand: - - ```shell-session - $ boundary targets update ssh -scope-id p_1234567890 -id tssh_1234567890 -enable-session-recording true -storage-bucket-id sb_1234567890 - ``` - - Make sure to add the `-enable-session-recording true` flag to turn on session recording for the target. - Add the `-storage-bucket-id ID` for the storage bucket you want to associate with this target. - - - To create a new target and enable it for session recording, run the following command: - - ```shell-session - $ boundary targets create ssh -scope-id p_1234567890 -default -port 22 -name test1 -address 99.12.345.67 -enable-session-recording true -storage-bucket-id sb_1234567890 - ``` - - Make sure to add the `-enable-session-recording true` flag to turn on session recording for the target. - Add the `-storage-bucket-id ID` for the storage bucket you want to associate with this target. - You can configure any other [target attributes](/boundary/docs/domain-model/targets). - - You can now view the target from the **Targets** page in the Boundary console. - - - - -Apply the following Terraform policy: - -```hcl -resource "boundary_target" "address_foo" { - name = "address_foo" - description = "Foo target with an address" - type = "tcp" - default_port = "22" - scope_id = boundary_scope.project.id - address = "127.0.0.1" - - # Add the next two lines to an existing target to enable session recording. - # Modify the value of storage_bucket_id as appropriate - enable_session_recording = true - storage_bucket_id = boundary_storage_bucket.aws_example.id -} -``` - - - - -The target is now enabled for session recording. -Any user session that connects to the target is automatically recorded. - -## Next steps - -After you have enabled session recording, you may want to [configure storage policies](/boundary/docs/session-recording/compliance/configure-storage-policy) to codify the lifecycle management of your session recordings. diff --git a/website/content/docs/session-recording/configuration/manage-recorded-sessions.mdx b/website/content/docs/session-recording/configuration/manage-recorded-sessions.mdx deleted file mode 100644 index 888e463c8..000000000 --- a/website/content/docs/session-recording/configuration/manage-recorded-sessions.mdx +++ /dev/null @@ -1,107 +0,0 @@ ---- -layout: docs -page_title: Find and view recorded sessions -description: >- - Find and view recorded sessions. View a list of all recorded sessions, or search for a specific recording. Download recorded sessions to meet compliance needs. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Find and view recorded sessions - -This feature requires HCP Boundary or Boundary Enterprise - -Boundary converts recorded sessions into an asciicast format so that you can play back interactive SSH sessions. -Make sure to refer to the [asciicast](/boundary/docs/session-recording#asciicast) documentation to understand potential limitations to the asciicast format. - -You can view a list of all recorded sessions, or if you know the ID of a specific recorded session, you can find any channels associated with that recording. - - - - -## Find all recorded sessions - -Complete the following steps to find all recorded sessions using the CLI. - -1. Authenticate to Boundary in the CLI. -1. Type the following command to view a list of all recorded sessions: - - ```bash - boundary session-recordings list -recursive - ``` - - Boundary displays a list of all recorded sessions by scope. - -## Find a specific recorded session by ID - -If you have the ID of a recorded session, you can use the following command to list the connections and channels associated with a session recording. - -```bash -boundary session-recordings read -id -``` - -## Download recorded session channels - -You can download a recording of SSH shell or exec sessions for a channel from a recorded session. -The channel ID is required for the download. - -If you have the ID of a recorded session, you can use the following command to list the connections and channels associated with a session recording. - -```bash -boundary session-recordings read -id -``` - -Complete the following steps to download a recorded session channel: - -1. Authenticate to Boundary in the CLI. -1. Type the following command to download a recorded session channel. -Substitute the ID of the channel for **chr_1234567890**: - - ```bash - boundary session-recordings download -id chr_1234567890 - ``` - - - - -## Find all recorded sessions - -You can find all recorded sessions in the UI from the global scope. - -1. Log in to Boundary. -1. Select **Session Recordings** in the navigation pane. - - The **Session Recordings** page displays the created time, user, project, - target, and duration of the recording. - -## View session recording details - -1. Select **View** next to the session recording you want to view. - - The details page has information related to the session recording and - links to related information like user, target, and storage bucket. - -## Play back channel recording - -1. Select **Play** next to the channel recording you want to view. - - The recorded session appears in the media player. - Click the **Play** button located at the bottom of the media player - to watch the recording. - - If a recorded session channel does not support playback, a **View** button - is shown. The playback page displays a message stating that playback - is not supported, but still shows details specific to that channel. - - - - -## More information - -Refer to the following topics for more information: - -- [Session recording](/boundary/docs/session-recording) -- [asciicast](/boundary/docs/session-recording#asciicast) diff --git a/website/content/docs/session-recording/configuration/storage-providers/configure-minio.mdx b/website/content/docs/session-recording/configuration/storage-providers/configure-minio.mdx deleted file mode 100644 index 1523a9d31..000000000 --- a/website/content/docs/session-recording/configuration/storage-providers/configure-minio.mdx +++ /dev/null @@ -1,120 +0,0 @@ ---- -layout: docs -page_title: Configure MinIO storage -description: >- - Configure MinIO as a storage provider for recorded sessions. Understand session recording and MinIO requirements. View an example configuration. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Configure MinIO as a storage provider - -This feature requires HCP Boundary or Boundary Enterprise - -This page describes how to configure MinIO as a storage provider for session recording with Boundary. - -## Requirements - -Before you can create a storage bucket in Boundary, you must ensure that your environment meets certain requirements. - -Session recording requires specific configuration for both the external storage provider and the Boundary worker. - -Refer to [Configure workers for session recording](/boundary/docs/session-recording/configuration/configure-worker-storage) to learn about configuring self-managed workers for session recording. - -When you determine storage requirements for the external bucket, you should consider: - -- [BSR storage considerations](/boundary/docs/session-recording#storage-considerations) -- [Storage bucket retention policies](/boundary/docs/session-recording/compliance/configure-storage-policy) - -### MinIO requirements - -- A MinIO storage bucket - - You must associate the Boundary storage bucket with a MinIO storage bucket. A Boundary MinIO storage bucket contains the bucket name, endpoint URL, optional region, optional prefix, and the service account credentials needed to access the bucket. To enable credential rotation, you cannot add a Boundary storage bucket without a MinIO service account. You can disable credential rotation when you create the Boundary storage bucket. - - At the time of the 0.18.0 release, the latest tested and supported MinIO version is `RELEASE.2024-10-02T17-50-4Z`. - Newer versions may work as well, but they have not been tested. - - - - At this time, the NetBSD operating system is not supported for the MinIO storage bucket. - - - -- A MinIO service account and access keys - - You must provide service account access keys when you configure a Boundary storage bucket later on. - - Refer to the [MinIO Access Keys](https://min.io/docs/minio/kubernetes/upstream/administration/console/security-and-access.html#access-keys) documentation page to learn how to set up a MinIO service account. - -- A MinIO storage bucket must be configured with R/W access. If you use a - restricted IAM user policy, the following policy actions must be allowed at a minimum. - - ```json - { - "Version": "2012-10-17", - "Statement": [ - { - "Action": [ - "s3:PutObject", - "s3:GetObject", - "s3:GetObjectAttributes", - "s3:DeleteObject" - ], - "Effect": "Allow", - "Resource": "arn:aws:s3:::test-session-recording-bucket/*" - }, - { - "Action": "s3:ListBucket", - "Effect": "Allow", - "Resource": "arn:aws:s3:::test-session-recording-bucket" - } - ] - } - ``` - -- HashiCorp recommends that you enable credential rotation. To enable credential rotation, use the following service account policy: - - ```json - { - "Version": "2012-10-17", - "Statement": [ - { - "Action": [ - "s3:PutObject", - "s3:GetObject", - "s3:GetObjectAttributes", - "s3:DeleteObject" - ], - "Effect": "Allow", - "Resource": "arn:aws:s3:::test-session-recording-bucket/*" - }, - { - "Action": "s3:ListBucket", - "Effect": "Allow", - "Resource": "arn:aws:s3:::test-session-recording-bucket" - }, - { - "Action": [ - "admin:CreateServiceAccount", - "admin:RemoveServiceAccount" - ], - "Effect": "Allow" - } - ] - } - ``` - -## Resources - -The following docs MinIO docs are relevant for configuring storage buckets and service accounts: - -- Refer to the [MinIO Policy Action Keys](https://min.io/docs/minio/linux/administration/identity-access-management/policy-based-access-control.html#mc-admin-policy-action-keys) documentation to learn more about restricting IAM user policies. -- Refer to the [MinIO Object Encryption with KES](https://min.io/docs/minio/linux/operations/server-side-encryption/configure-minio-kes.html#minio-sse-vault) documentation to learn more about KMS and data encryption with vault key management. - -## Next steps - -After you configure the external storage provider, you can [create the storage bucket](/boundary/docs/session-recording/configuration/create-storage-bucket) in Boundary. \ No newline at end of file diff --git a/website/content/docs/session-recording/configuration/storage-providers/configure-s3-compliant.mdx b/website/content/docs/session-recording/configuration/storage-providers/configure-s3-compliant.mdx deleted file mode 100644 index 691b7a6fc..000000000 --- a/website/content/docs/session-recording/configuration/storage-providers/configure-s3-compliant.mdx +++ /dev/null @@ -1,119 +0,0 @@ ---- -layout: docs -page_title: Configure S3-compliant storage -description: >- - Configure an S3-compliant storage provider for recorded sessions. Understand session recording and storage provider requirements. View an example configuration. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Configure an S3-compliant storage provider - -This feature requires HCP Boundary or Boundary Enterprise - -The [MinIO plugin](https://github.com/hashicorp/boundary-plugin-minio/) lets you configure S3-compliant storage providers for session recording. - - -HashiCorp has tested and confirmed that you can configure the following S3-compliant storage products for session recording using the MinIO plugin: - -- [Hitachi Content Platform](https://www.hitachivantara.com) - - At the time of the 0.18.0 release, the latest tested and supported Hitachi Content Platform version is `2.6.0.0`. - Newer versions may work as well, but they have not been tested. - -- [Backblaze B2](https://www.backblaze.com/cloud-storage) - -You can also configure other providers' S3-compliant storage products for session recording storage. -We will update the list of providers as we test them. - -The process for [configuring the Hitachi Content Platform](#hitachi-content-platform-configuration) is included below as an example. -Configuring other S3-compliant storage products for use with session recording should be a similar process. - -## Requirements - -Before you can create a storage bucket in Boundary, you must ensure that your environment meets certain requirements. - -Session recording requires specific configuration for both the external storage provider and the Boundary worker. - -Refer to [Configure workers for session recording](/boundary/docs/session-recording/configuration/configure-worker-storage) to learn about configuring self-managed workers for session recording. - -When you determine storage requirements for the external bucket, you should consider: - -- [BSR storage considerations](/boundary/docs/session-recording#storage-considerations) -- [Storage bucket retention policies](/boundary/docs/session-recording/compliance/configure-storage-policy) - -### S3-compliant storage provider requirements - -- A storage bucket - - You must associate the Boundary storage bucket with a third-party storage bucket. A third-party storage bucket contains the bucket name, endpoint URL, optional region, optional prefix, and the service account credentials needed to access the bucket. - -- A service account and access keys for the storage provider - - You must provide service account access keys when you configure a Boundary storage bucket later on. - Refer to your storage provider's documentation to learn how to set up a service account. - -- The storage bucket must be configured with R/W access. If you use a - restricted IAM user policy, you must allow the following policy actions at a minimum. - - ```json - { - "Version": "2012-10-17", - "Statement": [ - { - "Action": [ - "s3:PutObject", - "s3:GetObject", - "s3:GetObjectAttributes", - "s3:DeleteObject" - ], - "Effect": "Allow", - "Resource": "arn:aws:s3:::test-session-recording-bucket/*" - }, - { - "Action": "s3:ListBucket", - "Effect": "Allow", - "Resource": "arn:aws:s3:::test-session-recording-bucket" - } - ] - } - ``` - -### Hitachi Content Platform configuration - -HashiCorp has tested and confirmed that you can configure the Hitachi Content Platform for external session recording storage using the MinIO plugin. -It is included as an example in this topic. -You should be able to configure other S3-compliant storage providers to work for session recording storage as well, but we have only tested a [limited number of providers](#providers). - -You must have an account with Hitachi Content Platform to create storage buckets. -You can sign up for an account at the following URL: - -[https://www.hitachivantara.com](https://www.hitachivantara.com) - -When you sign up for an account, Hitachi sends you the details you need to connect to the instance including the endpoint, S3 access key ID, and S3 secret key. -Log in to Hitachi's S3 console to create a storage bucket, and make a note of the bucket's name. - -In Boundary, set the following environment variables using your Hitachi credentials and the name of the bucket: - -``` -export BUCKET_NAME= -export STORAGE_ACCESS_KEY_ID= -export STORAGE_SECRET_ACCESS_KEY= -``` - - - -Credential rotation is not supported for Hitachi Content Platform. - - - -## Resources - -Refer to your S3-compliant storage provider's documentation for more information about configuring storage buckets and service accounts. - -## Next steps - -After you configure the external storage provider, you can [create the storage bucket](/boundary/docs/session-recording/configuration/create-storage-bucket) in Boundary. \ No newline at end of file diff --git a/website/content/docs/session-recording/configuration/storage-providers/configure-s3.mdx b/website/content/docs/session-recording/configuration/storage-providers/configure-s3.mdx deleted file mode 100644 index e5d56940e..000000000 --- a/website/content/docs/session-recording/configuration/storage-providers/configure-s3.mdx +++ /dev/null @@ -1,136 +0,0 @@ ---- -layout: docs -page_title: Configure Amazon S3 storage -description: >- - Configure Amazon S3 as a storage provider for recorded sessions. Understand session recording and AWS requirements. View an example configuration. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Configure Amazon S3 as a storage provider - -This feature requires HCP Boundary or Boundary Enterprise - -This page describes how to configure Amazon S3 as a storage provider for session recording with Boundary. - -## Requirements - -Before you can create a storage bucket in Boundary, you must ensure that your environment meets certain requirements. - -Session recording requires specific configuration for both the external storage provider and the Boundary worker. - -Refer to [Configure workers for session recording](/boundary/docs/session-recording/configuration/configure-worker-storage) to learn about configuring self-managed workers for session recording. - -When you determine storage requirements for the external bucket, you should consider: - -- [BSR storage considerations](/boundary/docs/session-recording#storage-considerations) -- [Storage bucket retention policies](/boundary/docs/session-recording/compliance/configure-storage-policy) - -### AWS requirements - -- An Amazon S3 storage bucket - - You must associate the Boundary storage bucket with an Amazon S3 storage bucket. A Boundary Amazon S3 storage bucket contains the bucket name, region, and optional prefix, as well as any credentials needed to access the bucket. - - The Amazon S3 storage bucket can use static or dynamic credentials. - You can configure static credentials using an access key and secret key or dynamic credentials using the AWS [`AssumeRole` API](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole). - -- An AWS IAM role policy with the following statement: - - ```json - { - "Version": "2012-10-17", - "Statement": [ - { - "Action": [ - "s3:PutObject", - "s3:GetObject", - "s3:GetObjectAttributes", - "s3:DeleteObject", - "s3:ListBucket" - ], - "Effect": "Allow", - "Resource": "arn:aws:s3:::session_recording_storage*", - "Resource": "arn:aws:s3:::session_recording_storage/foo/bar/zoo/*" - }, - { - "Action": [ - "iam:DeleteAccessKey", - "iam:GetUser", - "iam:CreateAccessKey" - ], - "Effect": "Allow", - "Resource": "arn:aws:iam::123456789012:user/JohnDoe" - } - ] - } - ``` - -- If you apply KMS encryption to the storage bucket, you must add these additional permissions to the role policy for the storage bucket's IAM user: - - ```json - { - "Action": [ - "kms:Decrypt", - "kms:GenerateDataKey", - "kms:DescribeKey" - ], - "Effect": "Allow", - "Resource": "arn:aws:kms:us-east-1:1234567890:key/uuid" - } - ``` - - The following is an example working policy with KMS encryption configured on the S3 bucket: - - ```json - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "S3Permissions", - "Effect": "Allow", - "Action": [ - "s3:PutObject", - "s3:GetObject", - "s3:GetObjectAttributes", - "s3:DeleteObject", - "s3:ListBucket" - ], - "Resource": [ - "arn:aws:s3:::test-session-recording-bucket/*" - ] - }, - { - "Sid": "UserPermissions", - "Effect": "Allow", - "Action": [ - "iam:DeleteAccessKey", - "iam:GetUser", - "iam:CreateAccessKey" - ], - "Resource": [ - "arn:aws:iam::1234567890:user/test-boundary" - ] - }, - { - "Sid": "KMSPermissions", - "Effect": "Allow", - "Action": [ - "kms:Decrypt", - "kms:GenerateDataKey", - "kms:DescribeKey" - ], - "Resource": [ - "arn:aws:kms:us-east-2:1234567890:key 4b887395-c376-4936-8f37-80c592ea582c" - ] - } - ] - } - ``` - -## Next steps - -After you configure the external storage provider, you can [create the storage bucket](/boundary/docs/session-recording/configuration/create-storage-bucket) in Boundary. \ No newline at end of file diff --git a/website/content/docs/session-recording/configuration/troubleshoot-recorded-sessions.mdx b/website/content/docs/session-recording/configuration/troubleshoot-recorded-sessions.mdx deleted file mode 100644 index d22fd59a0..000000000 --- a/website/content/docs/session-recording/configuration/troubleshoot-recorded-sessions.mdx +++ /dev/null @@ -1,47 +0,0 @@ ---- -layout: docs -page_title: Troubleshoot session recordings -description: >- - View known issues and troubleshoot problems with Boundary's recorded sessions. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Troubleshoot session recordings - -This feature requires HCP Boundary or Boundary Enterprise - -Refer to the following for information about how to troubleshoot recorded sessions. - -## Known bugs - -**Rotation of AWS access and secret keys during a session results in stale recordings:** - -When you rotate a storage bucket's secrets, any new sessions use the new credentials. -However, previously established sessions continue to use the old credentials. - -As a best practice, administrators should rotate credentials in a phased manner, ensuring that all previously established sessions are completed before revoking the stale credentials. -Otherwise, you may end up with recordings that aren't stored in the remote storage bucket and are unable to be played back. - - - - -**Unsupported recovery workflow during worker failure:** - -If a worker fails during a recording, there is no way to recover the recording. -This could happen due to a network connectivity issue or because a worker is scaled down, for example. -There are a number of currently unsupported failure cases, including when the worker: - -- Crashes and restarts while servicing connections and channels for session to an SSH target -- Crashes and restarts while closing a channel before all files are synced to remote storage -- Crashes and restarts while closing a connection recorder before all files are synced to remote storage -- Crashes and restarts while closing a session recorder before all files are synced to remote storage -- Crashes and never restarts or is seen again while closing a channel/connection recorer/session recorder -- Loses its connection to the controller and cancels sessions; it must resend the information when communication resumes - -## Tips - -When you create or update a storage bucket, the actions `GetBucketAcl` and `GetEncryptionConfiguration` can be helpful in debugging access issues. diff --git a/website/content/docs/session-recording/data/bsr-file-structure.mdx b/website/content/docs/session-recording/data/bsr-file-structure.mdx deleted file mode 100644 index 4a7346b43..000000000 --- a/website/content/docs/session-recording/data/bsr-file-structure.mdx +++ /dev/null @@ -1,276 +0,0 @@ ---- -layout: docs -page_title: BSR file data structure -description: >- - Understand the data structure in Boundary's proprietary BSR file that stores session recording data. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# BSR file data structure - -This feature requires HCP Boundary or Boundary Enterprise - -The BSR (Boundary Session Recording) defines a hierarchical directory structure of files and a binary file format. -It contains all the data transmitted between a user and a target during a single session. - -Boundary creates the top-level directory of the BSR as `.bsr`. This top level directory contains session summary -information and subdirectories for connections. - -A BSR connections directory contains a summary of connections, as well as inbound and outbound requests. -If you use a multiplexed protocol, there are subdirectories for the channels. - -Every directory contains a SHA256SUMS and SHA256SUMS.sig file, to be used for cryptographically verifying the contents of -that directory. The SHA256SUMS file contains rows of file names paired with a checksum for file contents. The -SHA256SUMS.sign is a copy of the SHA256SUMS file, signed with the BSR’s private key. For more information on verifying a -session recording, refer to [Validating the integrity of session recordings](/boundary/docs/session-recording/compliance/validate-session-recordings). - -The example BSR below is for a multiplexed session recording with the ID `sr_iNCdGSREeX`. The session recording contains one connection, -`cr_3bB78W53Y9`. Connection `cr_3bB78W53Y9` contains two channels, `chr_VUnVuVnITu` and `chr_nITuVUnVuV`. -The files in each directory are explained in the following sections. - -``` -└── sr_iNCdGSREeX.bsr - ├── SHA256SUM - ├── SHA256SUM.sig - ├── bsrKey.pub - ├── pubKeyBsrSignature.sign - ├── pubKeySelfSignature.sign - ├── session-meta.json - ├── session-recording-summary.json - ├── session-recording.meta - ├── wrappedBsrKey - ├── wrappedPrivKey - ├── cr_3bB78W53Y9.connection - │ ├── SHA256SUM - │ ├── SHA256SUM.sig - │ ├── connection-recording-summary.json - │ ├── connection-recording.meta - │ ├── requests-inbound.data - │ ├── requests-outbound.data - │ ├── chr_VUnVuVnITu.channel - │ │ ├── SHA256SUM - │ │ ├── SHA256SUM.sig - │ │ ├── channel-recording-summary.json - │ │ ├── channel-recording.meta - │ │ ├── messages-inbound.data - │ │ ├── messages-outbound.data - │ │ ├── requests-inbound.data - │ │ └── requests-outbound.data - │ ├── chr_nITuVUnVuV.channel - │ │ ├── SHA256SUM - │ │ ├── SHA256SUM.sig - │ │ ├── channel-recording-summary.json - │ │ ├── channel-recording.meta - │ │ ├── messages-inbound.data - │ │ ├── messages-outbound.data - │ │ ├── requests-inbound.data - │ │ └── requests-outbound.data - │ └── - └── - - -``` - -## BSR Session folder - -A BSR session folder contains the following files: - -- `SHA256SUM.sig` is a plaintext file that contains rows of file names paired with a checksum for file contents. -- `SHA256SUM.sig` is a signature of the plaintext `SHA256SUM` file created with the private key. -- `bsrKey.pub` is the public ed25519 key. -- `pubKeySelfSignature.sign` is a self-signature of the plaintext public ed25519 key created with its private key. -- `pubKeyBsrSignature.sign` is a signature of the plaintext public ed25519 key created with the BSR key. -- `wrappedBsrKey` is the BSR key wrapped by the external KMS AES-GCM key that you configure. -- `wrappedPrivKey` is the private ed25519 key wrapped by the external KMS AES-GCM key that you configure. -- `session-meta.json` is a JSON file that contains metadata about the session, including the session id, endpoint, -user, target, host, worker, and credentials used to access the target. The intention of this file is to provide all information -relevant to the recorded session so that the BSR provides a complete snapshot of a session even in the absence of the Boundary -control plane. -- `session-recording.meta` is a plaintext file that contains metadata about the session, including the session id, protocol, -and a connection ids. For each connection id listed, there should be a corresponding connection directory in the session directory. -- `session-recording-summary.json` is a JSON file that contains a summary of the session recording, including the session id, connection count, -start time, end time, and any errors encountered during recording of the session. - -`session-recording.meta` file example: - -``` -id: sr_iNCdGSREeX -protocol: BSSH -connection: cr_3bB78W53Y9.connection -``` - -`session-recording-summary.json` file example: - -``` -{ - "Id": "sr_iNCdGSREeX", - "ConnectionCount": 1, - "StartTime": "2023-09-19T15:05:39.343307163Z", - "EndTime": "2023-09-19T15:08:02.953159598Z", - "Errors": "" -} - -``` - -`session-meta.json` file example: - -``` -{ - "PublicId": "s_HQbVb8fJaM", - "Endpoint": "ssh://openssh-server:2222", - "User": { - "PublicId": "u_5Ry4oDiEVp", - "Scope": { - "PublicId": "global", - "Name": "global", - "Description": "Global Scope", - "Type": "global", - "ParentId": "", - "PrimaryAuthMethodId": "ampw_CdIa5KR9iw" - }, - "Name": "admin", - "Description": "Initial admin user within the \"global\" scope" - }, - "Target": { - "PublicId": "tssh_TIx4ENZMdA", - "Scope": { - "PublicId": "p_7Qe46uNMYX", - "Name": "session-recording-project", - "Description": "", - "Type": "project", - "ParentId": "o_yK7GoA6OG2", - "PrimaryAuthMethodId": "" - }, - "Name": "session-recording-target", - "Description": "", - "DefaultPort": 2222, - "DefaultClientPort": 0, - "SessionMaxSeconds": 28800, - "SessionConnectionLimit": -1, - "WorkerFilter": "", - "EgressWorkerFilter": "", - "IngressWorkerFilter": "\"pki\" in \"/tags/type\"", - "EnableSessionRecording": true, - "StorageBucketId": "sb_vqn871JdQf" - }, - "Worker": { - "PublicId": "w_ogOQt0rsuQ", - "Version": "0.13.0", - "Sha": "" - }, - "StaticHost": null, - "DynamicHost": null, - "StaticJSONCredentials": null, - "StaticUsernamePasswordCredentials": [ - { - "PublicId": "credup_gdzeB5UWJv", - "Name": "", - "Description": "", - "Username": "username", - "PasswordHmac": "PasswordHmac, - "Purposes": [ - "injected_application" - ], - "CredentialStore": { - "PublicId": "csst_agwIT97uZ7", - "ProjectId": "p_7Qe46uNMYX", - "Name": "ssh static store", - "Description": "SSH Static Cred store" - } - } - ], - "StaticSshPrivateKeyCredentials": null, - "VaultGenericLibraries": null, - "VaultSshCertificateLibraries": null -} -``` - -## BSR Connection folder - -A BSR connection folder contains the following files: - -- `SHA256SUM.sig` is a plaintext file that contains rows of file names paired with a checksum for file contents. -- `SHA256SUM.sig` is a signature of the plaintext `SHA256SUM` file created with the private key. -- `connection-recording.meta` is a plaintext file that contains metadata about the connection, including the connection id, -requests seen, channel ids, and any errors seen. For each channel id listed, there should be a corresponding channel directory in the connection directory. -- `connection-recording-summary.json` is a JSON file that contains a summary of the connection, including the connection id, -start time, end time, bytes up, bytes down, and any errors encountered during recording the connection. -- `requests-inbound.data` is a binary file containing all inbound SSH request messages transmitted for the connection. -- `requests-outbound.data` is a binary file containing all outbound SSH request messages transmitted for the connection. - -`connection-recording.meta` file example: - -``` -id: cr_W53Y93bB78 -requests: outbound -requests: inbound -channel: chr_uVVuUITnVn.channel -error: error message would be appear here -``` - -`connection-recording-summary.json` file example: - -``` -{ - "Id": "cr_W53Y93bB78", - "ChannelCount": 1, - "StartTime": "2023-07-13T20:21:49.164105381Z", - "EndTime": "2023-07-13T20:22:37.241911112Z", - "BytesUp": 125, - "BytesDown": 748, - "Errors": null -} -``` - -### BSR Channel folder - -A BSR connection folder contains the following files: - -- `SHA256SUM.sig` is a plaintext file that contains rows of file names paired with a checksum for file contents. -- `SHA256SUM.sig` is a signature of the plaintext `SHA256SUM` file created with the private key. -- `channel-recording.meta` is a plaintext file that contains metadata about the channel, including the channel id, -inbound and outbound requests seen, and inbound and outbound messages seen. -- `channel-recording-summary.json` is a JSON file that contains a summary of the channel, including the channel id, -start time, end time, bytes up, bytes down, channel type, session program, subsystem name (if applicable), exec program (if applicable), -and file transfer direction (if applicable). -- `requests-inbound.data` is a binary file containing all inbound SSH request messages transmitted for the channel. -- `requests-outbound.data` is a binary file containing all outbound SSH request messages transmitted for the channel. -- `messages-inbound.data` is a binary file containing all inbound SSH data transmitted for the channel. -- `messages-outbound.data` is a binary file containing all outbound SSH data transmitted for the channel. - -`channel-recording.meta` file example: - -``` -id: chr_uVVuUITnVn -channelType: session -messages: outbound -requests: outbound -messages: inbound -requests: inbound -``` - -`channel-recording-summary.json` file example: - -``` -{ - "ChannelSummary": { - "Id": "chr_uVVuUITnVn", - "ConnectionRecordingId": "cr_W53Y93bB78", - "StartTime": "2023-07-13T20:21:49.230916214Z", - "EndTime": "2023-07-13T20:22:37.229379944Z", - "BytesUp": 125, - "BytesDown": 748, - "ChannelType": "session" - }, - "SessionProgram": "shell", - "SubsystemName": "", - "ExecProgram": "", - "FileTransferDirection": "not applicable" -} -``` - -For more information, refer to the [overview of session recording](/boundary/docs/session-recording). diff --git a/website/content/docs/session-recording/data/read-bsr-file.mdx b/website/content/docs/session-recording/data/read-bsr-file.mdx deleted file mode 100644 index 77538e78b..000000000 --- a/website/content/docs/session-recording/data/read-bsr-file.mdx +++ /dev/null @@ -1,36 +0,0 @@ ---- -layout: docs -page_title: Read a BSR file -description: >- - Learn how to read the data in Boundary's proprietary BSR file that stores session recording data. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Read a BSR file - -BSR data files are where all the data transmitted during a session is stored. BSR data files -have the file suffix `.data` and are binary files written in network byte or big-endian order. The first eight bytes of a -BSR data file always contains the following signature, which identifies the file as a BSR file: `"\x89BSR\r\n\x1a\n"`. - -Following the BSR signature, a BSR file contains “chunks” of data. Each chunk contains the same basic metadata information: -length, protocol, chunk type, direction, and a timestamp. The chunk type indicates the expected data payload. The first -chunk in a BSR file is the header chunk, and the last chunk in a BSR file is the EOF chunk. The remaining -chunks in the file depend on the protocol identified in the BSR header. - -The only protocol currently supported for session recording is SSH. Data files for SSH are prefixed with either `messages-` -or `requests-`, and suffixed with either `inbound` or `outbound` to indicate the direction the data came from. Message -files contain raw data from an SSH session and contain a header chunk, data chunks, and an EOF chunk. Request files -contain a header chunk, SSH request message chunks, and an EOF chunk. - -SSH request message chunks follow the SSH connection and channel request definitions. Boundary populates these chunks -using a protobuf definition provided here: [SSH Chunks](https://github.com/hashicorp/boundary/blob/main/internal/bsr/proto/ssh/v1/ssh_chunks.proto). - -Boundary session recording playback generates an asciinema from a session channel’s `messages-outbound.data` file. For more -information on finding and viewing BSR data using the asciinema, refer to [Find and view recorded sessions](/boundary/docs/session-recording/configuration/manage-recorded-sessions). - -While Boundary does not currently provide tooling to read other BSR .data files, the BSR definition is available in our -[community repository](https://github.com/hashicorp/boundary/tree/main/internal/bsr), and you can use it to develop external tooling. diff --git a/website/content/docs/session-recording/index.mdx b/website/content/docs/session-recording/index.mdx deleted file mode 100644 index bfd4dbe5a..000000000 --- a/website/content/docs/session-recording/index.mdx +++ /dev/null @@ -1,176 +0,0 @@ ---- -layout: docs -page_title: Session recording -description: >- - Discover resources to help you learn more about using session recording to audit user sessions and meet compliance standards for auditing. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Session recording - -This feature requires HCP Boundary or Boundary Enterprise - -Boundary provides auditing capabilities using a feature called session recording. - -In Boundary, a session represents a set of connections between a user and a host from a target. -The session begins when an authorized user requests access to a target, and it ends when that access is terminated. -All sessions have a fixed time limit, and all connections are proxied through a worker. - -When you enable session recording on a target, a worker records any sessions that access the target. -No session data is routed through controllers during the recording stage. -The worker stores the recording on local disk during the recording phase, and then it moves the recording to an external object store when the session is terminated. - -Session recordings are stored in the BSR (Boundary Session Recording) format. -Any credentials needed to access the external object store are passed from the controller to the recording worker when the session is established. -Administrators can view the recordings to investigate security issues, review system activity, or perform regular assessments of security policies and procedures. - -You view session recordings with a session player that runs in a web browser. -The session player is an aggregation of web components that work together to present the different parts of a session recording as a logical whole. -A controller retrieves the contents of a recording from a worker with access to the external object store. -The controller decodes the contents of the recording into a format that is usable by the player. -The player then retrieves the data from the controller. - -In a multi-hop session, the worker that is configured to access the external object store is the worker that records the session. -If no worker can access the storage backend, the session is canceled and an error is returned. - -## Storage buckets - -This feature requires HCP Boundary or Boundary Enterprise - -A resource known as a [storage bucket](/boundary/docs/domain-model/storage-buckets) is used to store the recorded sessions. -The storage bucket represents a bucket in an external object store. -You can configure storage buckets on Amazon S3, MinIO, and some S3-compliant cloud vendors. - -Storing session recordings in a system external to Boundary means those recordings can be accessed, modified, deleted, and even restored independently of Boundary. -You can view any sessions that Boundary recorded in your storage provider or via the CLI. - -Before you can use a storage bucket to record sessions, you must configure a worker with local storage to act as a cache. -The entire recording is written to the local storage cache before it is uploaded. -Once the session is complete, the files are automatically synced with the external storage bucket and deleted from the worker's local storage. - -A storage bucket exists in either the Global scope or an Org scope. -A storage bucket that is associated with the Global scope can be associated with any target. -However, a storage bucket in an Org scope can only be associated with targets in a project from the same Org scope. -Any storage buckets associated with an Org scope are deleted when the Org itself is deleted. - -Deleting a storage bucket in Boundary does not delete the bucket in the external object store, nor does it delete the recorded sessions in the bucket. -The storage bucket's lifecycle does not affect the lifecycle of the bucket in the external object store. -Any session recording metadata that is attached to the storage bucket is deleted when the storage bucket is deleted. - -### Storage considerations - -The BSR captures all the data transmitted between a user and a target during a single session. As a result, the size of a BSR is dependent on user activity. At a minimum, a BSR for a session with one connection requires 8KB of space for its file for BSR keys, checksums, and metadata. - -Determining how much storage you need to allocate on workers and the external storage provider for recordings depends on user activity, but the following two examples are provided to help with storage estimates: - -- For one minute of simple shell activity, a BSR can be around 20KB in size. The storage requirements for 1,000 such sessions would be 20MB. - -- Sending 50MB of data results in a BSR around 50.1MB in size. The storage requirements for 1,000 such sessions would be 50.1 GB. - -When you estimate worker storage requirements, consider the number of concurrent sessions that will be recorded on that worker. Boundary writes the BSR to the worker's local storage while the session is active, and then moves it to the remote storage bucket when the session is closed. - -You use the `recording_storage_minimum_available_capacity` setting to configure the minimum amount of storage space that is required for workers to perform session recording operations. If a worker is at or below the storage threshold, Boundary does not use the worker to record sessions or play back recordings. -Boundary determines the worker's local storage state based on the capacity you configure. -If the worker falls below the storage threshold, or if it runs out of local disk space, it may impact your ability to record sessions. -Refer to [Local storage](/boundary/docs/session-recording/configuration/configure-worker-storage#local-storage) for more information about configuring storage capacity and the possible storage states. - -When you estimate storage requirements for the external storage provider, you should also consider your [storage policy](/boundary/docs/domain-model/storage-policy) and how long a BSR will be retained in the external storage bucket. - - - -Boundary supports recorded session files up to 5 GB in size. -If a recorded session file is over 5 GB, the session details show the recording state as `Failed` and you may not be able to play back the session. -Be careful when you use Secure File Copy (SCP) to transfer large files during a recorded session because it can result in large recorded session files. - - - -## asciicast - -When you view recorded sessions using the CLI or Admin UI, Boundary can convert the recording into other formats for playback. -Currently Boundary supports converting the recording of an individual SSH channel into an asciicast format to play back an interactive SSH session. - -Refer to the [asciinema documentation](https://docs.asciinema.org/) for more information about the [asciicast](https://docs.asciinema.org/manual/asciicast/v3/) format. - -### Limitations - -The asciicast format is well suited for the playback of interactive shell activity. -However, some aspects of the recording cannot be translated into asciicast. -For example, if an SSH session uses the `RemoteCommand` option, or is used to `exec` a command, the command is not displayed in the asciicast. -The output of the command may be displayed, though. - -If you use SSH for something other than an interactive shell, such as for file transfer, X11 forwarding, or port forwarding, Boundary does not attempt to create an asciicast. -In all cases, the SSH session is still recorded in the BSR file and you can view the BSR file in the external storage bucket. - -### Security - -When a worker converts an SSH recording into the BSR file, it iterates through each of the requests in the recording and displays some of them to the user. -If you use an environment request to set the shell variable, the request is included in the asciicast header. -You should be aware of the following security concerns that could result from this behavior: - -- asciicast only includes the last value that you send in the header, any previous values are overwritten. -An attacker may be able to use a malicious shell value at the beginning of a session, and then switch to `shell=/bin/bash` at the end of the session to conceal the malicious activity. - -- asciicast does not display other variables such as `path` in the header, but they can cause drastic changes to code execution during the SSH session. -An attacker could change the `path` variable to point to a malicious program or change the beahvior of a normal program so that it performs a malicious action. - -- asciicast silently ignores any requests that do not have an explicit handler, even though they may cause signficant changes to code execution during the SSH session. -An attacker could execute malicious code using a request without an explicit handler. - -## Session recording audit events - -Boundary emits audit events for actions performed by users. Here are **some** of the possible event field types that are emitted: - -- `timestamp` - The timestamp of the event -- `auth` - Authentication information about the user who performed the action. -- `response.details.item.connection_recordings.` - - `id` - Session recording ID. - - `channel_recordings.id` - Session recording channel ID. - - `start_time.seconds` - Start time of session recording. - - `end_time.seconds` - End time of session recording. - - `bytes_up` - Upload bytes during session. - - `bytes_down` - Download bytes during session. - - `channel_recordings.duration.seconds`- Length of time a session took, recorded in seconds. -- `request_info.client_ip` - The client IP address used by the user. -- `response.details.item.create_time_values.` - - `target.name` - The name of the targets. - - `target.id` - The ID of the target accessed during the recording. - - `target.type` - The type of protocol used. - - `target.scope.name` - Name of the scope the target accessed belongs to. - - `target.scope.parent_scope_id` - Parent ID of the scope the target accessed belongs to. -- `response.details.item.Attrs.SshTargetAttributes.` - - `storage_bucket_id.value` - Storage bucket ID attached to a target that is used for storing session recordings. - - `enable_session_recording.value` - Determines if session recording is enabled on a target. - -## Next steps - -To enable session recording, you must: - -1. [Configure workers for local storage](/boundary/docs/session-recording/configuration/configure-worker-storage) -1. Configure an external storage provider: - - [Amazon S3](/boundary/docs/session-recording/configuration/storage-providers/configure-s3) - - [MinIO](/boundary/docs/session-recording/configuration/storage-providers/configure-minio) - - [S3-compliant](/boundary/docs/session-recording/configuration/storage-providers/configure-s3-compliant) -1. [Create a storage bucket](/boundary/docs/session-recording/configuration/create-storage-bucket) -1. [Enable session recording on a target](/boundary/docs/session-recording/configuration/enable-session-recording) - -Once you enable session recording, you can [Find and view recorded sessions](/boundary/docs/session-recording/configuration/manage-recorded-sessions). - -### Implement session recording compliance standards - -After enabling session recording, you can configure retention policies for recorded sessions or validate the recorded data: - -- [Configure storage policies](/boundary/docs/session-recording/compliance/configure-storage-policy) -- [Update storage policies](/boundary/docs/session-recording/compliance/update-storage-policy) -- [Validate recorded sessions](/boundary/docs/session-recording/compliance/validate-session-recordings) -- [Validate external data store](/boundary/docs/session-recording/compliance/validate-data-store) - -### Work with BSR data files - -For more information about working with BSR files, refer to the following topics: - -- [BSR file data structure](/boundary/docs/session-recording/data/bsr-file-structure) -- [Read a BSR file](/boundary/docs/session-recording/data/read-bsr-file) diff --git a/website/content/docs/targets/configuration/configure-transparent-sessions.mdx b/website/content/docs/targets/configuration/configure-transparent-sessions.mdx deleted file mode 100644 index 3e05007f0..000000000 --- a/website/content/docs/targets/configuration/configure-transparent-sessions.mdx +++ /dev/null @@ -1,84 +0,0 @@ ---- -layout: docs -page_title: Configure transparent sessions -description: >- - Learn how to configure transparent sessions to enhance end-user workflows and simplify target access. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Configure transparent sessions - -@include 'alerts/enterprise-only.mdx' - -Transparent sessions shift Boundary from an active connection model to a passive connection model. Boundary operates in the background instead of requiring you to remember specific resource IDs or ephemeral ports to connect to targets. - -As long as Boundary authenticates a user and the user is authorized to access the target, Boundary intercepts the DNS call and routes traffic through a session automatically. - -Transparent sessions require [aliases](/boundary/docs/targets/configuration) and the [Boundary Client Agent](/boundary/docs/client-agent). - -The Boundary Desktop client facilitates quick target discovery and session establishment using your preferred client. If you configure aliases for your targets, install the Boundary Client Agent, and ensure you are authenticated to the cluster, connections are transparent to the user. Boundary provides OS notifications to make it clear when you connect to a target using a transparent session. - -Boundary supports Windows and MacOS for transparent sessions. - -## Requirements - -Before you configure transparent sessions, you must: - -- Ensure that any previous versions of the Boundary Desktop or CLI client in your local environment are fully uninstalled before you install the Boundary clients using the latest Boundary installer. -- Download the appropriate Boundary installer for your Windows or MacOS environment from the [Install Boundary](/boundary/install#installer) page or the [releases](https://releases.hashicorp.com/boundary-installer) page. -- Install the Boundary Client Agent, CLI, and Desktop client. - - Refer to [Install the Boundary clients](/boundary/docs/deploy/self-managed/install-clients) for instructions. - - Refer to the [transparent sessions interoperability matrix](/boundary/docs/interoperability-matrix) for a list of third-party products that have been tested for use with the Boundary installer and Client Agent. -- Ensure that both IPv4 and IPv6 protocols are enabled for your environment. The [Client Agent](/boundary/docs/client-agent) requires both protocols to start and perform DNS lookups. - -You should also make sure you have the appropriate grants configured so that you can resolve aliases and establish transparent sessions. -For more information, refer to the [Grants](/boundary/docs/client-agent#grants) section in the Client Agent documentation. - - - -A known issue regarding how grants were previously created in HCP Boundary may cause you to receive a 500 error when you attempt to list resolvable aliases. -Clusters created before April 26, 2025 may be missing the following grants: - -`ids={{.User.Id}};type=user;actions=list-resolvable-aliases` - -`ids=*;type=target;actions=list,read` - -If your cluster is missing these grants, HashiCorp recommends adding them. - -For more information, refer to the [known issue](/boundary/docs/release-notes/v0_19_0#hcp-grants). - - - -## Configure targets - -The following section details how to configure targets to use transparent sessions. - - - -If you use a cluster that was created earlier than release 0.16.0, you must add the grant `list-resolvable-aliases` so that the client agent can populate the local alias cache. - -As an example, you could add the grant: - -`type=user;actions=list-resolvable-aliases;ids=*`. - -For more information, refer to the [Grants](/boundary/docs/client-agent#grants) section in the Client Agent documentation. - - - -Complete the following steps to configure targets: - -1. Authenticate to Boundary using the CLI or Desktop client. -1. [Create a new target with an alias](/boundary/docs/targets/configuration/create-target-alias#create-an-alias-during-target-creation) or [create an alias for an existing target](/boundary/docs/targets/configuration/create-target-alias#create-an-alias-for-an-existing-target). -Ensure that you have authorization to establish a session to the target. - -## Next steps - -Open the client of your choice and [connect to your target using the alias](/boundary/docs/targets/connections/transparent-sessions). - -## More information - -Refer to [Troubleshoot issues with the Client Agent](/boundary/docs/client-agent/troubleshoot) for a list of [known issues](/boundary/docs/client-agent/troubleshoot#transparent-sessions-known-issues) involving transparent sessions. diff --git a/website/content/docs/targets/configuration/create-target-alias.mdx b/website/content/docs/targets/configuration/create-target-alias.mdx deleted file mode 100644 index efe4470ee..000000000 --- a/website/content/docs/targets/configuration/create-target-alias.mdx +++ /dev/null @@ -1,710 +0,0 @@ ---- -layout: docs -page_title: Create target aliases -description: >- - Learn how to create a target alias for an existing target, or assign one during target creation. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Create target aliases - -An alias is a globally unique, DNS-like string that is associated with a destination resource. You can establish a session to a target by referencing its alias, instead of having to provide a target ID or target name and scope ID. - -For more information about aliases, including naming conventions and best practices, refer to [Overview of aliases](/boundary/docs/targets/configuration). - -You can create aliases and associate them with targets using the following methods: - -- [Create an alias for an existing target](#create-an-alias-for-an-existing-target) -- [Create an alias during target creation](#create-an-alias-during-target-creation) -- [Associate an existing alias with a target](#associate-an-existing-alias-with-a-target) -- [Create multiple target aliases: An example](#create-multiple-aliases-for-a-single-target) - -## Create an alias for an existing target - -You can create a new alias and associate it with an existing target at the same time. - -When you create the target alias, you can choose from the following methods: - -- Create the alias without adding a target -- Create the alias for one or more targets -- Create the alias with an optional host ID - -Complete the following steps to create a new alias and associate it with a target: - - - - -1. Log in to Boundary. -1. Select **Aliases** in the navigation pane. -1. Click **New Alias**. -1. Complete the following fields: - - **Name**: (Optional) Enter an optional name for the alias to use for identification purposes. - - **Description**: (Optional) Enter an optional description for the alias to use for identification purposes. - - **Type**: Select **Target**. - At this time, targets are the only Boundary resources that supports aliasing. - - **Alias Value**: Enter the string that you want to use as the alias to represent the target. - An alias's value can be a hostname or a DNS-like string. - - **Target ID**: (Optional) Specify any targets you want to associate with the alias. - - **Host ID**: (Optional) Enter an optional host ID, if you would like to specify that the alias always uses the same host when you use it to connect to a target. -1. Click **Save**. - - - - -1. Log in to Boundary. -1. Use the following command to create an alias: - - ```shell-session - $ boundary aliases create target \ - -description 'This is an example alias for target tcp_1234567890' \ - -destination-id tcp_1234567890 \ - -name Example Boundary alias \ - -scope-id global \ - -value example.alias.boundary \ - -authorize-session-host-id hst_1234567890 - ``` - - You can use any of the following [attributes](/boundary/docs/domain-model/aliases) when you create an alias: - - - `-description=` - Specifies the optional description you want to use for identification purposes. - - `-destination-id=` - Specifies the ID of the target that the alias references. - - `-name=` - Specifies the optional name you want to use to describe the alias for identification purposes. - - `-scope-id=` - Scope in which to create the alias. The default is `global`. - You can also specify the scope using the BOUNDARY_SCOPE_ID environment variable. - At this time, aliases are only supported for the global scope. - - `-value=` - Specifies the string that you want to use as the alias to represent the target. - The alias `value` can be a hostname or a DNS-like string. - - `-authorize-session-host-id=` - Optionally indicates the host ID to use when you use the alias to authorize a session. - - - - -Apply the following Terraform policy to create target alias `example.bar.foo.boundary` for an existing target `foo_target` and host `bar_host`: - -```hcl -resource "boundary_alias_target" "example_alias_target" { - name = "example_alias_target" - description = "Example alias to target foo using host boundary_host_static.bar_host" - scope_id = "global" - value = "example.bar.foo.boundary" - destination_id = boundary_target.foo_target.id - authorize_session_host_id = boundary_host_static.bar_host.id -} -``` - - - - -## Create an alias during target creation - -You can create a new target and new alias at the same time and associate the two. - -Complete the following steps to create a new target and new alias at the same time: - - - - -1. Log in to Boundary. -1. Select **Targets** in the navigation pane. -1. Click **New Target**. -1. Complete the following fields: - - **Name**: Enter the target name for identification purposes. - - **Description**: (Optional) Enter an optional description for identification purposes. - - **Type**: Select the target type. - You can create RDP, SSH, or TCP targets. - - **Target Address**: (Optional) Enter a valid IP address or DNS name. - Alternatively, you can configure host catalogs and host sets. - - If you set a target address for RDP targets that use Kerberos authentication, use the target's hostname and append the domain to it, for example `target-hostname.mydomain.com`. For RDP targets that use NTLM authentication, set the target address to the target's IP address. - - **Default Port**: (Optional) Enter an optional default port for the target to use for connections. - - **Default Client Port**: (Optional) Enter an optional local proxy port on which to listen when a session is started on a client. - - **Maximum Duration**: (Required) Enter a maximum duration for sessions on this target, in seconds. - If you do not enter a value, Boundary uses the default of 8 hours (28,800 seconds). - - **Maximum Connection**: (Optional) Enter the maximum number of connections allowed per session on this target. - For unlimited connections, enter `-1`. - - **Workers**: (Optional) Select whether you want the worker to function as an ingress and/or egress worker. - - **Aliases**: (Optional) Enter the value fpr any aliases you want to associate with this target, and then click **Add**. - An alias's value can be a hostname or a DNS-like string. - You can associate multiple aliases with a target. -1. Click **Save**. - - - - -1. Log in to Boundary. -1. Use the following command to create a target: - - ```shell-session - $ boundary targets create ssh \ - -description 'This is an example ssh target' \ - -name Example Boundary SSH target \ - -scope-id global \ - -with-alias-authorize-session-host-id hst_1234567890 \ - -with-alias-scope-id global \ - -with-alias-value example.alias.boundary - ``` - - You can use any of the following [attributes](/boundary/docs/domain-model/targets) when you create a target: - - - `description` - (optional) - An optional description that you can use for identification purposes. - - `name` - (required) - The `name` must be unique within the target's project. - - `scope-id` - (required) - The scope in which to create the target. - The default is `global`. - You can also specify the scope using the BOUNDARY_SCOPE_ID environment variable. - - `-address=` - An optional valid network address for the target to connect to. - You cannot use an address alongside host sources. - - If you set a target address for RDP targets that use Kerberos authentication, use the target's hostname and append the domain to it, for example `target-hostname.mydomain.com`. For RDP targets that use NTLM authentication, set the target address to the target's IP address. - - `-default-client-port=` - The default client port on the target. - - `-default-port=` - The default port on the target. - If you do not specify a default port, Boundary uses port 22. - - `-egress-worker-filter=` - A Boolean expression that filters which egress workers can process sessions for the target. - - `-enable-session-recording=` - A Boolean expression you can use to enable session recording for the target. - - `-ingress-worker-filter=` - A Boolean expression that filters which ingress workers can process sessions for the target. - - `-session-connection-limit=` - The maximum number of connections allowed for a session. -A value of `-1` means the connections are unlimited. - - `-session-max-seconds=` - The maximum lifetime of the session, including all connections. - You can specify an integer number of seconds or a duration string. - - `-storage-bucket-id=` - The public ID of the storage bucket to associate with the target. - - `-with-alias-authorize-session-host-id=` - The host ID that an alias uses to authorize sessions for the target. - - `-with-aliasscope-id=` - The scope ID that you want to create the target and alias in. - The default is `global`. - At this time, aliases are only supported for the global scope. - - `-with-alias-value=` - The value of the alias that you want to use to represent the target. - Use this parameter to create the alias and target, and associate them with each other, at the same time. - - You can create RDP, SSH, or TCP [target types](/boundary/docs/domain-model/targets#target-types). - The example command in this section creates an SSH target. - - - - -Apply the following Terraform policy to create the following: - -- A static host catalog `test_catalog` in `boundary_scope.project` (not shown) containing static host set `test_set`. -- A host `foo` belonging to `test_set`. -- A host `bar` belonging to `test_set`. -- A target `foo_target` using `foo_set` as its host source. -- A target alias `example.bar.foo.boundary` for `foo_target` that always uses `bar_host` to connect. - -```hcl -resource "boundary_host_catalog_static" "foo_catalog" { - name = "foo_catalog" - description = "test catalog" - scope_id = boundary_scope.project.id -} - -resource "boundary_host_static" "foo_host" { - name = "foo_host" - host_catalog_id = boundary_host_catalog_static.foo.id - address = "10.0.0.1" -} - -resource "boundary_host_static" "bar_host" { - name = "bar_host" - host_catalog_id = boundary_host_catalog_static.foo.id - address = "127.0.0.1" -} - -resource "boundary_host_set_static" "foo_set" { - name = "foo_set" - host_catalog_id = boundary_host_catalog_static.foo_catalog.id - - host_ids = [ - boundary_host_static.foo_host.id, - boundary_host_static.bar_host.id, - ] -} - -resource "boundary_target" "foo_target" { - name = "foo" - description = "Foo target" - type = "tcp" - default_port = "22" - scope_id = boundary_scope.project.id - host_source_ids = [ - boundary_host_set_static.foo_set.id, - ] -} - -resource "boundary_alias_target" "example_alias_target" { - name = "example_alias_target" - description = "Example alias to target foo using host boundary_host_static.bar_host" - scope_id = "global" - value = "example.bar.foo.boundary" - destination_id = boundary_target.foo_target.id - authorize_session_host_id = boundary_host_static.bar_host.id -} -``` - - - - -## Associate an existing alias with a target - -If you [created an alias](#create-an-alias-for-an-existing-target) without associating it with a target, you can update it with an existing target at a later time. Complete the following steps to add an alias to a target: - - - - -1. Log in to Boundary. -1. Select **Targets** in the navigation pane. -1. Select the target you want to add an alias to. -1. Under the **Aliases** heading in the right sidebar, click **Add an alias**. -1. Complete the following fields: - - **Name**: (Optional) Enter an optional name for the alias to use for identification purposes. - - **Description**: (Optional) Enter an optional description for the alias to use for identification purposes. - - **Type**: Select **Target**. - At this time, targets are the only Boundary resources that supports aliasing. - - **Alias Value**: Enter the alias value you want to use in commands to represent the target. - An alias's value can be a hostname or a DNS-like string. - - **Target ID**: This field contains the ID of the target you selected to add an alias to. - It is read only. - - **Host ID**: (Optional) Enter an optional host ID, if you would like to specify that the alias always uses the same host when you use it to connect to a target. -1. Click **Save**. - - - - -1. Log in to Boundary. -1. Use the following command to create an alias: - - ```shell-session - $ boundary aliases update target \ - -destination-id tcp_1234567890 \ - -id alt_1234567890 \ - -authorize-session-host-id hst_1234567890 - ``` - - You can use any of the following [attributes](/boundary/docs/domain-model/aliases) when you update an alias: - - - `-description=` - Specifies the optional description you want to use for identification purposes. - - `-destination-id=` - Specifies the ID of the target that the alias references. - - `id=` - Specifies the ID of the alias you want to update. - - `-name=` - Specifies the optional name you want to use to describe the alias for identification purposes. - - `-scope-id=` - Scope in which to create the alias. The default is `global`. - You can also specify the scope using the BOUNDARY_SCOPE_ID environment variable. - At this time, aliases are only supported for the global scope. - - `-value=` - Specifies the string that you want to use as the alias to represent the target. - The alias `value` must comply with DNS naming rules. - - `-authorize-session-host-id=` - Optionally indicates the host ID to use when you use the alias to authorize a session. - - - - -If you created a `boundary_alias_target` resource without setting a `destination_id` attribute, update the `destination_id` and reapply the following policy: - -```hcl -resource "boundary_alias_target" "example_alias_target" { - name = "example_alias_target" - description = "Example alias to target foo using host boundary_host_static.bar_host" - scope_id = "global" - value = "example.bar.foo.boundary" - destination_id = boundary_target.foo_target.id - authorize_session_host_id = boundary_host_static.bar_host.id -} -``` - - - - -## Create multiple aliases for a single target - -Target aliases point directly to the target they are associated with. You can assign targets a host set or a direct target address. - -[Host sets](/boundary/docs/domain-model/host-sets) are sets of functionally equivalent hosts, and are commonly used for deployments at scale. When Boundary authorizes a session, a target assigned a host set will select a host from the host set at random to use for all connections for the session. - -You assign [direct target addresses](/boundary/docs/domain-model/targets#address) directly to the target. They refer to a specific network resource, like an IP address. Boundary only connects to the direct target address when it establishes a connection to the associated target. - - - -If you set a target address for RDP targets that use Kerberos authentication, use the target's hostname and append the domain to it, for example `target-hostname.mydomain.com`. For RDP targets that use NTLM authentication, set the target address to the target's IP address. - - - -When you create a target alias, you can also assign it to a specific host. Assigning an alias to a specific host is useful if you want to avoid creating multiple targets for specific hosts using direct target addresses. - -For example, you could create two aliases for the same target that has been assigned a host set. One alias could refer to the target itself, and would allow Boundary to randomly select a host to connect to for a session. Another alias could point to the same target, but you could assign a host ID that Boundary should use for a session. - -### Example - -You may want to create aliases that point to the same target, but that specify which host Boundary should use when it establishes a session. - -In this example, you set up three aliases for the same target: - -1. A target alias without a host specified -1. A target alias with a host ID specified -1. A target alias with a different host ID specified - - - - This example uses SSH target types, which are only available in HCP Boundary and Boundary Enterprise. This process also works for any other target type, including the TCP target type available in Boundary Community Edition. - - - -For this example, assume that the following scopes exist: - -- Org: `engineering`, ID `o_2drCWvp3Oc` -- Project: `app-servers`, ID `p_3ECODJDbXV` - -And the following host set and hosts exist: - -- Host set: `linux-dev-servers`, ID `hsst_56oiL0WaKu` -- Host: `dev-040`, ID `hst_7wGXkF8e0Q` -- Host: `dev-041`, ID `hst_zlRwMMPKwp` - -Because the `linux-dev-servers` hosts are functionally equivalent, you can create a single target for the host set, and create an alias for the target. - -We recommend creating DNS-like aliases to ensure consistent naming conventions. In this example, an alias pattern might be: - -`hostname.host-set.project.org` - -For the `linux-dev-servers` target, create the alias `linux-dev.app-servers.eng`. - - - - -Create the `linux-dev-servers` target. - -1. Log in to Boundary. -1. Select the 'engineering' org and the `app-servers` project. -1. Select **Targets** in the navigation pane. -1. Click **New Target**. -1. Complete the following fields: - - **Name**: `linux-dev-servers` - - **Description**: `linux-dev.app-servers.eng target` - - **Type**: SSH - - **Default Port**: `22` - - **Aliases**: `linux-dev.app-servers.eng` -1. Click **Save**. - -Then add the `linux-dev-servers` host set to the new `linux-dev-servers` target. - -1. Click on the **Host Sources** tab. -1. Click **Add Host Sources**. -1. Select the `linux-dev-servers` host set. -1. Click **Add Host Sources**. - - - - -Create the `linux-dev-servers` target. - -1. Log in to Boundary. -1. Use the following command to create the `linux-dev-servers` target with alias `linux-dev.app-servers.eng`: - - ```shell-session - $ boundary targets create ssh \ - -description 'linux-dev.app-servers.eng target' \ - -name linux-dev-servers \ - -scope-id p_3ECODJDbXV \ - -default-port 22 \ - -with-alias-scope-id global \ - -with-alias-value linux-dev.app-servers.eng - ``` - - Example output: - - - - ```shell-session - $ boundary targets create ssh \ - -description 'linux-dev.app-servers.eng target' \ - -name linux-dev-servers \ - -scope-id p_pj6UUPVJT3 \ - -default-port 22 \ - -with-alias-scope-id global \ - -with-alias-value linux-dev.app-servers.eng - - Target information: - Created Time: Thu, 14 Nov 2024 13:39:36 MST - Description: linux-dev.app-servers.eng target - ID: tssh_lhH5pa425G - Name: linux-dev-servers - Session Connection Limit: -1 - Session Max Seconds: 28800 - Type: ssh - Updated Time: Thu, 14 Nov 2024 13:39:36 MST - Version: 1 - - Scope: - ID: p_3ECODJDbXV - Name: app-servers - Parent Scope ID: o_2drCWvp3Oc - Type: project - - Authorized Actions: - remove-host-sources - remove-credential-sources - authorize-session - delete - set-credential-sources - no-op - read - update - add-host-sources - set-host-sources - add-credential-sources - - Aliases: - ID: alt_CkC6wGKLWW - Value: linux-dev.app-servers.eng - - Attributes: - Default Port: 22 - Enable Session Recording: false - ``` - - - -Then add the `linux-dev-servers` host set (ID `hsst_56oiL0WaKu`) to the new `linux-dev-servers` target (ID `tssh_lhH5pa425G`). - -```shell-session -$ boundary targets add-host-sources -id tssh_lhH5pa425G -host-sourchsst_56oiL0WaKu -``` - - - - - - - In the following examples, Terraform resources are named with underscores instead of dashes, such as `linux_dev_servers`. The target alias values use dashes, such as `dev-041.linux-dev.app-servers.eng`. You do not need to follow these naming conventions. - - - -Create the `linux_dev_servers` SSH target, with `scope_id` set to `app_servers` and the host source `linux_dev_servers` (these resources are not shown): - -```hcl -resource "boundary_target" "linux_dev_servers" { - name = "linux_dev_servers" - description = "linux_dev_servers target" - type = "ssh" - default_port = "22" - scope_id = boundary_scope.app_servers.id - host_source_ids = [ - boundary_host_set_static.linux_dev_servers.id, - ] -} -``` - - - - -Next, create two more aliases for the target. - -Create the `dev-040.linux-dev.app-servers.eng` alias for the host `dev-040`: - - - - -1. Log in to Boundary. Navigate to the `global` scope. -1. Select **Aliases** in the navigation pane. -1. Click **New Alias**. -1. Complete the following fields: - - **Name**: `dev-040` - - **Description**: `Target alias for dev-040.linux-dev.app-servers.eng` - - **Type**: `Target` - - **Alias Value**: `dev-040.linux-dev.app-servers.eng` - - **Target ID**: `tssh_lhH5pa425G` - - **Host ID**: `hst_7wGXkF8e0Q` -1. Click **Save**. - - - - -1. Log in to Boundary. -1. Use the following command to create an alias for host `dev-040: - - ```shell-session - $ boundary aliases create target \ - -description 'Target alias for dev-040.linux-dev.app-servers.eng' \ - -destination-id tssh_lhH5pa425G \ - -name dev-040 \ - -scope-id global \ - -value dev-040.linux-dev.app-servers.eng \ - -authorize-session-host-id hst_7wGXkF8e0Q - ``` - - Example output: - - - - ```shell-session - $ boundary aliases create target \ - -description 'Target alias for dev-040.linux-dev.app-servers.eng' \ - -destination-id tssh_lhH5pa425G \ - -name dev-040 \ - -scope-id global \ - -value dev-040.linux-dev.app-servers.eng \ - -authorize-session-host-id hst_7wGXkF8e0Q - - Alias information: - Created Time: Thu, 14 Nov 2024 13:55:41 MST - Description: Target alias for dev-040.linux-dev.app-servers.eng - Destination ID: tssh_lhH5pa425G - ID: alt_QeCGTcvlq2 - Name: dev-040 - Type: target - Updated Time: Thu, 14 Nov 2024 13:55:41 MST - Value: dev-040.linux-dev.app-servers.eng - Version: 1 - - Scope: - ID: global - Name: global - Type: global - - Authorized Actions: - no-op - read - update - delete - - Attributes: - authorize_session_arguments: - { - "host_id": "hst_7wGXkF8e0Q" - } - ``` - - - - - - -```hcl -resource "boundary_alias_target" "dev_040" { - name = "dev_040" - description = "Example alias for target linux_dev_servers using host dev_040" - scope_id = "global" - value = "dev-040.linux-dev.app-servers.eng" - destination_id = boundary_target.linux_dev_servers.id - authorize_session_host_id = boundary_host_static.dev_040.id -} -``` - - - - -Then create the `dev-041.linux-dev.app-servers.eng` alias for the host `dev-041`. - - - - -1. Log in to Boundary. Navigate to the `global` scope. -1. Select **Aliases** in the navigation pane. -1. Click **New Alias**. -1. Complete the following fields: - - **Name**: `dev-041` - - **Description**: `Target alias for dev-041.linux-dev.app-servers.eng` - - **Type**: `Target` - - **Alias Value**: `dev-041.linux-dev.app-servers.eng` - - **Target ID**: `tssh_lhH5pa425G` - - **Host ID**: `hst_7wGXkF8e0Q` -1. Click **Save**. - - - - -1. Log in to Boundary. -1. Use the following command to create an alias for host `dev-041`: - - ```shell-session - $ boundary aliases create target \ - -description 'Target alias for dev-041.linux-dev.app-servers.eng' \ - -destination-id tssh_lhH5pa425G \ - -name dev-041 \ - -scope-id global \ - -value dev-041.linux-dev.app-servers.eng \ - -authorize-session-host-id hst_zlRwMMPKwp - ``` - - Example output: - - - - ```shell-session - $ boundary aliases create target \ - -description 'Target alias for dev-041.linux-dev.app-servers.eng' \ - -destination-id tssh_lhH5pa425G \ - -name dev-041 \ - -scope-id global \ - -value dev-041.linux-dev.app-servers.eng \ - -authorize-session-host-id hst_zlRwMMPKwp - - Alias information: - Created Time: Thu, 14 Nov 2024 14:00:13 MST - Description: Target alias for dev-040.linux-dev.app-servers.eng - Destination ID: tssh_lhH5pa425G - ID: alt_X5MRXRSi7t - Name: dev-041 - Type: target - Updated Time: Thu, 14 Nov 2024 14:00:13 MST - Value: dev-041.linux-dev.app-servers.eng - Version: 1 - - Scope: - ID: global - Name: global - Type: global - - Authorized Actions: - no-op - read - update - delete - - Attributes: - authorize_session_arguments: - { - "host_id": "hst_zlRwMMPKwp" - } - ``` - - - - - - -```hcl -resource "boundary_alias_target" "dev_041" { - name = "dev_040" - description = "Example alias for target linux_dev_servers using host dev_040" - scope_id = "global" - value = "dev-041.linux-dev.app-servers.eng" - destination_id = boundary_target.linux_dev_servers.id - authorize_session_host_id = boundary_host_static.dev_041.id -} -``` - - - - -You can now use the aliases to connect to the targets in different contexts. - -The Boundary Desktop Client lists the `linux-dev-servers` target and its aliases under the **Aliases** column. - -When you click **Connect**, a list of the hosts available for the connection appears in the **Quick Connect** box. - -To establish a connection to any `linux-dev` host using the CLI, use the `linux-dev.app-servers.eng` alias: - -```shell-session -$ boundary connect ssh linux-dev.app-servers.eng -``` - -This command randomly selects a host from the `linux-dev-servers` host set attached to the `linux-dev-servers` target. - -To establish a connection to a specific host, connect to its target alias instead: - -```shell-session -$ boundary connect ssh dev-041.linux-dev.app-servers.eng -``` - -This alias still points to the `linux-dev-servers` target, but will only create a session with the `dev-041` host. \ No newline at end of file diff --git a/website/content/docs/targets/configuration/index.mdx b/website/content/docs/targets/configuration/index.mdx deleted file mode 100644 index e9cb1acb0..000000000 --- a/website/content/docs/targets/configuration/index.mdx +++ /dev/null @@ -1,88 +0,0 @@ ---- -layout: docs -page_title: Overview -description: >- - Learn how to configure aliases and transparent sessions to enhance end-user workflows and simplify target access. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Overview of aliases - -Target aliases simplify the connection workflow for end users by allowing them to reference targets using a globally unique DNS-like string. - -Without aliases, connecting to an end target requires you to reference the target ID, or a combination of target name and scope: - -```shell-session -$ boundary connect ssh -target-id ttcp_1234567890 -``` - -```shell-session -$ boundary connect ssh -target-name sql-database -target-scope-name -staging -``` - -With target aliases, a single globally referenced value is assigned to a target, simplifying connection workflows and enabling transparent sessions for Enterprise and HCP end users. - -```shell-session -$ boundary connect ssh sql-database-staging -``` - -## Permissions - -The existence of an alias for a Boundary resource does not change how permissions function. Anyone can attempt to use an alias to access a target, but if you do not have permission to access the target, the attempt fails. You can create an alias for a target, even if you do not have permission to access the target. - -Separating the permissions from aliases and destination resources means a different set of people can manage the aliases than the people who have permission to operate on targets. For example, you may have a project with a sensitive set of targets. You can configure Boundary to allow a select few users to manage those targets, while a different group of users manage the aliases. - -## Naming conventions - -An alias is a globally unique, DNS-like string that is associated with a destination resource. The alias `value` parameter does not have to be delimited by a suffix, and can be just a hostname. - -Examples of valid aliases include `database.boundary` and `webserver.boundary`. - -### Single word aliases and transparent sessions - -HashiCorp recommends that you do not use single-word aliases such as `webserver` as opposed to `webserver.boundary`, because single-word aliases do not work intuitively on Windows. - -Windows DNS resolution does not support resolving unqualified single word DNS hostnames. You can make the hostname fully qualified, but is not intuitive to most users. - -For example the following hostname works: - -``` -ssh mytarget. -``` - -But this hostname does not work: - -``` -ssh mytarget -``` - -For this reason, if you expect any Windows users to use an alias, it should contain a dot (`.`) anywhere in the value. - -Refer to the [transparent sessions](/boundary/docs/concepts/transparent-sessions) documentation for more information. - -### HTTPS websites - -If you create an alias for a website that uses HTTPS, the alias must match the website's hostname. -You may receive connection errors if the alias does not match the website's hostname exactly. - -For example, if you want to create an alias to connect to https://www.hashicorp.com, you must name the alias `www.hashicorp.com`. - -## Scopes - -You can only create aliases in the `global` scope. However, you can associate aliases with targets or hosts from any scope. Support for additional resource types may be added in the future. - -If you delete a project, Boundary clears the `destination_id` parameter for any aliases that resolve to targets in that project, so that they no longer function. - -Refer to the [Create target aliases](/boundary/docs/targets/configuration/create-target-alias) pages to learn more. - -## Next steps - -To use target aliases to connect to targets: - -1. [Create a target alias](/boundary/docs/targets/configuration/create-target-alias) -1. [Connect to a target using an alias](/boundary/docs/targets/connections/connect-target-alias) -1. After you set up a target alias, you can optionally [Configure transparent sessions for end users](/boundary/docs/targets/configuration/configure-transparent-sessions). HCP/ENT \ No newline at end of file diff --git a/website/content/docs/targets/connections/connect-helpers.mdx b/website/content/docs/targets/connections/connect-helpers.mdx deleted file mode 100644 index edcb88a5e..000000000 --- a/website/content/docs/targets/connections/connect-helpers.mdx +++ /dev/null @@ -1,229 +0,0 @@ ---- -layout: docs -page_title: Connect helpers -description: >- - Learn how to use connect helpers to automatically accept host key prompts and facilitate connections for HTTP, Kubernetes, PostgreSQL, RDP, and SSH. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Connect helpers - -Boundary includes connect helpers that automatically accept host key prompts for you to help facilitate connections. -These are written as `boundary connect ` and are supported for the following connection types: - -- HTTP -- Kubernetes -- PostgreSQL -- RDP -- SSH - -If you want to pass additional flags to the client, you can add them to the command line separated by a double dash. -Boundary passes anything after the double dash to the executed client. -For example, the following command uses the SSH connect helper to pass `-l some-other-user` to the SSH client: - -```shell-session -$ boundary connect ssh -target-id ttcp_1234567890 -- -l some-other-user -``` - -Connect helpers also support a `-style` flag that lets you override the default client and format arguments in a different style. -For example, besides the default style `ssh`, the SSH connect helper supports a `-style putty` option that lets you pass connection information to PuTTY. - -One advantage to styles is that Boundary can provide information to the client in a format that makes sense. -For example, the `-username` flag is used to specify a username other than the currently logged-in user. -This ensures that regardless of the `-style` you choose, the username is properly passed to the executed client, and you don't have to figure out the syntax for yourself. - -## HTTP connect helper - -The HTTP connect helper executes `curl`, and passes information such as the HTTP path, method, and verb. -It can be useful to call API endpoints through the Boundary proxy. - -The following example calls a weather API endpoint to get the rain forecast for New York: - -```shell-session -$ boundary connect http -target-id ttcp_VlpkajEuuf -path '/v1/forecast?latitude=40.7143&longitude=-74.006&daily=precipitation_sum&timezone=America%2FNew_York' -``` - - - -The HTTP helper supports the following flags: - -- `host`: Specifies the host value to use, and overrides the endpoint address from the session information. -- `method`: Specifies the method to use. -If you do not set this value, the helper uses the client's default method. -- `path`: Specifies a path that Boundary appends to the generated URL. -- `scheme`: Specifies the scheme to use. -The default scheme is `https`. -- `style`: Specifies how the CLI attempts to invoke an HTTP client. -The only supported style for the HTTP helper is `curl`. - -For more information, refer to the [`connect http` command documenatation](/boundary/docs/commands/connect/http). - -## Kubernetes connect helper - -The Kubernetes connect helper executes `kubectl` by proxying the call through Boundary. -It can be useful to access a Kubernetes cluster that does not publicly expose its API server. -To pass subcommands to `kubectl`, use `--` followed by the command you want to pass. -The following example calls `kubectl top node`: - -```shell-session -$ boundary connect kube -target-id ttcp_Yq0QCUMSe2 -- top node -``` - - - -The Kubernetes helper supports the following flags: - -- `host`: Specifies the host value to use, and overrides the endpoint address from the session information. -- `scheme`: Specifies the scheme to use. -The default scheme is `https`. -- `style`: Specifies how the CLI attempts to invoke a Kubernetes client. -The only supported style for the Kubernetes helper is `kubectl`. - -For more information, refer to the [`connect kube` command documenatation](/boundary/docs/commands/connect/kube). - -## PostgreSQL connect helper - -The PostgreSQL helper executes `psql`, and passes information such as the username and database name from the command line. - -The following example connects to a PostgreSQL database named `boundary`: - -```shell-session -$ boundary connect postgres -target-id ttcp_eTcZMueUYv -username admin -dbname postgres -``` - - - -The PostgreSQL helper automatically injects brokered credentials, allowing you -to access the PostgreSQL instance without knowing the username and password. - -```shell-session -$ boundary connect postgres -target-id ttcp_eTcZMueUYv -dbname postgres -``` - - - -The PostgreSQL helper supports the following flags: - -- `dbname`: Specifies the database name you want to pass through to the client. -- `style`: Specifies how the CLI attempts to inovke a PostgreSQL client. -The only supported style for the PostgreSQL helper is `psql`. -- `username`: Specifies the username you want to pass through to the client. - -For more information, refer to the [`connect postgres` command documenatation](/boundary/docs/commands/connect/postgres). - -## RDP connect helper - -The RDP helper determines which RDP client to use depending on your operating system. -On Windows, it uses `mstsc.exe`. -On Mac, it uses `open`. -Other operating systems are not currently supported. - -The following command executes the RDP client and establishes the connection through Boundary: - -```shell-session -$ boundary connect rdp -target-id ttcp_eTcZMueUYv -``` - - - -The RDP helper supports the following flag: - -- `style`: Specifies how the CLI attempts to inovke an RDP client. -The RDP helper supports the styles `mstsc` and `open`. - -For more information, refer to the [`connect rdp` command documenatation](/boundary/docs/commands/connect/rdp). - -## SSH connect helper - -The SSH helper automatically executes SSH and passes connection information. -An expected host ID is set to avoid warnings on future connections when a different port is allocated automatically. -You must still accept a host key upon the first connection. - -The following command connects to a target and automatically fills in the local address and port: - -```shell-session -$ boundary connect ssh -target-id ttcp_1234567890 -``` - - - -The SSH helper supports the following flags: - -- `remote-command`: Specifies a command you want to run on the remote host. -You can specify a complete command line, or you may include additonal arguments. -If you include additional arguments, you must append them to the command and separate them using spaces. -- `style`: Specifies how the CLI attempts to inovke an SSH client. -The SSH helper supports the styles `ssh` and `putty`. -- `username`: Specifies the username you want to pass through to the client. - -For more information, refer to the [`connect ssh` command documenatation](/boundary/docs/commands/connect/ssh). \ No newline at end of file diff --git a/website/content/docs/targets/connections/connect-target-alias.mdx b/website/content/docs/targets/connections/connect-target-alias.mdx deleted file mode 100644 index 74692b369..000000000 --- a/website/content/docs/targets/connections/connect-target-alias.mdx +++ /dev/null @@ -1,35 +0,0 @@ ---- -layout: docs -page_title: Overview -description: >- - Learn how to connect to a target configured with an alias. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Connect to a target using an alias - -After you [Create a target alias](/boundary/docs/targets/configuration/create-target-alias), you can refer to the alias when you establish sessions. - -With aliases, you don't have to specify the target ID, target name, or scope when you connect with Boundary. Target aliases are also required to use [transparent sessions](/boundary/docs/concepts/transparent-sessions). - -You can substitute an alias whenever you could use the `-id` flag or `-target` flag in the CLI. - -For example, you can use the following command to connect to an SSH target with the ID `ttcp_1234567890`: - -```shell-session -$ boundary connect ssh -target -id ttcp_1234567890 -``` - -If you configured an alias named `example.alias.boundary` for the target, you can now use the alias to connect to the target: - -```shell-session -$ boundary connect ssh example.alias.boundary -``` - -Aliases are globally unique, so you don't need to specify the scope to connect to the target. - -After you verify that you can connect to the target using an alias, you can try to connect to the target using [transparent sessions](/boundary/docs/targets/configuration/configure-transparent-sessions). HCP/ENT \ No newline at end of file diff --git a/website/content/docs/targets/connections/exec-flag.mdx b/website/content/docs/targets/connections/exec-flag.mdx deleted file mode 100644 index 4d6704c1c..000000000 --- a/website/content/docs/targets/connections/exec-flag.mdx +++ /dev/null @@ -1,87 +0,0 @@ ---- -layout: docs -page_title: -exec flag -description: >- - Learn how to use the `-exec` flag to execute TCP sessions or pass flags using your preferred client. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Exec flag - -Boundary includes built-in connect helpers for clients, however, `boundary connect` can execute clients even when there is no built-in support for a specific client using the `-exec` flag. -The `-exec` flag lets you wrap Boundary TCP sessions in your preferred client. -You can use this flag to create an authenticated proxy to almost anything. - -When you use `-exec`, you can pass flags to the client by including them in the executed command after a double-dash `--`. -For example, the following command passes `-l myuser -i ~/.ssh/identity` to the PuTTY client: - -```shell-session -$ boundary connect ssh -style putty -exec putty.exe -target-id ttcp_1234567890 -- -l myuser -i ~/.ssh/identity -``` - -You can substitute the following templated values into the command arguments. -Boundary injects these values in the executed command as environment variables: - -- `{{boundary.ip}}` (`BOUNDARY_PROXIED_IP`): The IP address of the listening socket that `boundary connect` opened. -- `{{boundary.port}}` (`BOUNDARY_PROXIED_PORT`): The port of the listening socket that `boundary connect` has opened. -- `{{boundary.addr}}` (`BOUNDARY_PROXIED_ADDR`): The host:port format of the address. -This value is essentially equivalent to `{{boundary.ip}}:{{boundary.port}}`. - -For example, if you wanted to use Boundary to create an authenticated firewall -around `curl`, you could update the default TCP target from a default port -of `:22` to `:443` using the following command: - -```shell-session -$ boundary targets update tcp -default-port 443 -id ttcp_1234567890 - -Target information: - Address: 127.0.0.1 - Created Time: Fri, 25 Sep 2020 18:35:47 PDT - Description: Provides an initial target in Boundary - ID: ttcp_1234567890 - Name: Generated target - Session Connection Limit: 1 - Session Max Seconds: 28800 - Type: tcp - Updated Time: Fri, 25 Sep 2020 18:36:18 PDT - Version: 2 - - Scope: - ID: p_1234567890 - Name: Generated project scope - Parent Scope ID: o_1234567890 - Type: project - - Attributes: - Default Port: 443 -``` - -In the output above, the default port for the target has now changed to `:443`. - -Now, you can use `curl` as the client for a TCP target session. -For example, the following command uses `curl` to perform an authenticated download of hashicorp.com: - -```shell-session -$ boundary connect -exec curl -target-id ttcp_1234567890 \ - -- -vvsL --output /dev/null hashicorp.com - -* Trying 76.76.21.21... -* TCP_NODELAY set -* Connected to hashicorp.com (76.76.21.21) port 80 (#0) -> GET / HTTP/1.1 -> Host: hashicorp.com -> User-Agent: curl/7.64.1 -> Accept: */* -...... -``` - -Note that you can use `-exec` for subcommands that wrap clients as well. -As an example, if `putty.exe` is available on a Windows host but the command is being run from WSL, you could use the following command to specify the correct binary to use, since WSL must use `.exe` when it invokes Windows binaries: - -```shell-session -$ boundary connect ssh -style putty -exec putty.exe -target-id ttcp_1234567890 -``` \ No newline at end of file diff --git a/website/content/docs/targets/connections/index.mdx b/website/content/docs/targets/connections/index.mdx deleted file mode 100644 index 94324c225..000000000 --- a/website/content/docs/targets/connections/index.mdx +++ /dev/null @@ -1,83 +0,0 @@ ---- -layout: docs -page_title: Connection workflows -description: >- - Learn how transparent sessions, connect helpers, the `-exec` flag, SSH ProxyCommand, and multi-hop sessions can help facilitate connections to targets. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Connection workflows - -This topic provides an overview of the possible workflows you may use to connect to targets with Boundary. - -## Boundary connect - -When you run the `boundary connect` command against a target, Boundary establishes a local authenticated proxy to the address on the target's default port. -The `boundary connect` command has a number of useful options, such as `-listen-port` which lets you choose the port on which the command listens for an incoming connection. -Refer to the [`boundary connect`](/boundary/docs/commands/connect) documentation for a list of the available options and usage examples. - -To practice using the `boundary connect` command in a development environment, refer to the **Connect to your first target** tutorial for either [HCP Boundary](/boundary/tutorials/hcp-getting-started/hcp-getting-started-connect) or the [self-managed versions](/boundary/tutorials/get-started-community/community-get-started-connect) of Boundary. - -## Transparent sessions - -@include 'alerts/enterprise-only.mdx' - -Transparent sessions shift Boundary from an active connection model to a passive connection model. -Instead of interacting with the Boundary CLI or Desktop client and having to remember specific IDs or ephemeral ports to connect to targets, Boundary operates in the background. -If a user is authenticated and authorized, Boundary intercepts DNS calls and routes traffic through a session automatically. - -Refer to the [transparent sessions](/boundary/docs/concepts/transparent-sessions) documentation for more information. - -## Connect helpers - -Boundary features connect helpers that assist with making connections to targets using certain protocols. -Connect helpers automatically accept key prompts for you. -They are supported for the following connection types: - -- HTTP -- Kubernetes -- PostgreSQL -- RDP -- SSH - -Refer to the [Connect helpers](/boundary/docs/targets/connections/connect-helpers) documentation for more information. - -## Exec flag - -In addition to the built-in connect helpers, `boundary connect` can accommodate executing clients even when there is no built-in support for a specific client using the `-exec` flag. -The `-exec` flag lets you wrap Boundary TCP sessions in your preferred client. -You can use this flag to create an authenticated proxy to almost anything. - -Refer to the [Exec flag](/boundary/docs/targets/connections/exec-flag) documentation for more information. - -## SSH ProxyCommand - -The most common pattern for using Boundary to SSH is with the built-in `boundary connect ssh` command. -However, there are more idiomatic approaches that can be employed to make Boundary transparent to users, and at the same time simplify common developer and operator workflows. -Using `ProxyCommand` to execute a proxy when invoking the SSH client is a common practice. - -SSH `ProxyCommand` lets you proxy an SSH connection to a target according to a configuration file that you create. -You can configure the file to connect to the target ID or the target domain. - -Refer to the [SSH ProxyCommand](/boundary/docs/targets/connections/workflow-ssh-proxycommand) documentation for more information. - -## Multi-hop sessions - -@include 'alerts/enterprise-only.mdx' - -Most organizations want to provide access to infrastructure without exposing private networks. -Many organizations also have complex network topologies requiring inbound traffic to route through multiple network enclaves to reach the target system. -Multi-hop sessions allow you to chain together two or more workers across multiple networks to form reverse proxy connections between the user and the target, even in complex networks with strict outbound-only policies. - -You can deploy multi-hop workers in scenarios where inbound network traffic is -not allowed. -A worker in a private network can send outbound communication to its upstream worker, and create a reverse proxy to establish a session. - -You can configure target worker filters with multi-hop workers to allow for fine-grained control on which workers handle ingress and egress for session traffic to a target. -Ingress worker filters determine which workers you connect with to initiate a session, and egress worker filters determine which workers are used to access targets. - -Refer to the [Multi-hop sessions](/boundary/docs/workers/multi-hop) documentation for more information. \ No newline at end of file diff --git a/website/content/docs/targets/connections/transparent-sessions.mdx b/website/content/docs/targets/connections/transparent-sessions.mdx deleted file mode 100644 index d992a8185..000000000 --- a/website/content/docs/targets/connections/transparent-sessions.mdx +++ /dev/null @@ -1,78 +0,0 @@ ---- -layout: docs -page_title: Connect using transparent sessions -description: >- - Learn how to use transparent sessions to enhance end-user workflows and simplify target access. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Connect using transparent sessions - -@include 'alerts/enterprise-only.mdx' - -Transparent sessions shift Boundary from an active connection model to a passive connection model. Boundary operates in the background instead of requiring you to remember specific resource IDs or ephemeral ports to connect to targets. - -Transparent sessions require [aliases](/boundary/docs/targets/configuration) and the [Boundary Client Agent](/boundary/docs/client-agent). - -Boundary routes your session using the Boundary Client Agent. -You can validate that Boundary routed the session by looking at the **Sessions** page in the Desktop client, by typing `boundary sessions list -recursive` in the CLI, or by looking at sessions managed by the Client Agent using `boundary client-agent sessions`. - -## Requirements - -Before you begin, ensure that you have [configured transparent sessions](/boundary/docs/targets/configuration/configure-transparent-sessions) and [created aliases](/boundary/docs/targets/configuration/create-target-alias) for any targets you want to connect to. - -The Client Agent periodically requests an updated list of aliases from the controller, so the alias may not work immediately after you create it. -The alias should be updated in the Client Agent within 2 minutes. If you still see connection issues after 2 minutes, follow the troubleshooting steps in [the Client Agent troubleshooting guide](/boundary/docs/client-agent/troubleshoot). - -## Establish a transparent session - -Without transparent sessions, you must use the [Boundary connect helpers](/boundary/docs/targets/connections/connect-helpers) to establish a session: - -```shell-session -$ boundary connect ssh -target-name sql-database -target-scope-name -staging -``` - -Alternatively, you can use the Boundary Desktop Client to start a session, and connect on a local port supplied by Boundary: - -```shell-session -$ ssh 127.0.0.1 -p 55374 -``` - -With transparent sessions, you use the target alias as the address to establish a session. If the Client Agent is running and you have authenticated using the CLI or Boundary Desktop Client, you can use the alias to start a session: - -```shell-session -$ ssh my.alias.name -``` - -Boundary starts the session as usual, and brokers or injects any credentials you have configured. - -### RDP targets - -Due to a port conflict with the Windows Remote Desktop Connection app on modern Windows operating systems (Windows 11+, Windows Server 2025), transparent sessions fail when you use the default port (`3389`) to establish an RDP connection. -The port conflict is an issue even if you enable Remote Desktop. -To connect to an RDP target from a Windows client using a transparent session, you must use a custom port. -Refer to [RDP credential injection compatibility](/boundary/docs/credentials/rdp-testing-and-compatibility-matrix) for more information. - -When you connect to the RDP target using transparent sessions, you must specify the custom port with the alias in the RDP client, for example: - -`my.alias.name:33890` - -## Next steps - -When you have validated that transparent sessions work, you can create and establish transparent sessions to other services. - -To establish transparent sessions to other services: - -1. Make a list of the services you use. -1. Create workers as needed for network partitions. -1. Add the services to Boundary as targets. -1. [Create aliases for the targets](/boundary/docs/targets/configuration/create-target-alias). -1. Connect to the target using your client of choice. - -## More information - -Refer to [Troubleshoot issues with the Client Agent](/boundary/docs/client-agent/troubleshoot) for a list of [known issues](/boundary/docs/client-agent/troubleshoot#transparent-sessions-known-issues) involving transparent sessions. diff --git a/website/content/docs/targets/connections/workflow-ssh-proxycommand.mdx b/website/content/docs/targets/connections/workflow-ssh-proxycommand.mdx deleted file mode 100644 index 357c2608b..000000000 --- a/website/content/docs/targets/connections/workflow-ssh-proxycommand.mdx +++ /dev/null @@ -1,142 +0,0 @@ ---- -layout: docs -page_title: SSH ProxyCommand -description: >- - Learn how to use SSH ProxyCommand to proxy an SSH connection using a configuration file. Configure hosts using the target's ID or domain. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# SSH ProxyCommand - -SSH `ProxyCommand` lets you proxy an SSH connection to a target to simplify common developer and operator workflows. -For example, you can configure the `.ssh/ssh_config` file to connect to the target ID or the target domain. - -## Configure a host using target ID - -To use SSH `ProxyCommand`, you must configure a `Host` entry in `.ssh/ssh_config` for `localhost`. - -In the following example, `ProxyCommand` configures the SSH client to invoke `boundary connect`. - -The command passes the `-exec nc` flag to `boundary connect` to wrap [netcat](http://netcat.sourceforge.net/), and then pass the `boundary.ip` and `boundary.port` environment variables as arguments to `nc`. -This command allows you to proxy your SSH connection through a local netcat tunnel that's managed as a Boundary session: - - - -```bash -Host ttcp_* - ProxyCommand sh -c "boundary connect -target-id %n -exec nc -- {{boundary.ip}} {{boundary.port}}" -``` - - - -Using this configuration, if you run `ssh ttcp_1234567890` to connect to a target with the ID `ttcp_1234567890`, SSH invokes `boundary connect`, and tunnels the traffic through the local Boundary proxy in a wrapped netcat session. -Boundary passes the target ID to the `boundary` command as the hostname. - -Note that you must authenticate to Boundary before you can use `ssh` to invoke `boundary connect`. - -### SSH to target - -Once the command is configured, you can run `ssh` as you normally would and all the traffic is proxied over the Boundary proxy to your target machine: - -```bash -$ ssh ttcp_1234567890 -Password: -Last login: Thu Nov 19 10:32:09 2023 -➜ ~ -``` - -On the controller, you can see the session being invoked in the logs: - -```bash -controller.worker-handler: connection established: session_id=s_WkaQbqmrJx connection_id=sc_RDYNFFI2M4 client_tcp_address=127.0.0.1 client_tcp_port=57421 endpoint_tcp_address=::1 endpoint_tcp_port=22 -``` - -You can inspect the session on the CLI as well: - -```bash -$ boundary sessions read -id $(boundary sessions list -scope-id p_1234567890 -format json | jq '.[0]["id"]' | tr -d '"') - -Session information: - Auth Token ID: at_a8itRfDSyV - Created Time: Thu, 19 Nov 2023 10:52:44 PST - Endpoint: tcp://localhost:22 - Expiration Time: Thu, 19 Nov 2023 18:52:44 PST - Host ID: hst_1234567890 - Host Set ID: hsst_1234567890 - ID: s_WkaQbqmrJx - Status: active - Target ID: ttcp_1234567890 - Type: tcp - Updated Time: Thu, 19 Nov 2023 10:52:47 PST - User ID: u_1234567890 - Version: 2 - - Scope: - ID: p_1234567890 - Name: Generated project scope - Parent Scope ID: o_1234567890 - Type: project - - States: - Start Time: Thu, 19 Nov 2023 10:52:47 PST - Status: active - - End Time: Thu, 19 Nov 2023 10:52:47 PST - Start Time: Thu, 19 Nov 2023 10:52:44 PST - Status: pending -``` - -## Configure a host using target domain - -If you want to use the domain name to SSH to targets, you can set the `Host` value to the target domain instead of the target ID. - -This method requires an extra step. -You must authorize the session to the target and store it in your environment, since you do not pass the target ID as part of the SSH command. -Authorizing the session allows Boundary to pull the target information from the token you create using the `authorize session` command. - -### Authorize the session - -The following example authorizes a session to a target `ttcp_1234567890` and stores the token in the `BOUNDARY_CONNECT_AUTHZ_TOKEN` environment variable. -Boundary uses the token when it's invoked by SSH: - -```bash -$ export BOUNDARY_CONNECT_AUTHZ_TOKEN=$(boundary targets authorize-session -id ttcp_1234567890 -format json | jq '.authorization_token' | tr -d '"') -``` -### Configure the host - -To use SSH `ProxyCommand`, you must configure a `Host` entry in `.ssh/ssh_config` for `localhost`. - -In the following example, `ProxyCommand` configures the SSH client to invoke `boundary connect`. - -The command passes the `-exec nc` flag to `boundary connect` to wrap [netcat](http://netcat.sourceforge.net/), and then pass the `boundary.ip` and `boundary.port` environment variables as arguments to `nc`. -This command allows you to proxy your SSH connection through a local netcat tunnel that's managed as a Boundary session: - - - -```bash -Host localhost - # requires BOUNDARY_CONNECT_AUTHZ_TOKEN to be set from authorize-session command - ProxyCommand sh -c "boundary connect -exec nc -- {{boundary.ip}} {{boundary.port}}" -``` - - - -Using this configuration, if you run `ssh user@localhost` to connect to the target you created the authorization session for, SSH invokes `boundary connect`, and tunnels the traffic through the local Boundary proxy in a wrapped netcat session. -Boundary passes the target domain to the `boundary` command as the hostname. - -Note that you must authenticate to Boundary before you can use `ssh` to invoke `boundary connect`. - -### SSH to target - -Once the command is configured, you can run `ssh` as you normally would and all the traffic is proxied over the Boundary proxy to your target machine: - -```bash -$ ssh user@localhost -Password: -Last login: Thu Nov 19 10:32:09 2023 -➜ ~ -``` diff --git a/website/content/docs/vault/index.mdx b/website/content/docs/vault/index.mdx deleted file mode 100644 index 0e4c9fae7..000000000 --- a/website/content/docs/vault/index.mdx +++ /dev/null @@ -1,113 +0,0 @@ ---- -layout: docs -page_title: Vault integration -description: >- - Understand the security benefits of integrating Boundary and Vault to manage secrets and broker or inject credentials. Set up Vault as an OIDC bridge provider. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Vault integration - -The integration between Boundary and Vault improves two main areas of concern for organizations: - -- Security posture for remote access -- Workflow efficiency - -Integrating Boundary and Vault achieves these goals by enabling end-users to access targets without needing to manually distribute credentials. You must bring your own Vault deployment to Boundary. - -From a security perspective, you can configure credentials to be dynamic and ephemeral, and only valid for the lifetime of the session. Or you can attach a specific time to live (TTL) to the Vault token, resulting in a session having a finite amount of time. - -You can extend these security benefits to third-parties or contractors that may need to access resources. It is preferable to not expose credentials to temporary staff, while still ensuring that their access to resources is secure and granted in a timely manner. - -Timely access to resources creates improvements in workflow efficiency by removing manual approvals for access in favor of highly-scoped, preconfigured access requests. Additional end-workflow improvements are added by removing credential management from the end-user. - -## Credential management - -To configure credential brokering or credential injection with static credentials on Vault, please see [Manage static credentials with Vault](/boundary/docs/credentials/static-cred-vault). - - -# Credentials - -Within Boundary, you can configure Vault as a [credential store](/boundary/docs/domain-model/credential-stores) and [credential library](/boundary/docs/domain-model/credential-libraries). - -There are two configuration options: - -- Generic secrets -- SSH certificates - -Generic secrets reference a Vault key-value path where static secrets are stored, such as username/password or SSH keypairs. You can broker generic secrets to users when they connect to targets. - -SSH certificates have the advantages of using Vault as the certificate authority (CA) and being able to use the [HashiCorp Vault SSH Secrets Engine](/vault/docs/secrets/ssh). - -You can inject both generic secrets and SSH certificates directly into Boundary sessions using an HCP Boundary or Boundary Enterprise deployment. - -### Brokered credentials - -Brokered credentials let you use Boundary as a credential broker for infrastructure targets by binding credentials with user sessions. Credentials are surfaced during session initialization, after being brokered from Vault. - -Consider database access as an example. Within an organization, the finance team might need to access sensitive data that is in a database. Regardless of how often the database needs to be accessed, long-lived credentials create a security liability. These credentials could be purposely or accidentally leaked, creating risk for a company. - -Integrating Boundary and Vault helps mitigate this security risk. You can configure Vault secrets engines to issue static or dynamic short-lived database credentials to end users. Organizations can also define how long credentials are valid for, and once they have timed-out, access can automatically be revoked. - -![Brokered Credentials](/img/brokered-creds-ui.png) - -When you connect to the database using Boundary, Boundary displays the brokered credentials to the end user so that they can connect to the target. Once the session is closed or terminated, Boundary requires the user to request a new session to the target. - -### Injected credentials - -This feature requires HCP Boundary or Boundary Enterprise - -You can inject credentials directly into sessions using HCP Boundary or Boundary Enterprise. Injecting credentials removes the need for end users to manually use a brokered credential to access the target after Boundary has established a session. It also prevents users from ever accessing the credential. Injected credentials are never passed back to the end user. - -Credential injection with Vault can be configured using static or dynamic credentials: - -- [KV secrets engine](/vault/docs/secrets/kv/kv-v2) (static credentials) -- [SSH secrets engine](/vault/docs/secrets/ssh) (dynamic credentials) - -You can use the KV secrets engine for static username/password secrets, or static keypair secrets. - -When you use the SSH secrets engine, you can configure Vault to act as the certificate authority (CA), or you can configure an external CA. When Vault acts as the CA, it ensures that a user's certificate is signed before being brokered to Boundary. When key pairs are generated dynamically, they are signed by Vault to then be used to access the resources. - -There are two options for the key pair generation, depending on the type of Vault endpoint that you use within the Boundary credential library for SSH certification: - -- `/issue`: Vault generates and signs the key pair for you. - -- `/sign`: The Boundary controllers generate the key pair and then send it to Vault to sign. - -When you connect to a target that uses Vault for dynamic SSH certificates, a new certificate is generated for every target connection. As long as the target trusts the CA, access is granted without the end user having visibility into the credentials being injected. - -## Secrets management - -Within Boundary you can configure one or more credential stores. There are two types of credential stores: - -- [Static credential store](/boundary/docs/domain-model/credential-stores#static-credential-store) -- [Vault credential store](/boundary/docs/domain-model/credential-stores#vault-policies) - -A static credential store is built into Boundary if you want to manage secrets without integrating it with Vault. The Vault credential store can fetch secrets from Vault on behalf of Boundary users. - -Organizations may have valid reasons for using multiple credential stores within Boundary. You can only create credential stores at the [project](/boundary/docs/domain-model/scopes#projects) scope, and each project can contain multiple credential stores. Projects within an org scope may have different requirements from their credential stores. For example, within an org scope you may have two projects: Database and Compute. These two projects may need to be isolated, and can have a dedicated credential store per project. - -Credential stores may contain multiple credential libraries. This means a single Vault token can provide access to all the Vault paths defined in the credential libraries. HashiCorp recommends that you operate using the model of least privilege when setting up credential stores. - -When integrated with Vault, Boundary has to be assigned a periodic, renewable, [orphan token](/boundary/docs/domain-model/credential-stores#vault-token-requirements) from Vault. Each credential needs a separate Vault token. - -The following have no impact on Vault's [client count](/vault/docs/concepts/client-count/counting): - -- The number of Boundary targets that source credentials from the stores -- The number of users connecting to the targets -- The number of sessions that get created -- The number of credential libraries the credential store contains - -## Vault as an identity provider - -Boundary supports OIDC, LDAP, and username/password as [authentication methods](/boundary/docs/concepts/iam#access-management). Boundary can use Vault as an [OIDC bridge provider](/vault/tutorials/auth-methods/oidc-identity-provider). This allows Vault to delegate authentication to an external OIDC provider, such as Google Cloud, Okta, or Microsoft Entra ID. - -These providers then map the authenticated user's claims to Vault policies and identities. This allows users to authenticate to Boundary with any of Vault's supported authentication methods, even ones that Boundary does not natively support. When Boundary uses Vault as an OIDC provider, each user leveraging the authentication method then counts as a Vault client. - -## More information - -Refer to [Create a Vault credential store](/boundary/docs/credentials/static-cred-vault) for more information. \ No newline at end of file diff --git a/website/content/docs/what-is-boundary.mdx b/website/content/docs/what-is-boundary.mdx deleted file mode 100644 index 0356dbecd..000000000 --- a/website/content/docs/what-is-boundary.mdx +++ /dev/null @@ -1,88 +0,0 @@ ---- -layout: docs -page_title: What is Boundary? -description: >- - HashiCorp Boundary is a secure remote access solution that you can use to configure least-privileged, just-in-time access to systems, services, and applications. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# What is Boundary? - -HashiCorp Boundary is an identity-aware proxy aimed at simplifying and securing least-privileged access to cloud infrastructure - -With Boundary you can: -- Enable single sign-on to target services and applications via external identity providers -- Provide just-in-time network access to private resources -- Enable passwordless access with dynamic credentials via [HashiCorp Vault](https://www.vaultproject.io/) -- Automate discovery of new target systems -- Record and manage privileged sessions -- Standardize your team's access workflow with a consistent experience for any type of infrastructure across any provider - -## How does Boundary work? - -Boundary provides secure access to hosts and critical systems without distributing and managing credentials, configuring firewalls, or exposing the organization's private network. Traditionally, for users to access their resources, it's required that organizations establish and maintain SSH bastion hosts and VPNs. - -The video below provides an overview of the Boundary architecture, components, and deployment models. -It also gives a brief walkthrough of the end user's experience. - - - -The illustration below displays Boundary's core workflow. - -![Boundary core workflow](/img/boundary-core-workflow_light.png#light-theme-only) -![Boundary core workflow](/img/boundary-core-workflow_dark.png#dark-theme-only) - -The core Boundary workflow consists of four stages: - -- **User Authentication:** The user logs in with a trusted identity (based on the rules and policies) with a trust identity platform such as Azure Active Directory, Okta, Ping, or any other trust identity platforms supporting OpenID Connect. -- **Granular Authorization:** Boundary authenticates and authorizes users based on their roles and logical services, and tightly controls access and actions performed against systems. -- **User-selected dynamic catalogs**: The user selects their application or host from dynamic host catalogs. -- **Access:** Boundary streamlines connection to hosts by automating discovery and access configuration as workloads are deployed or changed. - -## Which edition of Boundary is right for me? - -- **HCP Boundary**: a managed Boundary offering with commercial features. HashiCorp hosts Boundary's control plane and you have the option of running private workers within your environment. -- **Boundary Enterprise**: a self-managed Boundary offering with full feature parity to HCP Boundary. -- **Boundary Community Edition**: a free, self-managed version of Boundary. - - -If you're not sure which edition is right for you, we recommend [**HCP Boundary**](https://developer.hashicorp.com/boundary/tutorials/hcp-getting-started) because it eliminates deployment operations. - -Regardless of which server edition of Boundary you use, all editions require the same Desktop and CLI clients, which you can download from the [Install Boundary downloads](https://developer.hashicorp.com/boundary/downloads) page. - -| Feature| Community | HCP | HCP | Enterprise | -|---|:-:|:-:|:-:|:-:| -| | | Standard | Plus | Plus | -| Just-in-time credential access via HashiCorp Vault | ✓ | ✓ | ✓ | ✓ | -| Just-in-time network access for TCP, SSH, HTTPS, RDS, K8s, database, etc | ✓ | ✓ | ✓ | ✓ | -| Single sign-on access via OIDC and LDAP | ✓ | ✓ | ✓ | ✓ | -| Identity provider managed groups | ✓ | ✓ | ✓ | ✓ | -| Terraform support for fully automated deployment and configuration | ✓ | ✓ | ✓ | ✓ | -| Credential brokering | ✓ | ✓ | ✓ | ✓ | -| Automated target discovery | ✓ | ✓ | ✓ | ✓ | -| Audit logs / Streaming | ✓ | ✓ | ✓ | ✓ | -| Transparent sessions | | ✓ | ✓ | ✓ | -| Multi-hop sessions | | ✓ | ✓ | ✓ | -| Credential injection | | ✓ | ✓ | ✓ | -| Automatic updates | | ✓ | ✓ | | -| Disaster recovery | | ✓ | ✓ | | -| Push button deployment | | ✓ | ✓ | | -| Session recording | | | ✓ | ✓ | -| Session recording lifecycle management | | | ✓ | ✓ | -## Get started - -Refer to the [Boundary tutorials](/boundary/tutorials) to learn how to set up, configure, and administer Boundary. - -## Community - -We welcome questions, suggestions, and contributions from the community. - -- Ask questions in [HashiCorp Discuss](https://discuss.hashicorp.com/c/boundary/50). -- Read our [contributing guide](https://github.com/hashicorp/boundary/blob/main/CONTRIBUTING.md). -- [Submit an issue](https://github.com/hashicorp/boundary/issues) for bugs and feature requests. diff --git a/website/content/docs/workers/create.mdx b/website/content/docs/workers/create.mdx deleted file mode 100644 index e7262a81d..000000000 --- a/website/content/docs/workers/create.mdx +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: docs -page_title: Create the worker configuration -description: >- - Learn about configuring workers. View an example of a worker configuration. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Create the worker configuration - -@include '/workers/single-worker-config.mdx' \ No newline at end of file diff --git a/website/content/docs/workers/filters.mdx b/website/content/docs/workers/filters.mdx deleted file mode 100644 index c5327ac89..000000000 --- a/website/content/docs/workers/filters.mdx +++ /dev/null @@ -1,172 +0,0 @@ ---- -layout: docs -page_title: Configure a worker filter -description: >- - Learn about configuring a filter to control which workers are allowed to manage a session. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Configure a worker filter - -You can use tags to configure a worker filter that controls which workers are allowed to perform specific functions. -Following are some examples of using these values in filters that can be applied to targets, Vault credential stores, or storage buckets: - -- Name regex: `"/name" matches "web-prod-us-east-[12]"`, which would - match workers whose names are `web-prod-us-east-1` or `web-prod-us-east-2` - -- Region: `"us-east-1" in "/tags/region"`. - -- Grouping: `("us-east-1" in "/tags/region" and "/name" == "web-prod-us-east-1") or "webservers" in "/tags/type"` - -Each tag can have multiple values, so you must use the `in` operator to match values. If you know that you have only one value, an equivalent would be `"/tags/key/0" == "value"`. - -Refer to [Filtering and listing resources](/boundary/docs/filtering) for more information about Boundary's filter syntax and best practices. - -## Example worker filter for targets - -Once workers have tags, you can use these tags to control which -workers are allowed to manage a given session by specifying worker filter attributes -when you configure [targets](/boundary/docs/domain-model/targets). - -The `egress_worker_filter` attribute controls which workers are used for egress to a target. This is the worker -that accesses the target. - -The `ingress_worker_filter`HCP/ENT attribute controls which workers are used for ingress to a target. -This is the worker a client connects to when initiating a connection to a target. - - - - -Example of a filter configured on a target in the Admin UI: - -![Example of a target ingress worker filter](/img/ui/target-ingress-worker-filter_light.png#light-theme-only) -![Example of a target ingress worker filter](/img/ui/target-ingress-worker-filter_dark.png#dark-theme-only) - - - - -Example of a filter configured on a target with the CLI: - -``` -$ boundary targets update tcp -id tssh_1234567890 -egress-worker-filter='"prod" in "/tags/type"' -``` - - - - -Example of a filter configured on a target with Terraform: - -```hcl -resource "boundary_target" "aws-webservers-prod" { - type = "ssh" - name = "aws-web-prod" - description = "AWS EC2 Targets" - egress_worker_filter = "\"prod\" in \"/tags/type\"" -} -``` - - - - -## Example worker filter for Vault credential store - -Tags are used to control which workers can manage Vault requests by specifying -a `worker_filter`attribute when configuring [credential stores](/boundary/docs/domain-model/credential-stores#vault-credential-store-attributes). - -This allows the use of private Vault instances with Boundary. Workers -deployed in the same network as a private Vault instance can access and relay -Vault requests to Boundary controllers. - - - - A worker that matches the worker filter must exist before you define the Vault credential store, as it will perform the Vault calls needed to set up the credential store with Boundary. - - - - - - -Example of a worker filter configured on a Vault credential store in the Admin UI: - -![Example of a credential store worker filter](/img/ui/vault-worker-filter_light.png#light-theme-only) -![Example of a credential store worker filter](/img/ui/vault-worker-filter_dark.png#dark-theme-only) - - - - -Example of a worker filter configured on a Vault credential store with the CLI: - -``` -$ boundary credential-stores update vault -id csvlt_1234567890 -worker-filter='"vault" in "/tags/type"' -``` - - - - -Example of a worker filter configured on a Vault credential store with Terraform: - -```hcl -resource "boundary_credential_store_vault" "vault_cred_store" { - name = "Vault host credentials" - address = "http://127.0.0.1:8200" # change to Vault address - token = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token - scope_id = boundary_scope.project.id # change to target scope - worker_filter = "\"vault\" in \"/tags/type\"" # change to access private Vault cluster -} -``` - - - - -## Example worker filter for storage buckets - -Storage buckets are used for session recording, which requires HCP Boundary or Boundary Enterprise - -Session recording functions are performed by Boundary workers. Workers also store recordings on Boundary storage buckets. When you create Boundary storage buckets, you can use tags to select the workers you prefer to use for session recording responsibilities. - - - - -Example of a worker filter configured on a storage bucket in the Admin UI: - -![Example of a storage bucket worker filter](/img/ui/session-rec-worker-filter_light.png#light-theme-only) -![Example of a storage bucket worker filter](/img/ui/session-rec-worker-filter_dark.png#dark-theme-only) - - - - -Example of a worker filter configured on a storage bucket with the CLI: - -``` -$ boundary storage-buckets update -id sb_1234567890 -worker-filter='"session-recording" in "/tags/type"' -``` - - - - -Example of a worker filter configured on a storage bucket with Terraform: - -```hcl -resource "boundary_storage_bucket" "aws_dynamic_credentials_example" { - name = "session-recording-storage-bucket" - scope_id = boundary_scope.org.id # change to valid scope ID - plugin_name = "aws" - bucket_name = "mybucket" # change to valid AWS S3 storage bucket name - - # the role_arn value should match the arn used as the instance profile attached to the ec2 instance - # https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html - attributes_json = jsonencode({ - "region" = "us-east-1" - "role_arn" = "arn:aws:iam::123456789012:role/S3Access" # change to valid role ARN - "disable_credential_rotation" = "true" - }) - worker_filter = "\"session-recording\" in \"/tags/type\"" # change to valid worker filter tag -} -``` - - - diff --git a/website/content/docs/workers/index.mdx b/website/content/docs/workers/index.mdx deleted file mode 100644 index 779511492..000000000 --- a/website/content/docs/workers/index.mdx +++ /dev/null @@ -1,128 +0,0 @@ ---- -layout: docs -page_title: Worker configuration overview -description: >- - Learn about worker configuration for proxies, storage, and tags. Understand how multi-hop configurations let you chain workers together in private networks. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Overview of workers - -Workers are primarily used as network proxies for Boundary sessions, they allow you to access private targets. Instead of exposing a private network to the public, or allowing users to have access to entire private networks, workers create a direct network tunnel between users and targets. - -Workers are services that can run on a container or virtual machine. You should deploy them strategically within networks to provide access to targets. -In all editions of Boundary, workers are fully self-managed and can be deployed anywhere. -In HCP Boundary, HCP-managed workers are automatically deployed with the cluster. - -All workers within Boundary use certificates and encryption keys to identify -themselves and protect data in transit. However, there are three different -ways to register them so that registration of workers can fit into any workflow: controller-led, worker-led, and via external KMS. - -You must register workers using the worker-led or controller-led methods in the system with an API call. These workers require storage on disk to store the current set of credentials. Workers using an external KMS auto-register after authenticating. This makes them an easy mechanism to use for automatic scaling. -This also means they do not need to store -credentials locally; the KMS re-authenticates them each time they connect. - - - -Before version 0.15 of Boundary, there were two different types of workers, PKI & KMS workers. -If you are using pre-0.15 workers with pre-0.15 upstream configurations, please switch the documentation version to `0.13.x` - `0.14.x`. This will ensure you have the correct information. - - - -## Signals - -The `SIGHUP` signal causes a worker to reload its configuration file to pick up any updates for the `initial_upstreams` and `tags` values. -Boundary ignores other updated values. - -The `SIGTERM` and `SIGINT` signals initiate a graceful shutdown on a worker. The worker waits for any sessions to drain -before shutting down. Workers in a graceful shutdown state do not receive any new work, including session proxying, from the control plane. - -## Session recording - -This feature requires HCP Boundary or Boundary Enterprise - -Session recording requires at least one worker with access to local and remote storage. -Workers used for session recording require an accessible directory defined by `recording_storage_path` for storing in-progress session recordings. On session closure, a local session recording is moved to remote storage and deleted locally. - -The `recording_storage_minimum_available_capacity` value determines the minimum amount of storage space that is required for workers to perform session recording operations. If a worker is at or below the storage threshold, Boundary does not use the worker to record sessions or play back recordings. - -Development example: - -```hcl -worker { - auth_storage_path="/var/lib/boundary" - initial_upstreams = ["10.0.0.1"] - recording_storage_path="/local/storage/directory" - recording_storage_minimum_available_capacity="500MB" -} -``` - -## Multi-hop sessions - -This feature requires HCP Boundary or Boundary Enterprise - -Multi-hop capabilities, including multi-hop sessions and Vault private access, -is when a session or Vault credential request goes through more than one worker. -To enable this, you must connect two or more workers to each other in some -configuration. There are no limits on the number of workers allowed in a -multi-hop session configuration. - -It helps to think of “upstream” and “downstream” nodes in the context of -multi-hop. If you view controllers as the “top” node of a multi-hop chain, any -worker connected to a node is "downstream" of that node. The node that any -particular worker connects to (whether another worker or a controller) is the -"upstream" of that node. For example, in the diagram below, Worker 2’s upstream -is Worker 1, and its downstream is Worker 3. - -![multi-hop workers](/img/multi-hop-workers.png) - -You can deploy multi-hop workers in scenarios where inbound network traffic is -not allowed. A worker in a private network can send outbound communication to -its upstream worker, and create a reverse proxy to establish a session. - -You can configure target worker filters with multi-hop workers to allow for -fine-grained control on which workers handle ingress and egress for session -traffic to a target. Ingress worker filters specify the workers you use to initiate a session, and egress worker filters specify the workers you use to access targets. - -## Common worker parameters - -@include '/configuration-reference/workers/common-worker-parameters.mdx' - - -## Complete configuration example - -@include '/configuration-reference/workers/complete-configuration-example.mdx' - -## Tutorials - -Refer to the [worker management](/boundary/tutorials/worker-management) tutorials for practice managing workers, configuring multi-hop sessions, and creating worker-aware targets. - -Refer to the [Self-managed worker registration with HCP Boundary](/boundary/tutorials/hcp-administration/hcp-manage-workers) tutorial to learn how to register and manage workers. - -Refer to the [Manage multi-hop sessions with HCP Boundary](/boundary/tutorials/hcp-administration/hcp-manage-multi-hop) tutorial to learn how to configure a multi-hop session. - -## More information - -Refer to [Filtering and listing resources](/boundary/docs/filtering) for more information about Boundary's filter syntax and best practices. - -To configure and register a worker, refer to the following topics: - -- [Create the worker configuration](/boundary/docs/workers/create) -- [Register workers](/boundary/docs/workers/registration) - -Refer to the following topics for more information about configuring workers for specific applications or workflows: - -- [Overview of multi-hop sessions](/boundary/docs/workers/multi-hop) - - [Configure multi-hop sessions for Boundary Enterprise](/boundary/docs/workers/multi-hop/enterprise) - - [Configure multi-hop sessions for HCP Boundary](/boundary/docs/workers/multi-hop/hcp) -- [Overview of session recording](/boundary/docs/session-recording) - - [Configure workers for session recording](/boundary/docs/session-recording/configuration/configure-worker-storage) -- [Configure workers for access to Vault](/boundary/docs/workers/filters#example-worker-filter-for-vault-credential-store) -- [Configure workers for dynamic host discovery from cloud providers](/boundary/docs/hosts) -- [Route traffic through a worker](/boundary/docs/workers/worker-tags) -- [Configure a worker filter](/boundary/docs/workers/filters) -- [Configure self-managed workers for HCP Boundary](/hcp/docs/boundary/self-managed-workers) diff --git a/website/content/docs/workers/multi-hop/enterprise.mdx b/website/content/docs/workers/multi-hop/enterprise.mdx deleted file mode 100644 index 3f9939f04..000000000 --- a/website/content/docs/workers/multi-hop/enterprise.mdx +++ /dev/null @@ -1,35 +0,0 @@ ---- -layout: docs -page_title: Create multi-hop sessions for Boundary Enterprise -description: >- - Configure multi-hop sessions for Boundary Enterprise. Chain together two or more workers across multiple networks to reach a target without exposing private networks. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Configure multi-hop sessions for Boundary Enterprise - -This feature requires HCP Boundary or Boundary Enterprise - -For Boundary Enterprise, you can configure ingress, intermediary, and egress workers to take advantage of multi-hop worker capabilities. - -Note that "ingress," "intermediary," and "egress" are general ways to describe how the respective worker interacts with resources. -A worker can serve more than one of those roles at a time. -Refer to [Multi-hop sessions](/boundary/docs/workers/multi-hop) for more information. - -Complete the steps below to configure ingress, intermediate, and egress workers for Boundary Enterprise. - -## Ingress worker configuration - -@include '/workers/ingress-worker-config.mdx' - -## Intermediate worker configuration - -@include '/workers/intermediate-worker-config.mdx' - -## Egress worker configuration - -@include '/workers/egress-worker-config.mdx' diff --git a/website/content/docs/workers/multi-hop/hcp.mdx b/website/content/docs/workers/multi-hop/hcp.mdx deleted file mode 100644 index 0fd638b19..000000000 --- a/website/content/docs/workers/multi-hop/hcp.mdx +++ /dev/null @@ -1,70 +0,0 @@ ---- -layout: docs -page_title: Create multi-hop sessions for HCP -description: >- - Configure multi-hop sessions for HCP Boundary. Chain together two or more workers across multiple networks to reach a target without exposing private networks. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Configure multi-hop sessions for HCP Boundary - -This feature requires HCP Boundary or Boundary Enterprise - -Many organizations have strict network policies that prohibit all inbound traffic into their networks. In these scenarios, you can use HCP-managed workers as the ingress workers. To establish a connection into the network, a self-managed worker configured as an egress worker initiates an outbound connection to the HCP-managed worker, creating a persistent connection. As a result, when end users connect to a target, the end user's connection would hop from the Boundary client to the HCP-managed worker (ingress worker) to the self-managed worker (egress worker) to the target (or other intermediary workers if needed). - -## Configure HCP-managed workers for ingress - -To configure end user traffic to ingress through HCP-managed workers, you must configure the self-managed worker (enterprise version). On your self-managed worker that you use for egress to the HCP-managed worker, set the configuration file with the following parameters: -- `hcp_boundary_cluster_id` - The HCP Boundary cluster ID, which can be found in the HCP Boundary cluster's URL. -- Omit the `public_addr` parameter. A public address is not needed since the self-managed worker initiates the connection to HCP-managed workers. -- Omit the `initial_upstreams` parameter. This is not needed because the `hcp_boundary_cluster_id` parameter is sufficent to indicate the HCP-managed workers as the upstream. -- Include a [worker tag](/boundary/docs/workers/worker-tags) in the `worker` stanza which will be used to select multi-hop routes for each target. - -### Example self-managed worker configuration: -``` -hcp_boundary_cluster_id = "7acdefe2c-1234-4ff1-b710-123456789876" - -listener "tcp" { - address = "0.0.0.0:9202" - purpose = "proxy" -} - -worker { - auth_storage_path = "/home/ubuntu/boundary/worker1" - tags { - tag = ["multihop"] - } - recording_storage_path = "/tmp/worker1" -} -``` -## Allow-list outbound network traffic to HCP-managed workers - -Some organizations require explicit destination addresses set in their network firewall rules for any outbound traffic. In this scenario, you should use the fully qualified domain name (FQDN) of the HCP-managed workers: - -``` -.proxy.boundary.hashicorp.cloud -``` - -where the `cluster_uuid` is the HCP Boundary cluster ID. You can find your HCP Boundary cluster ID in the HCP Boundary cluster's URL. - - - - The Boundary cluster ID is derived from the Boundary address. For example, if - your cluster URL is: - - `https://abcd1234-e567-f890-1ab2-cde345f6g789.boundary.hashicorp.cloud` - - Then your cluster id is `abcd1234-e567-f890-1ab2-cde345f6g789`. - - - -## Route end user traffic to targets through HCP-managed workers - -To route traffic through the HCP-managed workers, you should set the egress filters of each target to match the tag set in the self-managed worker's configuration file. You do not need to set additional ingress filters on the targets. - -![Multi-hop egress worker filter](/img/ui/multi-hop-egress-filter_light.png#light-theme-only) -![Multi-hop egress worker filter](/img/ui/multi-hop-egress-filter_dark.png#dark-theme-only) \ No newline at end of file diff --git a/website/content/docs/workers/multi-hop/index.mdx b/website/content/docs/workers/multi-hop/index.mdx deleted file mode 100644 index 7ce2146b6..000000000 --- a/website/content/docs/workers/multi-hop/index.mdx +++ /dev/null @@ -1,111 +0,0 @@ ---- -layout: docs -page_title: Multi-hop sessions -description: >- - Learn how multi-hop sessions let you chain together two or more workers across multiple networks to reach a target without exposing private networks. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Multi-hop sessions - -This feature requires HCP Boundary or Boundary Enterprise - -Most organizations want to provide access to infrastructure without exposing private networks. Many organizations also have complex network topologies requiring -inbound traffic to route through multiple network enclaves to reach the target system. -Multi-hop sessions allow you to chain together two or more workers -across multiple networks to form reverse proxy connections between the user and the target, even in complex networks with strict outbound-only policies. - -## Inbound network rules - -With a multi-hop deployment, all connections are initiated outbound from the most downstream worker in the chain. After Boundary establishes the initial connection between the workers, it uses the established connection for any subsequent connections. -These persistent TCP connections result in the requirement for only outbound connectivity. - -If you have one or more firewalls sitting between the ingress and egress workers, you do not need to create additional inbound networking rules to facilitate a Boundary multi-hop deployment. This not only helps to -simplify your infrastructure configuration, but also ensures that your security posture is not weakened or compromised. - -## Multi-hop worker types - -In multi-hop scenarios, there are typically three types of workers: -1. **Ingress worker** - An ingress worker is a worker that is accessible by the client. The client initiates the connection to the ingress worker. -1. **Intermediary worker** - An optional intermediary worker sits between ingress and egress workers as part of a multi-hop chain. There can be multiple intermediary workers as part of a multi-hop chain. -1. **Egress worker** - An egress worker is a worker that can access the target. The egress worker initiates reverse proxy connections to intermediary or ingress workers. - - -“Ingress,” “intermediary,” and “egress” are general ways to describe how the respective worker interfaces with resources, and a worker can act as more than one of those -at a time. For example in the diagram below, the intermediary worker is also an egress worker since it can access a target. - - -![Multi-hop session example showing ingress, intermediary, and egress workers](/img/concepts-multihop.png) - -After the persistent connection chain is established between the workers, when you attempt to connect to a target host, you are automatically proxied from: -1. Boundary client to ingress worker -1. Ingress worker to intermediary worker, where applicable -1. Ingress worker to egress worker -1. Egress worker to desired target - -## Multi-hop worker capabilities - -Multi-hop capabilities, including multi-hop sessions and Vault private access, -is when a session or Vault credential request goes through more than one worker. -To enable this, two or more workers must be connected to each other in some -configuration. There are no limits on the number of workers allowed in a -multi-hop session configuration. - -It helps to think of “upstream” and “downstream” nodes in the context of -multi-hop. If you view controllers as the “top” node of a multi-hop chain, any -worker connected to a node is "downstream" of that node; the node that any -particular worker connects to (whether another worker or a controller) is the -"upstream" of that node. For example, in the diagram below, Worker 2’s upstream -is Worker 1, and its downstream is Worker 3. - -![multi-hop workers](/img/multi-hop-workers.png) - -You can deploy multi-hop workers in scenarios where inbound network traffic is -not allowed. A worker in a private network can send outbound communication to -its upstream worker, and create a reverse proxy to establish a session. - -You can configure target worker filters with multi-hop workers to allow for -fine-grained control on which workers handle ingress and egress for session -traffic to a target. Ingress worker filters determine which workers you -connect with to initiate a session, and egress worker filters determine which -workers are used to access targets. - -## Multi-hop worker requirements - -When you configure multi-hop sessions, there is an "ingress" worker, an "egress" -worker, and any number of intermediary workers. Ingress, egress, and -intermediary workers have the following requirements. - -### Ingress worker requirements - -To proxy target connections, ingress workers require outbound access to the -Boundary control plane and inbound access from clients. - -HCP Boundary clusters automatically deploy HCP-managed workers which can be used as ingress workers. Using HCP-managed workers as ingress workers is helpful when organizations have strict networks security policies that prohibit any inbound access. In this scenario, intermediary or egress workers within the private network can establish a reverse proxy connection to the HCP-managed ingress worker. - -### Intermediary worker requirements - -Intermediary workers require outbound access to an upstream worker. The upstream -worker may be an ingress worker or another intermediary worker. Intermediary -workers also require inbound access from a downstream worker. The downstream -worker may be an egress worker or another intermediary worker. - -### Egress worker requirements - -To proxy target connections, egress workers require outbound access to an -upstream worker and outbound access to the destination host or service. - -## Complete worker configuration - -For the full set of worker parameters and a complete configuration example, refer to the [worker stanza](/boundary/docs/configuration/workers) documentation. - -## Next steps - -Refer to the following topics to configure multi-hop sessions: - -- [Configure multi-hop sessions for Boundary Enterprise](/boundary/docs/workers/multi-hop/enterprise) -- [Configure multi-hop sessions for HCP Boundary](/boundary/docs/workers/multi-hop/hcp) diff --git a/website/content/docs/workers/registration.mdx b/website/content/docs/workers/registration.mdx deleted file mode 100644 index ca38429c2..000000000 --- a/website/content/docs/workers/registration.mdx +++ /dev/null @@ -1,202 +0,0 @@ ---- -layout: docs -page_title: Register workers -description: >- - Learn about authorizing workers to the controller. View a worker configuration example. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Register workers - -Workers authenticate to Boundary using an activation token. They require an -accessible directory defined by `auth_storage_path` for credential storage and -rotation. Transport level communication between the worker & Controller is secured through PKI. - -Example (not safe for production!): - -```hcl -worker { - auth_storage_path="/var/lib/boundary" - initial_upstreams = ["10.0.0.1"] -} -``` - -## Authorization methods - -There are three mechanisms that can be used to initially register a worker to the cluster, Controller-Led, Worker-Led, and registration through an external KMS. - -### Controller-led authorization flow - -In this flow, the operator fetches an activation token from the controller's -`workers:create:controller-led` action (on the CLI, this is via `boundary -workers create controller-led`). That activation token is given to the worker -via the `controller_generated_activation_token` parameter. This can be done -either directly or via an env var or file by using `env://` or `file://` syntax: - -```hcl -worker { - auth_storage_path="/var/lib/boundary" - initial_upstreams = ["10.0.0.1"] - controller_generated_activation_token = "neslat_........." - # controller_generated_activation_token = "env://ACT_TOKEN" - # controller_generated_activation_token = "file:///tmp/worker_act_token" -} -``` - -Once the worker starts, it reads this token and uses it to authorize to the -cluster. Note that this token is one-time-use; it is safe to keep it here even -after the worker has successfully authorized and authenticated, as it will be -unusable at that point. - -Note: If this value is not present at worker startup time and the worker is not -authorized, it will print and write out suitable information for the worker-led -flow, described below. If the worker-led flow has not been used to -authorize the worker, and the controller-generated activation token is provided -and the worker restarted, it will make use of it. - -### Worker-led authorization flow - -In this flow, the worker prints out an authorization request token to two -places: the startup information printed to stdout, and a file called -`auth_request_token` in the base of the configured `auth_storage_path`. This -token can be submitted to a controller at the `workers:create:worker-led` path; -on the CLI this would be via `boundary workers create worker-led --worker-generated-auth-token`. No values are needed in the configuration file. - -### KMS-led authorization & authentication flow - -In this flow, the worker authenticates upstream, either to a controller or worker, using a shared KMS provided by the customer. This mechanism auto-registers the worker in addition to authenticating it, and does not require on-disk storage for credentials since each time it connects, it re-authenticates using the trusted KMS. - -Optionally with the Multi-Hop workers feature, trusted Workers can authenticate downstream nodes using a separate KMS. - -Workers using KMS-led authorization require a `name` field. This specifies a unique name of this worker -within the Boundary cluster and _must be unique across workers_. The `name` -value can be: -- a direct name string (must be all lowercase) -- a reference to a file on disk (`file://`) from which the name is read -- an env var (`env://`) from which the name is read. - -Workers using KMS-led authorization accept an optional `description` field. The `description` value can -be: -- a direct description string -- a reference to a file on disk (`file://`) from which the name is read -- an env var (`env://`) from which the name is read. - -```hcl -worker { - name = "example-worker" - description = "An example worker" - public_addr = "5.1.23.198" -} -``` - -Workers using the KMS authorization flow also require a KMS block designated for `worker-auth`. This is the KMS configuration for authentication between the workers and controllers and must be present. Example (not safe for production!): - -```hcl -kms "aead" { - purpose = "worker-auth" - aead_type = "aes-gcm" - key = "X+IJMVT6OnsrIR6G/9OTcJSX+lM9FSPN" - key_id = "global_worker-auth" -} -``` - -The upstream controller or worker must have a `kms` block that references the -same key and purpose. If both a controller and worker are running as the same -server process, only one stanza is needed. - -For Multi-Hop workers, It is also possible to specify a `kms` block with the `downstream-worker-auth` purpose. If specified, this will be a separate KMS that can be used for authenticating new downstream nodes. Blocks with this purpose can be specified multiple times. This allows a single upstream node to authenticate with one key to its own upstream (via the `worker-auth` purpose) and then serve as an authenticating upstream to nodes -across various networks, each with their own separate KMS system or key: - -```hcl -kms "aead" { - purpose = "downstream-worker-auth" - aead_type = "aes-gcm" - key = "XthZVtFtBD1Bw1XwAWhZKVrIwRhR7HcZ" - key_id = "iot-nodes-auth" -} - -kms "aead" { - purpose = "downstream-worker-auth" - aead_type = "aes-gcm" - key = "OLFhJNbEb3umRjdhY15QKNEmNXokY1Iq" - key_id = "production-nodes-auth" -} -``` - -In the examples above we are encoding key bytes directly in the configuration -file. This is because we are using the `aead` method where you directly supply a -key; in production you'd want to use a KMS such as AWS KMS, GCP CKMS, Azure -KeyVault, or HashiCorp Vault. For a complete guide to all available KMS types, -refer to [Data encryption in Boundary](/boundary/docs/secure/encryption/data-encryption). - -## Complete configuration example - -```hcl -listener "tcp" { - purpose = "proxy" - tls_disable = true - address = "127.0.0.1" -} - -worker { - # Name attr must be unique across workers - name = "demo-worker-1" - description = "A default worker created for demonstration" - - # Workers must be able to reach upstreams on :9201 - initial_upstreams = [ - "10.0.0.1", - "10.0.0.2", - "10.0.0.3", - ] - - public_addr = "myhost.mycompany.com" - - tags { - type = ["prod", "webservers"] - region = ["us-east-1"] - } -} - -# must be same key as used on controller config -kms "aead" { - purpose = "worker-auth" - aead_type = "aes-gcm" - key = "X+IJMVT6OnsrIR6G/9OTcJSX+lM9FSPN" - key_id = "global_worker-auth" -} -``` - -[`initial_upstreams`](/boundary/docs/configuration/workers#initial_upstreams) -are used to connect to upstream Boundary clusters. - -## Resources - -For more on how `tags{}` in the above configuration are used to facilitate -routing to the correct target, refer to [Route traffic through a worker](/boundary/docs/workers/worker-tags). - - -## KMS configuration - -When using Controller or Worker-led Authentication, a worker’s generated activation token is stored in clear-text on disk. Using an external KMS, a Workers' credentials can be encrypted by including an optional KMS stanza with the purpose `worker-auth-storage`. - -Example (not safe for production!): -```hcl -kms "aead" { - purpose = "worker-auth-storage" - aead_type = "aes-gcm" - key = "X+IJMVT6OnsrIR6G/9OTcJSX+lM9FSPN" - key_id = "worker-auth-storage" -} -``` - - - -The `name` and `description` fields are not valid configuration fields for workers that use worker-led or controller-led authorization. You can only set these fields through the API and they are only valid for workers that use the [KMS authorization method](/boundary/docs/workers/registration#kms-led-authorization-authentication-flow). - - diff --git a/website/content/docs/workers/worker-tags.mdx b/website/content/docs/workers/worker-tags.mdx deleted file mode 100644 index 044c29c95..000000000 --- a/website/content/docs/workers/worker-tags.mdx +++ /dev/null @@ -1,400 +0,0 @@ ---- -layout: docs -page_title: Route traffic through a worker -description: >- - Learn about using worker tags to designate worker roles. Examples include serving specific regions or functions, such as credential stores or storage buckets. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Route traffic through a worker - -This page describes how to use worker tags and filters to control which workers -are allowed to handle a given resource. You can use filters to control traffic -locally. As an example, you can use filters to ensure that traffic going into a -public cloud is only handled by workers running within that same cloud. -Tags can also be used determine which worker should perform session recording duties. - -Refer to [Filtering and listing resources](/boundary/docs/filtering) for more information about Boundary's filter syntax and best practices. - -You can configure worker tags using the worker config file, the Admin UI, the CLI, or the API. Select a tag below to view examples. - - - - Terraform users should consider tagging workers using the worker config file in conjunction with the Boundary Terraform provider [worker resource](https://registry.terraform.io/providers/hashicorp/boundary/latest/docs/resources/worker) to register workers. - - - - - - -You can tag workers with a set of key/value tags in their configuration file. The keys and values can be any lower-cased printable value. Each key can have more than one value: - -```hcl -worker { - name = "web-prod-us-east-1" - tags { - region = ["us-east-1"] - type = ["prod", "webservers"] - } -} -``` - -As HCL is JSON-compatible, this turns into an input JSON value of: - -```json -{ - "worker": { - "name": "web-prod-us-east-1", - "tags": { - "region": ["us-east-1"], - "type": ["prod", "webservers"] - } - } -} -``` - -This is the canonical format, and maps closely to the filter structure. -For compatibility with some other systems, you can specify the tags in a pure key=value style: - -```hcl -worker { - name = "web-prod-us-east-1" - tags = ["region=us-east-1", "type=prod", "type=webservers"] -} -``` - -In this format you cannot have an equal sign as part of the key. - -The entire `tags` block or the keys' values can also point to an environment variable or filepath in the system, through the `env://` and `file://` URLs: - -```hcl -worker { - name = "web-prod-us-east-1" - tags = "env://BOUNDARY_ALL_WORKER_TAGS" -} -``` - -```hcl -worker { - name = "web-prod-us-east-1" - tags { - type = "env://BOUNDARY_WORKER_TYPE_TAGS" - region = "file://config/worker/region_tags" - usage = ["admin"] - } -} -``` - -Notice that the syntax within the environment variable or file changes -depending on how the configuration file is set: - -- For setting the entire `tags` block, you must specify both the keys and values in JSON or HCL format: - - ```json - { - "region": ["us-east-1"], - "type": ["prod", "webservers"] - } - ``` - - ```hcl - region = ["us-east-1"] - type = ["prod", "webservers"] - ``` - -- For setting the keys' values within the `tags` block, only a JSON -array with the tags intended for the particular key is required: - - ```json - ["prod", "webservers"] - ``` - - - - -You can tag workers with a set of key/value API tags in the Boundary Admin UI. The keys and values can be any lower-cased printable value. Each key can have more than one value: - -![Worker Config Tags in Boundary Admin UI](/img/ui/worker-tags-config_light.png#light-theme-only) -![Worker Config Tags in Boundary Admin UI](/img/ui/worker-tags-config_dark.png#dark-theme-only) - -In the image above, the tag type is `config`, which means the tags were defined in the worker config file. Config tags cannot be modified within the UI, you must update them in the config file itself. - -Below is an example of this tag definition in a worker's `config.hcl` file: - -```hcl -worker { - name = "web-prod-us-east-1" - tags { - type = ["s3", "worker"] - } -} -``` - -As HCL is JSON-compatible, this turns into an input JSON value of: - -```json -{ - "worker": { - "name": "web-prod-us-east-1", - "tags": { - "type": ["s3", "worker"] - } - } -} -``` - -You can add API tags in the Admin UI. API tags are defined on the Boundary controller, and are not updated in the worker's config file. - -To add an API tag: - -1. Navigate to the worker's **Tags** tab. -1. Click the **Manage** dropdown and then **Create New Tags**. -1. Enter in the tag **Key** and **Value**, then click **Add**. -1. Repeat this process for any additional tags. When finished, click **Save**. - -A tag key can have multiple values associated with it. In the image below, the `type` key has three values. The `type=s3` and `type=worker` tags are both config tags, and the `type=aws` tag is an API tag. - -![Worker API in Boundary Admin UI](/img/ui/worker-tags-api_light.png#light-theme-only) -![Worker API in Boundary Admin UI](/img/ui/worker-tags-api_dark.png#dark-theme-only) - -You can remove API tags using the Admin UI, CLI, or API. - - - - -You can tag workers with a set of key/value API tags using the CLI. The keys and values can be any lower-cased printable value. Each key can have more than one value: - -```shell-session -$ boundary workers read -id w_0BNbXUyy8D - -Worker information: - Active Connection Count: 0 - Address: openssh-server:9202 - Created Time: Tue, 16 Jul 2024 09:39:13 MDT - ID: w_0BNbXUyy8D - Last Status Time: 2024-07-19 23:37:33.331817 +0000 UTC - Local Storage State: available - Name: web-prod-us-east-1 - Release Version: Boundary v0.16.2 - Type: pki - Updated Time: Fri, 19 Jul 2024 17:37:33 MDT - Version: 2 - - Scope: - ID: global - Name: global - Type: global - - Tags: - Configuration: - type: ["s3" "worker"] - Canonical: - type: ["s3" "worker"] - - Authorized Actions: - read - update - delete - add-worker-tags - set-worker-tags - remove-worker-tags - no-op -``` - -In the output above, the tags listed as `Configuration`, were defined in the worker config file. Config tags cannot be modified using the CLI, you must update them in the config file itself. - -Below is an example of this tag definition: - -```hcl -worker { - name = "web-prod-us-east-1" - tags { - type = ["s3", "worker"] - } -} -``` - -The `Canonical` tags in the output show all tags associated with a worker, including configuration tags and API tags. - -You can add API tags using the Admin UI, CLI, or API. API tags are defined on the Boundary controller, and are not updated in the worker's config file. - -You can add API tags using the [boundary workers add-worker-tags](/boundary/docs/commands/workers/add-worker-tags) CLI command: - -```shell-session -$ boundary workers add-worker-tags -id w_0BNbXUyy8D -tag "region=useast1" - -Worker information: - Active Connection Count: 0 - Address: openssh-server:9202 - Created Time: Tue, 16 Jul 2024 09:39:13 MDT - ID: w_0BNbXUyy8D - Last Status Time: 2024-07-19 23:37:33.331817 +0000 UTC - Local Storage State: available - Name: web-prod-us-east-1 - Release Version: Boundary v0.16.2 - Type: pki - Updated Time: Mon, 22 Jul 2024 14:12:45 MDT - Version: 3 - - Scope: - ID: global - Name: global - Type: global - - Tags: - Configuration: - type: ["s3" "worker"] - Api: - region: ["useast1"] - Canonical: - region: ["useast1"] - type: ["s3" "worker"] - - Authorized Actions: - no-op - read - update - delete - add-worker-tags - set-worker-tags - remove-worker-tags -``` - -Notice the worker now has both `Configuration` and `API` tags listed, and the summation of both sets is listed under the `Canonical` tags. - -A tag key can have multiple values associated with it. To update existing API tags using the CLI, you must use the [boundary workers set-worker-tags](/boundary/docs/commands/workers/set-worker-tags) command. - -In the example above, the `type` key has two values, `s3` and `worker`. The `type=s3` and `type=worker` tags are both config tags, and the `region=useast1` tag is an API tag. - -To add an updated API tag with a key of type, all the tags must be set: - -```shell-session -$ boundary workers set-worker-tags -id w_0BNbXUyy8D -tag "type=aws" -tag "region=useast1" - -Worker information: - Active Connection Count: 0 - Address: openssh-server:9202 - Created Time: Tue, 16 Jul 2024 09:39:13 MDT - ID: w_0BNbXUyy8D - Last Status Time: 2024-07-19 23:37:33.331817 +0000 UTC - Local Storage State: available - Name: web-prod-us-east-1 - Release Version: Boundary v0.16.2 - Type: pki - Updated Time: Mon, 22 Jul 2024 14:12:45 MDT - Version: 3 - - Scope: - ID: global - Name: global - Type: global - - Tags: - Configuration: - type: ["s3" "worker"] - Api: - region: ["useast1"] - type: ["aws"] - Canonical: - region: ["useast1"] - type: ["aws" "s3" "worker"] - - Authorized Actions: - read - update - delete - add-worker-tags - set-worker-tags - remove-worker-tags - no-op -``` - -Now the worker includes both config tags and API tags with a `type` key. The updated `Canonical` tags in the output show all tags associated with a worker, including configuration tags and API tags. - -You can remove API tags using the Admin UI, CLI, or API. To remove an API tag using [boundary workers remove-worker-tags](/boundary/docs/commands/workers/remove-worker-tags): - -```shell-session -$ boundary workers remove-worker-tags -id w_0BNbXUyy8D -tag "region=useast1" - -Worker information: - Active Connection Count: 0 - Address: openssh-server:9202 - Created Time: Tue, 16 Jul 2024 09:39:13 MDT - ID: w_0BNbXUyy8D - Last Status Time: 2024-07-19 23:37:33.331817 +0000 UTC - Local Storage State: available - Name: web-prod-us-east-1 - Release Version: Boundary v0.16.2 - Type: pki - Updated Time: Mon, 22 Jul 2024 14:12:45 MDT - Version: 3 - - Scope: - ID: global - Name: global - Type: global - - Tags: - Configuration: - type: ["s3" "worker"] - Api: - type: ["aws"] - Canonical: - type: ["aws" "s3" "worker"] - - Authorized Actions: - read - update - delete - add-worker-tags - set-worker-tags - remove-worker-tags - no-op -``` - - - - -## Filter workers using tags - -As filters operate on JSON Pointer selectors, the values that are input into the -filter come from the JSON representation of the values in the configuration file -nested under `tags` and include a `name` value: - -```json -{ - "name": "web-prod-us-east-1", - "tags": { - "region": ["us-east-1"], - "type": ["production", "webservers"] - } -} -``` - - - - If an expression fails due to a key not being found within the input data, -the worker is not included in the final set. You should ensure that all workers that should match a given filter are populated with tags referenced in the filter string. It is not possible to distinguish between a worker that is not included due to the expression itself and a worker that did not have correct tags. - - - -## Filter examples - -Following are some examples of using these values in filters that can be applied to targets, Vault credential stores, or storage buckets: - -- Name regex: `"/name" matches "web-prod-us-east-[12]"`, which would - match workers whose names are `web-prod-us-east-1` or `web-prod-us-east-2` - -- Region: `"us-east-1" in "/tags/region"`. - -- Grouping: `("us-east-1" in "/tags/region" and "/name" == "web-prod-us-east-1") or "webservers" in "/tags/type"` - -Each tag can have multiple values, so you must use the `in` operator to match values. If you know that you have only one value, an equivalent would be `"/tags/key/0" == "value"`. - -## Next steps - -You can [configure a worker filter](/boundary/docs/workers/filters) to control which workers are allowed to manage a given session, act as a Vault credential store, or store session recordings. diff --git a/website/content/partials/alerts/beta.mdx b/website/content/partials/alerts/beta.mdx deleted file mode 100644 index 5cbafd7ac..000000000 --- a/website/content/partials/alerts/beta.mdx +++ /dev/null @@ -1,6 +0,0 @@ - - -Beta functionality is stable, but possibly incomplete and subject to change. -**We strongly discourage using beta features in production deployments of Boundary.** - - \ No newline at end of file diff --git a/website/content/partials/alerts/enterprise-only.mdx b/website/content/partials/alerts/enterprise-only.mdx deleted file mode 100644 index 50d3cd2a3..000000000 --- a/website/content/partials/alerts/enterprise-only.mdx +++ /dev/null @@ -1 +0,0 @@ -This feature requires HCP Boundary or Boundary Enterprise \ No newline at end of file diff --git a/website/content/partials/cmd-connect-command-options.mdx b/website/content/partials/cmd-connect-command-options.mdx deleted file mode 100644 index aa0c6ee0a..000000000 --- a/website/content/partials/cmd-connect-command-options.mdx +++ /dev/null @@ -1,31 +0,0 @@ -### Connect command options: - -- `-authz-token` `(string: "")` - The authorization string returned from the Boundary controller via an `authorize-session` action against a target. - This option is only required if you don't set a `-target-id`. - If you set the value to `-`, the command attempts to read in the authorization string from standard input. - You can also specify the authorization string using the **BOUNDARY_CONNECT_AUTHZ_TOKEN** environment variable. - -- `-exec` `(string: "")` - If set, specifies that the given binary should be executed after connecting to the worker, if set. - This value should be a binary on your path or an absolute path. - If all command flags are followed by ` -- ` (space, two hyphens, space), then any arguments after that are sent directly to the binary. - You can also specify a binary using the **BOUNDARY_CONNECT_EXEC** environment variable. - -- `-host-id` `(string: "")` - The ID of a specific host to connect to out of - the target's host sets. - If you do not indicate a specific host, Boundary chooses one at random. - -- `-target-id` `(string: "")` - The ID of the target to authorize against. - You cannot use this option with `-authz-token`. - -- `-target-name` `(string: "")` - The target name, if you authorize the session using - scope parameters and target name. - -- `-target-scope-id` `(string: "")` - The target scope ID, if you authorize the - session using scope parameters and target name. - This value is mutually exclusive with `-scope-name`. - You can also specify the target scope ID using the **BOUNDARY_CONNECT_TARGET_SCOPE_ID** environment variable. - -- `-target-scope-name` `(string: "")` - The target scope name, if you authorize the - session using scope parameters and target name. - This value is mutually exclusive with `-scope-id`. - You can also specify the target scope name using the **BOUNDARY_CONNECT_TARGET_SCOPE_NAME** environment variable. diff --git a/website/content/partials/cmd-connect-env-vars.mdx b/website/content/partials/cmd-connect-env-vars.mdx deleted file mode 100644 index bddce7b08..000000000 --- a/website/content/partials/cmd-connect-env-vars.mdx +++ /dev/null @@ -1,10 +0,0 @@ -You also have access to some templated values that are substituted into the -command arguments, and these values are additionally injected as environment -variables in the executed command: - -- `{{boundary.ip}}` (`BOUNDARY_PROXIED_IP`): The IP address of the listening - socket that `boundary connect` has opened. -- `{{boundary.port}}` (`BOUNDARY_PROXIED_PORT`): The port of the listening - socket that `boundary connect` has opened. -- `{{boundary.addr}}` (`BOUNDARY_PROXIED_ADDR`): The host:port format of the - address. This is essentially equivalent to `{{boundary.ip}}:{{boundary.port}}`. diff --git a/website/content/partials/cmd-option-note.mdx b/website/content/partials/cmd-option-note.mdx deleted file mode 100644 index 075a4d3a0..000000000 --- a/website/content/partials/cmd-option-note.mdx +++ /dev/null @@ -1,11 +0,0 @@ - - -In addition to the command specific options, there are options common to all -CLI commands and subcommands: - -- [Connection options](/boundary/docs/commands/#connection-options) -- [Client options](/boundary/docs/commands/#client-options) -- [Output options](/boundary/docs/commands/#output-options) -- [Environment variables](/boundary/docs/commands/#environment-variables) - - \ No newline at end of file diff --git a/website/content/partials/configuration-reference/events/common-audit_config-examples.mdx b/website/content/partials/configuration-reference/events/common-audit_config-examples.mdx deleted file mode 100644 index 59f5df639..000000000 --- a/website/content/partials/configuration-reference/events/common-audit_config-examples.mdx +++ /dev/null @@ -1,32 +0,0 @@ -This example is equivalent to the default settings if no `audit_config` stanza -is provided. - -```hcl -audit_config { - audit_filter_overrides { - sensitive = "redact" - secret = "redact" - } -} -``` - -This example will HMAC sensitive fields, and encrypt secrets. - -```hcl -audit_config { - audit_filter_overrides { - sensitive = "hmac-sha256" - secret = "encrypt" - } -} -``` - -This example will not apply a filter to sensitive fields. - -```hcl -audit_config { - audit_filter_overrides { - sensitive = "" - } -} -``` \ No newline at end of file diff --git a/website/content/partials/configuration-reference/events/common-audit_config-parameters.mdx b/website/content/partials/configuration-reference/events/common-audit_config-parameters.mdx deleted file mode 100644 index 1e30194f0..000000000 --- a/website/content/partials/configuration-reference/events/common-audit_config-parameters.mdx +++ /dev/null @@ -1,2 +0,0 @@ -- `audit_filter_overrides` - Specifies overrides for the filter operations that - are applied to audit events. \ No newline at end of file diff --git a/website/content/partials/configuration-reference/events/common-audit_filter_overrides-parameters.mdx b/website/content/partials/configuration-reference/events/common-audit_filter_overrides-parameters.mdx deleted file mode 100644 index b581da6d5..000000000 --- a/website/content/partials/configuration-reference/events/common-audit_filter_overrides-parameters.mdx +++ /dev/null @@ -1,5 +0,0 @@ -- `sensitive` `(string: "", "encrypt", "hmac-sha256", "redact")` - Specifies - the filter operation to apply to fields that are classified as sensitive. - -- `secret` `(string: "", "encrypt", "hmac-sha256", "redact")` - Specifies - the filter operation to apply to fields that are classified as secret. \ No newline at end of file diff --git a/website/content/partials/configuration-reference/events/common-sink-intro.mdx b/website/content/partials/configuration-reference/events/common-sink-intro.mdx deleted file mode 100644 index bbf0546ca..000000000 --- a/website/content/partials/configuration-reference/events/common-sink-intro.mdx +++ /dev/null @@ -1,29 +0,0 @@ -These parameters are shared across all sink types: - -- `name` - Specify a name for the sink. - -- `description` - Specify a description for the sink. - -- `event_types` - Specifies a list of event types that will be sent to the sink. - Can be `*`, `audit`, `error`, `observation`, `system`, or `telemetry`. - -- `event_source_url` - Specifies an optional event source URL for the sink. If - not specified, the default source will be composed of the - `https://hashicorp.com/boundary.io/ServerName/Path/FileName`. - -- `allow_filters` - Specifies a set of predicates for including an event in the - sink. If any filter matches, the event will be included. For more information, - on using filters see: [event filtering](/boundary/docs/monitor/events/filter-events) - -- `deny_filters` - Specifies a set predicates for excluding an event in the - sink. If any filter matches, the event will be excluded. For more information - on using filters see: [event filtering](/boundary/docs/monitor/events/filter-events) - -- `format` - Specifies the format for the sink. Can be `cloudevents-json`, - `cloudevents-text`, `hclog-json`, or `hclog-text`. - -- `type` - Specifies the type of sink. Can be `stderr` or `file`. - -- `audit_config` - Specifies configuration for the processing of audit events - for the sink. This is ignored if the sink is not configured to receive - `audit` events. \ No newline at end of file diff --git a/website/content/partials/configuration-reference/events/default-events-stanza.mdx b/website/content/partials/configuration-reference/events/default-events-stanza.mdx deleted file mode 100644 index 121315da1..000000000 --- a/website/content/partials/configuration-reference/events/default-events-stanza.mdx +++ /dev/null @@ -1,15 +0,0 @@ -If no event stanza is specified then the following default is used: - -```hcl -events { - audit_enabled = false - observations_enabled = true - sysevents_enabled = true - telemetry_enabled = false - sink "stderr" { - name = "default" - event_types = ["*"] - format = "cloudevents-json" - } -} -``` diff --git a/website/content/partials/configuration-reference/events/events-stanza-intro.mdx b/website/content/partials/configuration-reference/events/events-stanza-intro.mdx deleted file mode 100644 index 28527587a..000000000 --- a/website/content/partials/configuration-reference/events/events-stanza-intro.mdx +++ /dev/null @@ -1,40 +0,0 @@ -The `events` stanza configures Boundary events-specific parameters. - -Example: - -```hcl -events { - observations_enabled = true - sysevents_enabled = true - telemetry_enabled = false - sink "stderr" { - name = "all-events" - description = "All events sent to stderr" - event_types = ["*"] - format = "hclog-text" - } - sink { - name = "obs-sink" - description = "Observations sent to a file" - event_types = ["observation"] - format = "cloudevents-json" - file { - path = "/var/log/boundary" - file_name = "events.ndjson" - } - } -} -``` - -- `audit_enabled` - Specifies if audit events should be emitted. - -- `observations_enabled` - Specifies if observation events should be emitted. - -- `sysevents_enabled` - Specifies if system events should be emitted. - -- `telemetry_enabled` - Specifies if telemetry events should be emitted. -To receive telemetry events, you must also set `observations_enabled` to `true`. - -- `sink` - Specifies the configuration of an event sink. Currently, two types of -sink are supported: [file](/boundary/docs/monitor/events/file) and [stderr](/boundary/docs/monitor/events/stderr). If no sinks are configured then all -events will be sent to a default stderr sink. Events may be sent to multiple sinks. \ No newline at end of file diff --git a/website/content/partials/configuration-reference/events/file-parameters.mdx b/website/content/partials/configuration-reference/events/file-parameters.mdx deleted file mode 100644 index 1893d1e8f..000000000 --- a/website/content/partials/configuration-reference/events/file-parameters.mdx +++ /dev/null @@ -1,13 +0,0 @@ -These parameters are only valid for a `file` sink. - -- `file_name` - Specifies the file name for the sink. - -- `path` - Optionally specifies the file path for the sink. - -- `rotate_bytes` - Optionally specifies the number of bytes that should trigger rotation of - a file sink. - -- `rotate_duration` - Optionally specifies how often a file sink should be rotated. - -- `rotate_max_files` - Optionally specifies how many historical rotated files should be kept - for a file sink. diff --git a/website/content/partials/configuration-reference/events/file-sink-intro.mdx b/website/content/partials/configuration-reference/events/file-sink-intro.mdx deleted file mode 100644 index d67424876..000000000 --- a/website/content/partials/configuration-reference/events/file-sink-intro.mdx +++ /dev/null @@ -1,18 +0,0 @@ -The file sink configures Boundary to send events to a file. - -```hcl -sink { - name = "obs-sink" - description = "Observations sent to a file" - event_types = ["observation"] - format = "cloudevents-json" - file { - path = "/var/log/boundary" - file_name = "events.ndjson" - } - } -``` - -The `sink` stanza may be specified more than once to make Boundary send events -to multiple sinks; however, each file sink must have a unique `path` + -`file_name`. diff --git a/website/content/partials/configuration-reference/events/stderr-intro.mdx b/website/content/partials/configuration-reference/events/stderr-intro.mdx deleted file mode 100644 index b988c1e06..000000000 --- a/website/content/partials/configuration-reference/events/stderr-intro.mdx +++ /dev/null @@ -1,11 +0,0 @@ -The stderr sink configures Boundary to send events to a stderr. - -```hcl - -sink "stderr" { - name = "all-events" - description = "All events sent to stderr" - event_types = ["*"] - format = "hclog-text" -} -``` \ No newline at end of file diff --git a/website/content/partials/configuration-reference/events/stderr-parameters.mdx b/website/content/partials/configuration-reference/events/stderr-parameters.mdx deleted file mode 100644 index 70801571a..000000000 --- a/website/content/partials/configuration-reference/events/stderr-parameters.mdx +++ /dev/null @@ -1 +0,0 @@ -There are parameters are only valid for a `stderr` sink. \ No newline at end of file diff --git a/website/content/partials/configuration-reference/listeners/listener-purpose.mdx b/website/content/partials/configuration-reference/listeners/listener-purpose.mdx deleted file mode 100644 index 9c0579f50..000000000 --- a/website/content/partials/configuration-reference/listeners/listener-purpose.mdx +++ /dev/null @@ -1,24 +0,0 @@ -The `purpose` field is used to determine what part of Boundary's functionality is -started and exposed for a given listener block. Each listener must have a `purpose` set. - -Currently, Boundary recognizes the following listener purposes: - -- `api`: Starts up and exposes Boundary's controller API. - At least one `api` listener must be present if a Boundary - instance is set-up as a controller. - By default, it runs on `:9200`. - -- `cluster`: Starts up and exposes Boundary's worker and - controller communication layer. Only one `cluster` listener - is allowed per Boundary instance. Must be present if a Boundary - instance is set-up as a controller. - By default, it runs on `:9201`. - -- `proxy`: Starts up a Boundary Worker. By default, it runs -on `:9202`. - -- `ops`: Starts up and exposes Boundary's operational -endpoints (eg: /health). By default, it runs on `:9203`. -This listener's exposed functionality depends on what Boundary -components you're running on any given Boundary instance (eg: Health does not -run unless your Boundary instance has a controller running) diff --git a/website/content/partials/configuration-reference/listeners/tcp-configure-custom-http-response-headers.mdx b/website/content/partials/configuration-reference/listeners/tcp-configure-custom-http-response-headers.mdx deleted file mode 100644 index b5395d7df..000000000 --- a/website/content/partials/configuration-reference/listeners/tcp-configure-custom-http-response-headers.mdx +++ /dev/null @@ -1,83 +0,0 @@ -This example shows configuring custom http response headers. Operators can configure -`"custom_api_response_headers"` and `"custom_ui_response_headers"` sub-stanzas in the listener stanza to -set custom http headers that are appropriate to their applications. Examples of such headers are -`"Strict-Transport-Security"` and `"Content-Security-Policy"` which are known HTTP headers, and could be -configured to harden the security of an application communicating with the Boundary endpoints. Note that -vulnerability scans often examine such security related HTTP headers. In addition, you can configure -application-specific custom headers. For example, `"X-Custom-Header"` has been configured in the example -below. - -```hcl -listener "tcp" { - custom_api_response_headers { - "default" = { - "Strict-Transport-Security" = ["max-age=31536000; includeSubDomains"], - "X-Custom-Header" = ["Custom Header Default Value"], - }, - "2xx" = { - "X-Custom-Header" = ["Custom Header Value 1", "Custom Header Value 2"], - }, - "301" = { - "Strict-Transport-Security" = ["max-age=31536000"], - }, - } - custom_ui_response_headers { - "default" = { - "Strict-Transport-Security" = ["max-age=31536000; includeSubDomains"], - "Content-Security-Policy" = ["default-src 'none'; script-src 'self' 'wasm-unsafe-eval'; frame-src 'self'; font-src 'self'; connect-src 'self'; img-src 'self' data:; style-src 'self'; media-src 'self'; manifest-src 'self'; style-src-attr 'self'; frame-ancestors 'self'"], - "X-Custom-Header" = ["Custom Header Default Value"], - }, - "2xx" = { - "X-Custom-Header" = ["Custom Header Value 1", "Custom Header Value 2"], - }, - "301" = { - "Strict-Transport-Security" = ["max-age=31536000"], - "Content-Security-Policy" = ["default-src 'none'; script-src 'none'; connect-src 'none'"], - }, - } -} -``` - -Note that Boundary requires `script-src 'wasm-unsafe-eval'` for playback of session recordings. - -In situations where a header is defined under several status code subsections, -Boundary returns the header matching the most specific response code. For example, -with the config example below, a `307` response would return `307 Custom header value`, -while a `306` would return `3xx Custom header value`. - -```hcl -listener "tcp" { - custom_api_response_headers { - "default" = { - "X-Custom-Header" = ["default Custom header value"] - }, - "3xx" = { - "X-Custom-Header" = ["3xx Custom header value"] - }, - "307" = { - "X-Custom-Header" = ["307 Custom header value"] - } - } -} -``` - -There may also be situations where default or collective status headers have been defined, -but you do not want them returned for a specific status code. You can unset headers at any -level by defining the headers as an empty list. - -```hcl -listener "tcp" { - custom_api_response_headers { - "default" = { - "X-Custom-Header" = ["default Custom header value"] - }, - "3xx" = { - "X-Custom-Header" = ["3xx Custom header value"] - }, - "307" = { - // Do not return this header for 307 responses - "X-Custom-Header" = [] - } - } -} -``` diff --git a/website/content/partials/configuration-reference/listeners/tcp-configure-tls.mdx b/website/content/partials/configuration-reference/listeners/tcp-configure-tls.mdx deleted file mode 100644 index 166b91321..000000000 --- a/website/content/partials/configuration-reference/listeners/tcp-configure-tls.mdx +++ /dev/null @@ -1,9 +0,0 @@ -This example shows enabling a TLS listener. - -```hcl -listener "tcp" { - purpose = "api" - tls_cert_file = "/etc/certs/Boundary.crt" - tls_key_file = "/etc/certs/Boundary.key" -} -``` \ No newline at end of file diff --git a/website/content/partials/configuration-reference/listeners/tcp-custom-api-response-headers.mdx b/website/content/partials/configuration-reference/listeners/tcp-custom-api-response-headers.mdx deleted file mode 100644 index b1b675e49..000000000 --- a/website/content/partials/configuration-reference/listeners/tcp-custom-api-response-headers.mdx +++ /dev/null @@ -1,18 +0,0 @@ -- `default` `(key-value-map: {})` - A map of string header names to an array of - string values. The default headers are set on all endpoints regardless of - the status code value. For an example, refer to the - [Listeners custom http response headers](#listener-s-custom-response-headers) - section. - -- `` `(key-value-map: {})` - A map of string header names - to an array of string values. These headers are set only when the response status - code falls under the collective status code. - For example, `"2xx" = {"Header-A": ["Value1", "Value2"]}`, `"Header-A"` - is set when the http response status code is `"200"`, `"204"`, etc. This overrides - headers defined at the `default` level. - -- `` `(key-value-map: {})` - A map of string header names - to an array of string values. These headers are set only when the specific status - code is returned. For example, `"200" = {"Header-A": ["Value1", "Value2"]}`, `"Header-A"` - is set when the http response status code is `"200"`. This overrides headers defined at - the `default` and `collective status code` level. diff --git a/website/content/partials/configuration-reference/listeners/tcp-custom-response-headers.mdx b/website/content/partials/configuration-reference/listeners/tcp-custom-response-headers.mdx deleted file mode 100644 index 57c907c84..000000000 --- a/website/content/partials/configuration-reference/listeners/tcp-custom-response-headers.mdx +++ /dev/null @@ -1,13 +0,0 @@ -Boundary supports defining custom HTTP response headers for all requests on any Boundary controller. -Headers are defined based on the returned status code. For example, you can define a list of -custom response headers for the `200` status code, and another list of custom response headers for -the `307` status code, and so on. You can also define headers based on the hundred-level status -code. For example, a list of headers applied to the `4xx` code will be applied to 400, 401, 404, and -all other 400-level status codes. The more specific the status, the higher priority it has. -Default headers are overwritten by hundred-level headers, which are overwritten by status-specific -headers. - -There are two different config parameters that define headers: `custom_api_response_headers` and -`custom_ui_response_headers`. API headers apply to API endpoints, currently all paths starting -with `/v1/`. UI headers apply to all other paths. This allows for configuring headers specifically -for serving content to a web browser, such as CSP headers. \ No newline at end of file diff --git a/website/content/partials/configuration-reference/listeners/tcp-custom-ui-response-headers.mdx b/website/content/partials/configuration-reference/listeners/tcp-custom-ui-response-headers.mdx deleted file mode 100644 index c08ae12e6..000000000 --- a/website/content/partials/configuration-reference/listeners/tcp-custom-ui-response-headers.mdx +++ /dev/null @@ -1,18 +0,0 @@ -- `default` `(key-value-map: {})` - A map of string header names to an array of - string values. The default headers are set on all endpoints regardless of - the status code value. For an example, refer to the - [Listeners custom http response headers](#listener-s-custom-response-headers) - section. - -- `` `(key-value-map: {})` - A map of string header names - to an array of string values. These headers are set only when the response status - code falls under the collective status code. - For example, `"2xx" = {"Header-A": ["Value1", "Value2"]}`, `"Header-A"` - is set when the http response status code is `"200"`, `"204"`, etc. This overrides - headers defined at the `default` level. - -- `` `(key-value-map: {})` - A map of string header names - to an array of string values. These headers are set only when the specific status - code is returned. For example, `"200" = {"Header-A": ["Value1", "Value2"]}`, `"Header-A"` - is set when the http response status code is `"200"`. This overrides headers defined at - the `default` and `collective status code` level. \ No newline at end of file diff --git a/website/content/partials/configuration-reference/listeners/tcp-general-parameters.mdx b/website/content/partials/configuration-reference/listeners/tcp-general-parameters.mdx deleted file mode 100644 index 6859b23c3..000000000 --- a/website/content/partials/configuration-reference/listeners/tcp-general-parameters.mdx +++ /dev/null @@ -1,58 +0,0 @@ -- `purpose` `(string: "")` - Specifies the purpose. Can be `api`, `cluster`, - `proxy`, or `ops`. - -- `address` `(string: "127.0.0.1:9200")` – Specifies the address to bind to for - listening. - -- `http_idle_timeout` `(string: "5m")` - Specifies the maximum amount of time to - wait for the next request when keep-alives are enabled. If `http_idle_timeout` - is zero, the value of `http_read_timeout` is used. If both are zero, the value - of `http_read_header_timeout` is used. This is specified using a label suffix - like `"30s"` or `"1h"`. - -- `http_read_header_timeout` `(string: "10s")` - Specifies the amount of time - allowed to read request headers. This is specified using a label suffix like - `"30s"` or `"1h"`. - -- `http_read_timeout` `(string: "30s")` - Specifies the maximum duration for - reading the entire request, including the body. This is specified using a - label suffix like `"30s"` or `"1h"`. - -- `http_write_timeout` `(string: "0")` - Specifies the maximum duration before - timing out writes of the response and is reset whenever a new request's header - is read. The default value of `"0"` means infinity. This is specified using a - label suffix like `"30s"` or `"1h"`. - - - -- `max_request_duration` `(string: "90s")` – Specifies the maximum - request duration allowed before Boundary cancels the request. This overrides - `default_max_request_duration` for this listener. - -- `cors_enabled` `(boolean: true)` - Specifies if CORS should be enabled, which - allows Boundary to support external browser-based clients (not including admin - UI), such as Boundary Desktop. If not specified, CORS will be enabled with an - allowed origin that grants access to Boundary Desktop, unless overridden with - `cors_disable_default_allowed_origin_values`. - -- `cors_disable_default_allowed_origin_values` `(boolean: false)` - Specifies - that Boundary should not append default allowed origin values to any specified - in `cors_allowed_origins`, such as Boundary Desktop's origin. This also - disables the behavior of enabling CORS if `cors_enabled` is not specified. - -- `cors_allowed_origins` `(array(string): ["serve://boundary"])` - An array of - allowed CORS origins. Origins must include protocol, host, and port (if port - is different than the default for the specified protocol). To allow all - origins, set to `['*']`. By default, Boundary Desktop's origin - `serve://boundary` is appended to any values included here, unless - `cors_disable_default_allowed_origin_values` is specified. - -- `cors_allowed_headers` `(array(string): [])` – An array specifying headers - that are permitted to be on cross-origin requests. Headers set via this - parameter will be appended to the list of headers that Boundary allows by - default, such as `"Content-Type"`, `"X-Requested-With"`, and - `"Authorization"`. \ No newline at end of file diff --git a/website/content/partials/configuration-reference/listeners/tcp-intro.mdx b/website/content/partials/configuration-reference/listeners/tcp-intro.mdx deleted file mode 100644 index e97eef8e3..000000000 --- a/website/content/partials/configuration-reference/listeners/tcp-intro.mdx +++ /dev/null @@ -1,12 +0,0 @@ -The TCP listener configures Boundary to listen on a TCP address/port. - -```hcl -listener "tcp" { - purpose = "api" - address = "127.0.0.1:9200" -} -``` - -The `listener` stanza may be specified more than once to make Boundary listen on -multiple interfaces; however, only one listener marked for `cluster` purpose is -allowed. \ No newline at end of file diff --git a/website/content/partials/configuration-reference/listeners/tcp-listen-on-mulitple-interfaces.mdx b/website/content/partials/configuration-reference/listeners/tcp-listen-on-mulitple-interfaces.mdx deleted file mode 100644 index 057a1aaa9..000000000 --- a/website/content/partials/configuration-reference/listeners/tcp-listen-on-mulitple-interfaces.mdx +++ /dev/null @@ -1,17 +0,0 @@ -This example shows Boundary listening on a private interface, as well as localhost. - -```hcl -listener "tcp" { - purpose = "api" - address = "127.0.0.1:9200" -} - -listener "tcp" { - purpose = "cluster" - address = "10.0.0.5:9201" -} -``` - -[golang-tls]: https://golang.org/src/crypto/tls/cipher_suites.go -[api-addr]: /boundary/docs/configuration#api_addr -[cluster-addr]: /boundary/docs/configuration#cluster_addr diff --git a/website/content/partials/configuration-reference/listeners/tcp-telemetry.mdx b/website/content/partials/configuration-reference/listeners/tcp-telemetry.mdx deleted file mode 100644 index 2fe5806d7..000000000 --- a/website/content/partials/configuration-reference/listeners/tcp-telemetry.mdx +++ /dev/null @@ -1,2 +0,0 @@ -- `unauthenticated_metrics_access` `(string: "false")` - If set to true, allows - unauthenticated access to the `/v1/sys/metrics` endpoint. diff --git a/website/content/partials/configuration-reference/listeners/tcp-tls.mdx b/website/content/partials/configuration-reference/listeners/tcp-tls.mdx deleted file mode 100644 index 0e146d156..000000000 --- a/website/content/partials/configuration-reference/listeners/tcp-tls.mdx +++ /dev/null @@ -1,69 +0,0 @@ -The `tls` parameters are valid for `api` and `ops` listeners. The `cluster` -and `proxy` connections use their own ephemeral TLS stacks. For more -information, refer to [TLS in Boundary](/boundary/docs/secure/encryption/connections-tls). - -- `tls_disable` `(string: "false")` – Specifies if TLS will be disabled. Boundary - assumes TLS by default, so you must explicitly disable TLS to opt-in to - insecure communication. - -- `tls_cert_file` `(string: )` – - Specifies the path to the certificate for TLS. To configure the listener to - use a CA certificate, concatenate the primary certificate and the CA - certificate together. The primary certificate should appear first in the - combined file. On `SIGHUP`, the path set here _at Boundary startup_ will be - used for reloading the certificate; modifying this value while Boundary is - running will have no effect for `SIGHUP`s. - -- `tls_key_file` `(string: )` – - Specifies the path to the private key for the certificate. If the key file is - encrypted, you will be prompted to enter the passphrase on server startup. The - passphrase must stay the same between key files when reloading your - configuration using `SIGHUP`. On `SIGHUP`, the path set here _at Boundary - startup_ will be used for reloading the certificate; modifying this value - while Boundary is running will have no effect for `SIGHUP`s. - -- `tls_min_version` `(string: "tls12")` – Specifies the minimum supported - version of TLS. Accepted values are "tls10", "tls11", "tls12" or "tls13". - - TLS 1.1 and lower are generally considered insecure. - -- `tls_max_version` `(string: "tls13")` – Specifies the maximum supported - version of TLS, useful if appliances (e.g. load balancers) are not yet capable - of higher levels. Accepted values are "tls10", "tls11", "tls12" or "tls13". - - TLS 1.1 and lower are generally considered insecure. - -- `tls_cipher_suites` `(string: "")` – Override the default list of supported - ciphersuites (which varies by TLS version) with the the specified - comma-delimited list. The list of all available ciphersuites is available in - the [Golang TLS documentation][golang-tls]. - -- `tls_prefer_server_cipher_suites` `(string: "false")` – Specifies to prefer the - server's ciphersuite over the client ciphersuites. - -- `tls_require_and_verify_client_cert` `(string: "false")` – Turns on client - authentication for this listener; the listener will require a presented - client cert that successfully validates against system CAs. - -- `tls_client_ca_file` `(string: "")` – PEM-encoded Certificate Authority file - used for checking the authenticity of client. - - \ No newline at end of file diff --git a/website/content/partials/configuration-reference/listeners/unix-configure-tls.mdx b/website/content/partials/configuration-reference/listeners/unix-configure-tls.mdx deleted file mode 100644 index ca5b86c09..000000000 --- a/website/content/partials/configuration-reference/listeners/unix-configure-tls.mdx +++ /dev/null @@ -1,10 +0,0 @@ -This example shows enabling a TLS listener. - -```hcl -listener "unix" { - purpose = "api" - address = "/var/run/boundary-api.sock" - tls_cert_file = "/etc/certs/Boundary.crt" - tls_key_file = "/etc/certs/Boundary.key" -} -``` \ No newline at end of file diff --git a/website/content/partials/configuration-reference/listeners/unix-general-parameters.mdx b/website/content/partials/configuration-reference/listeners/unix-general-parameters.mdx deleted file mode 100644 index 077f2266e..000000000 --- a/website/content/partials/configuration-reference/listeners/unix-general-parameters.mdx +++ /dev/null @@ -1,57 +0,0 @@ -- `purpose` `(string: "")` - Specifies the purpose. Can be `api`, `ops` or `cluster`. - -- `address` `(string: "")` – Specifies the address (filesystem path) to bind to - for listening. - -- `http_idle_timeout` `(string: "5m")` - Specifies the maximum amount of time to - wait for the next request when keep-alives are enabled. If `http_idle_timeout` - is zero, the value of `http_read_timeout` is used. If both are zero, the value - of `http_read_header_timeout` is used. This is specified using a label suffix - like `"30s"` or `"1h"`. - -- `http_read_header_timeout` `(string: "10s")` - Specifies the amount of time - allowed to read request headers. This is specified using a label suffix like - `"30s"` or `"1h"`. - -- `http_read_timeout` `(string: "30s")` - Specifies the maximum duration for - reading the entire request, including the body. This is specified using a - label suffix like `"30s"` or `"1h"`. - -- `http_write_timeout` `(string: "0")` - Specifies the maximum duration before - timing out writes of the response and is reset whenever a new request's header - is read. The default value of `"0"` means infinity. This is specified using a - label suffix like `"30s"` or `"1h"`. - - - -- `max_request_duration` `(string: "90s")` – Specifies the maximum - request duration allowed before Boundary cancels the request. This overrides - `default_max_request_duration` for this listener. - -- `cors_enabled` `(boolean: true)` - Specifies if CORS should be enabled, which - allows Boundary to support external browser-based clients (not including admin - UI), such as Boundary Desktop. If not specified, CORS will be enabled with an - allowed origin that grants access to Boundary Desktop, unless overridden with - `cors_disable_default_allowed_origin_values`. - -- `cors_disable_default_allowed_origin_values` `(boolean: false)` - Specifies - that Boundary should not append default allowed origin values to any specified - in `cors_allowed_origins`, such as Boundary Desktop's origin. This also - disables the behavior of enabling CORS if `cors_enabled` is not specified. - -- `cors_allowed_origins` `(array(string): ["serve://boundary"])` - An array of - allowed CORS origins. Origins must include protocol, host, and port (if port - is different than the default for the specified protocol). To allow all - origins, set to `['*']`. By default, Boundary Desktop's origin - `serve://boundary` is appended to any values included here, unless - `cors_disable_default_allowed_origin_values` is specified. - -- `cors_allowed_headers` `(array(string): [])` – An array specifying headers - that are permitted to be on cross-origin requests. Headers set via this - parameter will be appended to the list of headers that Boundary allows by - default, such as `"Content-Type"`, `"X-Requested-With"`, and - `"Authorization"`. diff --git a/website/content/partials/configuration-reference/listeners/unix-intro.mdx b/website/content/partials/configuration-reference/listeners/unix-intro.mdx deleted file mode 100644 index 4cb8043f0..000000000 --- a/website/content/partials/configuration-reference/listeners/unix-intro.mdx +++ /dev/null @@ -1,15 +0,0 @@ -The `unix` listener configures Boundary to listen on a Unix domain socket. - -It is only available for listeners for `api` and `cluster` purpose. -Unix sockets cannot currently be used for `"proxy"` purpose on a worker. - -```hcl -listener "unix" { - purpose = "api" - address = "/var/run/boundary-api.sock" -} -``` - -The `listener` stanza may be specified more than once to make Boundary listen on -multiple interfaces; however, only one listener marked for `cluster` purpose is -allowed. \ No newline at end of file diff --git a/website/content/partials/configuration-reference/listeners/unix-listen-on-multiple-interfaces.mdx b/website/content/partials/configuration-reference/listeners/unix-listen-on-multiple-interfaces.mdx deleted file mode 100644 index 516632918..000000000 --- a/website/content/partials/configuration-reference/listeners/unix-listen-on-multiple-interfaces.mdx +++ /dev/null @@ -1,13 +0,0 @@ -This example shows Boundary listening on a private interface, as well as localhost. - -```hcl -listener "tcp" { - purpose = "api" - address = "/var/run/boundary-api.sock" -} - -listener "tcp" { - purpose = "cluster" - address = "/var/run/boundary-cluster.sock" -} -``` diff --git a/website/content/partials/configuration-reference/listeners/unix-telemetry.mdx b/website/content/partials/configuration-reference/listeners/unix-telemetry.mdx deleted file mode 100644 index 3413e442c..000000000 --- a/website/content/partials/configuration-reference/listeners/unix-telemetry.mdx +++ /dev/null @@ -1,2 +0,0 @@ -- `unauthenticated_metrics_access` `(string: "false")` - If set to true, allows - unauthenticated access to the `/v1/sys/metrics` endpoint. \ No newline at end of file diff --git a/website/content/partials/configuration-reference/listeners/unix-tls-parameters.mdx b/website/content/partials/configuration-reference/listeners/unix-tls-parameters.mdx deleted file mode 100644 index eecf09325..000000000 --- a/website/content/partials/configuration-reference/listeners/unix-tls-parameters.mdx +++ /dev/null @@ -1,70 +0,0 @@ -The `tls` parameters are valid for `api` and `ops` listeners. `cluster` -and `proxy` connections use their own ephemeral TLS stacks. For more -information, refer to [TLS in Boundary](/boundary/docs/secure/encryption/connections-tls). - -- `tls_disable` `(string: "false")` – Specifies if TLS will be disabled. Boundary - assumes TLS by default, so you must explicitly disable TLS to opt-in to - insecure communication. - -- `tls_cert_file` `(string: )` – - Specifies the path to the certificate for TLS. To configure the listener to - use a CA certificate, concatenate the primary certificate and the CA - certificate together. The primary certificate should appear first in the - combined file. On `SIGHUP`, the path set here _at Boundary startup_ will be - used for reloading the certificate; modifying this value while Boundary is - running will have no effect for `SIGHUP`s. - -- `tls_key_file` `(string: )` – - Specifies the path to the private key for the certificate. If the key file is - encrypted, you will be prompted to enter the passphrase on server startup. The - passphrase must stay the same between key files when reloading your - configuration using `SIGHUP`. On `SIGHUP`, the path set here _at Boundary - startup_ will be used for reloading the certificate; modifying this value - while Boundary is running will have no effect for `SIGHUP`s. - -- `tls_min_version` `(string: "tls12")` – Specifies the minimum supported - version of TLS. Accepted values are "tls10", "tls11", "tls12" or "tls13". - - TLS 1.1 and lower are generally considered insecure. - -- `tls_max_version` `(string: "tls13")` – Specifies the maximum supported - version of TLS, useful if appliances (e.g. load balancers) are not yet capable - of higher levels. Accepted values are "tls10", "tls11", "tls12" or "tls13". - - TLS 1.1 and lower are generally considered insecure. - -- `tls_cipher_suites` `(string: "")` – Override the default list of supported - ciphersuites (which varies by TLS version) with the the specified - comma-delimited list. The list of all available ciphersuites is available in - the [Golang TLS documentation][golang-tls]. - -- `tls_prefer_server_cipher_suites` `(string: "false")` – Specifies to prefer the - server's ciphersuite over the client ciphersuites. - -- `tls_require_and_verify_client_cert` `(string: "false")` – Turns on client - authentication for this listener; the listener will require a presented - client cert that successfully validates against system CAs. - -- `tls_client_ca_file` `(string: "")` – PEM-encoded Certificate Authority file - used for checking the authenticity of client. - - diff --git a/website/content/partials/configuration-reference/workers/common-worker-parameters.mdx b/website/content/partials/configuration-reference/workers/common-worker-parameters.mdx deleted file mode 100644 index f22e681f8..000000000 --- a/website/content/partials/configuration-reference/workers/common-worker-parameters.mdx +++ /dev/null @@ -1,78 +0,0 @@ -The following fields apply to all registration mechanisms. - -```hcl -worker { - public_addr = "5.1.23.198" - - # Local storage path required if session recording is enabled - recording_storage_path = "tmp/boundary/" - - # Minimum available disk space required in the local storage path if session recording is enabled - recording_storage_minimum_available_capacity = "500MB" - - # Mutually exclusive with hcp_boundary_cluster_id - initial_upstreams = [ - "10.0.0.1", - "10.0.0.2", - ] - - tags { - type = ["prod", "webservers"] - region = ["us-east-1"] - } - - # HCP Boundary only - # hcp_boundary_cluster_id = "....." -} -``` - -- `public_addr` - Specifies the public host or IP address (and optionally port) - where clients can reach the worker for proxying. By default, it uses the - address of the listener marked for `proxy` purpose. This is useful for cloud - environments that do not bind a publicly accessible IP directly to a NIC on - the host, such as an Amazon EIP. - - You should omit this parameter in multi-hop configurations if this self-managed worker connects to an upstream HCP-managed worker. - - This value can reference any of the following: - - a direct address string - - read an address from a file on disk (file://) - - read an address from an environment variable (env://) - -- `initial_upstreams` - A list of hosts/IP addresses and optionally ports for - reaching the Boundary cluster. The port will default to `:9201` if not - specified. This value can be a direct access string array with the addresses, - or it can refer to a file on disk (`file://`) from which the addresses will be - read, or an environment variable (`env://`) from which to read the addresses. When - using environment variable or file, their contents must formatted as a JSON array: - `["127.0.0.1", "192.168.0.1", "10.0.0.1"]` - - Self-managed workers connecting to HCP Boundary require the [`hcp_boundary_cluster_id`](/boundary/docs/configuration/worker/#hcp_boundary_cluster_id) parameter instead of `initial upstreams`, unless you are configuring an HCP-managed worker as an ingress worker. - If you configure a self-managed worker with both `initial_upstreams` and `hcp_boundary_cluster_id`, the worker configuration fails. - -- `hcp_boundary_cluster_id` - A string required to configure workers using worker-led or controller-led registration - to connect to your HCP Boundary cluster rather than specifying -`initial_upstreams`. This parameter is valid only for workers using the worker-led or controller-led - registration method and for workers directly connected to HCP Boundary. - -- `recording_storage_path` - A path to the local storage for recorded sessions. - Boundary stores session recordings in the local storage while they are in progress. - When the session is complete, Boundary moves the local session recording to remote storage and deletes the local copy. - -- `recording_storage_minimum_available_capacity` - A value measured in bytes that - defines the worker's local storage state. Boundary compares this value to the available local disk space found in the `recording_storage_path` and determines if a worker can perform session recording operations. - The supported suffixes are kb, kib, mb, mib, gb, gib, tb, tib, which are not case sensitive. Example: 2GB, 2gb, 2GiB, 2gib. - The possible storage states based on the `recording_storage_minimum_available_capacity` are: - - Available - The worker has storage above the threshold and can proxy sessions that have session recording enabled. - - Low storage - The worker has storage below the threshold. It allows existing sessions to continue without interruption but prevents proxying new sessions that have session recording enabled. The worker cannot record new sessions or play back existing recordings. - - Critically low storage - The worker falls below half the storage threshold. It forcefully closes existing sessions with session recording. The worker cannot record new sessions or play back existing recordings. - - Out of storage - The worker is out of local disk space. It cannot record new sessions or play back existing recordings. The worker enters an unrecoverable state, requiring an administrator to intervene and resolve the issue. - - Not configured - The worker lacks a configured local storage path. - - Unknown - The worker starts with this default local storage state. This state indicates that the worker's local storage state is not yet known. - -- `tags` - A map of key-value pairs where values are an array of strings. Most - commonly used for [filtering](/boundary/docs/filtering) targets a - worker can proxy via [worker - tags](/boundary/docs/workers/worker-tags). On `SIGHUP`, the tags - set here will be re-parsed and new values used. It can also be a string - referring to a file on disk (`file://`) or an environment variable (`env://`). diff --git a/website/content/partials/configuration-reference/workers/complete-configuration-example.mdx b/website/content/partials/configuration-reference/workers/complete-configuration-example.mdx deleted file mode 100644 index 1f9711037..000000000 --- a/website/content/partials/configuration-reference/workers/complete-configuration-example.mdx +++ /dev/null @@ -1,43 +0,0 @@ -```hcl -listener "tcp" { - purpose = "proxy" - tls_disable = true - address = "127.0.0.1" -} - -worker { - # Path for worker storage, assuming worker-led or controller-led registration. Must be unique across workers - auth_storage_path="/boundary/demo-worker-1" - - # Local storage path required if session recording is enabled - recording_storage_path = "tmp/boundary/" - - # Minimum available disk space required in the local storage path if session recording is enabled - recording_storage_minimum_available_capacity = "500MB" - - # Workers typically need to reach upstreams on :9201 - initial_upstreams = [ - "10.0.0.1", - "10.0.0.2", - "10.0.0.3", - ] - - public_addr = "myhost.mycompany.com" - - tags { - type = ["prod", "webservers"] - region = ["us-east-1"] - } -} - -# The following KMS config is an example only -# Use a production KMS such as AWS KMS for production installs -kms "aead" { - purpose = "worker-auth-storage" - aead_type = "aes-gcm" - key = "X+IJMVT6OnsrIR6G/9OTcJSX+lM9FSPN" - key_id = "worker-auth-storage" -} - - -``` \ No newline at end of file diff --git a/website/content/partials/release-notes/intro.mdx b/website/content/partials/release-notes/intro.mdx deleted file mode 100644 index 533c3abce..000000000 --- a/website/content/partials/release-notes/intro.mdx +++ /dev/null @@ -1,4 +0,0 @@ -Release notes provide an at-a-glance summary of key updates to new versions of Boundary. -For a comprehensive list of product updates, improvements, and bug fixes refer to the [changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md) included with the Boundary code on GitHub. - -We encourage you to [upgrade to the latest release of Boundary](/boundary/tutorials/self-managed-deployment/upgrade-version) to take advantage of continuing improvements, critical fixes, and new features. \ No newline at end of file diff --git a/website/content/partials/workers/egress-worker-config.mdx b/website/content/partials/workers/egress-worker-config.mdx deleted file mode 100644 index 5ebe243e3..000000000 --- a/website/content/partials/workers/egress-worker-config.mdx +++ /dev/null @@ -1,102 +0,0 @@ -Create the `egress-worker.hcl` file with the relevant configuration information: - - - -```hcl -# disable memory from being swapped to disk -disable_mlock = true - -# listener denoting this is a worker proxy -listener "tcp" { - address = "0.0.0.0:9202" - purpose = "proxy" -} - -# worker block for configuring the specifics of the -# worker service -worker { - public_addr = "" - initial_upstreams = [":9202"] - auth_storage_path = "/var/lib/boundary" - tags { - type = ["worker3", "egress"] - } -} - -# Events (logging) configuration. This -# configures logging for ALL events to both -# stderr and a file at /var/log/boundary/.log -events { - audit_enabled = true - sysevents_enabled = true - observations_enable = true - sink "stderr" { - name = "all-events" - description = "All events sent to stderr" - event_types = ["*"] - format = "cloudevents-json" - } - sink { - name = "file-sink" - description = "All events sent to a file" - event_types = ["*"] - format = "cloudevents-json" - file { - path = "/var/log/boundary" - file_name = "egress-worker.log" - } - audit_config { - audit_filter_overrides { - sensitive = "redact" - secret = "redact" - } - } - } -} - -# kms block for encrypting the authentication PKI material -kms "awskms" { - purpose = "worker-auth-storage" - region = "us-east-1" - kms_key_id = "19ec80b0-dfdd-4d97-8164-c6examplekey5" - endpoint = "https://vpce-0e1bb1852241f8cc6-pzi0do8n.kms.us-east-1.vpce.amazonaws.com" -} -``` - - - -Refer to the list below for explanations of the parameters used in the example above: - -- `disable mlock (bool: false)` - Disables the server from executing the `mlock` syscall, which prevents memory from being swapped to the disk. -This is fine for local development and testing. -However, it is not recommended for production unless the systems running Boundary use only encrypted swap or do not use swap at all. -Boundary only supports memory locking on UNIX-like systems that support `mlock()` syscall like Linux and FreeBSD. - - On Linux, to give the Boundary executable the ability to use `mlock` syscall without running the process as root, run the following command: - - `sudo setcap cap_ipc_lock=+ep $(readlink -f $(which boundary))` - - If you use a Linux distribution with a modern version of systemd, you can add the following directive to the **"[Service]"** configuration section: - - `LimitMEMLOCK=infinity` - -- `listener` - Configures the listeners on which Boundary serves traffic (API cluster and proxy). -- `worker` - Configures the worker. -If present, `boundary server` starts a worker subprocess. -- `events` - Configures event-specific parameters. - - The example events configuration above is exhaustive and writes all events to both `stderr` and a file. - This configuration may or may not work for your organization's logging solution. - -- `kms` - Configures KMS blocks for [various purposes](/boundary/docs/secure/encryption/data-encryption). - - Refer to the links below for configuration information for the different cloud KMS blocks: - - - [AWS](/boundary/docs/configuration/kms/awskms) - - [Azure](/boundary/docs/configuration/kms/azurekeyvault) - - [GCP](/boundary/docs/configuration/kms/gcpckms) - - [OCI](/boundary/docs/configuration/kms/ocikms) - - [AliCloud](/boundary/docs/configuration/kms/alicloudkms) - - [Vault Transit](/boundary/docs/configuration/kms/transit) - -Refer to the documentation for additional [top-level configuration options](/boundary/docs/configuration) and additional [worker-specific options](/boundary/docs/configuration/workers). \ No newline at end of file diff --git a/website/content/partials/workers/ingress-worker-config.mdx b/website/content/partials/workers/ingress-worker-config.mdx deleted file mode 100644 index 499e27759..000000000 --- a/website/content/partials/workers/ingress-worker-config.mdx +++ /dev/null @@ -1,66 +0,0 @@ -Create the `ingress-worker.hcl` file with the relevant configuration information: - - - -```hcl -# disable memory from being swapped to disk -disable_mlock = true - -# listener denoting this is a worker proxy -listener "tcp" { - address = "0.0.0.0:9202" - purpose = "proxy" -} - -# worker block for configuring the specifics of the -# worker service -worker { - public_addr = "" - initial_upstreams = [":9201"] - auth_storage_path = "/var/lib/boundary" - tags { - type = ["worker1", "upstream"] - } -} - -# Events (logging) configuration. This -# configures logging for ALL events to both -# stderr and a file at /var/log/boundary/.log -events { - audit_enabled = true - sysevents_enabled = true - observations_enable = true - sink "stderr" { - name = "all-events" - description = "All events sent to stderr" - event_types = ["*"] - format = "cloudevents-json" - } - sink { - name = "file-sink" - description = "All events sent to a file" - event_types = ["*"] - format = "cloudevents-json" - file { - path = "/var/log/boundary" - file_name = "ingress-worker.log" - } - audit_config { - audit_filter_overrides { - sensitive = "redact" - secret = "redact" - } - } - } -} - -# kms block for encrypting the authentication PKI material -kms "awskms" { - purpose = "worker-auth-storage" - region = "us-east-1" - kms_key_id = "19ec80b0-dfdd-4d97-8164-c6examplekey3" - endpoint = "https://vpce-0e1bb1852241f8cc6-pzi0do8n.kms.us-east-1.vpce.amazonaws.com" -} -``` - - \ No newline at end of file diff --git a/website/content/partials/workers/intermediate-worker-config.mdx b/website/content/partials/workers/intermediate-worker-config.mdx deleted file mode 100644 index 10c4d2ef3..000000000 --- a/website/content/partials/workers/intermediate-worker-config.mdx +++ /dev/null @@ -1,66 +0,0 @@ -Create the `intermediate-worker.hcl` file with the relevant configuration information: - - - -```hcl -# disable memory from being swapped to disk -disable_mlock = true - -# listener denoting this is a worker proxy -listener "tcp" { - address = "0.0.0.0:9202" - purpose = "proxy" -} - -# worker block for configuring the specifics of the -# worker service -worker { - public_addr = "" - initial_upstreams = [":9202"] - auth_storage_path = "/var/lib/boundary" - tags { - type = ["worker2", "intermediate"] - } -} - -# Events (logging) configuration. This -# configures logging for ALL events to both -# stderr and a file at /var/log/boundary/.log -events { - audit_enabled = true - sysevents_enabled = true - observations_enable = true - sink "stderr" { - name = "all-events" - description = "All events sent to stderr" - event_types = ["*"] - format = "cloudevents-json" - } - sink { - name = "file-sink" - description = "All events sent to a file" - event_types = ["*"] - format = "cloudevents-json" - file { - path = "/var/log/boundary" - file_name = "intermediate-worker.log" - } - audit_config { - audit_filter_overrides { - sensitive = "redact" - secret = "redact" - } - } - } -} - -# kms block for encrypting the authentication PKI material -kms "awskms" { - purpose = "worker-auth-storage" - region = "us-east-1" - kms_key_id = "19ec80b0-dfdd-4d97-8164-c6examplekey4" - endpoint = "https://vpce-0e1bb1852241f8cc6-pzi0do8n.kms.us-east-1.vpce.amazonaws.com" -} -``` - - \ No newline at end of file diff --git a/website/content/partials/workers/single-worker-config.mdx b/website/content/partials/workers/single-worker-config.mdx deleted file mode 100644 index f61fe2771..000000000 --- a/website/content/partials/workers/single-worker-config.mdx +++ /dev/null @@ -1,102 +0,0 @@ -Create the `egress-worker.hcl` file with the relevant configuration information: - - - -```hcl -# disable memory from being swapped to disk -disable_mlock = true - -# listener denoting this is a worker proxy -listener "tcp" { - address = "0.0.0.0:9202" - purpose = "proxy" -} - -# worker block for configuring the specifics of the -# worker service -worker { - public_addr = "" - initial_upstreams = [":9201"] - auth_storage_path = "/var/lib/boundary" - tags { - type = ["worker", "egress"] - } -} - -# Events (logging) configuration. This -# configures logging for ALL events to both -# stderr and a file at /var/log/boundary/.log -events { - audit_enabled = true - sysevents_enabled = true - observations_enable = true - sink "stderr" { - name = "all-events" - description = "All events sent to stderr" - event_types = ["*"] - format = "cloudevents-json" - } - sink { - name = "file-sink" - description = "All events sent to a file" - event_types = ["*"] - format = "cloudevents-json" - file { - path = "/var/log/boundary" - file_name = "egress-worker.log" - } - audit_config { - audit_filter_overrides { - sensitive = "redact" - secret = "redact" - } - } - } -} - -# kms block for encrypting the authentication PKI material -kms "awskms" { - purpose = "worker-auth-storage" - region = "us-east-1" - kms_key_id = "19ec80b0-dfdd-4d97-8164-c6examplekey5" - endpoint = "https://vpce-0e1bb1852241f8cc6-pzi0do8n.kms.us-east-1.vpce.amazonaws.com" -} -``` - - - -Refer to the list below for explanations of the parameters used in the example above: - -- `disable mlock (bool: false)` - Disables the server from executing the `mlock` syscall, which prevents memory from being swapped to the disk. -This is fine for local development and testing. -However, it is not recommended for production unless the systems running Boundary use only encrypted swap or do not use swap at all. -Boundary only supports memory locking on UNIX-like systems that support `mlock()` syscall like Linux and FreeBSD. - - On Linux, to give the Boundary executable the ability to use `mlock` syscall without running the process as root, run the following command: - - `sudo setcap cap_ipc_lock=+ep $(readlink -f $(which boundary))` - - If you use a Linux distribution with a modern version of systemd, you can add the following directive to the **"[Service]"** configuration section: - - `LimitMEMLOCK=infinity` - -- `listener` - Configures the listeners on which Boundary serves traffic (API cluster and proxy). -- `worker` - Configures the worker. -If present, `boundary server` starts a worker subprocess. -- `events` - Configures event-specific parameters. - - The example events configuration above is exhaustive and writes all events to both `stderr` and a file. - This configuration may or may not work for your organization's logging solution. - -- `kms` - Configures KMS blocks for [various purposes](/boundary/docs/secure/encryption/data-encryption). - - Refer to the links below for configuration information for the different cloud KMS blocks: - - - [AWS](/boundary/docs/configuration/kms/awskms) - - [Azure](/boundary/docs/configuration/kms/azurekeyvault) - - [GCP](/boundary/docs/configuration/kms/gcpckms) - - [OCI](/boundary/docs/configuration/kms/ocikms) - - [AliCloud](/boundary/docs/configuration/kms/alicloudkms) - - [Vault Transit](/boundary/docs/configuration/kms/transit) - -Refer to the documentation for additional [top-level configuration options](/boundary/docs/configuration) and additional [worker-specific options](/boundary/docs/configuration/workers). \ No newline at end of file diff --git a/website/content/security.mdx b/website/content/security.mdx deleted file mode 100644 index 94051c7af..000000000 --- a/website/content/security.mdx +++ /dev/null @@ -1,28 +0,0 @@ ---- -layout: index -page_title: Security -description: >- - Boundary takes security very seriously. Please responsibly disclose any security - vulnerabilities found and we'll handle it quickly. ---- - -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ -> [!IMPORTANT] -> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com. -⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️ - -# Security - -We understand that many users place a high level of trust in HashiCorp and -the tools we build. We apply best practices and focus on security to make -sure we can maintain the trust of the community. - -We deeply appreciate any effort to disclose vulnerabilities responsibly. - -If you would like to report a vulnerability, please see the -[HashiCorp security page](https://www.hashicorp.com/security), -which has the proper email to communicate with as well as our PGP key. - -If you are not reporting a security sensitive vulnerability, please -open an issue on the standard [GitHub](https://github.com/hashicorp/boundary) -repository. diff --git a/website/data/docs-nav-data.json b/website/data/docs-nav-data.json deleted file mode 100644 index d4e77bc21..000000000 --- a/website/data/docs-nav-data.json +++ /dev/null @@ -1,2237 +0,0 @@ -[ - { - "heading": "Get started" - }, - { - "title": "What is Boundary?", - "path": "what-is-boundary" - }, - { - "title": "Why choose Boundary?", - "routes": [ - { - "title": "Use cases", - "path": "overview/use-cases" - }, - { - "title": "Zero trust", - "path": "overview/zero-trust" - }, - { - "title": "Bastion hosts", - "path": "overview/bastion-hosts" - }, - { - "title": "VPNs", - "path": "overview/vpn" - }, - { - "title": "Privileged access management", - "path": "overview/pam" - }, - { - "title": "Software-defined perimeter", - "path": "overview/sdp" - }, - { - "title": "Secrets management tools", - "path": "overview/secrets-management" - }, - { - "title": "Frequently asked questions", - "path": "overview/faq" - } - ] - }, - { - "title": "Quickstart", - "routes": [ - { - "title": "Get started", - "path": "getting-started" - }, - { - "title": "HCP Boundary quick start", - "href": "https://developer.hashicorp.com/boundary/tutorials/hcp-getting-started/" - }, - { - "title": "Self-managed Boundary quick start", - "href": "https://developer.hashicorp.com/boundary/tutorials/oss-getting-started/" - }, - { - "title": "Dev mode quick start", - "routes": [ - { - "title": "Overview", - "path": "getting-started/dev-mode" - }, - { - "title": "Run and log in", - "path": "getting-started/dev-mode/run-and-login" - }, - { - "title": "Connect to a target", - "path": "getting-started/dev-mode/connect-to-dev-target" - } - ] - } - ] - }, - { - "title": "Key concepts", - "routes": [ - { - "title": "Auditing", - "path": "concepts/auditing" - }, - { - "title": "Identity and access management", - "path": "concepts/iam" - }, - { - "title": "Credential management", - "path": "concepts/credential-management" - }, - { - "title": "Workers", - "path": "concepts/workers" - }, - { - "title": "Aliases", - "path": "concepts/aliases" - }, - { - "title": "Transparent sessions", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - }, - "path": "concepts/transparent-sessions" - } - ] - }, - { - "title": "Architecture", - "routes": [ - { - "title": "System requirements", - "path": "architecture/system-requirements" - }, - { - "title": "Recommended architecture", - "path": "architecture/recommended-architecture" - }, - { - "title": "Fault tolerance", - "path": "architecture/fault-tolerance" - }, - { - "title": "High availability", - "path": "architecture/high-availability" - } - ] - }, - { - "divider": true - }, - { - "heading": "Boundary operations" - }, - { - "title": "Deploy Boundary", - "routes": [ - { - "title": "In a self-managed environment", - "routes": [ - { - "title": "Overview", - "path": "deploy/self-managed" - }, - { - "title": "Install Boundary", - "path": "deploy/self-managed/install" - }, - { - "title": "Configure controllers", - "path": "deploy/self-managed/configure-controllers" - }, - { - "title": "Deploy workers", - "path": "deploy/self-managed/deploy-workers" - }, - { - "title": "Initialize Boundary", - "path": "deploy/self-managed/initialize" - }, - { - "title": "Install Boundary clients", - "path": "deploy/self-managed/install-clients" - }, - { - "title": "Systemd install", - "hidden": true, - "path": "deploy/self-managed/systemd" - } - ] - }, - { - "title": "On HashiCorp Cloud Platform (HCP)", - "href": "hcp/get-started/deploy-and-login" - }, - { - "title": "Using Terraform", - "routes": [ - { - "title": "Overview", - "path": "deploy/terraform-patterns" - }, - { - "title": "Configure scopes", - "path": "deploy/terraform-patterns/terraform-scopes" - }, - { - "title": "Configure users and auth methods", - "path": "deploy/terraform-patterns/terraform-users-and-auth-methods" - }, - { - "title": "Configure groups and RBAC", - "path": "deploy/terraform-patterns/terraform-groups-and-rbac" - }, - { - "title": "Configure hosts and host management", - "path": "deploy/terraform-patterns/terraform-hosts-and-host-management" - }, - { - "title": "Configure credentials and credential stores", - "path": "deploy/terraform-patterns/terraform-credentials-and-credential-stores" - }, - { - "title": "Configure session recording", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - }, - "path": "deploy/terraform-patterns/terraform-session-recording" - }, - { - "title": "Configure targets", - "path": "deploy/terraform-patterns/terraform-targets" - } - ] - } - ] - }, - { - "title": "Secure Boundary", - "routes": [ - { - "title": "Encrypt resources", - "routes": [ - { - "title": "Data encryption", - "path": "secure/encryption/data-encryption" - }, - { - "title": "Connections/TLS", - "path": "secure/encryption/connections-tls" - } - ] - }, - { - "title": "Security model", - "path": "secure/security-model" - } - ] - }, - { - "title": "Monitor Boundary", - "routes": [ - { - "title": "Overview", - "path": "monitor" - }, - { - "title": "Configure listener addresses and ports", - "routes": [ - { - "title": "Listeners", - "path": "monitor/listeners" - }, - { - "title": "TCP listeners", - "path": "monitor/listeners/tcp" - }, - { - "title": "Unix listeners", - "path": "monitor/listeners/unix" - } - ] - }, - { - "title": "Monitor metrics", - "path": "monitor/metrics" - }, - { - "title": "Monitor health", - "path": "monitor/health" - }, - { - "title": "Monitor events", - "routes": [ - { - "title": "Filter events", - "path": "monitor/events/filter-events" - }, - { - "title": "Events parameters", - "path": "monitor/events/events" - }, - { - "title": "Common sink parameters", - "path": "monitor/events/common" - }, - { - "title": "File sink", - "path": "monitor/events/file" - }, - { - "title": "Stderr sink", - "path": "monitor/events/stderr" - } - ] - } - ] - }, - { - "title": "Upgrade Boundary", - "href": "https://developer.hashicorp.com/boundary/tutorials/self-managed-deployment/upgrade-version" - }, - { - "title": "Release notes", - "routes": [ - { - "title": "v0.20.0", - "path": "release-notes/v0_20_0" - }, - { - "title": "v0.19.0", - "path": "release-notes/v0_19_0" - }, - { - "title": "v0.18.0", - "path": "release-notes/v0_18_0" - }, - { - "title": "v0.17.0", - "path": "release-notes/v0_17_0" - }, - { - "title": "v0.16.0", - "path": "release-notes/v0_16_0" - }, - { - "title": "v0.15.0", - "path": "release-notes/v0_15_0" - }, - { - "title": "v0.14.0", - "path": "release-notes/v0_14_0" - }, - { - "title": "v0.13.0", - "path": "release-notes/v0_13_0" - }, - { - "title": "v0.12.0", - "path": "release-notes/v0_12_0" - }, - { - "title": "v0.11.0", - "path": "release-notes/v0_11_0" - }, - { - "title": "v0.10.0", - "path": "release-notes/v0_10_0" - }, - { - "title": "v0.9.0", - "path": "release-notes/v0_9_0" - }, - { - "title": "v0.8.0", - "path": "release-notes/v0_8_0" - }, - { - "title": "v0.7.0", - "path": "release-notes/v0_7_0" - }, - { - "title": "v0.6.0", - "path": "release-notes/v0_6_0" - }, - { - "title": "v0.5.0", - "path": "release-notes/v0_5_0" - }, - { - "title": "v0.4.0", - "path": "release-notes/v0_4_0" - }, - { - "title": "v0.3.0", - "path": "release-notes/v0_3_0" - }, - { - "title": "v0.2.0", - "path": "release-notes/v0_2_0" - }, - { - "title": "v0.1.0", - "path": "release-notes/v0_1_0" - } - ] - }, - { - "divider": true - }, - { - "heading": "Secure access" - }, - { - "title": "Configure workers", - "routes": [ - { - "title": "Overview", - "path": "workers" - }, - { - "title": "Create the worker configuration", - "path": "workers/create" - }, - { - "title": "Register workers", - "path": "workers/registration" - }, - { - "title": "Configure multi-hop sessions", - "routes": [ - { - "title": "Multi-hop sessions", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - }, - "path": "workers/multi-hop" - }, - { - "title": "On Boundary Enterprise", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - }, - "path": "workers/multi-hop/enterprise" - }, - { - "title": "On HashiCorp Cloud Platform (HCP)", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - }, - "path": "workers/multi-hop/hcp" - } - ] - }, - { - "title": "Route traffic through a worker", - "path": "workers/worker-tags" - }, - { - "title": "Configure a worker filter", - "path": "workers/filters" - } - ] - }, - { - "title": "Configure hosts", - "routes": [ - { - "title": "Host discovery", - "path": "hosts" - }, - { - "title": "Sync AWS hosts", - "path": "hosts/aws" - }, - { - "title": "Sync Azure hosts", - "path": "hosts/azure" - }, - { - "title": "Sync GCP hosts", - "path": "hosts/gcp" - } - ] - }, - { - "title": "Configure targets", - "routes": [ - { - "title": "Set up a target", - "routes": [ - { - "title": "Aliases", - "path": "targets/configuration" - }, - { - "title": "Create a target alias", - "path": "targets/configuration/create-target-alias" - }, - { - "title": "Configure transparent sessions", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - }, - "path": "targets/configuration/configure-transparent-sessions" - } - ] - }, - { - "title": "Connect to a target", - "routes": [ - { - "title": "Connection workflows", - "path": "targets/connections" - }, - { - "title": "Connect helpers", - "path": "targets/connections/connect-helpers" - }, - { - "title": "Exec flag", - "path": "targets/connections/exec-flag" - }, - { - "title": "SSH ProxyCommand", - "path": "targets/connections/workflow-ssh-proxycommand" - }, - { - "title": "Connect using a target alias", - "path": "targets/connections/connect-target-alias" - }, - { - "title": "Connect using transparent sessions", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - }, - "path": "targets/connections/transparent-sessions" - } - ] - } - ] - }, - { - "title": "Configure credentials", - "routes": [ - { - "title": "Credentials in Boundary", - "path": "credentials" - }, - { - "title": "Create a static credential store", - "path": "credentials/static-cred-boundary" - }, - { - "title": "Create a Vault credential store", - "path": "credentials/static-cred-vault" - }, - { - "title": "Configure targets with credential brokering", - "path": "credentials/configure-credential-brokering" - }, - { - "title": "Configure targets with credential injection", - "path": "credentials/configure-credential-injection", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - }, - { - "title": "RDP credential injection compatibility", - "path": "credentials/rdp-testing-and-compatibility-matrix", - "badge": { - "text": "HCP/ENT BETA", - "type": "outlined", - "color": "neutral" - } - } - ] - }, - { - "title": "Monitor access", - "routes": [ - { - "title": "Session recording", - "path": "session-recording", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - }, - { - "title": "Record and play back session activity", - "routes": [ - { - "title": "Configure workers for storage", - "path": "session-recording/configuration/configure-worker-storage", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - }, - { - "title": "Configure storage provider", - "routes": [ - { - "title": "Amazon S3", - "path": "session-recording/configuration/storage-providers/configure-s3", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - }, - { - "title": "MinIO", - "path": "session-recording/configuration/storage-providers/configure-minio", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - }, - { - "title": "S3-compliant", - "path": "session-recording/configuration/storage-providers/configure-s3-compliant", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - } - ] - }, - { - "title": "Create storage buckets", - "path": "session-recording/configuration/create-storage-bucket", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - }, - { - "title": "Enable session recording", - "path": "session-recording/configuration/enable-session-recording", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - }, - { - "title": "Find and view recorded sessions", - "path": "session-recording/configuration/manage-recorded-sessions", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - }, - { - "title": "Troubleshoot recorded sessions", - "path": "session-recording/configuration/troubleshoot-recorded-sessions", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - } - ] - }, - { - "title": "Implement session recording compliance standards", - "routes": [ - { - "title": "Configure storage policies", - "path": "session-recording/compliance/configure-storage-policy", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - }, - { - "title": "Update storage policies", - "path": "session-recording/compliance/update-storage-policy", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - }, - { - "title": "Validate recorded sessions", - "path": "session-recording/compliance/validate-session-recordings", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - }, - { - "title": "Validate external data store", - "path": "session-recording/compliance/validate-data-store", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - } - ] - }, - { - "title": "Work with BSR data files", - "routes": [ - { - "title": "BSR file data structure", - "path": "session-recording/data/bsr-file-structure", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - }, - { - "title": "Read a BSR file", - "path": "session-recording/data/read-bsr-file", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - } - ] - } - ] - }, - { - "title": "Configure role-based access", - "routes": [ - { - "title": "Permissions", - "path": "rbac" - }, - { - "title": "Assignable permissions", - "path": "rbac/assignable-permissions" - }, - { - "title": "Permission grant formats", - "path": "rbac/permission-grant-formats" - }, - { - "title": "Manage access with roles", - "path": "rbac/manage-roles" - }, - { - "title": "Resource tables", - "path": "rbac/resource-table" - }, - { - "title": "Manage access to resources dynamically", - "routes": [ - { - "title": "Manage principals", - "path": "rbac/users/manage-users-groups" - }, - { - "title": "Filter managed groups", - "path": "rbac/users/managed-groups" - } - ] - } - ] - }, - { - "divider": true - }, - { - "heading": "Integrations" - }, - { - "title": "Vault", - "path": "vault" - }, - { - "divider": true - }, - { - "heading": "Enterprise solutions" - }, - { - "title": "HCP Boundary", - "routes": [ - { - "title": "Overview", - "path": "hcp", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - }, - { - "title": "Get started", - "routes": [ - { - "title": "Deploy and log in", - "path": "hcp/get-started/deploy-and-login", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - }, - { - "title": "Connect to a target", - "path": "hcp/get-started/connect-to-target", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - } - ] - }, - { - "title": "Documentation", - "href": "https://cloud.hashicorp.com/docs/boundary", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - } - ] - }, - { - "title": "Boundary Enterprise", - "routes": [ - { - "title": "Overview", - "path": "enterprise", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - }, - { - "title": "Licensing", - "path": "enterprise/licensing", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - }, - { - "title": "Automated license reporting", - "path": "enterprise/automated-license-reporting", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - }, - { - "title": "Supported versions policy", - "path": "enterprise/supported-versions", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - }, - { - "title": "Deployment guide", - "href": "https://developer.hashicorp.com/boundary/tutorials/enterprise/ent-deployment-guide", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - }, - { - "title": "Reference architecture", - "href": "https://developer.hashicorp.com/boundary/tutorials/enterprise/ent-reference-architecture", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - } - ] - }, - { - "divider": true - }, - { - "heading": "Clients" - }, - { - "title": "Client Agent", - "routes": [ - { - "title": "Overview", - "path": "client-agent", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - }, - { - "title": "Configure the Client Agent", - "path": "client-agent/configuration", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - }, - { - "title": "Manage the Client Agent", - "path": "client-agent/manage", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - }, - { - "title": "Troubleshoot issues", - "path": "client-agent/troubleshoot", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - }, - { - "title": "Conflicting software", - "path": "client-agent/conflicting-software", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - } - } - ] - }, - { - "title": "Client cache", - "path": "client-cache" - }, - { - "title": "Desktop", - "href": "https://learn.hashicorp.com/tutorials/boundary/hcp-getting-started-desktop-app" - }, - { - "title": "Go SDK", - "path": "go-sdk" - }, - { - "divider": true - }, - { - "heading": "Reference documentation" - }, - { - "title": "API", - "routes": [ - { - "title": "Overview", - "path": "api" - }, - { - "title": "Rate limiting", - "path": "api/rate-limiting" - }, - { - "title": "List pagination", - "path": "api/pagination" - }, - { - "title": "API documentation", - "href": "https://developer.hashicorp.com/boundary/api-docs" - } - ] - }, - { - "title": "Commands (CLI)", - "routes": [ - { - "title": "Overview", - "path": "commands" - }, - { - "title": "accounts", - "routes": [ - { - "title": "Overview", - "path": "commands/accounts" - }, - { - "title": "change-password", - "path": "commands/accounts/change-password" - }, - { - "title": "create", - "path": "commands/accounts/create" - }, - { - "title": "delete", - "path": "commands/accounts/delete" - }, - { - "title": "list", - "path": "commands/accounts/list" - }, - { - "title": "read", - "path": "commands/accounts/read" - }, - { - "title": "set-password", - "path": "commands/accounts/set-password" - }, - { - "title": "update", - "path": "commands/accounts/update" - } - ] - }, - { - "title": "aliases", - "routes": [ - { - "title": "Overview", - "path": "commands/aliases" - }, - { - "title": "create", - "path": "commands/aliases/create" - }, - { - "title": "delete", - "path": "commands/aliases/delete" - }, - { - "title": "list", - "path": "commands/aliases/list" - }, - { - "title": "read", - "path": "commands/aliases/read" - }, - { - "title": "update", - "path": "commands/aliases/update" - } - ] - }, - { - "title": "auth-methods", - "routes": [ - { - "title": "Overview", - "path": "commands/auth-methods" - }, - { - "title": "change-state", - "path": "commands/auth-methods/change-state" - }, - { - "title": "create", - "path": "commands/auth-methods/create" - }, - { - "title": "delete", - "path": "commands/auth-methods/delete" - }, - { - "title": "list", - "path": "commands/auth-methods/list" - }, - { - "title": "read", - "path": "commands/auth-methods/read" - }, - { - "title": "update", - "path": "commands/auth-methods/update" - } - ] - }, - { - "title": "auth-tokens", - "routes": [ - { - "title": "Overview", - "path": "commands/auth-tokens" - }, - { - "title": "delete", - "path": "commands/auth-tokens/delete" - }, - { - "title": "list", - "path": "commands/auth-tokens/list" - }, - { - "title": "read", - "path": "commands/auth-tokens/read" - } - ] - }, - { - "title": "authenticate", - "routes": [ - { - "title": "Overview", - "path": "commands/authenticate" - }, - { - "title": "ldap", - "path": "commands/authenticate/ldap" - }, - { - "title": "oidc", - "path": "commands/authenticate/oidc" - }, - { - "title": "password", - "path": "commands/authenticate/password" - } - ] - }, - { - "title": "billing", - "routes": [ - { - "title": "Overview", - "path": "commands/billing" - }, - { - "title": "monthly-active-users", - "path": "commands/billing/monthly-active-users" - } - ] - }, - { - "title": "cache", - "routes": [ - { - "title": "Overview", - "path": "commands/cache" - }, - { - "title": "add-token", - "path": "commands/cache/add-token" - }, - { - "title": "start", - "path": "commands/cache/start" - }, - { - "title": "status", - "path": "commands/cache/status" - }, - { - "title": "stop", - "path": "commands/cache/stop" - } - ] - }, - { - "title": "client-agent", - "routes": [ - { - "title": "Overview", - "path": "commands/client-agent" - }, - { - "title": "pause", - "path": "commands/client-agent/pause" - }, - { - "title": "resume", - "path": "commands/client-agent/resume" - }, - { - "title": "sessions", - "path": "commands/client-agent/sessions" - }, - { - "title": "status", - "path": "commands/client-agent/status" - } - ] - }, - { - "title": "config", - "routes": [ - { - "title": "Overview", - "path": "commands/config" - }, - { - "title": "autocomplete", - "path": "commands/config/autocomplete" - }, - { - "title": "decrypt", - "path": "commands/config/decrypt" - }, - { - "title": "encrypt", - "path": "commands/config/encrypt" - }, - { - "title": "get-token", - "path": "commands/config/get-token" - } - ] - }, - { - "title": "connect", - "routes": [ - { - "title": "Overview", - "path": "commands/connect" - }, - { - "title": "cassandra", - "path": "commands/connect/cassandra" - }, - { - "title": "http", - "path": "commands/connect/http" - }, - { - "title": "kube", - "path": "commands/connect/kube" - }, - { - "title": "mysql", - "path": "commands/connect/mysql" - }, - { - "title": "mongo", - "path": "commands/connect/mongo" - }, - { - "title": "postgres", - "path": "commands/connect/postgres" - }, - { - "title": "redis", - "path": "commands/connect/redis" - }, - { - "title": "rdp", - "path": "commands/connect/rdp" - }, - { - "title": "ssh", - "path": "commands/connect/ssh" - } - ] - }, - { - "title": "credential-libraries", - "routes": [ - { - "title": "Overview", - "path": "commands/credential-libraries" - }, - { - "title": "create", - "path": "commands/credential-libraries/create" - }, - { - "title": "delete", - "path": "commands/credential-libraries/delete" - }, - { - "title": "list", - "path": "commands/credential-libraries/list" - }, - { - "title": "read", - "path": "commands/credential-libraries/read" - }, - { - "title": "update", - "path": "commands/credential-libraries/update" - } - ] - }, - { - "title": "credential-stores", - "routes": [ - { - "title": "Overview", - "path": "commands/credential-stores" - }, - { - "title": "create", - "path": "commands/credential-stores/create" - }, - { - "title": "delete", - "path": "commands/credential-stores/delete" - }, - { - "title": "list", - "path": "commands/credential-stores/list" - }, - { - "title": "read", - "path": "commands/credential-stores/read" - }, - { - "title": "update", - "path": "commands/credential-stores/update" - } - ] - }, - { - "title": "credentials", - "routes": [ - { - "title": "Overview", - "path": "commands/credentials" - }, - { - "title": "create", - "path": "commands/credentials/create" - }, - { - "title": "delete", - "path": "commands/credentials/delete" - }, - { - "title": "list", - "path": "commands/credentials/list" - }, - { - "title": "read", - "path": "commands/credentials/read" - }, - { - "title": "update", - "path": "commands/credentials/update" - } - ] - }, - { - "title": "database", - "routes": [ - { - "title": "Overview", - "path": "commands/database" - }, - { - "title": "init", - "path": "commands/database/init" - }, - { - "title": "migrate", - "path": "commands/database/migrate" - } - ] - }, - { - "title": "delete", - "path": "commands/delete" - }, - { - "title": "dev", - "path": "commands/dev" - }, - { - "title": "groups", - "routes": [ - { - "title": "Overview", - "path": "commands/groups" - }, - { - "title": "add-members", - "path": "commands/groups/add-members" - }, - { - "title": "create", - "path": "commands/groups/create" - }, - { - "title": "delete", - "path": "commands/groups/delete" - }, - { - "title": "list", - "path": "commands/groups/list" - }, - { - "title": "read", - "path": "commands/groups/read" - }, - { - "title": "remove-members", - "path": "commands/groups/remove-members" - }, - { - "title": "set-members", - "path": "commands/groups/set-members" - }, - { - "title": "update", - "path": "commands/groups/update" - } - ] - }, - { - "title": "host-catalogs", - "routes": [ - { - "title": "Overview", - "path": "commands/host-catalogs" - }, - { - "title": "create", - "path": "commands/host-catalogs/create" - }, - { - "title": "delete", - "path": "commands/host-catalogs/delete" - }, - { - "title": "list", - "path": "commands/host-catalogs/list" - }, - { - "title": "read", - "path": "commands/host-catalogs/read" - }, - { - "title": "update", - "path": "commands/host-catalogs/update" - } - ] - }, - { - "title": "host-sets", - "routes": [ - { - "title": "Overview", - "path": "commands/host-sets" - }, - { - "title": "add-hosts", - "path": "commands/host-sets/add-hosts" - }, - { - "title": "create", - "path": "commands/host-sets/create" - }, - { - "title": "delete", - "path": "commands/host-sets/delete" - }, - { - "title": "list", - "path": "commands/host-sets/list" - }, - { - "title": "read", - "path": "commands/host-sets/read" - }, - { - "title": "remove-hosts", - "path": "commands/host-sets/remove-hosts" - }, - { - "title": "set-hosts", - "path": "commands/host-sets/set-hosts" - }, - { - "title": "update", - "path": "commands/host-sets/update" - } - ] - }, - { - "title": "hosts", - "routes": [ - { - "title": "Overview", - "path": "commands/hosts" - }, - { - "title": "create", - "path": "commands/hosts/create" - }, - { - "title": "delete", - "path": "commands/hosts/delete" - }, - { - "title": "list", - "path": "commands/hosts/list" - }, - { - "title": "read", - "path": "commands/hosts/read" - }, - { - "title": "update", - "path": "commands/hosts/update" - } - ] - }, - { - "title": "logout", - "path": "commands/logout" - }, - { - "title": "managed-groups", - "routes": [ - { - "title": "Overview", - "path": "commands/managed-groups" - }, - { - "title": "create", - "path": "commands/managed-groups/create" - }, - { - "title": "delete", - "path": "commands/managed-groups/delete" - }, - { - "title": "list", - "path": "commands/managed-groups/list" - }, - { - "title": "read", - "path": "commands/managed-groups/read" - }, - { - "title": "update", - "path": "commands/managed-groups/update" - } - ] - }, - { - "title": "policies", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - }, - "routes": [ - { - "title": "Overview", - "path": "commands/policies" - }, - { - "title": "create", - "path": "commands/policies/create" - }, - { - "title": "delete", - "path": "commands/policies/delete" - }, - { - "title": "list", - "path": "commands/policies/list" - }, - { - "title": "read", - "path": "commands/policies/read" - }, - { - "title": "update", - "path": "commands/policies/update" - } - ] - }, - { - "title": "read", - "path": "commands/read" - }, - { - "title": "roles", - "routes": [ - { - "title": "Overview", - "path": "commands/roles" - }, - { - "title": "add-grant-scopes", - "path": "commands/roles/add-grant-scopes" - }, - { - "title": "add-grants", - "path": "commands/roles/add-grants" - }, - { - "title": "add-principals", - "path": "commands/roles/add-principals" - }, - { - "title": "create", - "path": "commands/roles/create" - }, - { - "title": "delete", - "path": "commands/roles/delete" - }, - { - "title": "list", - "path": "commands/roles/list" - }, - { - "title": "read", - "path": "commands/roles/read" - }, - { - "title": "remove-grant-scopes", - "path": "commands/roles/remove-grant-scopes" - }, - { - "title": "remove-grants", - "path": "commands/roles/remove-grants" - }, - { - "title": "remove-principals", - "path": "commands/roles/remove-principals" - }, - { - "title": "set-grant-scopes", - "path": "commands/roles/set-grant-scopes" - }, - { - "title": "set-grants", - "path": "commands/roles/set-grants" - }, - { - "title": "set-principals", - "path": "commands/roles/set-principals" - }, - { - "title": "update", - "path": "commands/roles/update" - } - ] - }, - { - "title": "scopes", - "routes": [ - { - "title": "Overview", - "path": "commands/scopes" - }, - { - "title": "create", - "path": "commands/scopes/create" - }, - { - "title": "delete", - "path": "commands/scopes/delete" - }, - { - "title": "destroy-key-version", - "path": "commands/scopes/destroy-key-version" - }, - { - "title": "list", - "path": "commands/scopes/list" - }, - { - "title": "list-key-version-destruction-jobs", - "path": "commands/scopes/list-key-version-destruction-jobs" - }, - { - "title": "list-keys", - "path": "commands/scopes/list-keys" - }, - { - "title": "read", - "path": "commands/scopes/read" - }, - { - "title": "rotate-keys", - "path": "commands/scopes/rotate-keys" - }, - { - "title": "update", - "path": "commands/scopes/update" - } - ] - }, - { - "title": "search", - "path": "commands/search" - }, - { - "title": "server", - "path": "commands/server" - }, - { - "title": "session-recordings", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - }, - "routes": [ - { - "title": "Overview", - "path": "commands/session-recordings" - }, - { - "title": "delete", - "path": "commands/session-recordings/delete" - }, - { - "title": "download", - "path": "commands/session-recordings/download" - }, - { - "title": "list", - "path": "commands/session-recordings/list" - }, - { - "title": "read", - "path": "commands/session-recordings/read" - }, - { - "title": "reapply-storage-policy", - "path": "commands/session-recordings/reapply-storage-policy" - } - ] - }, - { - "title": "sessions", - "routes": [ - { - "title": "Overview", - "path": "commands/sessions" - }, - { - "title": "cancel", - "path": "commands/sessions/cancel" - }, - { - "title": "list", - "path": "commands/sessions/list" - }, - { - "title": "read", - "path": "commands/sessions/read" - } - ] - }, - { - "title": "storage-buckets", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - }, - "routes": [ - { - "title": "Overview", - "path": "commands/storage-buckets" - }, - { - "title": "create", - "path": "commands/storage-buckets/create" - }, - { - "title": "delete", - "path": "commands/storage-buckets/delete" - }, - { - "title": "list", - "path": "commands/storage-buckets/list" - }, - { - "title": "read", - "path": "commands/storage-buckets/read" - }, - { - "title": "update", - "path": "commands/storage-buckets/update" - } - ] - }, - { - "title": "targets", - "routes": [ - { - "title": "Overview", - "path": "commands/targets" - }, - { - "title": "add-credential-sources", - "path": "commands/targets/add-credential-sources" - }, - { - "title": "add-host-sources", - "path": "commands/targets/add-host-sources" - }, - { - "title": "authorize-session", - "path": "commands/targets/authorize-session" - }, - { - "title": "create", - "path": "commands/targets/create" - }, - { - "title": "delete", - "path": "commands/targets/delete" - }, - { - "title": "list", - "path": "commands/targets/list" - }, - { - "title": "read", - "path": "commands/targets/read" - }, - { - "title": "remove-credential-source", - "path": "commands/targets/remove-credential-sources" - }, - { - "title": "remove-host-sources", - "path": "commands/targets/remove-host-sources" - }, - { - "title": "set-credential-sources", - "path": "commands/targets/set-credential-sources" - }, - { - "title": "set-host-sources", - "path": "commands/targets/set-host-sources" - }, - { - "title": "update", - "path": "commands/targets/update" - } - ] - }, - { - "title": "update", - "path": "commands/update" - }, - { - "title": "users", - "routes": [ - { - "title": "Overview", - "path": "commands/users" - }, - { - "title": "add-accounts", - "path": "commands/users/add-accounts" - }, - { - "title": "create", - "path": "commands/users/create" - }, - { - "title": "delete", - "path": "commands/users/delete" - }, - { - "title": "list", - "path": "commands/users/list" - }, - { - "title": "read", - "path": "commands/users/read" - }, - { - "title": "remove-accounts", - "path": "commands/users/remove-accounts" - }, - { - "title": "set-accounts", - "path": "commands/users/set-accounts" - }, - { - "title": "update", - "path": "commands/users/update" - } - ] - }, - { - "title": "workers", - "routes": [ - { - "title": "Overview", - "path": "commands/workers" - }, - { - "title": "add-worker-tags", - "path": "commands/workers/add-worker-tags" - }, - { - "title": "certificate-authority", - "path": "commands/workers/certificate-authority" - }, - { - "title": "create", - "path": "commands/workers/create" - }, - { - "title": "delete", - "path": "commands/workers/delete" - }, - { - "title": "list", - "path": "commands/workers/list" - }, - { - "title": "read", - "path": "commands/workers/read" - }, - { - "title": "remove-worker-tags", - "path": "commands/workers/remove-worker-tags" - }, - { - "title": "set-worker-tags", - "path": "commands/workers/set-worker-tags" - }, - { - "title": "update", - "path": "commands/workers/update" - } - ] - } - ] - }, - { - "title": "Domain model", - "routes": [ - { - "title": "Overview", - "path": "domain-model" - }, - { - "title": "Accounts", - "path": "domain-model/accounts" - }, - { - "title": "Aliases", - "path": "domain-model/aliases" - }, - { - "title": "Auth methods", - "path": "domain-model/auth-methods" - }, - { - "title": "Credentials", - "path": "domain-model/credentials" - }, - { - "title": "Credential libraries", - "path": "domain-model/credential-libraries" - }, - { - "title": "Credential stores", - "path": "domain-model/credential-stores" - }, - { - "title": "Groups", - "path": "domain-model/groups" - }, - { - "title": "Hosts", - "path": "domain-model/hosts" - }, - { - "title": "Host catalogs", - "path": "domain-model/host-catalogs" - }, - { - "title": "Host sets", - "path": "domain-model/host-sets" - }, - { - "title": "Managed groups", - "path": "domain-model/managed-groups" - }, - { - "title": "Roles", - "path": "domain-model/roles" - }, - { - "title": "Scopes", - "path": "domain-model/scopes" - }, - { - "title": "Sessions", - "path": "domain-model/sessions" - }, - { - "title": "Session connections", - "path": "domain-model/session-connections" - }, - { - "title": "Session recordings", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - }, - "path": "domain-model/session-recordings" - }, - { - "title": "Storage buckets", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - }, - "path": "domain-model/storage-buckets" - }, - { - "title": "Storage policies", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - }, - "path": "domain-model/storage-policy" - }, - { - "title": "Targets", - "path": "domain-model/targets" - }, - { - "title": "Users", - "path": "domain-model/users" - } - ] - }, - { - "title": "Configuration parameters", - "routes": [ - { - "title": "Top-level parameters", - "path": "configuration" - }, - { - "title": "Controllers", - "path": "configuration/controller" - }, - { - "title": "Events", - "routes": [ - { - "title": "Events", - "path": "configuration/events" - }, - { - "title": "Common sink parameters", - "path": "configuration/events/common-sink-parameters" - }, - { - "title": "File sink", - "path": "configuration/events/file-sink" - }, - { - "title": "Stderr sink", - "path": "configuration/events/stderr-sink" - } - ] - }, - { - "title": "KMS", - "routes": [ - { - "title": "Overview", - "path": "configuration/kms" - }, - { - "title": "AEAD", - "path": "configuration/kms/aead" - }, - { - "title": "AliCloud KMS", - "path": "configuration/kms/alicloudkms" - }, - { - "title": "AWS KMS", - "path": "configuration/kms/awskms" - }, - { - "title": "Azure Key Vault", - "path": "configuration/kms/azurekeyvault" - }, - { - "title": "GCP Cloud KMS", - "path": "configuration/kms/gcpckms" - }, - { - "title": "OCI KMS", - "path": "configuration/kms/ocikms" - }, - { - "title": "Vault transit", - "path": "configuration/kms/transit" - } - ] - }, - { - "title": "Listeners", - "routes": [ - { - "title": "Overview", - "path": "configuration/listeners" - }, - { - "title": "TCP", - "path": "configuration/listeners/tcp-listeners" - }, - { - "title": "Unix", - "path": "configuration/listeners/unix-listeners" - } - ] - }, - { - "title": "Plugins", - "path": "configuration/plugins" - }, - { - "title": "Workers", - "path": "configuration/workers" - } - ] - }, - { - "title": "Filtering and listing resources", - "path": "filtering" - }, - { - "title": "Common error messages", - "path": "errors" - }, - { - "title": "Transparent sessions interoperability matrix", - "badge": { - "text": "HCP/ENT", - "type": "outlined", - "color": "neutral" - }, - "path": "interoperability-matrix" - }, - { - "title": "Common workflows", - "hidden": true, - "routes": [ - { - "title": "Overview", - "path": "common-workflows" - }, - { - "title": "Manage scopes", - "path": "common-workflows/manage-scopes" - }, - { - "title": "Manage sessions", - "path": "common-workflows/manage-sessions" - }, - { - "title": "Manage targets", - "path": "common-workflows/manage-targets" - } - ] - }, - { - "title": "API and clients", - "hidden": true, - "routes": [ - { - "title": "Overview", - "hidden": true, - "path": "api-clients" - }, - { - "title": "Desktop", - "hidden": true, - "path": "api-clients/desktop" - } - ] - }, - { - "title": "Develop Boundary", - "hidden": true, - "routes": [ - { - "title": "Overview", - "path": "developing" - }, - { - "title": "Build Boundary", - "path": "developing/building" - }, - { - "title": "Develop the UI", - "path": "developing/ui" - } - ] - }, - { - "title": "Boundary Community Edition", - "hidden": true, - "routes": [ - { - "title": "Overview", - "path": "community" - } - ] - } -] diff --git a/website/package-lock.json b/website/package-lock.json deleted file mode 100644 index 8c70c4e65..000000000 --- a/website/package-lock.json +++ /dev/null @@ -1,13833 +0,0 @@ -{ - "name": "boundary-docs", - "version": "1.0.0", - "lockfileVersion": 3, - "requires": true, - "packages": { - "": { - "name": "boundary-docs", - "version": "1.0.0", - "devDependencies": { - "@hashicorp/platform-cli": "^2.6.0", - "@hashicorp/platform-content-conformance": "^0.0.10", - "husky": "4.3.8", - "next": "^14.1.0", - "prettier": "2.2.1" - }, - "engines": { - "node": ">=22.17.1", - "npm": ">=9.6.7" - } - }, - "node_modules/@aashutoshrathi/word-wrap": { - "version": "1.2.6", - "resolved": "https://registry.npmjs.org/@aashutoshrathi/word-wrap/-/word-wrap-1.2.6.tgz", - "integrity": "sha512-1Yjs2SvM8TflER/OD3cOjhWWOZb58A2t7wpE2S9XfBYTiIl+XFhQG2bjy4Pu1I+EAlCNUzRDYDdFwFYUKvXcIA==", - "dev": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/@ampproject/remapping": { - "version": "2.2.1", - "resolved": "https://registry.npmjs.org/@ampproject/remapping/-/remapping-2.2.1.tgz", - "integrity": "sha512-lFMjJTrFL3j7L9yBxwYfCq2k6qqwHyzuUl/XBnif78PWTJYyL/dfowQHWE3sp6U6ZzqWiiIZnpTMO96zhkjwtg==", - "dev": true, - "dependencies": { - "@jridgewell/gen-mapping": "^0.3.0", - "@jridgewell/trace-mapping": "^0.3.9" - }, - "engines": { - "node": ">=6.0.0" - } - }, - "node_modules/@babel/code-frame": { - "version": "7.22.13", - "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.22.13.tgz", - "integrity": "sha512-XktuhWlJ5g+3TJXc5upd9Ks1HutSArik6jf2eAjYFyIOf4ej3RN+184cZbzDvbPnuTJIUhPKKJE3cIsYTiAT3w==", - "dev": true, - "dependencies": { - "@babel/highlight": "^7.22.13", - "chalk": "^2.4.2" - }, - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/@babel/code-frame/node_modules/ansi-styles": { - "version": "3.2.1", - "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz", - "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==", - "dev": true, - "dependencies": { - "color-convert": "^1.9.0" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/@babel/code-frame/node_modules/chalk": { - "version": "2.4.2", - "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz", - "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==", - "dev": true, - "dependencies": { - "ansi-styles": "^3.2.1", - "escape-string-regexp": "^1.0.5", - "supports-color": "^5.3.0" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/@babel/code-frame/node_modules/color-convert": { - "version": "1.9.3", - "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz", - "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==", - "dev": true, - "dependencies": { - "color-name": "1.1.3" - } - }, - "node_modules/@babel/code-frame/node_modules/color-name": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz", - "integrity": "sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==", - "dev": true - }, - "node_modules/@babel/code-frame/node_modules/escape-string-regexp": { - "version": "1.0.5", - "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz", - "integrity": "sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==", - "dev": true, - "engines": { - "node": ">=0.8.0" - } - }, - "node_modules/@babel/code-frame/node_modules/has-flag": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz", - "integrity": "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==", - "dev": true, - "engines": { - "node": ">=4" - } - }, - "node_modules/@babel/code-frame/node_modules/supports-color": { - "version": "5.5.0", - "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz", - "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==", - "dev": true, - "dependencies": { - "has-flag": "^3.0.0" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/@babel/compat-data": { - "version": "7.23.2", - "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.23.2.tgz", - "integrity": "sha512-0S9TQMmDHlqAZ2ITT95irXKfxN9bncq8ZCoJhun3nHL/lLUxd2NKBJYoNGWH7S0hz6fRQwWlAWn/ILM0C70KZQ==", - "dev": true, - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/@babel/core": { - "version": "7.23.2", - "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.23.2.tgz", - "integrity": "sha512-n7s51eWdaWZ3vGT2tD4T7J6eJs3QoBXydv7vkUM06Bf1cbVD2Kc2UrkzhiQwobfV7NwOnQXYL7UBJ5VPU+RGoQ==", - "dev": true, - "dependencies": { - "@ampproject/remapping": "^2.2.0", - "@babel/code-frame": "^7.22.13", - "@babel/generator": "^7.23.0", - "@babel/helper-compilation-targets": "^7.22.15", - "@babel/helper-module-transforms": "^7.23.0", - "@babel/helpers": "^7.23.2", - "@babel/parser": "^7.23.0", - "@babel/template": "^7.22.15", - "@babel/traverse": "^7.23.2", - "@babel/types": "^7.23.0", - "convert-source-map": "^2.0.0", - "debug": "^4.1.0", - "gensync": "^1.0.0-beta.2", - "json5": "^2.2.3", - "semver": "^6.3.1" - }, - "engines": { - "node": ">=6.9.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/babel" - } - }, - "node_modules/@babel/core/node_modules/convert-source-map": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz", - "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==", - "dev": true - }, - "node_modules/@babel/core/node_modules/semver": { - "version": "6.3.1", - "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz", - "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==", - "dev": true, - "bin": { - "semver": "bin/semver.js" - } - }, - "node_modules/@babel/generator": { - "version": "7.23.0", - "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.23.0.tgz", - "integrity": "sha512-lN85QRR+5IbYrMWM6Y4pE/noaQtg4pNiqeNGX60eqOfo6gtEj6uw/JagelB8vVztSd7R6M5n1+PQkDbHbBRU4g==", - "dev": true, - "dependencies": { - "@babel/types": "^7.23.0", - "@jridgewell/gen-mapping": "^0.3.2", - "@jridgewell/trace-mapping": "^0.3.17", - "jsesc": "^2.5.1" - }, - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/@babel/helper-compilation-targets": { - "version": "7.22.15", - "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.22.15.tgz", - "integrity": "sha512-y6EEzULok0Qvz8yyLkCvVX+02ic+By2UdOhylwUOvOn9dvYc9mKICJuuU1n1XBI02YWsNsnrY1kc6DVbjcXbtw==", - "dev": true, - "dependencies": { - "@babel/compat-data": "^7.22.9", - "@babel/helper-validator-option": "^7.22.15", - "browserslist": "^4.21.9", - "lru-cache": "^5.1.1", - "semver": "^6.3.1" - }, - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/@babel/helper-compilation-targets/node_modules/semver": { - "version": "6.3.1", - "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz", - "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==", - "dev": true, - "bin": { - "semver": "bin/semver.js" - } - }, - "node_modules/@babel/helper-environment-visitor": { - "version": "7.22.20", - "resolved": "https://registry.npmjs.org/@babel/helper-environment-visitor/-/helper-environment-visitor-7.22.20.tgz", - "integrity": "sha512-zfedSIzFhat/gFhWfHtgWvlec0nqB9YEIVrpuwjruLlXfUSnA8cJB0miHKwqDnQ7d32aKo2xt88/xZptwxbfhA==", - "dev": true, - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/@babel/helper-function-name": { - "version": "7.23.0", - "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.23.0.tgz", - "integrity": "sha512-OErEqsrxjZTJciZ4Oo+eoZqeW9UIiOcuYKRJA4ZAgV9myA+pOXhhmpfNCKjEH/auVfEYVFJ6y1Tc4r0eIApqiw==", - "dev": true, - "dependencies": { - "@babel/template": "^7.22.15", - "@babel/types": "^7.23.0" - }, - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/@babel/helper-hoist-variables": { - "version": "7.22.5", - "resolved": "https://registry.npmjs.org/@babel/helper-hoist-variables/-/helper-hoist-variables-7.22.5.tgz", - "integrity": "sha512-wGjk9QZVzvknA6yKIUURb8zY3grXCcOZt+/7Wcy8O2uctxhplmUPkOdlgoNhmdVee2c92JXbf1xpMtVNbfoxRw==", - "dev": true, - "dependencies": { - "@babel/types": "^7.22.5" - }, - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/@babel/helper-module-imports": { - "version": "7.22.15", - "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.22.15.tgz", - "integrity": "sha512-0pYVBnDKZO2fnSPCrgM/6WMc7eS20Fbok+0r88fp+YtWVLZrp4CkafFGIp+W0VKw4a22sgebPT99y+FDNMdP4w==", - "dev": true, - "dependencies": { - "@babel/types": "^7.22.15" - }, - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/@babel/helper-module-transforms": { - "version": "7.23.0", - "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.23.0.tgz", - "integrity": "sha512-WhDWw1tdrlT0gMgUJSlX0IQvoO1eN279zrAUbVB+KpV2c3Tylz8+GnKOLllCS6Z/iZQEyVYxhZVUdPTqs2YYPw==", - "dev": true, - "dependencies": { - "@babel/helper-environment-visitor": "^7.22.20", - "@babel/helper-module-imports": "^7.22.15", - "@babel/helper-simple-access": "^7.22.5", - "@babel/helper-split-export-declaration": "^7.22.6", - "@babel/helper-validator-identifier": "^7.22.20" - }, - "engines": { - "node": ">=6.9.0" - }, - "peerDependencies": { - "@babel/core": "^7.0.0" - } - }, - "node_modules/@babel/helper-plugin-utils": { - "version": "7.22.5", - "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.22.5.tgz", - "integrity": "sha512-uLls06UVKgFG9QD4OeFYLEGteMIAa5kpTPcFL28yuCIIzsf6ZyKZMllKVOCZFhiZ5ptnwX4mtKdWCBE/uT4amg==", - "dev": true, - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/@babel/helper-simple-access": { - "version": "7.22.5", - "resolved": "https://registry.npmjs.org/@babel/helper-simple-access/-/helper-simple-access-7.22.5.tgz", - "integrity": "sha512-n0H99E/K+Bika3++WNL17POvo4rKWZ7lZEp1Q+fStVbUi8nxPQEBOlTmCOxW/0JsS56SKKQ+ojAe2pHKJHN35w==", - "dev": true, - "dependencies": { - "@babel/types": "^7.22.5" - }, - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/@babel/helper-split-export-declaration": { - "version": "7.22.6", - "resolved": "https://registry.npmjs.org/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.22.6.tgz", - "integrity": "sha512-AsUnxuLhRYsisFiaJwvp1QF+I3KjD5FOxut14q/GzovUe6orHLesW2C7d754kRm53h5gqrz6sFl6sxc4BVtE/g==", - "dev": true, - "dependencies": { - "@babel/types": "^7.22.5" - }, - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/@babel/helper-string-parser": { - "version": "7.22.5", - "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.22.5.tgz", - "integrity": "sha512-mM4COjgZox8U+JcXQwPijIZLElkgEpO5rsERVDJTc2qfCDfERyob6k5WegS14SX18IIjv+XD+GrqNumY5JRCDw==", - "dev": true, - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/@babel/helper-validator-identifier": { - "version": "7.22.20", - "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.22.20.tgz", - "integrity": "sha512-Y4OZ+ytlatR8AI+8KZfKuL5urKp7qey08ha31L8b3BwewJAoJamTzyvxPR/5D+KkdJCGPq/+8TukHBlY10FX9A==", - "dev": true, - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/@babel/helper-validator-option": { - "version": "7.22.15", - "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.22.15.tgz", - "integrity": "sha512-bMn7RmyFjY/mdECUbgn9eoSY4vqvacUnS9i9vGAGttgFWesO6B4CYWA7XlpbWgBt71iv/hfbPlynohStqnu5hA==", - "dev": true, - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/@babel/helpers": { - "version": "7.23.2", - "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.23.2.tgz", - "integrity": "sha512-lzchcp8SjTSVe/fPmLwtWVBFC7+Tbn8LGHDVfDp9JGxpAY5opSaEFgt8UQvrnECWOTdji2mOWMz1rOhkHscmGQ==", - "dev": true, - "dependencies": { - "@babel/template": "^7.22.15", - "@babel/traverse": "^7.23.2", - "@babel/types": "^7.23.0" - }, - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/@babel/highlight": { - "version": "7.22.20", - "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.22.20.tgz", - "integrity": "sha512-dkdMCN3py0+ksCgYmGG8jKeGA/8Tk+gJwSYYlFGxG5lmhfKNoAy004YpLxpS1W2J8m/EK2Ew+yOs9pVRwO89mg==", - "dev": true, - "dependencies": { - "@babel/helper-validator-identifier": "^7.22.20", - "chalk": "^2.4.2", - "js-tokens": "^4.0.0" - }, - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/@babel/highlight/node_modules/ansi-styles": { - "version": "3.2.1", - "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz", - "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==", - "dev": true, - "dependencies": { - "color-convert": "^1.9.0" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/@babel/highlight/node_modules/chalk": { - "version": "2.4.2", - "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz", - "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==", - "dev": true, - "dependencies": { - "ansi-styles": "^3.2.1", - "escape-string-regexp": "^1.0.5", - "supports-color": "^5.3.0" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/@babel/highlight/node_modules/color-convert": { - "version": "1.9.3", - "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz", - "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==", - "dev": true, - "dependencies": { - "color-name": "1.1.3" - } - }, - "node_modules/@babel/highlight/node_modules/color-name": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz", - "integrity": "sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==", - "dev": true - }, - "node_modules/@babel/highlight/node_modules/escape-string-regexp": { - "version": "1.0.5", - "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz", - "integrity": "sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==", - "dev": true, - "engines": { - "node": ">=0.8.0" - } - }, - "node_modules/@babel/highlight/node_modules/has-flag": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz", - "integrity": "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==", - "dev": true, - "engines": { - "node": ">=4" - } - }, - "node_modules/@babel/highlight/node_modules/supports-color": { - "version": "5.5.0", - "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz", - "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==", - "dev": true, - "dependencies": { - "has-flag": "^3.0.0" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/@babel/parser": { - "version": "7.23.0", - "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.23.0.tgz", - "integrity": "sha512-vvPKKdMemU85V9WE/l5wZEmImpCtLqbnTvqDS2U1fJ96KrxoW7KrXhNsNCblQlg8Ck4b85yxdTyelsMUgFUXiw==", - "dev": true, - "bin": { - "parser": "bin/babel-parser.js" - }, - "engines": { - "node": ">=6.0.0" - } - }, - "node_modules/@babel/plugin-proposal-object-rest-spread": { - "version": "7.12.1", - "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-object-rest-spread/-/plugin-proposal-object-rest-spread-7.12.1.tgz", - "integrity": "sha512-s6SowJIjzlhx8o7lsFx5zmY4At6CTtDvgNQDdPzkBQucle58A6b/TTeEBYtyDgmcXjUTM+vE8YOGHZzzbc/ioA==", - "deprecated": "This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-object-rest-spread instead.", - "dev": true, - "dependencies": { - "@babel/helper-plugin-utils": "^7.10.4", - "@babel/plugin-syntax-object-rest-spread": "^7.8.0", - "@babel/plugin-transform-parameters": "^7.12.1" - }, - "peerDependencies": { - "@babel/core": "^7.0.0-0" - } - }, - "node_modules/@babel/plugin-syntax-async-generators": { - "version": "7.8.4", - "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-async-generators/-/plugin-syntax-async-generators-7.8.4.tgz", - "integrity": "sha512-tycmZxkGfZaxhMRbXlPXuVFpdWlXpir2W4AMhSJgRKzk/eDlIXOhb2LHWoLpDF7TEHylV5zNhykX6KAgHJmTNw==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/helper-plugin-utils": "^7.8.0" - }, - "peerDependencies": { - "@babel/core": "^7.0.0-0" - } - }, - "node_modules/@babel/plugin-syntax-bigint": { - "version": "7.8.3", - "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-bigint/-/plugin-syntax-bigint-7.8.3.tgz", - "integrity": "sha512-wnTnFlG+YxQm3vDxpGE57Pj0srRU4sHE/mDkt1qv2YJJSeUAec2ma4WLUnUPeKjyrfntVwe/N6dCXpU+zL3Npg==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/helper-plugin-utils": "^7.8.0" - }, - "peerDependencies": { - "@babel/core": "^7.0.0-0" - } - }, - "node_modules/@babel/plugin-syntax-class-properties": { - "version": "7.12.13", - "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-class-properties/-/plugin-syntax-class-properties-7.12.13.tgz", - "integrity": "sha512-fm4idjKla0YahUNgFNLCB0qySdsoPiZP3iQE3rky0mBUtMZ23yDJ9SJdg6dXTSDnulOVqiF3Hgr9nbXvXTQZYA==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/helper-plugin-utils": "^7.12.13" - }, - "peerDependencies": { - "@babel/core": "^7.0.0-0" - } - }, - "node_modules/@babel/plugin-syntax-import-meta": { - "version": "7.10.4", - "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-meta/-/plugin-syntax-import-meta-7.10.4.tgz", - "integrity": "sha512-Yqfm+XDx0+Prh3VSeEQCPU81yC+JWZ2pDPFSS4ZdpfZhp4MkFMaDC1UqseovEKwSUpnIL7+vK+Clp7bfh0iD7g==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/helper-plugin-utils": "^7.10.4" - }, - "peerDependencies": { - "@babel/core": "^7.0.0-0" - } - }, - "node_modules/@babel/plugin-syntax-json-strings": { - "version": "7.8.3", - "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-json-strings/-/plugin-syntax-json-strings-7.8.3.tgz", - "integrity": "sha512-lY6kdGpWHvjoe2vk4WrAapEuBR69EMxZl+RoGRhrFGNYVK8mOPAW8VfbT/ZgrFbXlDNiiaxQnAtgVCZ6jv30EA==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/helper-plugin-utils": "^7.8.0" - }, - "peerDependencies": { - "@babel/core": "^7.0.0-0" - } - }, - "node_modules/@babel/plugin-syntax-jsx": { - "version": "7.12.1", - "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-jsx/-/plugin-syntax-jsx-7.12.1.tgz", - "integrity": "sha512-1yRi7yAtB0ETgxdY9ti/p2TivUxJkTdhu/ZbF9MshVGqOx1TdB3b7xCXs49Fupgg50N45KcAsRP/ZqWjs9SRjg==", - "dev": true, - "dependencies": { - "@babel/helper-plugin-utils": "^7.10.4" - }, - "peerDependencies": { - "@babel/core": "^7.0.0-0" - } - }, - "node_modules/@babel/plugin-syntax-logical-assignment-operators": { - "version": "7.10.4", - "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-logical-assignment-operators/-/plugin-syntax-logical-assignment-operators-7.10.4.tgz", - "integrity": "sha512-d8waShlpFDinQ5MtvGU9xDAOzKH47+FFoney2baFIoMr952hKOLp1HR7VszoZvOsV/4+RRszNY7D17ba0te0ig==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/helper-plugin-utils": "^7.10.4" - }, - "peerDependencies": { - "@babel/core": "^7.0.0-0" - } - }, - "node_modules/@babel/plugin-syntax-nullish-coalescing-operator": { - "version": "7.8.3", - "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-nullish-coalescing-operator/-/plugin-syntax-nullish-coalescing-operator-7.8.3.tgz", - "integrity": "sha512-aSff4zPII1u2QD7y+F8oDsz19ew4IGEJg9SVW+bqwpwtfFleiQDMdzA/R+UlWDzfnHFCxxleFT0PMIrR36XLNQ==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/helper-plugin-utils": "^7.8.0" - }, - "peerDependencies": { - "@babel/core": "^7.0.0-0" - } - }, - "node_modules/@babel/plugin-syntax-numeric-separator": { - "version": "7.10.4", - "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-numeric-separator/-/plugin-syntax-numeric-separator-7.10.4.tgz", - "integrity": "sha512-9H6YdfkcK/uOnY/K7/aA2xpzaAgkQn37yzWUMRK7OaPOqOpGS1+n0H5hxT9AUw9EsSjPW8SVyMJwYRtWs3X3ug==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/helper-plugin-utils": "^7.10.4" - }, - "peerDependencies": { - "@babel/core": "^7.0.0-0" - } - }, - "node_modules/@babel/plugin-syntax-object-rest-spread": { - "version": "7.8.3", - "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-object-rest-spread/-/plugin-syntax-object-rest-spread-7.8.3.tgz", - "integrity": "sha512-XoqMijGZb9y3y2XskN+P1wUGiVwWZ5JmoDRwx5+3GmEplNyVM2s2Dg8ILFQm8rWM48orGy5YpI5Bl8U1y7ydlA==", - "dev": true, - "dependencies": { - "@babel/helper-plugin-utils": "^7.8.0" - }, - "peerDependencies": { - "@babel/core": "^7.0.0-0" - } - }, - "node_modules/@babel/plugin-syntax-optional-catch-binding": { - "version": "7.8.3", - "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-catch-binding/-/plugin-syntax-optional-catch-binding-7.8.3.tgz", - "integrity": "sha512-6VPD0Pc1lpTqw0aKoeRTMiB+kWhAoT24PA+ksWSBrFtl5SIRVpZlwN3NNPQjehA2E/91FV3RjLWoVTglWcSV3Q==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/helper-plugin-utils": "^7.8.0" - }, - "peerDependencies": { - "@babel/core": "^7.0.0-0" - } - }, - "node_modules/@babel/plugin-syntax-optional-chaining": { - "version": "7.8.3", - "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-chaining/-/plugin-syntax-optional-chaining-7.8.3.tgz", - "integrity": "sha512-KoK9ErH1MBlCPxV0VANkXW2/dw4vlbGDrFgz8bmUsBGYkFRcbRwMh6cIJubdPrkxRwuGdtCk0v/wPTKbQgBjkg==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/helper-plugin-utils": "^7.8.0" - }, - "peerDependencies": { - "@babel/core": "^7.0.0-0" - } - }, - "node_modules/@babel/plugin-syntax-top-level-await": { - "version": "7.14.5", - "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-top-level-await/-/plugin-syntax-top-level-await-7.14.5.tgz", - "integrity": "sha512-hx++upLv5U1rgYfwe1xBQUhRmU41NEvpUvrp8jkrSCdvGSnM5/qdRMtylJ6PG5OFkBaHkbTAKTnd3/YyESRHFw==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/helper-plugin-utils": "^7.14.5" - }, - "engines": { - "node": ">=6.9.0" - }, - "peerDependencies": { - "@babel/core": "^7.0.0-0" - } - }, - "node_modules/@babel/plugin-transform-parameters": { - "version": "7.22.15", - "resolved": "https://registry.npmjs.org/@babel/plugin-transform-parameters/-/plugin-transform-parameters-7.22.15.tgz", - "integrity": "sha512-hjk7qKIqhyzhhUvRT683TYQOFa/4cQKwQy7ALvTpODswN40MljzNDa0YldevS6tGbxwaEKVn502JmY0dP7qEtQ==", - "dev": true, - "dependencies": { - "@babel/helper-plugin-utils": "^7.22.5" - }, - "engines": { - "node": ">=6.9.0" - }, - "peerDependencies": { - "@babel/core": "^7.0.0-0" - } - }, - "node_modules/@babel/runtime": { - "version": "7.23.2", - "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.23.2.tgz", - "integrity": "sha512-mM8eg4yl5D6i3lu2QKPuPH4FArvJ8KhTofbE7jwMUv9KX5mBvwPAqnV3MlyBNqdp9RyRKP6Yck8TrfYrPvX3bg==", - "dev": true, - "dependencies": { - "regenerator-runtime": "^0.14.0" - }, - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/@babel/template": { - "version": "7.22.15", - "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.22.15.tgz", - "integrity": "sha512-QPErUVm4uyJa60rkI73qneDacvdvzxshT3kksGqlGWYdOTIUOwJ7RDUL8sGqslY1uXWSL6xMFKEXDS3ox2uF0w==", - "dev": true, - "dependencies": { - "@babel/code-frame": "^7.22.13", - "@babel/parser": "^7.22.15", - "@babel/types": "^7.22.15" - }, - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/@babel/traverse": { - "version": "7.23.2", - "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.23.2.tgz", - "integrity": "sha512-azpe59SQ48qG6nu2CzcMLbxUudtN+dOM9kDbUqGq3HXUJRlo7i8fvPoxQUzYgLZ4cMVmuZgm8vvBpNeRhd6XSw==", - "dev": true, - "dependencies": { - "@babel/code-frame": "^7.22.13", - "@babel/generator": "^7.23.0", - "@babel/helper-environment-visitor": "^7.22.20", - "@babel/helper-function-name": "^7.23.0", - "@babel/helper-hoist-variables": "^7.22.5", - "@babel/helper-split-export-declaration": "^7.22.6", - "@babel/parser": "^7.23.0", - "@babel/types": "^7.23.0", - "debug": "^4.1.0", - "globals": "^11.1.0" - }, - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/@babel/traverse/node_modules/globals": { - "version": "11.12.0", - "resolved": "https://registry.npmjs.org/globals/-/globals-11.12.0.tgz", - "integrity": "sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==", - "dev": true, - "engines": { - "node": ">=4" - } - }, - "node_modules/@babel/types": { - "version": "7.23.0", - "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.23.0.tgz", - "integrity": "sha512-0oIyUfKoI3mSqMvsxBdclDwxXKXAUA8v/apZbc+iSyARYou1o8ZGDxbUYyLFoW2arqS2jDGqJuZvv1d/io1axg==", - "dev": true, - "dependencies": { - "@babel/helper-string-parser": "^7.22.5", - "@babel/helper-validator-identifier": "^7.22.20", - "to-fast-properties": "^2.0.0" - }, - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/@bcoe/v8-coverage": { - "version": "0.2.3", - "resolved": "https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-0.2.3.tgz", - "integrity": "sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==", - "dev": true, - "peer": true - }, - "node_modules/@cnakazawa/watch": { - "version": "1.0.4", - "resolved": "https://registry.npmjs.org/@cnakazawa/watch/-/watch-1.0.4.tgz", - "integrity": "sha512-v9kIhKwjeZThiWrLmj0y17CWoyddASLj9O2yvbZkbvw/N3rWOYy9zkV66ursAoVr0mV15bL8g0c4QZUE6cdDoQ==", - "dev": true, - "peer": true, - "dependencies": { - "exec-sh": "^0.3.2", - "minimist": "^1.2.0" - }, - "bin": { - "watch": "cli.js" - }, - "engines": { - "node": ">=0.1.95" - } - }, - "node_modules/@eslint-community/eslint-utils": { - "version": "4.4.0", - "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.4.0.tgz", - "integrity": "sha512-1/sA4dwrzBAyeUoQ6oxahHKmrZvsnLCg4RfxW3ZFGGmQkSNQPFNLV9CUEFQP1x9EYXHTo5p6xdhZM1Ne9p/AfA==", - "dev": true, - "dependencies": { - "eslint-visitor-keys": "^3.3.0" - }, - "engines": { - "node": "^12.22.0 || ^14.17.0 || >=16.0.0" - }, - "peerDependencies": { - "eslint": "^6.0.0 || ^7.0.0 || >=8.0.0" - } - }, - "node_modules/@eslint-community/regexpp": { - "version": "4.10.0", - "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.10.0.tgz", - "integrity": "sha512-Cu96Sd2By9mCNTx2iyKOmq10v22jUVQv0lQnlGNy16oE9589yE+QADPbrMGCkA51cKZSg3Pu/aTJVTGfL/qjUA==", - "dev": true, - "engines": { - "node": "^12.0.0 || ^14.0.0 || >=16.0.0" - } - }, - "node_modules/@eslint/eslintrc": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-2.1.2.tgz", - "integrity": "sha512-+wvgpDsrB1YqAMdEUCcnTlpfVBH7Vqn6A/NT3D8WVXFIaKMlErPIZT3oCIAVCOtarRpMtelZLqJeU3t7WY6X6g==", - "dev": true, - "dependencies": { - "ajv": "^6.12.4", - "debug": "^4.3.2", - "espree": "^9.6.0", - "globals": "^13.19.0", - "ignore": "^5.2.0", - "import-fresh": "^3.2.1", - "js-yaml": "^4.1.0", - "minimatch": "^3.1.2", - "strip-json-comments": "^3.1.1" - }, - "engines": { - "node": "^12.22.0 || ^14.17.0 || >=16.0.0" - }, - "funding": { - "url": "https://opencollective.com/eslint" - } - }, - "node_modules/@eslint/js": { - "version": "8.52.0", - "resolved": "https://registry.npmjs.org/@eslint/js/-/js-8.52.0.tgz", - "integrity": "sha512-mjZVbpaeMZludF2fsWLD0Z9gCref1Tk4i9+wddjRvpUNqqcndPkBD09N/Mapey0b3jaXbLm2kICwFv2E64QinA==", - "dev": true, - "engines": { - "node": "^12.22.0 || ^14.17.0 || >=16.0.0" - } - }, - "node_modules/@graphql-typed-document-node/core": { - "version": "3.2.0", - "resolved": "https://registry.npmjs.org/@graphql-typed-document-node/core/-/core-3.2.0.tgz", - "integrity": "sha512-mB9oAsNCm9aM3/SOv4YtBMqZbYj10R7dkq8byBqxGY/ncFwhf2oQzMV+LCRlWoDSEBJ3COiR1yeDvMtsoOsuFQ==", - "dev": true, - "peerDependencies": { - "graphql": "^0.8.0 || ^0.9.0 || ^0.10.0 || ^0.11.0 || ^0.12.0 || ^0.13.0 || ^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" - } - }, - "node_modules/@hashicorp/platform-cli": { - "version": "2.7.2", - "resolved": "https://registry.npmjs.org/@hashicorp/platform-cli/-/platform-cli-2.7.2.tgz", - "integrity": "sha512-G9hLBvciCOFoyc7fbq1K8n2ZCklp2gD1w6a13zFEasZWrA6eX+7+4oms52H/AHRUpwUn1rCMDPjYaADpUXKEIg==", - "dev": true, - "dependencies": { - "@hashicorp/platform-cms": "0.4.0", - "@typescript-eslint/eslint-plugin": "^5.48.0", - "@typescript-eslint/parser": "^5.48.0", - "chalk": "4.1.0", - "commander": "7.2.0", - "ejs": "3.1.5", - "eslint": "^8.31.0", - "eslint-config-next": "^13.1.1", - "eslint-config-prettier": "^8.6.0", - "eslint-plugin-jsx-a11y": "^6.6.1", - "eslint-plugin-prettier": "^4.2.1", - "fs-extra": "9.0.1", - "globby": "11.0.1", - "inquirer": "7.3.3", - "lint-staged": "11.1.2", - "open": "7.3.0", - "prettier": "^2.8.7", - "readdirp": "3.5.0", - "signale": "1.4.0", - "slugify": "1.4.6", - "stylelint": "13.8.0", - "stylelint-config-css-modules": "2.2.0", - "stylelint-config-prettier": "8.0.2", - "stylelint-config-standard": "20.0.0", - "stylelint-media-use-custom-media": "2.0.0", - "stylelint-order": "4.1.0", - "stylelint-use-nesting": "3.0.0", - "stylelint-value-no-unknown-custom-properties": "3.0.0", - "ts-jest": "^26.4.4" - }, - "bin": { - "next-hashicorp": "next-hashicorp" - } - }, - "node_modules/@hashicorp/platform-cli/node_modules/prettier": { - "version": "2.8.8", - "resolved": "https://registry.npmjs.org/prettier/-/prettier-2.8.8.tgz", - "integrity": "sha512-tdN8qQGvNjw4CHbY+XXk0JgCXn9QiF21a55rBe5LJAU+kDyC4WQn4+awm2Xfk2lQMk5fKup9XgzTZtGkjBdP9Q==", - "dev": true, - "bin": { - "prettier": "bin-prettier.js" - }, - "engines": { - "node": ">=10.13.0" - }, - "funding": { - "url": "https://github.com/prettier/prettier?sponsor=1" - } - }, - "node_modules/@hashicorp/platform-cms": { - "version": "0.4.0", - "resolved": "https://registry.npmjs.org/@hashicorp/platform-cms/-/platform-cms-0.4.0.tgz", - "integrity": "sha512-Q8fixx7JnzzDvuMEC1+UK8xO4bqMh/QxNX7lPusfMixVhnnyJaTF7xRhDRFWMG1bhUwI9TJxQYElWC2aDj7CmA==", - "dev": true, - "dependencies": { - "rivet-graphql": "^0.6.0-canary-20230309231927" - } - }, - "node_modules/@hashicorp/platform-content-conformance": { - "version": "0.0.10", - "resolved": "https://registry.npmjs.org/@hashicorp/platform-content-conformance/-/platform-content-conformance-0.0.10.tgz", - "integrity": "sha512-vXLbd2w9phS4JfFyh17jCiyu+LXVonTfb7WEUK2eMlOL/wxe2umyJvEQaJNzD5bwyYC8LuXGA5JkbnPXnU5ZQg==", - "dev": true, - "dependencies": { - "find-up": "^6.3.0", - "flat": "^5.0.2", - "globby": "^13.1.2", - "mdast-util-to-string": "^3.1.0", - "remark": "12.0.1", - "remark-mdx": "^1.6.22", - "unified-lint-rule": "^2.1.1", - "unist-util-stringify-position": "^3.0.2", - "unist-util-visit": "^4.1.1", - "vfile": "^5.3.6", - "vfile-matter": "^4.0.0", - "vfile-reporter": "^7.0.4", - "vfile-reporter-json": "^3.2.0", - "vfile-statistics": "^2.0.0", - "yaml": "^2.1.3", - "yargs": "^17.4.1", - "zod": "^3.19.1" - }, - "bin": { - "hc-content": "dist/cli.js" - } - }, - "node_modules/@hashicorp/platform-content-conformance/node_modules/globby": { - "version": "13.2.2", - "resolved": "https://registry.npmjs.org/globby/-/globby-13.2.2.tgz", - "integrity": "sha512-Y1zNGV+pzQdh7H39l9zgB4PJqjRNqydvdYCDG4HFXM4XuvSaQQlEc91IU1yALL8gUTDomgBAfz3XJdmUS+oo0w==", - "dev": true, - "dependencies": { - "dir-glob": "^3.0.1", - "fast-glob": "^3.3.0", - "ignore": "^5.2.4", - "merge2": "^1.4.1", - "slash": "^4.0.0" - }, - "engines": { - "node": "^12.20.0 || ^14.13.1 || >=16.0.0" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/@hashicorp/platform-content-conformance/node_modules/slash": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/slash/-/slash-4.0.0.tgz", - "integrity": "sha512-3dOsAHXXUkQTpOYcoAxLIorMTp4gIQr5IW3iVb7A7lFIp0VHhnynm9izx6TssdrIcVIESAlVjtnO2K8bg+Coew==", - "dev": true, - "engines": { - "node": ">=12" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/@humanwhocodes/config-array": { - "version": "0.11.13", - "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.11.13.tgz", - "integrity": "sha512-JSBDMiDKSzQVngfRjOdFXgFfklaXI4K9nLF49Auh21lmBWRLIK3+xTErTWD4KU54pb6coM6ESE7Awz/FNU3zgQ==", - "dev": true, - "dependencies": { - "@humanwhocodes/object-schema": "^2.0.1", - "debug": "^4.1.1", - "minimatch": "^3.0.5" - }, - "engines": { - "node": ">=10.10.0" - } - }, - "node_modules/@humanwhocodes/module-importer": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz", - "integrity": "sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==", - "dev": true, - "engines": { - "node": ">=12.22" - }, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/nzakas" - } - }, - "node_modules/@humanwhocodes/object-schema": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/@humanwhocodes/object-schema/-/object-schema-2.0.1.tgz", - "integrity": "sha512-dvuCeX5fC9dXgJn9t+X5atfmgQAzUOWqS1254Gh0m6i8wKd10ebXkfNKiRK+1GWi/yTvvLDHpoxLr0xxxeslWw==", - "dev": true - }, - "node_modules/@istanbuljs/load-nyc-config": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/@istanbuljs/load-nyc-config/-/load-nyc-config-1.1.0.tgz", - "integrity": "sha512-VjeHSlIzpv/NyD3N0YuHfXOPDIixcA1q2ZV98wsMqcYlPmv2n3Yb2lYP9XMElnaFVXg5A7YLTeLu6V84uQDjmQ==", - "dev": true, - "peer": true, - "dependencies": { - "camelcase": "^5.3.1", - "find-up": "^4.1.0", - "get-package-type": "^0.1.0", - "js-yaml": "^3.13.1", - "resolve-from": "^5.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/@istanbuljs/load-nyc-config/node_modules/argparse": { - "version": "1.0.10", - "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz", - "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==", - "dev": true, - "peer": true, - "dependencies": { - "sprintf-js": "~1.0.2" - } - }, - "node_modules/@istanbuljs/load-nyc-config/node_modules/find-up": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz", - "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==", - "dev": true, - "peer": true, - "dependencies": { - "locate-path": "^5.0.0", - "path-exists": "^4.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": { - "version": "3.14.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz", - "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==", - "dev": true, - "peer": true, - "dependencies": { - "argparse": "^1.0.7", - "esprima": "^4.0.0" - }, - "bin": { - "js-yaml": "bin/js-yaml.js" - } - }, - "node_modules/@istanbuljs/load-nyc-config/node_modules/locate-path": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz", - "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==", - "dev": true, - "peer": true, - "dependencies": { - "p-locate": "^4.1.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/@istanbuljs/load-nyc-config/node_modules/p-limit": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz", - "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==", - "dev": true, - "peer": true, - "dependencies": { - "p-try": "^2.0.0" - }, - "engines": { - "node": ">=6" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/@istanbuljs/load-nyc-config/node_modules/p-locate": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz", - "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==", - "dev": true, - "peer": true, - "dependencies": { - "p-limit": "^2.2.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/@istanbuljs/load-nyc-config/node_modules/path-exists": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz", - "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==", - "dev": true, - "peer": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/@istanbuljs/load-nyc-config/node_modules/resolve-from": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-5.0.0.tgz", - "integrity": "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==", - "dev": true, - "peer": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/@istanbuljs/schema": { - "version": "0.1.3", - "resolved": "https://registry.npmjs.org/@istanbuljs/schema/-/schema-0.1.3.tgz", - "integrity": "sha512-ZXRY4jNvVgSVQ8DL3LTcakaAtXwTVUxE81hslsyD2AtoXW/wVob10HkOJ1X/pAlcI7D+2YoZKg5do8G/w6RYgA==", - "dev": true, - "peer": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/@jest/console": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/@jest/console/-/console-26.6.2.tgz", - "integrity": "sha512-IY1R2i2aLsLr7Id3S6p2BA82GNWryt4oSvEXLAKc+L2zdi89dSkE8xC1C+0kpATG4JhBJREnQOH7/zmccM2B0g==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/types": "^26.6.2", - "@types/node": "*", - "chalk": "^4.0.0", - "jest-message-util": "^26.6.2", - "jest-util": "^26.6.2", - "slash": "^3.0.0" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/@jest/core": { - "version": "26.6.3", - "resolved": "https://registry.npmjs.org/@jest/core/-/core-26.6.3.tgz", - "integrity": "sha512-xvV1kKbhfUqFVuZ8Cyo+JPpipAHHAV3kcDBftiduK8EICXmTFddryy3P7NfZt8Pv37rA9nEJBKCCkglCPt/Xjw==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/console": "^26.6.2", - "@jest/reporters": "^26.6.2", - "@jest/test-result": "^26.6.2", - "@jest/transform": "^26.6.2", - "@jest/types": "^26.6.2", - "@types/node": "*", - "ansi-escapes": "^4.2.1", - "chalk": "^4.0.0", - "exit": "^0.1.2", - "graceful-fs": "^4.2.4", - "jest-changed-files": "^26.6.2", - "jest-config": "^26.6.3", - "jest-haste-map": "^26.6.2", - "jest-message-util": "^26.6.2", - "jest-regex-util": "^26.0.0", - "jest-resolve": "^26.6.2", - "jest-resolve-dependencies": "^26.6.3", - "jest-runner": "^26.6.3", - "jest-runtime": "^26.6.3", - "jest-snapshot": "^26.6.2", - "jest-util": "^26.6.2", - "jest-validate": "^26.6.2", - "jest-watcher": "^26.6.2", - "micromatch": "^4.0.2", - "p-each-series": "^2.1.0", - "rimraf": "^3.0.0", - "slash": "^3.0.0", - "strip-ansi": "^6.0.0" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/@jest/environment": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/@jest/environment/-/environment-26.6.2.tgz", - "integrity": "sha512-nFy+fHl28zUrRsCeMB61VDThV1pVTtlEokBRgqPrcT1JNq4yRNIyTHfyht6PqtUvY9IsuLGTrbG8kPXjSZIZwA==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/fake-timers": "^26.6.2", - "@jest/types": "^26.6.2", - "@types/node": "*", - "jest-mock": "^26.6.2" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/@jest/fake-timers": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/@jest/fake-timers/-/fake-timers-26.6.2.tgz", - "integrity": "sha512-14Uleatt7jdzefLPYM3KLcnUl1ZNikaKq34enpb5XG9i81JpppDb5muZvonvKyrl7ftEHkKS5L5/eB/kxJ+bvA==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/types": "^26.6.2", - "@sinonjs/fake-timers": "^6.0.1", - "@types/node": "*", - "jest-message-util": "^26.6.2", - "jest-mock": "^26.6.2", - "jest-util": "^26.6.2" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/@jest/globals": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/@jest/globals/-/globals-26.6.2.tgz", - "integrity": "sha512-85Ltnm7HlB/KesBUuALwQ68YTU72w9H2xW9FjZ1eL1U3lhtefjjl5c2MiUbpXt/i6LaPRvoOFJ22yCBSfQ0JIA==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/environment": "^26.6.2", - "@jest/types": "^26.6.2", - "expect": "^26.6.2" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/@jest/reporters": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/@jest/reporters/-/reporters-26.6.2.tgz", - "integrity": "sha512-h2bW53APG4HvkOnVMo8q3QXa6pcaNt1HkwVsOPMBV6LD/q9oSpxNSYZQYkAnjdMjrJ86UuYeLo+aEZClV6opnw==", - "dev": true, - "peer": true, - "dependencies": { - "@bcoe/v8-coverage": "^0.2.3", - "@jest/console": "^26.6.2", - "@jest/test-result": "^26.6.2", - "@jest/transform": "^26.6.2", - "@jest/types": "^26.6.2", - "chalk": "^4.0.0", - "collect-v8-coverage": "^1.0.0", - "exit": "^0.1.2", - "glob": "^7.1.2", - "graceful-fs": "^4.2.4", - "istanbul-lib-coverage": "^3.0.0", - "istanbul-lib-instrument": "^4.0.3", - "istanbul-lib-report": "^3.0.0", - "istanbul-lib-source-maps": "^4.0.0", - "istanbul-reports": "^3.0.2", - "jest-haste-map": "^26.6.2", - "jest-resolve": "^26.6.2", - "jest-util": "^26.6.2", - "jest-worker": "^26.6.2", - "slash": "^3.0.0", - "source-map": "^0.6.0", - "string-length": "^4.0.1", - "terminal-link": "^2.0.0", - "v8-to-istanbul": "^7.0.0" - }, - "engines": { - "node": ">= 10.14.2" - }, - "optionalDependencies": { - "node-notifier": "^8.0.0" - } - }, - "node_modules/@jest/source-map": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/@jest/source-map/-/source-map-26.6.2.tgz", - "integrity": "sha512-YwYcCwAnNmOVsZ8mr3GfnzdXDAl4LaenZP5z+G0c8bzC9/dugL8zRmxZzdoTl4IaS3CryS1uWnROLPFmb6lVvA==", - "dev": true, - "peer": true, - "dependencies": { - "callsites": "^3.0.0", - "graceful-fs": "^4.2.4", - "source-map": "^0.6.0" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/@jest/test-result": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-26.6.2.tgz", - "integrity": "sha512-5O7H5c/7YlojphYNrK02LlDIV2GNPYisKwHm2QTKjNZeEzezCbwYs9swJySv2UfPMyZ0VdsmMv7jIlD/IKYQpQ==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/console": "^26.6.2", - "@jest/types": "^26.6.2", - "@types/istanbul-lib-coverage": "^2.0.0", - "collect-v8-coverage": "^1.0.0" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/@jest/test-sequencer": { - "version": "26.6.3", - "resolved": "https://registry.npmjs.org/@jest/test-sequencer/-/test-sequencer-26.6.3.tgz", - "integrity": "sha512-YHlVIjP5nfEyjlrSr8t/YdNfU/1XEt7c5b4OxcXCjyRhjzLYu/rO69/WHPuYcbCWkz8kAeZVZp2N2+IOLLEPGw==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/test-result": "^26.6.2", - "graceful-fs": "^4.2.4", - "jest-haste-map": "^26.6.2", - "jest-runner": "^26.6.3", - "jest-runtime": "^26.6.3" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/@jest/transform": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/@jest/transform/-/transform-26.6.2.tgz", - "integrity": "sha512-E9JjhUgNzvuQ+vVAL21vlyfy12gP0GhazGgJC4h6qUt1jSdUXGWJ1wfu/X7Sd8etSgxV4ovT1pb9v5D6QW4XgA==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/core": "^7.1.0", - "@jest/types": "^26.6.2", - "babel-plugin-istanbul": "^6.0.0", - "chalk": "^4.0.0", - "convert-source-map": "^1.4.0", - "fast-json-stable-stringify": "^2.0.0", - "graceful-fs": "^4.2.4", - "jest-haste-map": "^26.6.2", - "jest-regex-util": "^26.0.0", - "jest-util": "^26.6.2", - "micromatch": "^4.0.2", - "pirates": "^4.0.1", - "slash": "^3.0.0", - "source-map": "^0.6.1", - "write-file-atomic": "^3.0.0" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/@jest/types": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/@jest/types/-/types-26.6.2.tgz", - "integrity": "sha512-fC6QCp7Sc5sX6g8Tvbmj4XUTbyrik0akgRy03yjXbQaBWWNWGE7SGtJk98m0N8nzegD/7SggrUlivxo5ax4KWQ==", - "dev": true, - "dependencies": { - "@types/istanbul-lib-coverage": "^2.0.0", - "@types/istanbul-reports": "^3.0.0", - "@types/node": "*", - "@types/yargs": "^15.0.0", - "chalk": "^4.0.0" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/@jridgewell/gen-mapping": { - "version": "0.3.3", - "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.3.tgz", - "integrity": "sha512-HLhSWOLRi875zjjMG/r+Nv0oCW8umGb0BgEhyX3dDX3egwZtB8PqLnjz3yedt8R5StBrzcg4aBpnh8UA9D1BoQ==", - "dev": true, - "dependencies": { - "@jridgewell/set-array": "^1.0.1", - "@jridgewell/sourcemap-codec": "^1.4.10", - "@jridgewell/trace-mapping": "^0.3.9" - }, - "engines": { - "node": ">=6.0.0" - } - }, - "node_modules/@jridgewell/resolve-uri": { - "version": "3.1.1", - "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.1.tgz", - "integrity": "sha512-dSYZh7HhCDtCKm4QakX0xFpsRDqjjtZf/kjI/v3T3Nwt5r8/qz/M19F9ySyOqU94SXBmeG9ttTul+YnR4LOxFA==", - "dev": true, - "engines": { - "node": ">=6.0.0" - } - }, - "node_modules/@jridgewell/set-array": { - "version": "1.1.2", - "resolved": "https://registry.npmjs.org/@jridgewell/set-array/-/set-array-1.1.2.tgz", - "integrity": "sha512-xnkseuNADM0gt2bs+BvhO0p78Mk762YnZdsuzFV018NoG1Sj1SCQvpSqa7XUaTam5vAGasABV9qXASMKnFMwMw==", - "dev": true, - "engines": { - "node": ">=6.0.0" - } - }, - "node_modules/@jridgewell/sourcemap-codec": { - "version": "1.4.15", - "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.4.15.tgz", - "integrity": "sha512-eF2rxCRulEKXHTRiDrDy6erMYWqNw4LPdQ8UQA4huuxaQsVeRPFl2oM8oDGxMFhJUWZf9McpLtJasDDZb/Bpeg==", - "dev": true - }, - "node_modules/@jridgewell/trace-mapping": { - "version": "0.3.20", - "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.20.tgz", - "integrity": "sha512-R8LcPeWZol2zR8mmH3JeKQ6QRCFb7XgUhV9ZlGhHLGyg4wpPiPZNQOOWhFZhxKw8u//yTbNGI42Bx/3paXEQ+Q==", - "dev": true, - "dependencies": { - "@jridgewell/resolve-uri": "^3.1.0", - "@jridgewell/sourcemap-codec": "^1.4.14" - } - }, - "node_modules/@mdx-js/util": { - "version": "1.6.22", - "resolved": "https://registry.npmjs.org/@mdx-js/util/-/util-1.6.22.tgz", - "integrity": "sha512-H1rQc1ZOHANWBvPcW+JpGwr+juXSxM8Q8YCkm3GhZd8REu1fHR3z99CErO1p9pkcfcxZnMdIZdIsXkOHY0NilA==", - "dev": true, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/@next/env": { - "version": "14.1.0", - "resolved": "https://registry.npmjs.org/@next/env/-/env-14.1.0.tgz", - "integrity": "sha512-Py8zIo+02ht82brwwhTg36iogzFqGLPXlRGKQw5s+qP/kMNc4MAyDeEwBKDijk6zTIbegEgu8Qy7C1LboslQAw==", - "dev": true - }, - "node_modules/@next/eslint-plugin-next": { - "version": "13.5.6", - "resolved": "https://registry.npmjs.org/@next/eslint-plugin-next/-/eslint-plugin-next-13.5.6.tgz", - "integrity": "sha512-ng7pU/DDsxPgT6ZPvuprxrkeew3XaRf4LAT4FabaEO/hAbvVx4P7wqnqdbTdDn1kgTvsI4tpIgT4Awn/m0bGbg==", - "dev": true, - "dependencies": { - "glob": "7.1.7" - } - }, - "node_modules/@next/swc-darwin-arm64": { - "version": "14.1.0", - "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-14.1.0.tgz", - "integrity": "sha512-nUDn7TOGcIeyQni6lZHfzNoo9S0euXnu0jhsbMOmMJUBfgsnESdjN97kM7cBqQxZa8L/bM9om/S5/1dzCrW6wQ==", - "cpu": [ - "arm64" - ], - "dev": true, - "optional": true, - "os": [ - "darwin" - ], - "engines": { - "node": ">= 10" - } - }, - "node_modules/@next/swc-darwin-x64": { - "version": "14.1.0", - "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-14.1.0.tgz", - "integrity": "sha512-1jgudN5haWxiAl3O1ljUS2GfupPmcftu2RYJqZiMJmmbBT5M1XDffjUtRUzP4W3cBHsrvkfOFdQ71hAreNQP6g==", - "cpu": [ - "x64" - ], - "dev": true, - "optional": true, - "os": [ - "darwin" - ], - "engines": { - "node": ">= 10" - } - }, - "node_modules/@next/swc-linux-arm64-gnu": { - "version": "14.1.0", - "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-14.1.0.tgz", - "integrity": "sha512-RHo7Tcj+jllXUbK7xk2NyIDod3YcCPDZxj1WLIYxd709BQ7WuRYl3OWUNG+WUfqeQBds6kvZYlc42NJJTNi4tQ==", - "cpu": [ - "arm64" - ], - "dev": true, - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">= 10" - } - }, - "node_modules/@next/swc-linux-arm64-musl": { - "version": "14.1.0", - "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-14.1.0.tgz", - "integrity": "sha512-v6kP8sHYxjO8RwHmWMJSq7VZP2nYCkRVQ0qolh2l6xroe9QjbgV8siTbduED4u0hlk0+tjS6/Tuy4n5XCp+l6g==", - "cpu": [ - "arm64" - ], - "dev": true, - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">= 10" - } - }, - "node_modules/@next/swc-linux-x64-gnu": { - "version": "14.1.0", - "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-14.1.0.tgz", - "integrity": "sha512-zJ2pnoFYB1F4vmEVlb/eSe+VH679zT1VdXlZKX+pE66grOgjmKJHKacf82g/sWE4MQ4Rk2FMBCRnX+l6/TVYzQ==", - "cpu": [ - "x64" - ], - "dev": true, - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">= 10" - } - }, - "node_modules/@next/swc-linux-x64-musl": { - "version": "14.1.0", - "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-14.1.0.tgz", - "integrity": "sha512-rbaIYFt2X9YZBSbH/CwGAjbBG2/MrACCVu2X0+kSykHzHnYH5FjHxwXLkcoJ10cX0aWCEynpu+rP76x0914atg==", - "cpu": [ - "x64" - ], - "dev": true, - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">= 10" - } - }, - "node_modules/@next/swc-win32-arm64-msvc": { - "version": "14.1.0", - "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-14.1.0.tgz", - "integrity": "sha512-o1N5TsYc8f/HpGt39OUQpQ9AKIGApd3QLueu7hXk//2xq5Z9OxmV6sQfNp8C7qYmiOlHYODOGqNNa0e9jvchGQ==", - "cpu": [ - "arm64" - ], - "dev": true, - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": ">= 10" - } - }, - "node_modules/@next/swc-win32-ia32-msvc": { - "version": "14.1.0", - "resolved": "https://registry.npmjs.org/@next/swc-win32-ia32-msvc/-/swc-win32-ia32-msvc-14.1.0.tgz", - "integrity": "sha512-XXIuB1DBRCFwNO6EEzCTMHT5pauwaSj4SWs7CYnME57eaReAKBXCnkUE80p/pAZcewm7hs+vGvNqDPacEXHVkw==", - "cpu": [ - "ia32" - ], - "dev": true, - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": ">= 10" - } - }, - "node_modules/@next/swc-win32-x64-msvc": { - "version": "14.1.0", - "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-14.1.0.tgz", - "integrity": "sha512-9WEbVRRAqJ3YFVqEZIxUqkiO8l1nool1LmNxygr5HWF8AcSYsEpneUDhmjUVJEzO2A04+oPtZdombzzPPkTtgg==", - "cpu": [ - "x64" - ], - "dev": true, - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": ">= 10" - } - }, - "node_modules/@nodelib/fs.scandir": { - "version": "2.1.5", - "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz", - "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==", - "dev": true, - "dependencies": { - "@nodelib/fs.stat": "2.0.5", - "run-parallel": "^1.1.9" - }, - "engines": { - "node": ">= 8" - } - }, - "node_modules/@nodelib/fs.stat": { - "version": "2.0.5", - "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz", - "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==", - "dev": true, - "engines": { - "node": ">= 8" - } - }, - "node_modules/@nodelib/fs.walk": { - "version": "1.2.8", - "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz", - "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==", - "dev": true, - "dependencies": { - "@nodelib/fs.scandir": "2.1.5", - "fastq": "^1.6.0" - }, - "engines": { - "node": ">= 8" - } - }, - "node_modules/@rushstack/eslint-patch": { - "version": "1.5.1", - "resolved": "https://registry.npmjs.org/@rushstack/eslint-patch/-/eslint-patch-1.5.1.tgz", - "integrity": "sha512-6i/8UoL0P5y4leBIGzvkZdS85RDMG9y1ihZzmTZQ5LdHUYmZ7pKFoj8X0236s3lusPs1Fa5HTQUpwI+UfTcmeA==", - "dev": true - }, - "node_modules/@sinonjs/commons": { - "version": "1.8.6", - "resolved": "https://registry.npmjs.org/@sinonjs/commons/-/commons-1.8.6.tgz", - "integrity": "sha512-Ky+XkAkqPZSm3NLBeUng77EBQl3cmeJhITaGHdYH8kjVB+aun3S4XBRti2zt17mtt0mIUDiNxYeoJm6drVvBJQ==", - "dev": true, - "peer": true, - "dependencies": { - "type-detect": "4.0.8" - } - }, - "node_modules/@sinonjs/fake-timers": { - "version": "6.0.1", - "resolved": "https://registry.npmjs.org/@sinonjs/fake-timers/-/fake-timers-6.0.1.tgz", - "integrity": "sha512-MZPUxrmFubI36XS1DI3qmI0YdN1gks62JtFZvxR67ljjSNCeK6U08Zx4msEWOXuofgqUt6zPHSi1H9fbjR/NRA==", - "dev": true, - "peer": true, - "dependencies": { - "@sinonjs/commons": "^1.7.0" - } - }, - "node_modules/@stylelint/postcss-css-in-js": { - "version": "0.37.3", - "resolved": "https://registry.npmjs.org/@stylelint/postcss-css-in-js/-/postcss-css-in-js-0.37.3.tgz", - "integrity": "sha512-scLk3cSH1H9KggSniseb2KNAU5D9FWc3H7BxCSAIdtU9OWIyw0zkEZ9qEKHryRM+SExYXRKNb7tOOVNAsQ3iwg==", - "deprecated": "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.", - "dev": true, - "dependencies": { - "@babel/core": "^7.17.9" - }, - "peerDependencies": { - "postcss": ">=7.0.0", - "postcss-syntax": ">=0.36.2" - } - }, - "node_modules/@stylelint/postcss-markdown": { - "version": "0.36.2", - "resolved": "https://registry.npmjs.org/@stylelint/postcss-markdown/-/postcss-markdown-0.36.2.tgz", - "integrity": "sha512-2kGbqUVJUGE8dM+bMzXG/PYUWKkjLIkRLWNh39OaADkiabDRdw8ATFCgbMz5xdIcvwspPAluSL7uY+ZiTWdWmQ==", - "deprecated": "Use the original unforked package instead: postcss-markdown", - "dev": true, - "dependencies": { - "remark": "^13.0.0", - "unist-util-find-all-after": "^3.0.2" - }, - "peerDependencies": { - "postcss": ">=7.0.0", - "postcss-syntax": ">=0.36.2" - } - }, - "node_modules/@stylelint/postcss-markdown/node_modules/remark": { - "version": "13.0.0", - "resolved": "https://registry.npmjs.org/remark/-/remark-13.0.0.tgz", - "integrity": "sha512-HDz1+IKGtOyWN+QgBiAT0kn+2s6ovOxHyPAFGKVE81VSzJ+mq7RwHFledEvB5F1p4iJvOah/LOKdFuzvRnNLCA==", - "dev": true, - "dependencies": { - "remark-parse": "^9.0.0", - "remark-stringify": "^9.0.0", - "unified": "^9.1.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/@stylelint/postcss-markdown/node_modules/remark-parse": { - "version": "9.0.0", - "resolved": "https://registry.npmjs.org/remark-parse/-/remark-parse-9.0.0.tgz", - "integrity": "sha512-geKatMwSzEXKHuzBNU1z676sGcDcFoChMK38TgdHJNAYfFtsfHDQG7MoJAjs6sgYMqyLduCYWDIWZIxiPeafEw==", - "dev": true, - "dependencies": { - "mdast-util-from-markdown": "^0.8.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/@stylelint/postcss-markdown/node_modules/remark-stringify": { - "version": "9.0.1", - "resolved": "https://registry.npmjs.org/remark-stringify/-/remark-stringify-9.0.1.tgz", - "integrity": "sha512-mWmNg3ZtESvZS8fv5PTvaPckdL4iNlCHTt8/e/8oN08nArHRHjNZMKzA/YW3+p7/lYqIw4nx1XsjCBo/AxNChg==", - "dev": true, - "dependencies": { - "mdast-util-to-markdown": "^0.6.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/@swc/helpers": { - "version": "0.5.2", - "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.2.tgz", - "integrity": "sha512-E4KcWTpoLHqwPHLxidpOqQbcrZVgi0rsmmZXUle1jXmJfuIf/UWpczUJ7MZZ5tlxytgJXyp0w4PGkkeLiuIdZw==", - "dev": true, - "dependencies": { - "tslib": "^2.4.0" - } - }, - "node_modules/@tootallnate/once": { - "version": "1.1.2", - "resolved": "https://registry.npmjs.org/@tootallnate/once/-/once-1.1.2.tgz", - "integrity": "sha512-RbzJvlNzmRq5c3O09UipeuXno4tA1FE6ikOjxZK0tuxVv3412l64l5t1W5pj4+rJq9vpkm/kwiR07aZXnsKPxw==", - "dev": true, - "peer": true, - "engines": { - "node": ">= 6" - } - }, - "node_modules/@types/babel__core": { - "version": "7.20.3", - "resolved": "https://registry.npmjs.org/@types/babel__core/-/babel__core-7.20.3.tgz", - "integrity": "sha512-54fjTSeSHwfan8AyHWrKbfBWiEUrNTZsUwPTDSNaaP1QDQIZbeNUg3a59E9D+375MzUw/x1vx2/0F5LBz+AeYA==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/parser": "^7.20.7", - "@babel/types": "^7.20.7", - "@types/babel__generator": "*", - "@types/babel__template": "*", - "@types/babel__traverse": "*" - } - }, - "node_modules/@types/babel__generator": { - "version": "7.6.6", - "resolved": "https://registry.npmjs.org/@types/babel__generator/-/babel__generator-7.6.6.tgz", - "integrity": "sha512-66BXMKb/sUWbMdBNdMvajU7i/44RkrA3z/Yt1c7R5xejt8qh84iU54yUWCtm0QwGJlDcf/gg4zd/x4mpLAlb/w==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/types": "^7.0.0" - } - }, - "node_modules/@types/babel__template": { - "version": "7.4.3", - "resolved": "https://registry.npmjs.org/@types/babel__template/-/babel__template-7.4.3.tgz", - "integrity": "sha512-ciwyCLeuRfxboZ4isgdNZi/tkt06m8Tw6uGbBSBgWrnnZGNXiEyM27xc/PjXGQLqlZ6ylbgHMnm7ccF9tCkOeQ==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/parser": "^7.1.0", - "@babel/types": "^7.0.0" - } - }, - "node_modules/@types/babel__traverse": { - "version": "7.20.3", - "resolved": "https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.20.3.tgz", - "integrity": "sha512-Lsh766rGEFbaxMIDH7Qa+Yha8cMVI3qAK6CHt3OR0YfxOIn5Z54iHiyDRycHrBqeIiqGa20Kpsv1cavfBKkRSw==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/types": "^7.20.7" - } - }, - "node_modules/@types/graceful-fs": { - "version": "4.1.8", - "resolved": "https://registry.npmjs.org/@types/graceful-fs/-/graceful-fs-4.1.8.tgz", - "integrity": "sha512-NhRH7YzWq8WiNKVavKPBmtLYZHxNY19Hh+az28O/phfp68CF45pMFud+ZzJ8ewnxnC5smIdF3dqFeiSUQ5I+pw==", - "dev": true, - "peer": true, - "dependencies": { - "@types/node": "*" - } - }, - "node_modules/@types/istanbul-lib-coverage": { - "version": "2.0.5", - "resolved": "https://registry.npmjs.org/@types/istanbul-lib-coverage/-/istanbul-lib-coverage-2.0.5.tgz", - "integrity": "sha512-zONci81DZYCZjiLe0r6equvZut0b+dBRPBN5kBDjsONnutYNtJMoWQ9uR2RkL1gLG9NMTzvf+29e5RFfPbeKhQ==", - "dev": true - }, - "node_modules/@types/istanbul-lib-report": { - "version": "3.0.2", - "resolved": "https://registry.npmjs.org/@types/istanbul-lib-report/-/istanbul-lib-report-3.0.2.tgz", - "integrity": "sha512-8toY6FgdltSdONav1XtUHl4LN1yTmLza+EuDazb/fEmRNCwjyqNVIQWs2IfC74IqjHkREs/nQ2FWq5kZU9IC0w==", - "dev": true, - "dependencies": { - "@types/istanbul-lib-coverage": "*" - } - }, - "node_modules/@types/istanbul-reports": { - "version": "3.0.3", - "resolved": "https://registry.npmjs.org/@types/istanbul-reports/-/istanbul-reports-3.0.3.tgz", - "integrity": "sha512-1nESsePMBlf0RPRffLZi5ujYh7IH1BWL4y9pr+Bn3cJBdxz+RTP8bUFljLz9HvzhhOSWKdyBZ4DIivdL6rvgZg==", - "dev": true, - "dependencies": { - "@types/istanbul-lib-report": "*" - } - }, - "node_modules/@types/json-schema": { - "version": "7.0.14", - "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.14.tgz", - "integrity": "sha512-U3PUjAudAdJBeC2pgN8uTIKgxrb4nlDF3SF0++EldXQvQBGkpFZMSnwQiIoDU77tv45VgNkl/L4ouD+rEomujw==", - "dev": true - }, - "node_modules/@types/json5": { - "version": "0.0.29", - "resolved": "https://registry.npmjs.org/@types/json5/-/json5-0.0.29.tgz", - "integrity": "sha512-dRLjCWHYg4oaA77cxO64oO+7JwCwnIzkZPdrrC71jQmQtlhM556pwKo5bUzqvZndkVbeFLIIi+9TC40JNF5hNQ==", - "dev": true - }, - "node_modules/@types/mdast": { - "version": "3.0.14", - "resolved": "https://registry.npmjs.org/@types/mdast/-/mdast-3.0.14.tgz", - "integrity": "sha512-gVZ04PGgw1qLZKsnWnyFv4ORnaJ+DXLdHTVSFbU8yX6xZ34Bjg4Q32yPkmveUP1yItXReKfB0Aknlh/3zxTKAw==", - "dev": true, - "dependencies": { - "@types/unist": "^2" - } - }, - "node_modules/@types/minimist": { - "version": "1.2.4", - "resolved": "https://registry.npmjs.org/@types/minimist/-/minimist-1.2.4.tgz", - "integrity": "sha512-Kfe/D3hxHTusnPNRbycJE1N77WHDsdS4AjUYIzlDzhDrS47NrwuL3YW4VITxwR7KCVpzwgy4Rbj829KSSQmwXQ==", - "dev": true - }, - "node_modules/@types/node": { - "version": "20.8.10", - "resolved": "https://registry.npmjs.org/@types/node/-/node-20.8.10.tgz", - "integrity": "sha512-TlgT8JntpcbmKUFzjhsyhGfP2fsiz1Mv56im6enJ905xG1DAYesxJaeSbGqQmAw8OWPdhyJGhGSQGKRNJ45u9w==", - "dev": true, - "dependencies": { - "undici-types": "~5.26.4" - } - }, - "node_modules/@types/normalize-package-data": { - "version": "2.4.3", - "resolved": "https://registry.npmjs.org/@types/normalize-package-data/-/normalize-package-data-2.4.3.tgz", - "integrity": "sha512-ehPtgRgaULsFG8x0NeYJvmyH1hmlfsNLujHe9dQEia/7MAJYdzMSi19JtchUHjmBA6XC/75dK55mzZH+RyieSg==", - "dev": true - }, - "node_modules/@types/parse-json": { - "version": "4.0.1", - "resolved": "https://registry.npmjs.org/@types/parse-json/-/parse-json-4.0.1.tgz", - "integrity": "sha512-3YmXzzPAdOTVljVMkTMBdBEvlOLg2cDQaDhnnhT3nT9uDbnJzjWhKlzb+desT12Y7tGqaN6d+AbozcKzyL36Ng==", - "dev": true - }, - "node_modules/@types/prettier": { - "version": "2.7.3", - "resolved": "https://registry.npmjs.org/@types/prettier/-/prettier-2.7.3.tgz", - "integrity": "sha512-+68kP9yzs4LMp7VNh8gdzMSPZFL44MLGqiHWvttYJe+6qnuVr4Ek9wSBQoveqY/r+LwjCcU29kNVkidwim+kYA==", - "dev": true, - "peer": true - }, - "node_modules/@types/semver": { - "version": "7.5.4", - "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.5.4.tgz", - "integrity": "sha512-MMzuxN3GdFwskAnb6fz0orFvhfqi752yjaXylr0Rp4oDg5H0Zn1IuyRhDVvYOwAXoJirx2xuS16I3WjxnAIHiQ==", - "dev": true - }, - "node_modules/@types/stack-utils": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/@types/stack-utils/-/stack-utils-2.0.2.tgz", - "integrity": "sha512-g7CK9nHdwjK2n0ymT2CW698FuWJRIx+RP6embAzZ2Qi8/ilIrA1Imt2LVSeHUzKvpoi7BhmmQcXz95eS0f2JXw==", - "dev": true, - "peer": true - }, - "node_modules/@types/supports-color": { - "version": "8.1.2", - "resolved": "https://registry.npmjs.org/@types/supports-color/-/supports-color-8.1.2.tgz", - "integrity": "sha512-nhs1D8NjNueBqRBhBTsc81g90g7VBD4wnMTMy9oP+QIldHuJkE655QTL2D1jkj3LyCd+Q5Y69oOpfxN1l0eCMA==", - "dev": true - }, - "node_modules/@types/unist": { - "version": "2.0.9", - "resolved": "https://registry.npmjs.org/@types/unist/-/unist-2.0.9.tgz", - "integrity": "sha512-zC0iXxAv1C1ERURduJueYzkzZ2zaGyc+P2c95hgkikHPr3z8EdUZOlgEQ5X0DRmwDZn+hekycQnoeiiRVrmilQ==", - "dev": true - }, - "node_modules/@types/yargs": { - "version": "15.0.17", - "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-15.0.17.tgz", - "integrity": "sha512-cj53I8GUcWJIgWVTSVe2L7NJAB5XWGdsoMosVvUgv1jEnMbAcsbaCzt1coUcyi8Sda5PgTWAooG8jNyDTD+CWA==", - "dev": true, - "dependencies": { - "@types/yargs-parser": "*" - } - }, - "node_modules/@types/yargs-parser": { - "version": "21.0.2", - "resolved": "https://registry.npmjs.org/@types/yargs-parser/-/yargs-parser-21.0.2.tgz", - "integrity": "sha512-5qcvofLPbfjmBfKaLfj/+f+Sbd6pN4zl7w7VSVI5uz7m9QZTuB2aZAa2uo1wHFBNN2x6g/SoTkXmd8mQnQF2Cw==", - "dev": true - }, - "node_modules/@typescript-eslint/eslint-plugin": { - "version": "5.62.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-5.62.0.tgz", - "integrity": "sha512-TiZzBSJja/LbhNPvk6yc0JrX9XqhQ0hdh6M2svYfsHGejaKFIAGd9MQ+ERIMzLGlN/kZoYIgdxFV0PuljTKXag==", - "dev": true, - "dependencies": { - "@eslint-community/regexpp": "^4.4.0", - "@typescript-eslint/scope-manager": "5.62.0", - "@typescript-eslint/type-utils": "5.62.0", - "@typescript-eslint/utils": "5.62.0", - "debug": "^4.3.4", - "graphemer": "^1.4.0", - "ignore": "^5.2.0", - "natural-compare-lite": "^1.4.0", - "semver": "^7.3.7", - "tsutils": "^3.21.0" - }, - "engines": { - "node": "^12.22.0 || ^14.17.0 || >=16.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/typescript-eslint" - }, - "peerDependencies": { - "@typescript-eslint/parser": "^5.0.0", - "eslint": "^6.0.0 || ^7.0.0 || ^8.0.0" - }, - "peerDependenciesMeta": { - "typescript": { - "optional": true - } - } - }, - "node_modules/@typescript-eslint/parser": { - "version": "5.62.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-5.62.0.tgz", - "integrity": "sha512-VlJEV0fOQ7BExOsHYAGrgbEiZoi8D+Bl2+f6V2RrXerRSylnp+ZBHmPvaIa8cz0Ajx7WO7Z5RqfgYg7ED1nRhA==", - "dev": true, - "dependencies": { - "@typescript-eslint/scope-manager": "5.62.0", - "@typescript-eslint/types": "5.62.0", - "@typescript-eslint/typescript-estree": "5.62.0", - "debug": "^4.3.4" - }, - "engines": { - "node": "^12.22.0 || ^14.17.0 || >=16.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/typescript-eslint" - }, - "peerDependencies": { - "eslint": "^6.0.0 || ^7.0.0 || ^8.0.0" - }, - "peerDependenciesMeta": { - "typescript": { - "optional": true - } - } - }, - "node_modules/@typescript-eslint/scope-manager": { - "version": "5.62.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-5.62.0.tgz", - "integrity": "sha512-VXuvVvZeQCQb5Zgf4HAxc04q5j+WrNAtNh9OwCsCgpKqESMTu3tF/jhZ3xG6T4NZwWl65Bg8KuS2uEvhSfLl0w==", - "dev": true, - "dependencies": { - "@typescript-eslint/types": "5.62.0", - "@typescript-eslint/visitor-keys": "5.62.0" - }, - "engines": { - "node": "^12.22.0 || ^14.17.0 || >=16.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/typescript-eslint" - } - }, - "node_modules/@typescript-eslint/type-utils": { - "version": "5.62.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-5.62.0.tgz", - "integrity": "sha512-xsSQreu+VnfbqQpW5vnCJdq1Z3Q0U31qiWmRhr98ONQmcp/yhiPJFPq8MXiJVLiksmOKSjIldZzkebzHuCGzew==", - "dev": true, - "dependencies": { - "@typescript-eslint/typescript-estree": "5.62.0", - "@typescript-eslint/utils": "5.62.0", - "debug": "^4.3.4", - "tsutils": "^3.21.0" - }, - "engines": { - "node": "^12.22.0 || ^14.17.0 || >=16.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/typescript-eslint" - }, - "peerDependencies": { - "eslint": "*" - }, - "peerDependenciesMeta": { - "typescript": { - "optional": true - } - } - }, - "node_modules/@typescript-eslint/types": { - "version": "5.62.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-5.62.0.tgz", - "integrity": "sha512-87NVngcbVXUahrRTqIK27gD2t5Cu1yuCXxbLcFtCzZGlfyVWWh8mLHkoxzjsB6DDNnvdL+fW8MiwPEJyGJQDgQ==", - "dev": true, - "engines": { - "node": "^12.22.0 || ^14.17.0 || >=16.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/typescript-eslint" - } - }, - "node_modules/@typescript-eslint/typescript-estree": { - "version": "5.62.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-5.62.0.tgz", - "integrity": "sha512-CmcQ6uY7b9y694lKdRB8FEel7JbU/40iSAPomu++SjLMntB+2Leay2LO6i8VnJk58MtE9/nQSFIH6jpyRWyYzA==", - "dev": true, - "dependencies": { - "@typescript-eslint/types": "5.62.0", - "@typescript-eslint/visitor-keys": "5.62.0", - "debug": "^4.3.4", - "globby": "^11.1.0", - "is-glob": "^4.0.3", - "semver": "^7.3.7", - "tsutils": "^3.21.0" - }, - "engines": { - "node": "^12.22.0 || ^14.17.0 || >=16.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/typescript-eslint" - }, - "peerDependenciesMeta": { - "typescript": { - "optional": true - } - } - }, - "node_modules/@typescript-eslint/typescript-estree/node_modules/globby": { - "version": "11.1.0", - "resolved": "https://registry.npmjs.org/globby/-/globby-11.1.0.tgz", - "integrity": "sha512-jhIXaOzy1sb8IyocaruWSn1TjmnBVs8Ayhcy83rmxNJ8q2uWKCAj3CnJY+KpGSXCueAPc0i05kVvVKtP1t9S3g==", - "dev": true, - "dependencies": { - "array-union": "^2.1.0", - "dir-glob": "^3.0.1", - "fast-glob": "^3.2.9", - "ignore": "^5.2.0", - "merge2": "^1.4.1", - "slash": "^3.0.0" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/@typescript-eslint/utils": { - "version": "5.62.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-5.62.0.tgz", - "integrity": "sha512-n8oxjeb5aIbPFEtmQxQYOLI0i9n5ySBEY/ZEHHZqKQSFnxio1rv6dthascc9dLuwrL0RC5mPCxB7vnAVGAYWAQ==", - "dev": true, - "dependencies": { - "@eslint-community/eslint-utils": "^4.2.0", - "@types/json-schema": "^7.0.9", - "@types/semver": "^7.3.12", - "@typescript-eslint/scope-manager": "5.62.0", - "@typescript-eslint/types": "5.62.0", - "@typescript-eslint/typescript-estree": "5.62.0", - "eslint-scope": "^5.1.1", - "semver": "^7.3.7" - }, - "engines": { - "node": "^12.22.0 || ^14.17.0 || >=16.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/typescript-eslint" - }, - "peerDependencies": { - "eslint": "^6.0.0 || ^7.0.0 || ^8.0.0" - } - }, - "node_modules/@typescript-eslint/visitor-keys": { - "version": "5.62.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-5.62.0.tgz", - "integrity": "sha512-07ny+LHRzQXepkGg6w0mFY41fVUNBrL2Roj/++7V1txKugfjm/Ci/qSND03r2RhlJhJYMcTn9AhhSSqQp0Ysyw==", - "dev": true, - "dependencies": { - "@typescript-eslint/types": "5.62.0", - "eslint-visitor-keys": "^3.3.0" - }, - "engines": { - "node": "^12.22.0 || ^14.17.0 || >=16.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/typescript-eslint" - } - }, - "node_modules/@ungap/structured-clone": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.2.0.tgz", - "integrity": "sha512-zuVdFrMJiuCDQUMCzQaD6KL28MjnqqN8XnAqiEq9PNm/hCPTSGfrXCOfwj1ow4LFb/tNymJPwsNbVePc1xFqrQ==", - "dev": true - }, - "node_modules/abab": { - "version": "2.0.6", - "resolved": "https://registry.npmjs.org/abab/-/abab-2.0.6.tgz", - "integrity": "sha512-j2afSsaIENvHZN2B8GOpF566vZ5WVk5opAiMTvWgaQT8DkbOqsTfvNAvHoRGU2zzP8cPoqys+xHTRDWW8L+/BA==", - "dev": true, - "peer": true - }, - "node_modules/acorn": { - "version": "8.11.2", - "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.11.2.tgz", - "integrity": "sha512-nc0Axzp/0FILLEVsm4fNwLCwMttvhEI263QtVPQcbpfZZ3ts0hLsZGOpE6czNlid7CJ9MlyH8reXkpsf3YUY4w==", - "dev": true, - "bin": { - "acorn": "bin/acorn" - }, - "engines": { - "node": ">=0.4.0" - } - }, - "node_modules/acorn-globals": { - "version": "6.0.0", - "resolved": "https://registry.npmjs.org/acorn-globals/-/acorn-globals-6.0.0.tgz", - "integrity": "sha512-ZQl7LOWaF5ePqqcX4hLuv/bLXYQNfNWw2c0/yX/TsPRKamzHcTGQnlCjHT3TsmkOUVEPS3crCxiPfdzE/Trlhg==", - "dev": true, - "peer": true, - "dependencies": { - "acorn": "^7.1.1", - "acorn-walk": "^7.1.1" - } - }, - "node_modules/acorn-globals/node_modules/acorn": { - "version": "7.4.1", - "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.4.1.tgz", - "integrity": "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A==", - "dev": true, - "peer": true, - "bin": { - "acorn": "bin/acorn" - }, - "engines": { - "node": ">=0.4.0" - } - }, - "node_modules/acorn-jsx": { - "version": "5.3.2", - "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz", - "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==", - "dev": true, - "peerDependencies": { - "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0" - } - }, - "node_modules/acorn-walk": { - "version": "7.2.0", - "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-7.2.0.tgz", - "integrity": "sha512-OPdCF6GsMIP+Az+aWfAAOEt2/+iVDKE7oy6lJ098aoe59oAmK76qV6Gw60SbZ8jHuG2wH058GF4pLFbYamYrVA==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.4.0" - } - }, - "node_modules/agent-base": { - "version": "6.0.2", - "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz", - "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==", - "dev": true, - "peer": true, - "dependencies": { - "debug": "4" - }, - "engines": { - "node": ">= 6.0.0" - } - }, - "node_modules/aggregate-error": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/aggregate-error/-/aggregate-error-3.1.0.tgz", - "integrity": "sha512-4I7Td01quW/RpocfNayFdFVk1qSuoh0E7JrbRJ16nH01HhKFQ88INq9Sd+nd72zqRySlr9BmDA8xlEJ6vJMrYA==", - "dev": true, - "dependencies": { - "clean-stack": "^2.0.0", - "indent-string": "^4.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/ajv": { - "version": "6.12.6", - "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz", - "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==", - "dev": true, - "dependencies": { - "fast-deep-equal": "^3.1.1", - "fast-json-stable-stringify": "^2.0.0", - "json-schema-traverse": "^0.4.1", - "uri-js": "^4.2.2" - }, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/epoberezkin" - } - }, - "node_modules/ansi-colors": { - "version": "4.1.3", - "resolved": "https://registry.npmjs.org/ansi-colors/-/ansi-colors-4.1.3.tgz", - "integrity": "sha512-/6w/C21Pm1A7aZitlI5Ni/2J6FFQN8i1Cvz3kHABAAbw93v/NlvKdVOqz7CCWz/3iv/JplRSEEZ83XION15ovw==", - "dev": true, - "engines": { - "node": ">=6" - } - }, - "node_modules/ansi-escapes": { - "version": "4.3.2", - "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-4.3.2.tgz", - "integrity": "sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==", - "dev": true, - "dependencies": { - "type-fest": "^0.21.3" - }, - "engines": { - "node": ">=8" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/ansi-escapes/node_modules/type-fest": { - "version": "0.21.3", - "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.21.3.tgz", - "integrity": "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==", - "dev": true, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/ansi-regex": { - "version": "5.0.1", - "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz", - "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==", - "dev": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/ansi-styles": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz", - "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==", - "dev": true, - "dependencies": { - "color-convert": "^2.0.1" - }, - "engines": { - "node": ">=8" - }, - "funding": { - "url": "https://github.com/chalk/ansi-styles?sponsor=1" - } - }, - "node_modules/anymatch": { - "version": "3.1.3", - "resolved": "https://registry.npmjs.org/anymatch/-/anymatch-3.1.3.tgz", - "integrity": "sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==", - "dev": true, - "peer": true, - "dependencies": { - "normalize-path": "^3.0.0", - "picomatch": "^2.0.4" - }, - "engines": { - "node": ">= 8" - } - }, - "node_modules/argparse": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz", - "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==", - "dev": true - }, - "node_modules/aria-query": { - "version": "5.3.0", - "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.0.tgz", - "integrity": "sha512-b0P0sZPKtyu8HkeRAfCq0IfURZK+SuwMjY1UXGBU27wpAiTwQAIlq56IbIO+ytk/JjS1fMR14ee5WBBfKi5J6A==", - "dev": true, - "dependencies": { - "dequal": "^2.0.3" - } - }, - "node_modules/arr-diff": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/arr-diff/-/arr-diff-4.0.0.tgz", - "integrity": "sha512-YVIQ82gZPGBebQV/a8dar4AitzCQs0jjXwMPZllpXMaGjXPYVUawSxQrRsjhjupyVxEvbHgUmIhKVlND+j02kA==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/arr-flatten": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/arr-flatten/-/arr-flatten-1.1.0.tgz", - "integrity": "sha512-L3hKV5R/p5o81R7O02IGnwpDmkp6E982XhtbuwSe3O4qOtMMMtodicASA1Cny2U+aCXcNpml+m4dPsvsJ3jatg==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/arr-union": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/arr-union/-/arr-union-3.1.0.tgz", - "integrity": "sha512-sKpyeERZ02v1FeCZT8lrfJq5u6goHCtpTAzPwJYe7c8SPFOboNjNg1vz2L4VTn9T4PQxEx13TbXLmYUcS6Ug7Q==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/array-buffer-byte-length": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/array-buffer-byte-length/-/array-buffer-byte-length-1.0.0.tgz", - "integrity": "sha512-LPuwb2P+NrQw3XhxGc36+XSvuBPopovXYTR9Ew++Du9Yb/bx5AzBfrIsBoj0EZUifjQU+sHL21sseZ3jerWO/A==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "is-array-buffer": "^3.0.1" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/array-includes": { - "version": "3.1.7", - "resolved": "https://registry.npmjs.org/array-includes/-/array-includes-3.1.7.tgz", - "integrity": "sha512-dlcsNBIiWhPkHdOEEKnehA+RNUWDc4UqFtnIXU4uuYDPtA4LDkr7qip2p0VvFAEXNDr0yWZ9PJyIRiGjRLQzwQ==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "define-properties": "^1.2.0", - "es-abstract": "^1.22.1", - "get-intrinsic": "^1.2.1", - "is-string": "^1.0.7" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/array-union": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/array-union/-/array-union-2.1.0.tgz", - "integrity": "sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw==", - "dev": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/array-unique": { - "version": "0.3.2", - "resolved": "https://registry.npmjs.org/array-unique/-/array-unique-0.3.2.tgz", - "integrity": "sha512-SleRWjh9JUud2wH1hPs9rZBZ33H6T9HOiL0uwGnGx9FpE6wKGyfWugmbkEOIs6qWrZhg0LWeLziLrEwQJhs5mQ==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/array.prototype.findlastindex": { - "version": "1.2.3", - "resolved": "https://registry.npmjs.org/array.prototype.findlastindex/-/array.prototype.findlastindex-1.2.3.tgz", - "integrity": "sha512-LzLoiOMAxvy+Gd3BAq3B7VeIgPdo+Q8hthvKtXybMvRV0jrXfJM/t8mw7nNlpEcVlVUnCnM2KSX4XU5HmpodOA==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "define-properties": "^1.2.0", - "es-abstract": "^1.22.1", - "es-shim-unscopables": "^1.0.0", - "get-intrinsic": "^1.2.1" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/array.prototype.flat": { - "version": "1.3.2", - "resolved": "https://registry.npmjs.org/array.prototype.flat/-/array.prototype.flat-1.3.2.tgz", - "integrity": "sha512-djYB+Zx2vLewY8RWlNCUdHjDXs2XOgm602S9E7P/UpHgfeHL00cRiIF+IN/G/aUJ7kGPb6yO/ErDI5V2s8iycA==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "define-properties": "^1.2.0", - "es-abstract": "^1.22.1", - "es-shim-unscopables": "^1.0.0" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/array.prototype.flatmap": { - "version": "1.3.2", - "resolved": "https://registry.npmjs.org/array.prototype.flatmap/-/array.prototype.flatmap-1.3.2.tgz", - "integrity": "sha512-Ewyx0c9PmpcsByhSW4r+9zDU7sGjFc86qf/kKtuSCRdhfbk0SNLLkaT5qvcHnRGgc5NP/ly/y+qkXkqONX54CQ==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "define-properties": "^1.2.0", - "es-abstract": "^1.22.1", - "es-shim-unscopables": "^1.0.0" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/array.prototype.tosorted": { - "version": "1.1.2", - "resolved": "https://registry.npmjs.org/array.prototype.tosorted/-/array.prototype.tosorted-1.1.2.tgz", - "integrity": "sha512-HuQCHOlk1Weat5jzStICBCd83NxiIMwqDg/dHEsoefabn/hJRj5pVdWcPUSpRrwhwxZOsQassMpgN/xRYFBMIg==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "define-properties": "^1.2.0", - "es-abstract": "^1.22.1", - "es-shim-unscopables": "^1.0.0", - "get-intrinsic": "^1.2.1" - } - }, - "node_modules/arraybuffer.prototype.slice": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/arraybuffer.prototype.slice/-/arraybuffer.prototype.slice-1.0.2.tgz", - "integrity": "sha512-yMBKppFur/fbHu9/6USUe03bZ4knMYiwFBcyiaXB8Go0qNehwX6inYPzK9U0NeQvGxKthcmHcaR8P5MStSRBAw==", - "dev": true, - "dependencies": { - "array-buffer-byte-length": "^1.0.0", - "call-bind": "^1.0.2", - "define-properties": "^1.2.0", - "es-abstract": "^1.22.1", - "get-intrinsic": "^1.2.1", - "is-array-buffer": "^3.0.2", - "is-shared-array-buffer": "^1.0.2" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/arrify": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/arrify/-/arrify-1.0.1.tgz", - "integrity": "sha512-3CYzex9M9FGQjCGMGyi6/31c8GJbgb0qGyrx5HWxPd0aCwh4cB2YjMb2Xf9UuoogrMrlO9cTqnB5rI5GHZTcUA==", - "dev": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/assign-symbols": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/assign-symbols/-/assign-symbols-1.0.0.tgz", - "integrity": "sha512-Q+JC7Whu8HhmTdBph/Tq59IoRtoy6KAm5zzPv00WdujX82lbAL8K7WVjne7vdCsAmbF4AYaDOPyO3k0kl8qIrw==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/ast-types-flow": { - "version": "0.0.7", - "resolved": "https://registry.npmjs.org/ast-types-flow/-/ast-types-flow-0.0.7.tgz", - "integrity": "sha512-eBvWn1lvIApYMhzQMsu9ciLfkBY499mFZlNqG+/9WR7PVlroQw0vG30cOQQbaKz3sCEc44TAOu2ykzqXSNnwag==", - "dev": true - }, - "node_modules/astral-regex": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/astral-regex/-/astral-regex-2.0.0.tgz", - "integrity": "sha512-Z7tMw1ytTXt5jqMcOP+OQteU1VuNK9Y02uuJtKQ1Sv69jXQKKg5cibLwGJow8yzZP+eAc18EmLGPal0bp36rvQ==", - "dev": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/async": { - "version": "3.2.4", - "resolved": "https://registry.npmjs.org/async/-/async-3.2.4.tgz", - "integrity": "sha512-iAB+JbDEGXhyIUavoDl9WP/Jj106Kz9DEn1DPgYw5ruDn0e3Wgi3sKFm55sASdGBNOQB8F59d9qQ7deqrHA8wQ==", - "dev": true - }, - "node_modules/asynciterator.prototype": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/asynciterator.prototype/-/asynciterator.prototype-1.0.0.tgz", - "integrity": "sha512-wwHYEIS0Q80f5mosx3L/dfG5t5rjEa9Ft51GTaNt862EnpyGHpgz2RkZvLPp1oF5TnAiTohkEKVEu8pQPJI7Vg==", - "dev": true, - "dependencies": { - "has-symbols": "^1.0.3" - } - }, - "node_modules/asynckit": { - "version": "0.4.0", - "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz", - "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==", - "dev": true - }, - "node_modules/at-least-node": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/at-least-node/-/at-least-node-1.0.0.tgz", - "integrity": "sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg==", - "dev": true, - "engines": { - "node": ">= 4.0.0" - } - }, - "node_modules/atob": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/atob/-/atob-2.1.2.tgz", - "integrity": "sha512-Wm6ukoaOGJi/73p/cl2GvLjTI5JM1k/O14isD73YML8StrH/7/lRFgmg8nICZgD3bZZvjwCGxtMOD3wWNAu8cg==", - "dev": true, - "peer": true, - "bin": { - "atob": "bin/atob.js" - }, - "engines": { - "node": ">= 4.5.0" - } - }, - "node_modules/autoprefixer": { - "version": "9.8.8", - "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-9.8.8.tgz", - "integrity": "sha512-eM9d/swFopRt5gdJ7jrpCwgvEMIayITpojhkkSMRsFHYuH5bkSQ4p/9qTEHtmNudUZh22Tehu7I6CxAW0IXTKA==", - "dev": true, - "dependencies": { - "browserslist": "^4.12.0", - "caniuse-lite": "^1.0.30001109", - "normalize-range": "^0.1.2", - "num2fraction": "^1.2.2", - "picocolors": "^0.2.1", - "postcss": "^7.0.32", - "postcss-value-parser": "^4.1.0" - }, - "bin": { - "autoprefixer": "bin/autoprefixer" - }, - "funding": { - "type": "tidelift", - "url": "https://tidelift.com/funding/github/npm/autoprefixer" - } - }, - "node_modules/autoprefixer/node_modules/picocolors": { - "version": "0.2.1", - "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-0.2.1.tgz", - "integrity": "sha512-cMlDqaLEqfSaW8Z7N5Jw+lyIW869EzT73/F5lhtY9cLGoVxSXznfgfXMO0Z5K0o0Q2TkTXq+0KFsdnSe3jDViA==", - "dev": true - }, - "node_modules/autoprefixer/node_modules/postcss": { - "version": "7.0.39", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-7.0.39.tgz", - "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==", - "dev": true, - "dependencies": { - "picocolors": "^0.2.1", - "source-map": "^0.6.1" - }, - "engines": { - "node": ">=6.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/postcss/" - } - }, - "node_modules/available-typed-arrays": { - "version": "1.0.5", - "resolved": "https://registry.npmjs.org/available-typed-arrays/-/available-typed-arrays-1.0.5.tgz", - "integrity": "sha512-DMD0KiN46eipeziST1LPP/STfDU0sufISXmjSgvVsoU2tqxctQeASejWcfNtxYKqETM1UxQ8sp2OrSBWpHY6sw==", - "dev": true, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/axe-core": { - "version": "4.8.2", - "resolved": "https://registry.npmjs.org/axe-core/-/axe-core-4.8.2.tgz", - "integrity": "sha512-/dlp0fxyM3R8YW7MFzaHWXrf4zzbr0vaYb23VBFCl83R7nWNPg/yaQw2Dc8jzCMmDVLhSdzH8MjrsuIUuvX+6g==", - "dev": true, - "engines": { - "node": ">=4" - } - }, - "node_modules/axobject-query": { - "version": "3.2.1", - "resolved": "https://registry.npmjs.org/axobject-query/-/axobject-query-3.2.1.tgz", - "integrity": "sha512-jsyHu61e6N4Vbz/v18DHwWYKK0bSWLqn47eeDSKPB7m8tqMHF9YJ+mhIk2lVteyZrY8tnSj/jHOv4YiTCuCJgg==", - "dev": true, - "dependencies": { - "dequal": "^2.0.3" - } - }, - "node_modules/babel-jest": { - "version": "26.6.3", - "resolved": "https://registry.npmjs.org/babel-jest/-/babel-jest-26.6.3.tgz", - "integrity": "sha512-pl4Q+GAVOHwvjrck6jKjvmGhnO3jHX/xuB9d27f+EJZ/6k+6nMuPjorrYp7s++bKKdANwzElBWnLWaObvTnaZA==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/transform": "^26.6.2", - "@jest/types": "^26.6.2", - "@types/babel__core": "^7.1.7", - "babel-plugin-istanbul": "^6.0.0", - "babel-preset-jest": "^26.6.2", - "chalk": "^4.0.0", - "graceful-fs": "^4.2.4", - "slash": "^3.0.0" - }, - "engines": { - "node": ">= 10.14.2" - }, - "peerDependencies": { - "@babel/core": "^7.0.0" - } - }, - "node_modules/babel-plugin-istanbul": { - "version": "6.1.1", - "resolved": "https://registry.npmjs.org/babel-plugin-istanbul/-/babel-plugin-istanbul-6.1.1.tgz", - "integrity": "sha512-Y1IQok9821cC9onCx5otgFfRm7Lm+I+wwxOx738M/WLPZ9Q42m4IG5W0FNX8WLL2gYMZo3JkuXIH2DOpWM+qwA==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/helper-plugin-utils": "^7.0.0", - "@istanbuljs/load-nyc-config": "^1.0.0", - "@istanbuljs/schema": "^0.1.2", - "istanbul-lib-instrument": "^5.0.4", - "test-exclude": "^6.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/babel-plugin-istanbul/node_modules/istanbul-lib-instrument": { - "version": "5.2.1", - "resolved": "https://registry.npmjs.org/istanbul-lib-instrument/-/istanbul-lib-instrument-5.2.1.tgz", - "integrity": "sha512-pzqtp31nLv/XFOzXGuvhCb8qhjmTVo5vjVk19XE4CRlSWz0KoeJ3bw9XsA7nOp9YBf4qHjwBxkDzKcME/J29Yg==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/core": "^7.12.3", - "@babel/parser": "^7.14.7", - "@istanbuljs/schema": "^0.1.2", - "istanbul-lib-coverage": "^3.2.0", - "semver": "^6.3.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/babel-plugin-istanbul/node_modules/semver": { - "version": "6.3.1", - "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz", - "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==", - "dev": true, - "peer": true, - "bin": { - "semver": "bin/semver.js" - } - }, - "node_modules/babel-plugin-jest-hoist": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/babel-plugin-jest-hoist/-/babel-plugin-jest-hoist-26.6.2.tgz", - "integrity": "sha512-PO9t0697lNTmcEHH69mdtYiOIkkOlj9fySqfO3K1eCcdISevLAE0xY59VLLUj0SoiPiTX/JU2CYFpILydUa5Lw==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/template": "^7.3.3", - "@babel/types": "^7.3.3", - "@types/babel__core": "^7.0.0", - "@types/babel__traverse": "^7.0.6" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/babel-preset-current-node-syntax": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/babel-preset-current-node-syntax/-/babel-preset-current-node-syntax-1.0.1.tgz", - "integrity": "sha512-M7LQ0bxarkxQoN+vz5aJPsLBn77n8QgTFmo8WK0/44auK2xlCXrYcUxHFxgU7qW5Yzw/CjmLRK2uJzaCd7LvqQ==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/plugin-syntax-async-generators": "^7.8.4", - "@babel/plugin-syntax-bigint": "^7.8.3", - "@babel/plugin-syntax-class-properties": "^7.8.3", - "@babel/plugin-syntax-import-meta": "^7.8.3", - "@babel/plugin-syntax-json-strings": "^7.8.3", - "@babel/plugin-syntax-logical-assignment-operators": "^7.8.3", - "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3", - "@babel/plugin-syntax-numeric-separator": "^7.8.3", - "@babel/plugin-syntax-object-rest-spread": "^7.8.3", - "@babel/plugin-syntax-optional-catch-binding": "^7.8.3", - "@babel/plugin-syntax-optional-chaining": "^7.8.3", - "@babel/plugin-syntax-top-level-await": "^7.8.3" - }, - "peerDependencies": { - "@babel/core": "^7.0.0" - } - }, - "node_modules/babel-preset-jest": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/babel-preset-jest/-/babel-preset-jest-26.6.2.tgz", - "integrity": "sha512-YvdtlVm9t3k777c5NPQIv6cxFFFapys25HiUmuSgHwIZhfifweR5c5Sf5nwE3MAbfu327CYSvps8Yx6ANLyleQ==", - "dev": true, - "peer": true, - "dependencies": { - "babel-plugin-jest-hoist": "^26.6.2", - "babel-preset-current-node-syntax": "^1.0.0" - }, - "engines": { - "node": ">= 10.14.2" - }, - "peerDependencies": { - "@babel/core": "^7.0.0" - } - }, - "node_modules/bail": { - "version": "1.0.5", - "resolved": "https://registry.npmjs.org/bail/-/bail-1.0.5.tgz", - "integrity": "sha512-xFbRxM1tahm08yHBP16MMjVUAvDaBMD38zsM9EMAUN61omwLmKlOpB/Zku5QkjZ8TZ4vn53pj+t518cH0S03RQ==", - "dev": true, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/balanced-match": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz", - "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==", - "dev": true - }, - "node_modules/base": { - "version": "0.11.2", - "resolved": "https://registry.npmjs.org/base/-/base-0.11.2.tgz", - "integrity": "sha512-5T6P4xPgpp0YDFvSWwEZ4NoE3aM4QBQXDzmVbraCkFj8zHM+mba8SyqB5DbZWyR7mYHo6Y7BdQo3MoA4m0TeQg==", - "dev": true, - "peer": true, - "dependencies": { - "cache-base": "^1.0.1", - "class-utils": "^0.3.5", - "component-emitter": "^1.2.1", - "define-property": "^1.0.0", - "isobject": "^3.0.1", - "mixin-deep": "^1.2.0", - "pascalcase": "^0.1.1" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/base/node_modules/define-property": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/define-property/-/define-property-1.0.0.tgz", - "integrity": "sha512-cZTYKFWspt9jZsMscWo8sc/5lbPC9Q0N5nBLgb+Yd915iL3udB1uFgS3B8YCx66UVHq018DAVFoee7x+gxggeA==", - "dev": true, - "peer": true, - "dependencies": { - "is-descriptor": "^1.0.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/brace-expansion": { - "version": "1.1.11", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz", - "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==", - "dev": true, - "dependencies": { - "balanced-match": "^1.0.0", - "concat-map": "0.0.1" - } - }, - "node_modules/braces": { - "version": "3.0.2", - "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.2.tgz", - "integrity": "sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==", - "dev": true, - "dependencies": { - "fill-range": "^7.0.1" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/browser-process-hrtime": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/browser-process-hrtime/-/browser-process-hrtime-1.0.0.tgz", - "integrity": "sha512-9o5UecI3GhkpM6DrXr69PblIuWxPKk9Y0jHBRhdocZ2y7YECBFCsHm79Pr3OyR2AvjhDkabFJaDJMYRazHgsow==", - "dev": true, - "peer": true - }, - "node_modules/browserslist": { - "version": "4.22.1", - "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.22.1.tgz", - "integrity": "sha512-FEVc202+2iuClEhZhrWy6ZiAcRLvNMyYcxZ8raemul1DYVOVdFsbqckWLdsixQZCpJlwe77Z3UTalE7jsjnKfQ==", - "dev": true, - "funding": [ - { - "type": "opencollective", - "url": "https://opencollective.com/browserslist" - }, - { - "type": "tidelift", - "url": "https://tidelift.com/funding/github/npm/browserslist" - }, - { - "type": "github", - "url": "https://github.com/sponsors/ai" - } - ], - "dependencies": { - "caniuse-lite": "^1.0.30001541", - "electron-to-chromium": "^1.4.535", - "node-releases": "^2.0.13", - "update-browserslist-db": "^1.0.13" - }, - "bin": { - "browserslist": "cli.js" - }, - "engines": { - "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7" - } - }, - "node_modules/bs-logger": { - "version": "0.2.6", - "resolved": "https://registry.npmjs.org/bs-logger/-/bs-logger-0.2.6.tgz", - "integrity": "sha512-pd8DCoxmbgc7hyPKOvxtqNcjYoOsABPQdcCUjGp3d42VR2CX1ORhk2A87oqqu5R1kk+76nsxZupkmyd+MVtCog==", - "dev": true, - "dependencies": { - "fast-json-stable-stringify": "2.x" - }, - "engines": { - "node": ">= 6" - } - }, - "node_modules/bser": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/bser/-/bser-2.1.1.tgz", - "integrity": "sha512-gQxTNE/GAfIIrmHLUE3oJyp5FO6HRBfhjnw4/wMmA63ZGDJnWBmgY/lyQBpnDUkGmAhbSe39tx2d/iTOAfglwQ==", - "dev": true, - "peer": true, - "dependencies": { - "node-int64": "^0.4.0" - } - }, - "node_modules/buffer-from": { - "version": "1.1.2", - "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz", - "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==", - "dev": true - }, - "node_modules/busboy": { - "version": "1.6.0", - "resolved": "https://registry.npmjs.org/busboy/-/busboy-1.6.0.tgz", - "integrity": "sha512-8SFQbg/0hQ9xy3UNTB0YEnsNBbWfhf7RtnzpL7TkBiTBRfrQ9Fxcnz7VJsleJpyp6rVLvXiuORqjlHi5q+PYuA==", - "dev": true, - "dependencies": { - "streamsearch": "^1.1.0" - }, - "engines": { - "node": ">=10.16.0" - } - }, - "node_modules/cache-base": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/cache-base/-/cache-base-1.0.1.tgz", - "integrity": "sha512-AKcdTnFSWATd5/GCPRxr2ChwIJ85CeyrEyjRHlKxQ56d4XJMGym0uAiKn0xbLOGOl3+yRpOTi484dVCEc5AUzQ==", - "dev": true, - "peer": true, - "dependencies": { - "collection-visit": "^1.0.0", - "component-emitter": "^1.2.1", - "get-value": "^2.0.6", - "has-value": "^1.0.0", - "isobject": "^3.0.1", - "set-value": "^2.0.0", - "to-object-path": "^0.3.0", - "union-value": "^1.0.0", - "unset-value": "^1.0.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/call-bind": { - "version": "1.0.5", - "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.5.tgz", - "integrity": "sha512-C3nQxfFZxFRVoJoGKKI8y3MOEo129NQ+FgQ08iye+Mk4zNZZGdjfs06bVTr+DBSlA66Q2VEcMki/cUCP4SercQ==", - "dev": true, - "dependencies": { - "function-bind": "^1.1.2", - "get-intrinsic": "^1.2.1", - "set-function-length": "^1.1.1" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/callsites": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz", - "integrity": "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==", - "dev": true, - "engines": { - "node": ">=6" - } - }, - "node_modules/camelcase": { - "version": "5.3.1", - "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz", - "integrity": "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==", - "dev": true, - "engines": { - "node": ">=6" - } - }, - "node_modules/camelcase-keys": { - "version": "6.2.2", - "resolved": "https://registry.npmjs.org/camelcase-keys/-/camelcase-keys-6.2.2.tgz", - "integrity": "sha512-YrwaA0vEKazPBkn0ipTiMpSajYDSe+KjQfrjhcBMxJt/znbvlHd8Pw/Vamaz5EB4Wfhs3SUR3Z9mwRu/P3s3Yg==", - "dev": true, - "dependencies": { - "camelcase": "^5.3.1", - "map-obj": "^4.0.0", - "quick-lru": "^4.0.1" - }, - "engines": { - "node": ">=8" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/caniuse-lite": { - "version": "1.0.30001580", - "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001580.tgz", - "integrity": "sha512-mtj5ur2FFPZcCEpXFy8ADXbDACuNFXg6mxVDqp7tqooX6l3zwm+d8EPoeOSIFRDvHs8qu7/SLFOGniULkcH2iA==", - "dev": true, - "funding": [ - { - "type": "opencollective", - "url": "https://opencollective.com/browserslist" - }, - { - "type": "tidelift", - "url": "https://tidelift.com/funding/github/npm/caniuse-lite" - }, - { - "type": "github", - "url": "https://github.com/sponsors/ai" - } - ] - }, - "node_modules/capture-exit": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/capture-exit/-/capture-exit-2.0.0.tgz", - "integrity": "sha512-PiT/hQmTonHhl/HFGN+Lx3JJUznrVYJ3+AQsnthneZbvW7x+f08Tk7yLJTLEOUvBTbduLeeBkxEaYXUOUrRq6g==", - "dev": true, - "peer": true, - "dependencies": { - "rsvp": "^4.8.4" - }, - "engines": { - "node": "6.* || 8.* || >= 10.*" - } - }, - "node_modules/ccount": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/ccount/-/ccount-1.1.0.tgz", - "integrity": "sha512-vlNK021QdI7PNeiUh/lKkC/mNHHfV0m/Ad5JoI0TYtlBnJAslM/JIkm/tGC88bkLIwO6OQ5uV6ztS6kVAtCDlg==", - "dev": true, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/chalk": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.0.tgz", - "integrity": "sha512-qwx12AxXe2Q5xQ43Ac//I6v5aXTipYrSESdOgzrN+9XjgEpyjpKuvSGaN4qE93f7TQTlerQQ8S+EQ0EyDoVL1A==", - "dev": true, - "dependencies": { - "ansi-styles": "^4.1.0", - "supports-color": "^7.1.0" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/chalk/chalk?sponsor=1" - } - }, - "node_modules/char-regex": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/char-regex/-/char-regex-1.0.2.tgz", - "integrity": "sha512-kWWXztvZ5SBQV+eRgKFeh8q5sLuZY2+8WUIzlxWVTg+oGwY14qylx1KbKzHd8P6ZYkAg0xyIDU9JMHhyJMZ1jw==", - "dev": true, - "peer": true, - "engines": { - "node": ">=10" - } - }, - "node_modules/character-entities": { - "version": "1.2.4", - "resolved": "https://registry.npmjs.org/character-entities/-/character-entities-1.2.4.tgz", - "integrity": "sha512-iBMyeEHxfVnIakwOuDXpVkc54HijNgCyQB2w0VfGQThle6NXn50zU6V/u+LDhxHcDUPojn6Kpga3PTAD8W1bQw==", - "dev": true, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/character-entities-html4": { - "version": "1.1.4", - "resolved": "https://registry.npmjs.org/character-entities-html4/-/character-entities-html4-1.1.4.tgz", - "integrity": "sha512-HRcDxZuZqMx3/a+qrzxdBKBPUpxWEq9xw2OPZ3a/174ihfrQKVsFhqtthBInFy1zZ9GgZyFXOatNujm8M+El3g==", - "dev": true, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/character-entities-legacy": { - "version": "1.1.4", - "resolved": "https://registry.npmjs.org/character-entities-legacy/-/character-entities-legacy-1.1.4.tgz", - "integrity": "sha512-3Xnr+7ZFS1uxeiUDvV02wQ+QDbc55o97tIV5zHScSPJpcLm/r0DFPcoY3tYRp+VZukxuMeKgXYmsXQHO05zQeA==", - "dev": true, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/character-reference-invalid": { - "version": "1.1.4", - "resolved": "https://registry.npmjs.org/character-reference-invalid/-/character-reference-invalid-1.1.4.tgz", - "integrity": "sha512-mKKUkUbhPpQlCOfIuZkvSEgktjPFIsZKRRbC6KWVEMvlzblj3i3asQv5ODsrwt0N3pHAEvjP8KTQPHkp0+6jOg==", - "dev": true, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/chardet": { - "version": "0.7.0", - "resolved": "https://registry.npmjs.org/chardet/-/chardet-0.7.0.tgz", - "integrity": "sha512-mT8iDcrh03qDGRRmoA2hmBJnxpllMR+0/0qlzjqZES6NdiWDcZkCNAk4rPFZ9Q85r27unkiNNg8ZOiwZXBHwcA==", - "dev": true - }, - "node_modules/ci-info": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-2.0.0.tgz", - "integrity": "sha512-5tK7EtrZ0N+OLFMthtqOj4fI2Jeb88C4CAZPu25LDVUgXJ0A3Js4PMGqrn0JU1W0Mh1/Z8wZzYPxqUrXeBboCQ==", - "dev": true - }, - "node_modules/cjs-module-lexer": { - "version": "0.6.0", - "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-0.6.0.tgz", - "integrity": "sha512-uc2Vix1frTfnuzxxu1Hp4ktSvM3QaI4oXl4ZUqL1wjTu/BGki9TrCWoqLTg/drR1KwAEarXuRFCG2Svr1GxPFw==", - "dev": true, - "peer": true - }, - "node_modules/class-utils": { - "version": "0.3.6", - "resolved": "https://registry.npmjs.org/class-utils/-/class-utils-0.3.6.tgz", - "integrity": "sha512-qOhPa/Fj7s6TY8H8esGu5QNpMMQxz79h+urzrNYN6mn+9BnxlDGf5QZ+XeCDsxSjPqsSR56XOZOJmpeurnLMeg==", - "dev": true, - "peer": true, - "dependencies": { - "arr-union": "^3.1.0", - "define-property": "^0.2.5", - "isobject": "^3.0.0", - "static-extend": "^0.1.1" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/class-utils/node_modules/define-property": { - "version": "0.2.5", - "resolved": "https://registry.npmjs.org/define-property/-/define-property-0.2.5.tgz", - "integrity": "sha512-Rr7ADjQZenceVOAKop6ALkkRAmH1A4Gx9hV/7ZujPUN2rkATqFO0JZLZInbAjpZYoJ1gUx8MRMQVkYemcbMSTA==", - "dev": true, - "peer": true, - "dependencies": { - "is-descriptor": "^0.1.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/class-utils/node_modules/is-descriptor": { - "version": "0.1.7", - "resolved": "https://registry.npmjs.org/is-descriptor/-/is-descriptor-0.1.7.tgz", - "integrity": "sha512-C3grZTvObeN1xud4cRWl366OMXZTj0+HGyk4hvfpx4ZHt1Pb60ANSXqCK7pdOTeUQpRzECBSTphqvD7U+l22Eg==", - "dev": true, - "peer": true, - "dependencies": { - "is-accessor-descriptor": "^1.0.1", - "is-data-descriptor": "^1.0.1" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/clean-stack": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/clean-stack/-/clean-stack-2.2.0.tgz", - "integrity": "sha512-4diC9HaTE+KRAMWhDhrGOECgWZxoevMc5TlkObMqNSsVU62PYzXZ/SMTjzyGAFF1YusgxGcSWTEXBhp0CPwQ1A==", - "dev": true, - "engines": { - "node": ">=6" - } - }, - "node_modules/cli-cursor": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/cli-cursor/-/cli-cursor-3.1.0.tgz", - "integrity": "sha512-I/zHAwsKf9FqGoXM4WWRACob9+SNukZTd94DWF57E4toouRulbCxcUh6RKUEOQlYTHJnzkPMySvPNaaSLNfLZw==", - "dev": true, - "dependencies": { - "restore-cursor": "^3.1.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/cli-truncate": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/cli-truncate/-/cli-truncate-2.1.0.tgz", - "integrity": "sha512-n8fOixwDD6b/ObinzTrp1ZKFzbgvKZvuz/TvejnLn1aQfC6r52XEx85FmuC+3HI+JM7coBRXUvNqEU2PHVrHpg==", - "dev": true, - "dependencies": { - "slice-ansi": "^3.0.0", - "string-width": "^4.2.0" - }, - "engines": { - "node": ">=8" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/cli-width": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/cli-width/-/cli-width-3.0.0.tgz", - "integrity": "sha512-FxqpkPPwu1HjuN93Omfm4h8uIanXofW0RxVEW3k5RKx+mJJYSthzNhp32Kzxxy3YAEZ/Dc/EWN1vZRY0+kOhbw==", - "dev": true, - "engines": { - "node": ">= 10" - } - }, - "node_modules/client-only": { - "version": "0.0.1", - "resolved": "https://registry.npmjs.org/client-only/-/client-only-0.0.1.tgz", - "integrity": "sha512-IV3Ou0jSMzZrd3pZ48nLkT9DA7Ag1pnPzaiQhpW7c3RbcqqzvzzVu+L8gfqMp/8IM2MQtSiqaCxrrcfu8I8rMA==", - "dev": true - }, - "node_modules/cliui": { - "version": "8.0.1", - "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz", - "integrity": "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==", - "dev": true, - "dependencies": { - "string-width": "^4.2.0", - "strip-ansi": "^6.0.1", - "wrap-ansi": "^7.0.0" - }, - "engines": { - "node": ">=12" - } - }, - "node_modules/clone-regexp": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/clone-regexp/-/clone-regexp-2.2.0.tgz", - "integrity": "sha512-beMpP7BOtTipFuW8hrJvREQ2DrRu3BE7by0ZpibtfBA+qfHYvMGTc2Yb1JMYPKg/JUw0CHYvpg796aNTSW9z7Q==", - "dev": true, - "dependencies": { - "is-regexp": "^2.0.0" - }, - "engines": { - "node": ">=6" - } - }, - "node_modules/clone-regexp/node_modules/is-regexp": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/is-regexp/-/is-regexp-2.1.0.tgz", - "integrity": "sha512-OZ4IlER3zmRIoB9AqNhEggVxqIH4ofDns5nRrPS6yQxXE1TPCUpFznBfRQmQa8uC+pXqjMnukiJBxCisIxiLGA==", - "dev": true, - "engines": { - "node": ">=6" - } - }, - "node_modules/co": { - "version": "4.6.0", - "resolved": "https://registry.npmjs.org/co/-/co-4.6.0.tgz", - "integrity": "sha512-QVb0dM5HvG+uaxitm8wONl7jltx8dqhfU33DcqtOZcLSVIKSDDLDi7+0LbAKiyI8hD9u42m2YxXSkMGWThaecQ==", - "dev": true, - "peer": true, - "engines": { - "iojs": ">= 1.0.0", - "node": ">= 0.12.0" - } - }, - "node_modules/collapse-white-space": { - "version": "1.0.6", - "resolved": "https://registry.npmjs.org/collapse-white-space/-/collapse-white-space-1.0.6.tgz", - "integrity": "sha512-jEovNnrhMuqyCcjfEJA56v0Xq8SkIoPKDyaHahwo3POf4qcSXqMYuwNcOTzp74vTsR9Tn08z4MxWqAhcekogkQ==", - "dev": true, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/collect-v8-coverage": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/collect-v8-coverage/-/collect-v8-coverage-1.0.2.tgz", - "integrity": "sha512-lHl4d5/ONEbLlJvaJNtsF/Lz+WvB07u2ycqTYbdrq7UypDXailES4valYb2eWiJFxZlVmpGekfqoxQhzyFdT4Q==", - "dev": true, - "peer": true - }, - "node_modules/collection-visit": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/collection-visit/-/collection-visit-1.0.0.tgz", - "integrity": "sha512-lNkKvzEeMBBjUGHZ+q6z9pSJla0KWAQPvtzhEV9+iGyQYG+pBpl7xKDhxoNSOZH2hhv0v5k0y2yAM4o4SjoSkw==", - "dev": true, - "peer": true, - "dependencies": { - "map-visit": "^1.0.0", - "object-visit": "^1.0.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/color-convert": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz", - "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==", - "dev": true, - "dependencies": { - "color-name": "~1.1.4" - }, - "engines": { - "node": ">=7.0.0" - } - }, - "node_modules/color-name": { - "version": "1.1.4", - "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz", - "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==", - "dev": true - }, - "node_modules/colorette": { - "version": "2.0.20", - "resolved": "https://registry.npmjs.org/colorette/-/colorette-2.0.20.tgz", - "integrity": "sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w==", - "dev": true - }, - "node_modules/combined-stream": { - "version": "1.0.8", - "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz", - "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==", - "dev": true, - "dependencies": { - "delayed-stream": "~1.0.0" - }, - "engines": { - "node": ">= 0.8" - } - }, - "node_modules/commander": { - "version": "7.2.0", - "resolved": "https://registry.npmjs.org/commander/-/commander-7.2.0.tgz", - "integrity": "sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw==", - "dev": true, - "engines": { - "node": ">= 10" - } - }, - "node_modules/compare-versions": { - "version": "3.6.0", - "resolved": "https://registry.npmjs.org/compare-versions/-/compare-versions-3.6.0.tgz", - "integrity": "sha512-W6Af2Iw1z4CB7q4uU4hv646dW9GQuBM+YpC0UvUCWSD8w90SJjp+ujJuXaEMtAXBtSqGfMPuFOVn4/+FlaqfBA==", - "dev": true - }, - "node_modules/component-emitter": { - "version": "1.3.0", - "resolved": "https://registry.npmjs.org/component-emitter/-/component-emitter-1.3.0.tgz", - "integrity": "sha512-Rd3se6QB+sO1TwqZjscQrurpEPIfO0/yYnSin6Q/rD3mOutHvUrCAhJub3r90uNb+SESBuE0QYoB90YdfatsRg==", - "dev": true, - "peer": true - }, - "node_modules/concat-map": { - "version": "0.0.1", - "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz", - "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==", - "dev": true - }, - "node_modules/convert-source-map": { - "version": "1.9.0", - "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.9.0.tgz", - "integrity": "sha512-ASFBup0Mz1uyiIjANan1jzLQami9z1PoYSZCiiYW2FczPbenXc45FZdBZLzOT+r6+iciuEModtmCti+hjaAk0A==", - "dev": true - }, - "node_modules/copy-descriptor": { - "version": "0.1.1", - "resolved": "https://registry.npmjs.org/copy-descriptor/-/copy-descriptor-0.1.1.tgz", - "integrity": "sha512-XgZ0pFcakEUlbwQEVNg3+QAis1FyTL3Qel9FYy8pSkQqoG3PNoT0bOCQtOXcOkur21r2Eq2kI+IE+gsmAEVlYw==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/cosmiconfig": { - "version": "7.1.0", - "resolved": "https://registry.npmjs.org/cosmiconfig/-/cosmiconfig-7.1.0.tgz", - "integrity": "sha512-AdmX6xUzdNASswsFtmwSt7Vj8po9IuqXm0UXz7QKPuEUmPB4XyjGfaAr2PSuELMwkRMVH1EpIkX5bTZGRB3eCA==", - "dev": true, - "dependencies": { - "@types/parse-json": "^4.0.0", - "import-fresh": "^3.2.1", - "parse-json": "^5.0.0", - "path-type": "^4.0.0", - "yaml": "^1.10.0" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/cosmiconfig/node_modules/yaml": { - "version": "1.10.2", - "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.2.tgz", - "integrity": "sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg==", - "dev": true, - "engines": { - "node": ">= 6" - } - }, - "node_modules/cross-fetch": { - "version": "3.1.8", - "resolved": "https://registry.npmjs.org/cross-fetch/-/cross-fetch-3.1.8.tgz", - "integrity": "sha512-cvA+JwZoU0Xq+h6WkMvAUqPEYy92Obet6UdKLfW60qn99ftItKjB5T+BkyWOFWe2pUyfQ+IJHmpOTznqk1M6Kg==", - "dev": true, - "dependencies": { - "node-fetch": "^2.6.12" - } - }, - "node_modules/cross-spawn": { - "version": "7.0.3", - "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz", - "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==", - "dev": true, - "dependencies": { - "path-key": "^3.1.0", - "shebang-command": "^2.0.0", - "which": "^2.0.1" - }, - "engines": { - "node": ">= 8" - } - }, - "node_modules/cssesc": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/cssesc/-/cssesc-3.0.0.tgz", - "integrity": "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==", - "dev": true, - "bin": { - "cssesc": "bin/cssesc" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/cssom": { - "version": "0.4.4", - "resolved": "https://registry.npmjs.org/cssom/-/cssom-0.4.4.tgz", - "integrity": "sha512-p3pvU7r1MyyqbTk+WbNJIgJjG2VmTIaB10rI93LzVPrmDJKkzKYMtxxyAvQXR/NS6otuzveI7+7BBq3SjBS2mw==", - "dev": true, - "peer": true - }, - "node_modules/cssstyle": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/cssstyle/-/cssstyle-2.3.0.tgz", - "integrity": "sha512-AZL67abkUzIuvcHqk7c09cezpGNcxUxU4Ioi/05xHk4DQeTkWmGYftIE6ctU6AEt+Gn4n1lDStOtj7FKycP71A==", - "dev": true, - "peer": true, - "dependencies": { - "cssom": "~0.3.6" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/cssstyle/node_modules/cssom": { - "version": "0.3.8", - "resolved": "https://registry.npmjs.org/cssom/-/cssom-0.3.8.tgz", - "integrity": "sha512-b0tGHbfegbhPJpxpiBPU2sCkigAqtM9O121le6bbOlgyV+NyGyCmVfJ6QW9eRjz8CpNfWEOYBIMIGRYkLwsIYg==", - "dev": true, - "peer": true - }, - "node_modules/damerau-levenshtein": { - "version": "1.0.8", - "resolved": "https://registry.npmjs.org/damerau-levenshtein/-/damerau-levenshtein-1.0.8.tgz", - "integrity": "sha512-sdQSFB7+llfUcQHUQO3+B8ERRj0Oa4w9POWMI/puGtuf7gFywGmkaLCElnudfTiKZV+NvHqL0ifzdrI8Ro7ESA==", - "dev": true - }, - "node_modules/data-urls": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/data-urls/-/data-urls-2.0.0.tgz", - "integrity": "sha512-X5eWTSXO/BJmpdIKCRuKUgSCgAN0OwliVK3yPKbwIWU1Tdw5BRajxlzMidvh+gwko9AfQ9zIj52pzF91Q3YAvQ==", - "dev": true, - "peer": true, - "dependencies": { - "abab": "^2.0.3", - "whatwg-mimetype": "^2.3.0", - "whatwg-url": "^8.0.0" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/debug": { - "version": "4.3.4", - "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz", - "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==", - "dev": true, - "dependencies": { - "ms": "2.1.2" - }, - "engines": { - "node": ">=6.0" - }, - "peerDependenciesMeta": { - "supports-color": { - "optional": true - } - } - }, - "node_modules/decamelize": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/decamelize/-/decamelize-1.2.0.tgz", - "integrity": "sha512-z2S+W9X73hAUUki+N+9Za2lBlun89zigOyGrsax+KUQ6wKW4ZoWpEYBkGhQjwAjjDCkWxhY0VKEhk8wzY7F5cA==", - "dev": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/decamelize-keys": { - "version": "1.1.1", - "resolved": "https://registry.npmjs.org/decamelize-keys/-/decamelize-keys-1.1.1.tgz", - "integrity": "sha512-WiPxgEirIV0/eIOMcnFBA3/IJZAZqKnwAwWyvvdi4lsr1WCN22nhdf/3db3DoZcUjTV2SqfzIwNyp6y2xs3nmg==", - "dev": true, - "dependencies": { - "decamelize": "^1.1.0", - "map-obj": "^1.0.0" - }, - "engines": { - "node": ">=0.10.0" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/decamelize-keys/node_modules/map-obj": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/map-obj/-/map-obj-1.0.1.tgz", - "integrity": "sha512-7N/q3lyZ+LVCp7PzuxrJr4KMbBE2hW7BT7YNia330OFxIf4d3r5zVpicP2650l7CPN6RM9zOJRl3NGpqSiw3Eg==", - "dev": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/decimal.js": { - "version": "10.4.3", - "resolved": "https://registry.npmjs.org/decimal.js/-/decimal.js-10.4.3.tgz", - "integrity": "sha512-VBBaLc1MgL5XpzgIP7ny5Z6Nx3UrRkIViUkPUdtl9aya5amy3De1gsUUSB1g3+3sExYNjCAsAznmukyxCb1GRA==", - "dev": true, - "peer": true - }, - "node_modules/decode-uri-component": { - "version": "0.2.2", - "resolved": "https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.2.tgz", - "integrity": "sha512-FqUYQ+8o158GyGTrMFJms9qh3CqTKvAqgqsTnkLI8sKu0028orqBhxNMFkFen0zGyg6epACD32pjVk58ngIErQ==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10" - } - }, - "node_modules/deep-is": { - "version": "0.1.4", - "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz", - "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==", - "dev": true - }, - "node_modules/deepmerge": { - "version": "4.3.1", - "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz", - "integrity": "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/define-data-property": { - "version": "1.1.1", - "resolved": "https://registry.npmjs.org/define-data-property/-/define-data-property-1.1.1.tgz", - "integrity": "sha512-E7uGkTzkk1d0ByLeSc6ZsFS79Axg+m1P/VsgYsxHgiuc3tFSj+MjMIwe90FC4lOAZzNBdY7kkO2P2wKdsQ1vgQ==", - "dev": true, - "dependencies": { - "get-intrinsic": "^1.2.1", - "gopd": "^1.0.1", - "has-property-descriptors": "^1.0.0" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/define-properties": { - "version": "1.2.1", - "resolved": "https://registry.npmjs.org/define-properties/-/define-properties-1.2.1.tgz", - "integrity": "sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg==", - "dev": true, - "dependencies": { - "define-data-property": "^1.0.1", - "has-property-descriptors": "^1.0.0", - "object-keys": "^1.1.1" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/define-property": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/define-property/-/define-property-2.0.2.tgz", - "integrity": "sha512-jwK2UV4cnPpbcG7+VRARKTZPUWowwXA8bzH5NP6ud0oeAxyYPuGZUAC7hMugpCdz4BeSZl2Dl9k66CHJ/46ZYQ==", - "dev": true, - "peer": true, - "dependencies": { - "is-descriptor": "^1.0.2", - "isobject": "^3.0.1" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/delayed-stream": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz", - "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==", - "dev": true, - "engines": { - "node": ">=0.4.0" - } - }, - "node_modules/dequal": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz", - "integrity": "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==", - "dev": true, - "engines": { - "node": ">=6" - } - }, - "node_modules/detect-newline": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/detect-newline/-/detect-newline-3.1.0.tgz", - "integrity": "sha512-TLz+x/vEXm/Y7P7wn1EJFNLxYpUD4TgMosxY6fAVJUnJMbupHBOncxyWUG9OpTaH9EBD7uFI5LfEgmMOc54DsA==", - "dev": true, - "peer": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/diff-sequences": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/diff-sequences/-/diff-sequences-26.6.2.tgz", - "integrity": "sha512-Mv/TDa3nZ9sbc5soK+OoA74BsS3mL37yixCvUAQkiuA4Wz6YtwP/K47n2rv2ovzHZvoiQeA5FTQOschKkEwB0Q==", - "dev": true, - "peer": true, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/dir-glob": { - "version": "3.0.1", - "resolved": "https://registry.npmjs.org/dir-glob/-/dir-glob-3.0.1.tgz", - "integrity": "sha512-WkrWp9GR4KXfKGYzOLmTuGVi1UWFfws377n9cc55/tb6DuqyF6pcQ5AbiHEshaDpY9v6oaSr2XCDidGmMwdzIA==", - "dev": true, - "dependencies": { - "path-type": "^4.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/doctrine": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-3.0.0.tgz", - "integrity": "sha512-yS+Q5i3hBf7GBkd4KG8a7eBNNWNGLTaEwwYWUijIYM7zrlYDM0BFXHjjPWlWZ1Rg7UaddZeIDmi9jF3HmqiQ2w==", - "dev": true, - "dependencies": { - "esutils": "^2.0.2" - }, - "engines": { - "node": ">=6.0.0" - } - }, - "node_modules/dom-serializer": { - "version": "0.2.2", - "resolved": "https://registry.npmjs.org/dom-serializer/-/dom-serializer-0.2.2.tgz", - "integrity": "sha512-2/xPb3ORsQ42nHYiSunXkDjPLBaEj/xTwUO4B7XCZQTRk7EBtTOPaygh10YAAh2OI1Qrp6NWfpAhzswj0ydt9g==", - "dev": true, - "dependencies": { - "domelementtype": "^2.0.1", - "entities": "^2.0.0" - } - }, - "node_modules/dom-serializer/node_modules/domelementtype": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/domelementtype/-/domelementtype-2.3.0.tgz", - "integrity": "sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw==", - "dev": true, - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/fb55" - } - ] - }, - "node_modules/dom-serializer/node_modules/entities": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/entities/-/entities-2.2.0.tgz", - "integrity": "sha512-p92if5Nz619I0w+akJrLZH0MX0Pb5DX39XOwQTtXSdQQOaYH03S1uIQp4mhOZtAXrxq4ViO67YTiLBo2638o9A==", - "dev": true, - "funding": { - "url": "https://github.com/fb55/entities?sponsor=1" - } - }, - "node_modules/domelementtype": { - "version": "1.3.1", - "resolved": "https://registry.npmjs.org/domelementtype/-/domelementtype-1.3.1.tgz", - "integrity": "sha512-BSKB+TSpMpFI/HOxCNr1O8aMOTZ8hT3pM3GQ0w/mWRmkhEDSFJkkyzz4XQsBV44BChwGkrDfMyjVD0eA2aFV3w==", - "dev": true - }, - "node_modules/domexception": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/domexception/-/domexception-2.0.1.tgz", - "integrity": "sha512-yxJ2mFy/sibVQlu5qHjOkf9J3K6zgmCxgJ94u2EdvDOV09H+32LtRswEcUsmUWN72pVLOEnTSRaIVVzVQgS0dg==", - "dev": true, - "peer": true, - "dependencies": { - "webidl-conversions": "^5.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/domexception/node_modules/webidl-conversions": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-5.0.0.tgz", - "integrity": "sha512-VlZwKPCkYKxQgeSbH5EyngOmRp7Ww7I9rQLERETtf5ofd9pGeswWiOtogpEO850jziPRarreGxn5QIiTqpb2wA==", - "dev": true, - "peer": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/domhandler": { - "version": "2.4.2", - "resolved": "https://registry.npmjs.org/domhandler/-/domhandler-2.4.2.tgz", - "integrity": "sha512-JiK04h0Ht5u/80fdLMCEmV4zkNh2BcoMFBmZ/91WtYZ8qVXSKjiw7fXMgFPnHcSZgOo3XdinHvmnDUeMf5R4wA==", - "dev": true, - "dependencies": { - "domelementtype": "1" - } - }, - "node_modules/domutils": { - "version": "1.7.0", - "resolved": "https://registry.npmjs.org/domutils/-/domutils-1.7.0.tgz", - "integrity": "sha512-Lgd2XcJ/NjEw+7tFvfKxOzCYKZsdct5lczQ2ZaQY8Djz7pfAD3Gbp8ySJWtreII/vDlMVmxwa6pHmdxIYgttDg==", - "dev": true, - "dependencies": { - "dom-serializer": "0", - "domelementtype": "1" - } - }, - "node_modules/eastasianwidth": { - "version": "0.2.0", - "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz", - "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==", - "dev": true - }, - "node_modules/ejs": { - "version": "3.1.5", - "resolved": "https://registry.npmjs.org/ejs/-/ejs-3.1.5.tgz", - "integrity": "sha512-dldq3ZfFtgVTJMLjOe+/3sROTzALlL9E34V4/sDtUd/KlBSS0s6U1/+WPE1B4sj9CXHJpL1M6rhNJnc9Wbal9w==", - "dev": true, - "dependencies": { - "jake": "^10.6.1" - }, - "bin": { - "ejs": "bin/cli.js" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/electron-to-chromium": { - "version": "1.4.573", - "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.573.tgz", - "integrity": "sha512-tzxxvKDTO3V5vzN2F+3v9jrK9gEbCdf1YYJUx/zVq1cyzyh+x1ddeYNNWh0ZS2ETNCVK3+Pns1LHIBq4w20X2Q==", - "dev": true - }, - "node_modules/emittery": { - "version": "0.7.2", - "resolved": "https://registry.npmjs.org/emittery/-/emittery-0.7.2.tgz", - "integrity": "sha512-A8OG5SR/ij3SsJdWDJdkkSYUjQdCUx6APQXem0SaEePBSRg4eymGYwBkKo1Y6DU+af/Jn2dBQqDBvjnr9Vi8nQ==", - "dev": true, - "peer": true, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sindresorhus/emittery?sponsor=1" - } - }, - "node_modules/emoji-regex": { - "version": "9.2.2", - "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz", - "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==", - "dev": true - }, - "node_modules/end-of-stream": { - "version": "1.4.4", - "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.4.tgz", - "integrity": "sha512-+uw1inIHVPQoaVuHzRyXd21icM+cnt4CzD5rW+NC1wjOUSTOs+Te7FOv7AhN7vS9x/oIyhLP5PR1H+phQAHu5Q==", - "dev": true, - "peer": true, - "dependencies": { - "once": "^1.4.0" - } - }, - "node_modules/enhanced-resolve": { - "version": "5.15.0", - "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.15.0.tgz", - "integrity": "sha512-LXYT42KJ7lpIKECr2mAXIaMldcNCh/7E0KBKOu4KSfkHmP+mZmSs+8V5gBAqisWBy0OO4W5Oyys0GO1Y8KtdKg==", - "dev": true, - "dependencies": { - "graceful-fs": "^4.2.4", - "tapable": "^2.2.0" - }, - "engines": { - "node": ">=10.13.0" - } - }, - "node_modules/enquirer": { - "version": "2.4.1", - "resolved": "https://registry.npmjs.org/enquirer/-/enquirer-2.4.1.tgz", - "integrity": "sha512-rRqJg/6gd538VHvR3PSrdRBb/1Vy2YfzHqzvbhGIQpDRKIa4FgV/54b5Q1xYSxOOwKvjXweS26E0Q+nAMwp2pQ==", - "dev": true, - "dependencies": { - "ansi-colors": "^4.1.1", - "strip-ansi": "^6.0.1" - }, - "engines": { - "node": ">=8.6" - } - }, - "node_modules/entities": { - "version": "1.1.2", - "resolved": "https://registry.npmjs.org/entities/-/entities-1.1.2.tgz", - "integrity": "sha512-f2LZMYl1Fzu7YSBKg+RoROelpOaNrcGmE9AZubeDfrCEia483oW4MI4VyFd5VNHIgQ/7qm1I0wUHK1eJnn2y2w==", - "dev": true - }, - "node_modules/error-ex": { - "version": "1.3.2", - "resolved": "https://registry.npmjs.org/error-ex/-/error-ex-1.3.2.tgz", - "integrity": "sha512-7dFHNmqeFSEt2ZBsCriorKnn3Z2pj+fd9kmI6QoWw4//DL+icEBfc0U7qJCisqrTsKTjw4fNFy2pW9OqStD84g==", - "dev": true, - "dependencies": { - "is-arrayish": "^0.2.1" - } - }, - "node_modules/es-abstract": { - "version": "1.22.3", - "resolved": "https://registry.npmjs.org/es-abstract/-/es-abstract-1.22.3.tgz", - "integrity": "sha512-eiiY8HQeYfYH2Con2berK+To6GrK2RxbPawDkGq4UiCQQfZHb6wX9qQqkbpPqaxQFcl8d9QzZqo0tGE0VcrdwA==", - "dev": true, - "dependencies": { - "array-buffer-byte-length": "^1.0.0", - "arraybuffer.prototype.slice": "^1.0.2", - "available-typed-arrays": "^1.0.5", - "call-bind": "^1.0.5", - "es-set-tostringtag": "^2.0.1", - "es-to-primitive": "^1.2.1", - "function.prototype.name": "^1.1.6", - "get-intrinsic": "^1.2.2", - "get-symbol-description": "^1.0.0", - "globalthis": "^1.0.3", - "gopd": "^1.0.1", - "has-property-descriptors": "^1.0.0", - "has-proto": "^1.0.1", - "has-symbols": "^1.0.3", - "hasown": "^2.0.0", - "internal-slot": "^1.0.5", - "is-array-buffer": "^3.0.2", - "is-callable": "^1.2.7", - "is-negative-zero": "^2.0.2", - "is-regex": "^1.1.4", - "is-shared-array-buffer": "^1.0.2", - "is-string": "^1.0.7", - "is-typed-array": "^1.1.12", - "is-weakref": "^1.0.2", - "object-inspect": "^1.13.1", - "object-keys": "^1.1.1", - "object.assign": "^4.1.4", - "regexp.prototype.flags": "^1.5.1", - "safe-array-concat": "^1.0.1", - "safe-regex-test": "^1.0.0", - "string.prototype.trim": "^1.2.8", - "string.prototype.trimend": "^1.0.7", - "string.prototype.trimstart": "^1.0.7", - "typed-array-buffer": "^1.0.0", - "typed-array-byte-length": "^1.0.0", - "typed-array-byte-offset": "^1.0.0", - "typed-array-length": "^1.0.4", - "unbox-primitive": "^1.0.2", - "which-typed-array": "^1.1.13" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/es-iterator-helpers": { - "version": "1.0.15", - "resolved": "https://registry.npmjs.org/es-iterator-helpers/-/es-iterator-helpers-1.0.15.tgz", - "integrity": "sha512-GhoY8uYqd6iwUl2kgjTm4CZAf6oo5mHK7BPqx3rKgx893YSsy0LGHV6gfqqQvZt/8xM8xeOnfXBCfqclMKkJ5g==", - "dev": true, - "dependencies": { - "asynciterator.prototype": "^1.0.0", - "call-bind": "^1.0.2", - "define-properties": "^1.2.1", - "es-abstract": "^1.22.1", - "es-set-tostringtag": "^2.0.1", - "function-bind": "^1.1.1", - "get-intrinsic": "^1.2.1", - "globalthis": "^1.0.3", - "has-property-descriptors": "^1.0.0", - "has-proto": "^1.0.1", - "has-symbols": "^1.0.3", - "internal-slot": "^1.0.5", - "iterator.prototype": "^1.1.2", - "safe-array-concat": "^1.0.1" - } - }, - "node_modules/es-set-tostringtag": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.0.2.tgz", - "integrity": "sha512-BuDyupZt65P9D2D2vA/zqcI3G5xRsklm5N3xCwuiy+/vKy8i0ifdsQP1sLgO4tZDSCaQUSnmC48khknGMV3D2Q==", - "dev": true, - "dependencies": { - "get-intrinsic": "^1.2.2", - "has-tostringtag": "^1.0.0", - "hasown": "^2.0.0" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/es-shim-unscopables": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/es-shim-unscopables/-/es-shim-unscopables-1.0.2.tgz", - "integrity": "sha512-J3yBRXCzDu4ULnQwxyToo/OjdMx6akgVC7K6few0a7F/0wLtmKKN7I73AH5T2836UuXRqN7Qg+IIUw/+YJksRw==", - "dev": true, - "dependencies": { - "hasown": "^2.0.0" - } - }, - "node_modules/es-to-primitive": { - "version": "1.2.1", - "resolved": "https://registry.npmjs.org/es-to-primitive/-/es-to-primitive-1.2.1.tgz", - "integrity": "sha512-QCOllgZJtaUo9miYBcLChTUaHNjJF3PYs1VidD7AwiEj1kYxKeQTctLAezAOH5ZKRH0g2IgPn6KwB4IT8iRpvA==", - "dev": true, - "dependencies": { - "is-callable": "^1.1.4", - "is-date-object": "^1.0.1", - "is-symbol": "^1.0.2" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/escalade": { - "version": "3.1.1", - "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.1.1.tgz", - "integrity": "sha512-k0er2gUkLf8O0zKJiAhmkTnJlTvINGv7ygDNPbeIsX/TJjGJZHuh9B2UxbsaEkmlEo9MfhrSzmhIlhRlI2GXnw==", - "dev": true, - "engines": { - "node": ">=6" - } - }, - "node_modules/escape-string-regexp": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz", - "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==", - "dev": true, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/escodegen": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/escodegen/-/escodegen-2.1.0.tgz", - "integrity": "sha512-2NlIDTwUWJN0mRPQOdtQBzbUHvdGY2P1VXSyU83Q3xKxM7WHX2Ql8dKq782Q9TgQUNOLEzEYu9bzLNj1q88I5w==", - "dev": true, - "peer": true, - "dependencies": { - "esprima": "^4.0.1", - "estraverse": "^5.2.0", - "esutils": "^2.0.2" - }, - "bin": { - "escodegen": "bin/escodegen.js", - "esgenerate": "bin/esgenerate.js" - }, - "engines": { - "node": ">=6.0" - }, - "optionalDependencies": { - "source-map": "~0.6.1" - } - }, - "node_modules/eslint": { - "version": "8.52.0", - "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.52.0.tgz", - "integrity": "sha512-zh/JHnaixqHZsolRB/w9/02akBk9EPrOs9JwcTP2ek7yL5bVvXuRariiaAjjoJ5DvuwQ1WAE/HsMz+w17YgBCg==", - "dev": true, - "dependencies": { - "@eslint-community/eslint-utils": "^4.2.0", - "@eslint-community/regexpp": "^4.6.1", - "@eslint/eslintrc": "^2.1.2", - "@eslint/js": "8.52.0", - "@humanwhocodes/config-array": "^0.11.13", - "@humanwhocodes/module-importer": "^1.0.1", - "@nodelib/fs.walk": "^1.2.8", - "@ungap/structured-clone": "^1.2.0", - "ajv": "^6.12.4", - "chalk": "^4.0.0", - "cross-spawn": "^7.0.2", - "debug": "^4.3.2", - "doctrine": "^3.0.0", - "escape-string-regexp": "^4.0.0", - "eslint-scope": "^7.2.2", - "eslint-visitor-keys": "^3.4.3", - "espree": "^9.6.1", - "esquery": "^1.4.2", - "esutils": "^2.0.2", - "fast-deep-equal": "^3.1.3", - "file-entry-cache": "^6.0.1", - "find-up": "^5.0.0", - "glob-parent": "^6.0.2", - "globals": "^13.19.0", - "graphemer": "^1.4.0", - "ignore": "^5.2.0", - "imurmurhash": "^0.1.4", - "is-glob": "^4.0.0", - "is-path-inside": "^3.0.3", - "js-yaml": "^4.1.0", - "json-stable-stringify-without-jsonify": "^1.0.1", - "levn": "^0.4.1", - "lodash.merge": "^4.6.2", - "minimatch": "^3.1.2", - "natural-compare": "^1.4.0", - "optionator": "^0.9.3", - "strip-ansi": "^6.0.1", - "text-table": "^0.2.0" - }, - "bin": { - "eslint": "bin/eslint.js" - }, - "engines": { - "node": "^12.22.0 || ^14.17.0 || >=16.0.0" - }, - "funding": { - "url": "https://opencollective.com/eslint" - } - }, - "node_modules/eslint-config-next": { - "version": "13.5.6", - "resolved": "https://registry.npmjs.org/eslint-config-next/-/eslint-config-next-13.5.6.tgz", - "integrity": "sha512-o8pQsUHTo9aHqJ2YiZDym5gQAMRf7O2HndHo/JZeY7TDD+W4hk6Ma8Vw54RHiBeb7OWWO5dPirQB+Is/aVQ7Kg==", - "dev": true, - "dependencies": { - "@next/eslint-plugin-next": "13.5.6", - "@rushstack/eslint-patch": "^1.3.3", - "@typescript-eslint/parser": "^5.4.2 || ^6.0.0", - "eslint-import-resolver-node": "^0.3.6", - "eslint-import-resolver-typescript": "^3.5.2", - "eslint-plugin-import": "^2.28.1", - "eslint-plugin-jsx-a11y": "^6.7.1", - "eslint-plugin-react": "^7.33.2", - "eslint-plugin-react-hooks": "^4.5.0 || 5.0.0-canary-7118f5dd7-20230705" - }, - "peerDependencies": { - "eslint": "^7.23.0 || ^8.0.0", - "typescript": ">=3.3.1" - }, - "peerDependenciesMeta": { - "typescript": { - "optional": true - } - } - }, - "node_modules/eslint-config-prettier": { - "version": "8.10.0", - "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-8.10.0.tgz", - "integrity": "sha512-SM8AMJdeQqRYT9O9zguiruQZaN7+z+E4eAP9oiLNGKMtomwaB1E9dcgUD6ZAn/eQAb52USbvezbiljfZUhbJcg==", - "dev": true, - "bin": { - "eslint-config-prettier": "bin/cli.js" - }, - "peerDependencies": { - "eslint": ">=7.0.0" - } - }, - "node_modules/eslint-import-resolver-node": { - "version": "0.3.9", - "resolved": "https://registry.npmjs.org/eslint-import-resolver-node/-/eslint-import-resolver-node-0.3.9.tgz", - "integrity": "sha512-WFj2isz22JahUv+B788TlO3N6zL3nNJGU8CcZbPZvVEkBPaJdCV4vy5wyghty5ROFbCRnm132v8BScu5/1BQ8g==", - "dev": true, - "dependencies": { - "debug": "^3.2.7", - "is-core-module": "^2.13.0", - "resolve": "^1.22.4" - } - }, - "node_modules/eslint-import-resolver-node/node_modules/debug": { - "version": "3.2.7", - "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz", - "integrity": "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==", - "dev": true, - "dependencies": { - "ms": "^2.1.1" - } - }, - "node_modules/eslint-import-resolver-typescript": { - "version": "3.6.1", - "resolved": "https://registry.npmjs.org/eslint-import-resolver-typescript/-/eslint-import-resolver-typescript-3.6.1.tgz", - "integrity": "sha512-xgdptdoi5W3niYeuQxKmzVDTATvLYqhpwmykwsh7f6HIOStGWEIL9iqZgQDF9u9OEzrRwR8no5q2VT+bjAujTg==", - "dev": true, - "dependencies": { - "debug": "^4.3.4", - "enhanced-resolve": "^5.12.0", - "eslint-module-utils": "^2.7.4", - "fast-glob": "^3.3.1", - "get-tsconfig": "^4.5.0", - "is-core-module": "^2.11.0", - "is-glob": "^4.0.3" - }, - "engines": { - "node": "^14.18.0 || >=16.0.0" - }, - "funding": { - "url": "https://opencollective.com/unts/projects/eslint-import-resolver-ts" - }, - "peerDependencies": { - "eslint": "*", - "eslint-plugin-import": "*" - } - }, - "node_modules/eslint-module-utils": { - "version": "2.8.0", - "resolved": "https://registry.npmjs.org/eslint-module-utils/-/eslint-module-utils-2.8.0.tgz", - "integrity": "sha512-aWajIYfsqCKRDgUfjEXNN/JlrzauMuSEy5sbd7WXbtW3EH6A6MpwEh42c7qD+MqQo9QMJ6fWLAeIJynx0g6OAw==", - "dev": true, - "dependencies": { - "debug": "^3.2.7" - }, - "engines": { - "node": ">=4" - }, - "peerDependenciesMeta": { - "eslint": { - "optional": true - } - } - }, - "node_modules/eslint-module-utils/node_modules/debug": { - "version": "3.2.7", - "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz", - "integrity": "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==", - "dev": true, - "dependencies": { - "ms": "^2.1.1" - } - }, - "node_modules/eslint-plugin-import": { - "version": "2.29.0", - "resolved": "https://registry.npmjs.org/eslint-plugin-import/-/eslint-plugin-import-2.29.0.tgz", - "integrity": "sha512-QPOO5NO6Odv5lpoTkddtutccQjysJuFxoPS7fAHO+9m9udNHvTCPSAMW9zGAYj8lAIdr40I8yPCdUYrncXtrwg==", - "dev": true, - "dependencies": { - "array-includes": "^3.1.7", - "array.prototype.findlastindex": "^1.2.3", - "array.prototype.flat": "^1.3.2", - "array.prototype.flatmap": "^1.3.2", - "debug": "^3.2.7", - "doctrine": "^2.1.0", - "eslint-import-resolver-node": "^0.3.9", - "eslint-module-utils": "^2.8.0", - "hasown": "^2.0.0", - "is-core-module": "^2.13.1", - "is-glob": "^4.0.3", - "minimatch": "^3.1.2", - "object.fromentries": "^2.0.7", - "object.groupby": "^1.0.1", - "object.values": "^1.1.7", - "semver": "^6.3.1", - "tsconfig-paths": "^3.14.2" - }, - "engines": { - "node": ">=4" - }, - "peerDependencies": { - "eslint": "^2 || ^3 || ^4 || ^5 || ^6 || ^7.2.0 || ^8" - } - }, - "node_modules/eslint-plugin-import/node_modules/debug": { - "version": "3.2.7", - "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz", - "integrity": "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==", - "dev": true, - "dependencies": { - "ms": "^2.1.1" - } - }, - "node_modules/eslint-plugin-import/node_modules/doctrine": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-2.1.0.tgz", - "integrity": "sha512-35mSku4ZXK0vfCuHEDAwt55dg2jNajHZ1odvF+8SSr82EsZY4QmXfuWso8oEd8zRhVObSN18aM0CjSdoBX7zIw==", - "dev": true, - "dependencies": { - "esutils": "^2.0.2" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/eslint-plugin-import/node_modules/semver": { - "version": "6.3.1", - "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz", - "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==", - "dev": true, - "bin": { - "semver": "bin/semver.js" - } - }, - "node_modules/eslint-plugin-jsx-a11y": { - "version": "6.7.1", - "resolved": "https://registry.npmjs.org/eslint-plugin-jsx-a11y/-/eslint-plugin-jsx-a11y-6.7.1.tgz", - "integrity": "sha512-63Bog4iIethyo8smBklORknVjB0T2dwB8Mr/hIC+fBS0uyHdYYpzM/Ed+YC8VxTjlXHEWFOdmgwcDn1U2L9VCA==", - "dev": true, - "dependencies": { - "@babel/runtime": "^7.20.7", - "aria-query": "^5.1.3", - "array-includes": "^3.1.6", - "array.prototype.flatmap": "^1.3.1", - "ast-types-flow": "^0.0.7", - "axe-core": "^4.6.2", - "axobject-query": "^3.1.1", - "damerau-levenshtein": "^1.0.8", - "emoji-regex": "^9.2.2", - "has": "^1.0.3", - "jsx-ast-utils": "^3.3.3", - "language-tags": "=1.0.5", - "minimatch": "^3.1.2", - "object.entries": "^1.1.6", - "object.fromentries": "^2.0.6", - "semver": "^6.3.0" - }, - "engines": { - "node": ">=4.0" - }, - "peerDependencies": { - "eslint": "^3 || ^4 || ^5 || ^6 || ^7 || ^8" - } - }, - "node_modules/eslint-plugin-jsx-a11y/node_modules/semver": { - "version": "6.3.1", - "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz", - "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==", - "dev": true, - "bin": { - "semver": "bin/semver.js" - } - }, - "node_modules/eslint-plugin-prettier": { - "version": "4.2.1", - "resolved": "https://registry.npmjs.org/eslint-plugin-prettier/-/eslint-plugin-prettier-4.2.1.tgz", - "integrity": "sha512-f/0rXLXUt0oFYs8ra4w49wYZBG5GKZpAYsJSm6rnYL5uVDjd+zowwMwVZHnAjf4edNrKpCDYfXDgmRE/Ak7QyQ==", - "dev": true, - "dependencies": { - "prettier-linter-helpers": "^1.0.0" - }, - "engines": { - "node": ">=12.0.0" - }, - "peerDependencies": { - "eslint": ">=7.28.0", - "prettier": ">=2.0.0" - }, - "peerDependenciesMeta": { - "eslint-config-prettier": { - "optional": true - } - } - }, - "node_modules/eslint-plugin-react": { - "version": "7.33.2", - "resolved": "https://registry.npmjs.org/eslint-plugin-react/-/eslint-plugin-react-7.33.2.tgz", - "integrity": "sha512-73QQMKALArI8/7xGLNI/3LylrEYrlKZSb5C9+q3OtOewTnMQi5cT+aE9E41sLCmli3I9PGGmD1yiZydyo4FEPw==", - "dev": true, - "dependencies": { - "array-includes": "^3.1.6", - "array.prototype.flatmap": "^1.3.1", - "array.prototype.tosorted": "^1.1.1", - "doctrine": "^2.1.0", - "es-iterator-helpers": "^1.0.12", - "estraverse": "^5.3.0", - "jsx-ast-utils": "^2.4.1 || ^3.0.0", - "minimatch": "^3.1.2", - "object.entries": "^1.1.6", - "object.fromentries": "^2.0.6", - "object.hasown": "^1.1.2", - "object.values": "^1.1.6", - "prop-types": "^15.8.1", - "resolve": "^2.0.0-next.4", - "semver": "^6.3.1", - "string.prototype.matchall": "^4.0.8" - }, - "engines": { - "node": ">=4" - }, - "peerDependencies": { - "eslint": "^3 || ^4 || ^5 || ^6 || ^7 || ^8" - } - }, - "node_modules/eslint-plugin-react-hooks": { - "version": "4.6.0", - "resolved": "https://registry.npmjs.org/eslint-plugin-react-hooks/-/eslint-plugin-react-hooks-4.6.0.tgz", - "integrity": "sha512-oFc7Itz9Qxh2x4gNHStv3BqJq54ExXmfC+a1NjAta66IAN87Wu0R/QArgIS9qKzX3dXKPI9H5crl9QchNMY9+g==", - "dev": true, - "engines": { - "node": ">=10" - }, - "peerDependencies": { - "eslint": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0" - } - }, - "node_modules/eslint-plugin-react/node_modules/doctrine": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-2.1.0.tgz", - "integrity": "sha512-35mSku4ZXK0vfCuHEDAwt55dg2jNajHZ1odvF+8SSr82EsZY4QmXfuWso8oEd8zRhVObSN18aM0CjSdoBX7zIw==", - "dev": true, - "dependencies": { - "esutils": "^2.0.2" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/eslint-plugin-react/node_modules/resolve": { - "version": "2.0.0-next.5", - "resolved": "https://registry.npmjs.org/resolve/-/resolve-2.0.0-next.5.tgz", - "integrity": "sha512-U7WjGVG9sH8tvjW5SmGbQuui75FiyjAX72HX15DwBBwF9dNiQZRQAg9nnPhYy+TUnE0+VcrttuvNI8oSxZcocA==", - "dev": true, - "dependencies": { - "is-core-module": "^2.13.0", - "path-parse": "^1.0.7", - "supports-preserve-symlinks-flag": "^1.0.0" - }, - "bin": { - "resolve": "bin/resolve" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/eslint-plugin-react/node_modules/semver": { - "version": "6.3.1", - "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz", - "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==", - "dev": true, - "bin": { - "semver": "bin/semver.js" - } - }, - "node_modules/eslint-scope": { - "version": "5.1.1", - "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-5.1.1.tgz", - "integrity": "sha512-2NxwbF/hZ0KpepYN0cNbo+FN6XoK7GaHlQhgx/hIZl6Va0bF45RQOOwhLIy8lQDbuCiadSLCBnH2CFYquit5bw==", - "dev": true, - "dependencies": { - "esrecurse": "^4.3.0", - "estraverse": "^4.1.1" - }, - "engines": { - "node": ">=8.0.0" - } - }, - "node_modules/eslint-scope/node_modules/estraverse": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-4.3.0.tgz", - "integrity": "sha512-39nnKffWz8xN1BU/2c79n9nB9HDzo0niYUqx6xyqUnyoAnQyyWpOTdZEeiCch8BBu515t4wp9ZmgVfVhn9EBpw==", - "dev": true, - "engines": { - "node": ">=4.0" - } - }, - "node_modules/eslint-visitor-keys": { - "version": "3.4.3", - "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz", - "integrity": "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==", - "dev": true, - "engines": { - "node": "^12.22.0 || ^14.17.0 || >=16.0.0" - }, - "funding": { - "url": "https://opencollective.com/eslint" - } - }, - "node_modules/eslint/node_modules/eslint-scope": { - "version": "7.2.2", - "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-7.2.2.tgz", - "integrity": "sha512-dOt21O7lTMhDM+X9mB4GX+DZrZtCUJPL/wlcTqxyrx5IvO0IYtILdtrQGQp+8n5S0gwSVmOf9NQrjMOgfQZlIg==", - "dev": true, - "dependencies": { - "esrecurse": "^4.3.0", - "estraverse": "^5.2.0" - }, - "engines": { - "node": "^12.22.0 || ^14.17.0 || >=16.0.0" - }, - "funding": { - "url": "https://opencollective.com/eslint" - } - }, - "node_modules/eslint/node_modules/find-up": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz", - "integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==", - "dev": true, - "dependencies": { - "locate-path": "^6.0.0", - "path-exists": "^4.0.0" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/eslint/node_modules/locate-path": { - "version": "6.0.0", - "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz", - "integrity": "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==", - "dev": true, - "dependencies": { - "p-locate": "^5.0.0" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/eslint/node_modules/p-limit": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz", - "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==", - "dev": true, - "dependencies": { - "yocto-queue": "^0.1.0" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/eslint/node_modules/p-locate": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-5.0.0.tgz", - "integrity": "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==", - "dev": true, - "dependencies": { - "p-limit": "^3.0.2" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/eslint/node_modules/path-exists": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz", - "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==", - "dev": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/eslint/node_modules/yocto-queue": { - "version": "0.1.0", - "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz", - "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==", - "dev": true, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/espree": { - "version": "9.6.1", - "resolved": "https://registry.npmjs.org/espree/-/espree-9.6.1.tgz", - "integrity": "sha512-oruZaFkjorTpF32kDSI5/75ViwGeZginGGy2NoOSg3Q9bnwlnmDm4HLnkl0RE3n+njDXR037aY1+x58Z/zFdwQ==", - "dev": true, - "dependencies": { - "acorn": "^8.9.0", - "acorn-jsx": "^5.3.2", - "eslint-visitor-keys": "^3.4.1" - }, - "engines": { - "node": "^12.22.0 || ^14.17.0 || >=16.0.0" - }, - "funding": { - "url": "https://opencollective.com/eslint" - } - }, - "node_modules/esprima": { - "version": "4.0.1", - "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz", - "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==", - "dev": true, - "peer": true, - "bin": { - "esparse": "bin/esparse.js", - "esvalidate": "bin/esvalidate.js" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/esquery": { - "version": "1.5.0", - "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.5.0.tgz", - "integrity": "sha512-YQLXUplAwJgCydQ78IMJywZCceoqk1oH01OERdSAJc/7U2AylwjhSCLDEtqwg811idIS/9fIU5GjG73IgjKMVg==", - "dev": true, - "dependencies": { - "estraverse": "^5.1.0" - }, - "engines": { - "node": ">=0.10" - } - }, - "node_modules/esrecurse": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz", - "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==", - "dev": true, - "dependencies": { - "estraverse": "^5.2.0" - }, - "engines": { - "node": ">=4.0" - } - }, - "node_modules/estraverse": { - "version": "5.3.0", - "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz", - "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==", - "dev": true, - "engines": { - "node": ">=4.0" - } - }, - "node_modules/esutils": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz", - "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==", - "dev": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/exec-sh": { - "version": "0.3.6", - "resolved": "https://registry.npmjs.org/exec-sh/-/exec-sh-0.3.6.tgz", - "integrity": "sha512-nQn+hI3yp+oD0huYhKwvYI32+JFeq+XkNcD1GAo3Y/MjxsfVGmrrzrnzjWiNY6f+pUCP440fThsFh5gZrRAU/w==", - "dev": true, - "peer": true - }, - "node_modules/execa": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/execa/-/execa-4.1.0.tgz", - "integrity": "sha512-j5W0//W7f8UxAn8hXVnwG8tLwdiUy4FJLcSupCg6maBYZDpyBvTApK7KyuI4bKj8KOh1r2YH+6ucuYtJv1bTZA==", - "dev": true, - "peer": true, - "dependencies": { - "cross-spawn": "^7.0.0", - "get-stream": "^5.0.0", - "human-signals": "^1.1.1", - "is-stream": "^2.0.0", - "merge-stream": "^2.0.0", - "npm-run-path": "^4.0.0", - "onetime": "^5.1.0", - "signal-exit": "^3.0.2", - "strip-final-newline": "^2.0.0" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sindresorhus/execa?sponsor=1" - } - }, - "node_modules/execall": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/execall/-/execall-2.0.0.tgz", - "integrity": "sha512-0FU2hZ5Hh6iQnarpRtQurM/aAvp3RIbfvgLHrcqJYzhXyV2KFruhuChf9NC6waAhiUR7FFtlugkI4p7f2Fqlow==", - "dev": true, - "dependencies": { - "clone-regexp": "^2.1.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/exit": { - "version": "0.1.2", - "resolved": "https://registry.npmjs.org/exit/-/exit-0.1.2.tgz", - "integrity": "sha512-Zk/eNKV2zbjpKzrsQ+n1G6poVbErQxJ0LBOJXaKZ1EViLzH+hrLu9cdXI4zw9dBQJslwBEpbQ2P1oS7nDxs6jQ==", - "dev": true, - "peer": true, - "engines": { - "node": ">= 0.8.0" - } - }, - "node_modules/expand-brackets": { - "version": "2.1.4", - "resolved": "https://registry.npmjs.org/expand-brackets/-/expand-brackets-2.1.4.tgz", - "integrity": "sha512-w/ozOKR9Obk3qoWeY/WDi6MFta9AoMR+zud60mdnbniMcBxRuFJyDt2LdX/14A1UABeqk+Uk+LDfUpvoGKppZA==", - "dev": true, - "peer": true, - "dependencies": { - "debug": "^2.3.3", - "define-property": "^0.2.5", - "extend-shallow": "^2.0.1", - "posix-character-classes": "^0.1.0", - "regex-not": "^1.0.0", - "snapdragon": "^0.8.1", - "to-regex": "^3.0.1" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/expand-brackets/node_modules/debug": { - "version": "2.6.9", - "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz", - "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==", - "dev": true, - "peer": true, - "dependencies": { - "ms": "2.0.0" - } - }, - "node_modules/expand-brackets/node_modules/define-property": { - "version": "0.2.5", - "resolved": "https://registry.npmjs.org/define-property/-/define-property-0.2.5.tgz", - "integrity": "sha512-Rr7ADjQZenceVOAKop6ALkkRAmH1A4Gx9hV/7ZujPUN2rkATqFO0JZLZInbAjpZYoJ1gUx8MRMQVkYemcbMSTA==", - "dev": true, - "peer": true, - "dependencies": { - "is-descriptor": "^0.1.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/expand-brackets/node_modules/extend-shallow": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz", - "integrity": "sha512-zCnTtlxNoAiDc3gqY2aYAWFx7XWWiasuF2K8Me5WbN8otHKTUKBwjPtNpRs/rbUZm7KxWAaNj7P1a/p52GbVug==", - "dev": true, - "peer": true, - "dependencies": { - "is-extendable": "^0.1.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/expand-brackets/node_modules/is-descriptor": { - "version": "0.1.7", - "resolved": "https://registry.npmjs.org/is-descriptor/-/is-descriptor-0.1.7.tgz", - "integrity": "sha512-C3grZTvObeN1xud4cRWl366OMXZTj0+HGyk4hvfpx4ZHt1Pb60ANSXqCK7pdOTeUQpRzECBSTphqvD7U+l22Eg==", - "dev": true, - "peer": true, - "dependencies": { - "is-accessor-descriptor": "^1.0.1", - "is-data-descriptor": "^1.0.1" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/expand-brackets/node_modules/is-extendable": { - "version": "0.1.1", - "resolved": "https://registry.npmjs.org/is-extendable/-/is-extendable-0.1.1.tgz", - "integrity": "sha512-5BMULNob1vgFX6EjQw5izWDxrecWK9AM72rugNr0TFldMOi0fj6Jk+zeKIt0xGj4cEfQIJth4w3OKWOJ4f+AFw==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/expand-brackets/node_modules/ms": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz", - "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==", - "dev": true, - "peer": true - }, - "node_modules/expect": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/expect/-/expect-26.6.2.tgz", - "integrity": "sha512-9/hlOBkQl2l/PLHJx6JjoDF6xPKcJEsUlWKb23rKE7KzeDqUZKXKNMW27KIue5JMdBV9HgmoJPcc8HtO85t9IA==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/types": "^26.6.2", - "ansi-styles": "^4.0.0", - "jest-get-type": "^26.3.0", - "jest-matcher-utils": "^26.6.2", - "jest-message-util": "^26.6.2", - "jest-regex-util": "^26.0.0" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/extend": { - "version": "3.0.2", - "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz", - "integrity": "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==", - "dev": true - }, - "node_modules/extend-shallow": { - "version": "3.0.2", - "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-3.0.2.tgz", - "integrity": "sha512-BwY5b5Ql4+qZoefgMj2NUmx+tehVTH/Kf4k1ZEtOHNFcm2wSxMRo992l6X3TIgni2eZVTZ85xMOjF31fwZAj6Q==", - "dev": true, - "peer": true, - "dependencies": { - "assign-symbols": "^1.0.0", - "is-extendable": "^1.0.1" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/external-editor": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/external-editor/-/external-editor-3.1.0.tgz", - "integrity": "sha512-hMQ4CX1p1izmuLYyZqLMO/qGNw10wSv9QDCPfzXfyFrOaCSSoRfqE1Kf1s5an66J5JZC62NewG+mK49jOCtQew==", - "dev": true, - "dependencies": { - "chardet": "^0.7.0", - "iconv-lite": "^0.4.24", - "tmp": "^0.0.33" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/extglob": { - "version": "2.0.4", - "resolved": "https://registry.npmjs.org/extglob/-/extglob-2.0.4.tgz", - "integrity": "sha512-Nmb6QXkELsuBr24CJSkilo6UHHgbekK5UiZgfE6UHD3Eb27YC6oD+bhcT+tJ6cl8dmsgdQxnWlcry8ksBIBLpw==", - "dev": true, - "peer": true, - "dependencies": { - "array-unique": "^0.3.2", - "define-property": "^1.0.0", - "expand-brackets": "^2.1.4", - "extend-shallow": "^2.0.1", - "fragment-cache": "^0.2.1", - "regex-not": "^1.0.0", - "snapdragon": "^0.8.1", - "to-regex": "^3.0.1" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/extglob/node_modules/define-property": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/define-property/-/define-property-1.0.0.tgz", - "integrity": "sha512-cZTYKFWspt9jZsMscWo8sc/5lbPC9Q0N5nBLgb+Yd915iL3udB1uFgS3B8YCx66UVHq018DAVFoee7x+gxggeA==", - "dev": true, - "peer": true, - "dependencies": { - "is-descriptor": "^1.0.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/extglob/node_modules/extend-shallow": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz", - "integrity": "sha512-zCnTtlxNoAiDc3gqY2aYAWFx7XWWiasuF2K8Me5WbN8otHKTUKBwjPtNpRs/rbUZm7KxWAaNj7P1a/p52GbVug==", - "dev": true, - "peer": true, - "dependencies": { - "is-extendable": "^0.1.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/extglob/node_modules/is-extendable": { - "version": "0.1.1", - "resolved": "https://registry.npmjs.org/is-extendable/-/is-extendable-0.1.1.tgz", - "integrity": "sha512-5BMULNob1vgFX6EjQw5izWDxrecWK9AM72rugNr0TFldMOi0fj6Jk+zeKIt0xGj4cEfQIJth4w3OKWOJ4f+AFw==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/extract-files": { - "version": "9.0.0", - "resolved": "https://registry.npmjs.org/extract-files/-/extract-files-9.0.0.tgz", - "integrity": "sha512-CvdFfHkC95B4bBBk36hcEmvdR2awOdhhVUYH6S/zrVj3477zven/fJMYg7121h4T1xHZC+tetUpubpAhxwI7hQ==", - "dev": true, - "engines": { - "node": "^10.17.0 || ^12.0.0 || >= 13.7.0" - }, - "funding": { - "url": "https://github.com/sponsors/jaydenseric" - } - }, - "node_modules/fast-deep-equal": { - "version": "3.1.3", - "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz", - "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==", - "dev": true - }, - "node_modules/fast-diff": { - "version": "1.3.0", - "resolved": "https://registry.npmjs.org/fast-diff/-/fast-diff-1.3.0.tgz", - "integrity": "sha512-VxPP4NqbUjj6MaAOafWeUn2cXWLcCtljklUtZf0Ind4XQ+QPtmA0b18zZy0jIQx+ExRVCR/ZQpBmik5lXshNsw==", - "dev": true - }, - "node_modules/fast-glob": { - "version": "3.3.1", - "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.1.tgz", - "integrity": "sha512-kNFPyjhh5cKjrUltxs+wFx+ZkbRaxxmZ+X0ZU31SOsxCEtP9VPgtq2teZw1DebupL5GmDaNQ6yKMMVcM41iqDg==", - "dev": true, - "dependencies": { - "@nodelib/fs.stat": "^2.0.2", - "@nodelib/fs.walk": "^1.2.3", - "glob-parent": "^5.1.2", - "merge2": "^1.3.0", - "micromatch": "^4.0.4" - }, - "engines": { - "node": ">=8.6.0" - } - }, - "node_modules/fast-glob/node_modules/glob-parent": { - "version": "5.1.2", - "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz", - "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==", - "dev": true, - "dependencies": { - "is-glob": "^4.0.1" - }, - "engines": { - "node": ">= 6" - } - }, - "node_modules/fast-json-stable-stringify": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz", - "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==", - "dev": true - }, - "node_modules/fast-levenshtein": { - "version": "2.0.6", - "resolved": "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz", - "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==", - "dev": true - }, - "node_modules/fastest-levenshtein": { - "version": "1.0.16", - "resolved": "https://registry.npmjs.org/fastest-levenshtein/-/fastest-levenshtein-1.0.16.tgz", - "integrity": "sha512-eRnCtTTtGZFpQCwhJiUOuxPQWRXVKYDn0b2PeHfXL6/Zi53SLAzAHfVhVWK2AryC/WH05kGfxhFIPvTF0SXQzg==", - "dev": true, - "engines": { - "node": ">= 4.9.1" - } - }, - "node_modules/fastq": { - "version": "1.15.0", - "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.15.0.tgz", - "integrity": "sha512-wBrocU2LCXXa+lWBt8RoIRD89Fi8OdABODa/kEnyeyjS5aZO5/GNvI5sEINADqP/h8M29UHTHUb53sUu5Ihqdw==", - "dev": true, - "dependencies": { - "reusify": "^1.0.4" - } - }, - "node_modules/fb-watchman": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/fb-watchman/-/fb-watchman-2.0.2.tgz", - "integrity": "sha512-p5161BqbuCaSnB8jIbzQHOlpgsPmK5rJVDfDKO91Axs5NC1uu3HRQm6wt9cd9/+GtQQIO53JdGXXoyDpTAsgYA==", - "dev": true, - "peer": true, - "dependencies": { - "bser": "2.1.1" - } - }, - "node_modules/figures": { - "version": "3.2.0", - "resolved": "https://registry.npmjs.org/figures/-/figures-3.2.0.tgz", - "integrity": "sha512-yaduQFRKLXYOGgEn6AZau90j3ggSOyiqXU0F9JZfeXYhNa+Jk4X+s45A2zg5jns87GAFa34BBm2kXw4XpNcbdg==", - "dev": true, - "dependencies": { - "escape-string-regexp": "^1.0.5" - }, - "engines": { - "node": ">=8" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/figures/node_modules/escape-string-regexp": { - "version": "1.0.5", - "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz", - "integrity": "sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==", - "dev": true, - "engines": { - "node": ">=0.8.0" - } - }, - "node_modules/file-entry-cache": { - "version": "6.0.1", - "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-6.0.1.tgz", - "integrity": "sha512-7Gps/XWymbLk2QLYK4NzpMOrYjMhdIxXuIvy2QBsLE6ljuodKvdkWs/cpyJJ3CVIVpH0Oi1Hvg1ovbMzLdFBBg==", - "dev": true, - "dependencies": { - "flat-cache": "^3.0.4" - }, - "engines": { - "node": "^10.12.0 || >=12.0.0" - } - }, - "node_modules/filelist": { - "version": "1.0.4", - "resolved": "https://registry.npmjs.org/filelist/-/filelist-1.0.4.tgz", - "integrity": "sha512-w1cEuf3S+DrLCQL7ET6kz+gmlJdbq9J7yXCSjK/OZCPA+qEN1WyF4ZAf0YYJa4/shHJra2t/d/r8SV4Ji+x+8Q==", - "dev": true, - "dependencies": { - "minimatch": "^5.0.1" - } - }, - "node_modules/filelist/node_modules/brace-expansion": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz", - "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==", - "dev": true, - "dependencies": { - "balanced-match": "^1.0.0" - } - }, - "node_modules/filelist/node_modules/minimatch": { - "version": "5.1.6", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.6.tgz", - "integrity": "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==", - "dev": true, - "dependencies": { - "brace-expansion": "^2.0.1" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/fill-range": { - "version": "7.0.1", - "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.0.1.tgz", - "integrity": "sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==", - "dev": true, - "dependencies": { - "to-regex-range": "^5.0.1" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/find-up": { - "version": "6.3.0", - "resolved": "https://registry.npmjs.org/find-up/-/find-up-6.3.0.tgz", - "integrity": "sha512-v2ZsoEuVHYy8ZIlYqwPe/39Cy+cFDzp4dXPaxNvkEuouymu+2Jbz0PxpKarJHYJTmv2HWT3O382qY8l4jMWthw==", - "dev": true, - "dependencies": { - "locate-path": "^7.1.0", - "path-exists": "^5.0.0" - }, - "engines": { - "node": "^12.20.0 || ^14.13.1 || >=16.0.0" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/find-versions": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/find-versions/-/find-versions-4.0.0.tgz", - "integrity": "sha512-wgpWy002tA+wgmO27buH/9KzyEOQnKsG/R0yrcjPT9BOFm0zRBVQbZ95nRGXWMywS8YR5knRbpohio0bcJABxQ==", - "dev": true, - "dependencies": { - "semver-regex": "^3.1.2" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/flat": { - "version": "5.0.2", - "resolved": "https://registry.npmjs.org/flat/-/flat-5.0.2.tgz", - "integrity": "sha512-b6suED+5/3rTpUBdG1gupIl8MPFCAMA0QXwmljLhvCUKcUvdE4gWky9zpuGCcXHOsz4J9wPGNWq6OKpmIzz3hQ==", - "dev": true, - "bin": { - "flat": "cli.js" - } - }, - "node_modules/flat-cache": { - "version": "3.1.1", - "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-3.1.1.tgz", - "integrity": "sha512-/qM2b3LUIaIgviBQovTLvijfyOQXPtSRnRK26ksj2J7rzPIecePUIpJsZ4T02Qg+xiAEKIs5K8dsHEd+VaKa/Q==", - "dev": true, - "dependencies": { - "flatted": "^3.2.9", - "keyv": "^4.5.3", - "rimraf": "^3.0.2" - }, - "engines": { - "node": ">=12.0.0" - } - }, - "node_modules/flatted": { - "version": "3.2.9", - "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.2.9.tgz", - "integrity": "sha512-36yxDn5H7OFZQla0/jFJmbIKTdZAQHngCedGxiMmpNfEZM0sdEeT+WczLQrjK6D7o2aiyLYDnkw0R3JK0Qv1RQ==", - "dev": true - }, - "node_modules/for-each": { - "version": "0.3.3", - "resolved": "https://registry.npmjs.org/for-each/-/for-each-0.3.3.tgz", - "integrity": "sha512-jqYfLp7mo9vIyQf8ykW2v7A+2N4QjeCeI5+Dz9XraiO1ign81wjiH7Fb9vSOWvQfNtmSa4H2RoQTrrXivdUZmw==", - "dev": true, - "dependencies": { - "is-callable": "^1.1.3" - } - }, - "node_modules/for-in": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/for-in/-/for-in-1.0.2.tgz", - "integrity": "sha512-7EwmXrOjyL+ChxMhmG5lnW9MPt1aIeZEwKhQzoBUdTV0N3zuwWDZYVJatDvZ2OyzPUvdIAZDsCetk3coyMfcnQ==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/form-data": { - "version": "3.0.1", - "resolved": "https://registry.npmjs.org/form-data/-/form-data-3.0.1.tgz", - "integrity": "sha512-RHkBKtLWUVwd7SqRIvCZMEvAMoGUp0XU+seQiZejj0COz3RI3hWP4sCv3gZWWLjJTd7rGwcsF5eKZGii0r/hbg==", - "dev": true, - "dependencies": { - "asynckit": "^0.4.0", - "combined-stream": "^1.0.8", - "mime-types": "^2.1.12" - }, - "engines": { - "node": ">= 6" - } - }, - "node_modules/fragment-cache": { - "version": "0.2.1", - "resolved": "https://registry.npmjs.org/fragment-cache/-/fragment-cache-0.2.1.tgz", - "integrity": "sha512-GMBAbW9antB8iZRHLoGw0b3HANt57diZYFO/HL1JGIC1MjKrdmhxvrJbupnVvpys0zsz7yBApXdQyfepKly2kA==", - "dev": true, - "peer": true, - "dependencies": { - "map-cache": "^0.2.2" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/fs-extra": { - "version": "9.0.1", - "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.0.1.tgz", - "integrity": "sha512-h2iAoN838FqAFJY2/qVpzFXy+EBxfVE220PalAqQLDVsFOHLJrZvut5puAbCdNv6WJk+B8ihI+k0c7JK5erwqQ==", - "dev": true, - "dependencies": { - "at-least-node": "^1.0.0", - "graceful-fs": "^4.2.0", - "jsonfile": "^6.0.1", - "universalify": "^1.0.0" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/fs.realpath": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz", - "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==", - "dev": true - }, - "node_modules/fsevents": { - "version": "2.3.3", - "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz", - "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==", - "dev": true, - "hasInstallScript": true, - "optional": true, - "os": [ - "darwin" - ], - "peer": true, - "engines": { - "node": "^8.16.0 || ^10.6.0 || >=11.0.0" - } - }, - "node_modules/function-bind": { - "version": "1.1.2", - "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz", - "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==", - "dev": true, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/function.prototype.name": { - "version": "1.1.6", - "resolved": "https://registry.npmjs.org/function.prototype.name/-/function.prototype.name-1.1.6.tgz", - "integrity": "sha512-Z5kx79swU5P27WEayXM1tBi5Ze/lbIyiNgU3qyXUOf9b2rgXYyF9Dy9Cx+IQv/Lc8WCG6L82zwUPpSS9hGehIg==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "define-properties": "^1.2.0", - "es-abstract": "^1.22.1", - "functions-have-names": "^1.2.3" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/functions-have-names": { - "version": "1.2.3", - "resolved": "https://registry.npmjs.org/functions-have-names/-/functions-have-names-1.2.3.tgz", - "integrity": "sha512-xckBUXyTIqT97tq2x2AMb+g163b5JFysYk0x4qxNFwbfQkmNZoiRHb6sPzI9/QV33WeuvVYBUIiD4NzNIyqaRQ==", - "dev": true, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/gensync": { - "version": "1.0.0-beta.2", - "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz", - "integrity": "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==", - "dev": true, - "engines": { - "node": ">=6.9.0" - } - }, - "node_modules/get-caller-file": { - "version": "2.0.5", - "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz", - "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==", - "dev": true, - "engines": { - "node": "6.* || 8.* || >= 10.*" - } - }, - "node_modules/get-intrinsic": { - "version": "1.2.2", - "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.2.2.tgz", - "integrity": "sha512-0gSo4ml/0j98Y3lngkFEot/zhiCeWsbYIlZ+uZOVgzLyLaUw7wxUL+nCTP0XJvJg1AXulJRI3UJi8GsbDuxdGA==", - "dev": true, - "dependencies": { - "function-bind": "^1.1.2", - "has-proto": "^1.0.1", - "has-symbols": "^1.0.3", - "hasown": "^2.0.0" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/get-own-enumerable-property-symbols": { - "version": "3.0.2", - "resolved": "https://registry.npmjs.org/get-own-enumerable-property-symbols/-/get-own-enumerable-property-symbols-3.0.2.tgz", - "integrity": "sha512-I0UBV/XOz1XkIJHEUDMZAbzCThU/H8DxmSfmdGcKPnVhu2VfFqr34jr9777IyaTYvxjedWhqVIilEDsCdP5G6g==", - "dev": true - }, - "node_modules/get-package-type": { - "version": "0.1.0", - "resolved": "https://registry.npmjs.org/get-package-type/-/get-package-type-0.1.0.tgz", - "integrity": "sha512-pjzuKtY64GYfWizNAJ0fr9VqttZkNiK2iS430LtIHzjBEr6bX8Am2zm4sW4Ro5wjWW5cAlRL1qAMTcXbjNAO2Q==", - "dev": true, - "peer": true, - "engines": { - "node": ">=8.0.0" - } - }, - "node_modules/get-stdin": { - "version": "8.0.0", - "resolved": "https://registry.npmjs.org/get-stdin/-/get-stdin-8.0.0.tgz", - "integrity": "sha512-sY22aA6xchAzprjyqmSEQv4UbAAzRN0L2dQB0NlN5acTTK9Don6nhoc3eAbUnpZiCANAMfd/+40kVdKfFygohg==", - "dev": true, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/get-stream": { - "version": "5.2.0", - "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-5.2.0.tgz", - "integrity": "sha512-nBF+F1rAZVCu/p7rjzgA+Yb4lfYXrpl7a6VmJrU8wF9I1CKvP/QwPNZHnOlwbTkY6dvtFIzFMSyQXbLoTQPRpA==", - "dev": true, - "peer": true, - "dependencies": { - "pump": "^3.0.0" - }, - "engines": { - "node": ">=8" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/get-symbol-description": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/get-symbol-description/-/get-symbol-description-1.0.0.tgz", - "integrity": "sha512-2EmdH1YvIQiZpltCNgkuiUnyukzxM/R6NDJX31Ke3BG1Nq5b0S2PhX59UKi9vZpPDQVdqn+1IcaAwnzTT5vCjw==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "get-intrinsic": "^1.1.1" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/get-tsconfig": { - "version": "4.7.2", - "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-4.7.2.tgz", - "integrity": "sha512-wuMsz4leaj5hbGgg4IvDU0bqJagpftG5l5cXIAvo8uZrqn0NJqwtfupTN00VnkQJPcIRrxYrm1Ue24btpCha2A==", - "dev": true, - "dependencies": { - "resolve-pkg-maps": "^1.0.0" - }, - "funding": { - "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1" - } - }, - "node_modules/get-value": { - "version": "2.0.6", - "resolved": "https://registry.npmjs.org/get-value/-/get-value-2.0.6.tgz", - "integrity": "sha512-Ln0UQDlxH1BapMu3GPtf7CuYNwRZf2gwCuPqbyG6pB8WfmFpzqcy4xtAaAMUhnNqjMKTiCPZG2oMT3YSx8U2NA==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/glob": { - "version": "7.1.7", - "resolved": "https://registry.npmjs.org/glob/-/glob-7.1.7.tgz", - "integrity": "sha512-OvD9ENzPLbegENnYP5UUfJIirTg4+XwMWGaQfQTY0JenxNvvIKP3U3/tAQSPIu/lHxXYSZmpXlUHeqAIdKzBLQ==", - "dev": true, - "dependencies": { - "fs.realpath": "^1.0.0", - "inflight": "^1.0.4", - "inherits": "2", - "minimatch": "^3.0.4", - "once": "^1.3.0", - "path-is-absolute": "^1.0.0" - }, - "engines": { - "node": "*" - }, - "funding": { - "url": "https://github.com/sponsors/isaacs" - } - }, - "node_modules/glob-parent": { - "version": "6.0.2", - "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz", - "integrity": "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==", - "dev": true, - "dependencies": { - "is-glob": "^4.0.3" - }, - "engines": { - "node": ">=10.13.0" - } - }, - "node_modules/global-modules": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/global-modules/-/global-modules-2.0.0.tgz", - "integrity": "sha512-NGbfmJBp9x8IxyJSd1P+otYK8vonoJactOogrVfFRIAEY1ukil8RSKDz2Yo7wh1oihl51l/r6W4epkeKJHqL8A==", - "dev": true, - "dependencies": { - "global-prefix": "^3.0.0" - }, - "engines": { - "node": ">=6" - } - }, - "node_modules/global-prefix": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/global-prefix/-/global-prefix-3.0.0.tgz", - "integrity": "sha512-awConJSVCHVGND6x3tmMaKcQvwXLhjdkmomy2W+Goaui8YPgYgXJZewhg3fWC+DlfqqQuWg8AwqjGTD2nAPVWg==", - "dev": true, - "dependencies": { - "ini": "^1.3.5", - "kind-of": "^6.0.2", - "which": "^1.3.1" - }, - "engines": { - "node": ">=6" - } - }, - "node_modules/global-prefix/node_modules/which": { - "version": "1.3.1", - "resolved": "https://registry.npmjs.org/which/-/which-1.3.1.tgz", - "integrity": "sha512-HxJdYWq1MTIQbJ3nw0cqssHoTNU267KlrDuGZ1WYlxDStUtKUhOaJmh112/TZmHxxUfuJqPXSOm7tDyas0OSIQ==", - "dev": true, - "dependencies": { - "isexe": "^2.0.0" - }, - "bin": { - "which": "bin/which" - } - }, - "node_modules/globals": { - "version": "13.23.0", - "resolved": "https://registry.npmjs.org/globals/-/globals-13.23.0.tgz", - "integrity": "sha512-XAmF0RjlrjY23MA51q3HltdlGxUpXPvg0GioKiD9X6HD28iMjo2dKC8Vqwm7lne4GNr78+RHTfliktR6ZH09wA==", - "dev": true, - "dependencies": { - "type-fest": "^0.20.2" - }, - "engines": { - "node": ">=8" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/globalthis": { - "version": "1.0.3", - "resolved": "https://registry.npmjs.org/globalthis/-/globalthis-1.0.3.tgz", - "integrity": "sha512-sFdI5LyBiNTHjRd7cGPWapiHWMOXKyuBNX/cWJ3NfzrZQVa8GI/8cofCl74AOVqq9W5kNmguTIzJ/1s2gyI9wA==", - "dev": true, - "dependencies": { - "define-properties": "^1.1.3" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/globby": { - "version": "11.0.1", - "resolved": "https://registry.npmjs.org/globby/-/globby-11.0.1.tgz", - "integrity": "sha512-iH9RmgwCmUJHi2z5o2l3eTtGBtXek1OYlHrbcxOYugyHLmAsZrPj43OtHThd62Buh/Vv6VyCBD2bdyWcGNQqoQ==", - "dev": true, - "dependencies": { - "array-union": "^2.1.0", - "dir-glob": "^3.0.1", - "fast-glob": "^3.1.1", - "ignore": "^5.1.4", - "merge2": "^1.3.0", - "slash": "^3.0.0" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/globjoin": { - "version": "0.1.4", - "resolved": "https://registry.npmjs.org/globjoin/-/globjoin-0.1.4.tgz", - "integrity": "sha512-xYfnw62CKG8nLkZBfWbhWwDw02CHty86jfPcc2cr3ZfeuK9ysoVPPEUxf21bAD/rWAgk52SuBrLJlefNy8mvFg==", - "dev": true - }, - "node_modules/gonzales-pe": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/gonzales-pe/-/gonzales-pe-4.3.0.tgz", - "integrity": "sha512-otgSPpUmdWJ43VXyiNgEYE4luzHCL2pz4wQ0OnDluC6Eg4Ko3Vexy/SrSynglw/eR+OhkzmqFCZa/OFa/RgAOQ==", - "dev": true, - "dependencies": { - "minimist": "^1.2.5" - }, - "bin": { - "gonzales": "bin/gonzales.js" - }, - "engines": { - "node": ">=0.6.0" - } - }, - "node_modules/gopd": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.0.1.tgz", - "integrity": "sha512-d65bNlIadxvpb/A2abVdlqKqV563juRnZ1Wtk6s1sIR8uNsXR70xqIzVqxVf1eTqDunwT2MkczEeaezCKTZhwA==", - "dev": true, - "dependencies": { - "get-intrinsic": "^1.1.3" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/graceful-fs": { - "version": "4.2.11", - "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz", - "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==", - "dev": true - }, - "node_modules/graphemer": { - "version": "1.4.0", - "resolved": "https://registry.npmjs.org/graphemer/-/graphemer-1.4.0.tgz", - "integrity": "sha512-EtKwoO6kxCL9WO5xipiHTZlSzBm7WLT627TqC/uVRd0HKmq8NXyebnNYxDoBi7wt8eTWrUrKXCOVaFq9x1kgag==", - "dev": true - }, - "node_modules/graphql": { - "version": "16.8.1", - "resolved": "https://registry.npmjs.org/graphql/-/graphql-16.8.1.tgz", - "integrity": "sha512-59LZHPdGZVh695Ud9lRzPBVTtlX9ZCV150Er2W43ro37wVof0ctenSaskPPjN7lVTIN8mSZt8PHUNKZuNQUuxw==", - "dev": true, - "engines": { - "node": "^12.22.0 || ^14.16.0 || ^16.0.0 || >=17.0.0" - } - }, - "node_modules/graphql-request": { - "version": "5.1.0", - "resolved": "https://registry.npmjs.org/graphql-request/-/graphql-request-5.1.0.tgz", - "integrity": "sha512-0OeRVYigVwIiXhNmqnPDt+JhMzsjinxHE7TVy3Lm6jUzav0guVcL0lfSbi6jVTRAxcbwgyr6yrZioSHxf9gHzw==", - "dev": true, - "dependencies": { - "@graphql-typed-document-node/core": "^3.1.1", - "cross-fetch": "^3.1.5", - "extract-files": "^9.0.0", - "form-data": "^3.0.0" - }, - "peerDependencies": { - "graphql": "14 - 16" - } - }, - "node_modules/growly": { - "version": "1.3.0", - "resolved": "https://registry.npmjs.org/growly/-/growly-1.3.0.tgz", - "integrity": "sha512-+xGQY0YyAWCnqy7Cd++hc2JqMYzlm0dG30Jd0beaA64sROr8C4nt8Yc9V5Ro3avlSUDTN0ulqP/VBKi1/lLygw==", - "dev": true, - "optional": true, - "peer": true - }, - "node_modules/hard-rejection": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/hard-rejection/-/hard-rejection-2.1.0.tgz", - "integrity": "sha512-VIZB+ibDhx7ObhAe7OVtoEbuP4h/MuOTHJ+J8h/eBXotJYl0fBgR72xDFCKgIh22OJZIOVNxBMWuhAr10r8HdA==", - "dev": true, - "engines": { - "node": ">=6" - } - }, - "node_modules/has": { - "version": "1.0.4", - "resolved": "https://registry.npmjs.org/has/-/has-1.0.4.tgz", - "integrity": "sha512-qdSAmqLF6209RFj4VVItywPMbm3vWylknmB3nvNiUIs72xAimcM8nVYxYr7ncvZq5qzk9MKIZR8ijqD/1QuYjQ==", - "dev": true, - "engines": { - "node": ">= 0.4.0" - } - }, - "node_modules/has-bigints": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/has-bigints/-/has-bigints-1.0.2.tgz", - "integrity": "sha512-tSvCKtBr9lkF0Ex0aQiP9N+OpV4zi2r/Nee5VkRDbaqv35RLYMzbwQfFSZZH0kR+Rd6302UJZ2p/bJCEoR3VoQ==", - "dev": true, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/has-flag": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz", - "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==", - "dev": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/has-property-descriptors": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/has-property-descriptors/-/has-property-descriptors-1.0.1.tgz", - "integrity": "sha512-VsX8eaIewvas0xnvinAe9bw4WfIeODpGYikiWYLH+dma0Jw6KHYqWiWfhQlgOVK8D6PvjubK5Uc4P0iIhIcNVg==", - "dev": true, - "dependencies": { - "get-intrinsic": "^1.2.2" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/has-proto": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/has-proto/-/has-proto-1.0.1.tgz", - "integrity": "sha512-7qE+iP+O+bgF9clE5+UoBFzE65mlBiVj3tKCrlNQ0Ogwm0BjpT/gK4SlLYDMybDh5I3TCTKnPPa0oMG7JDYrhg==", - "dev": true, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/has-symbols": { - "version": "1.0.3", - "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.0.3.tgz", - "integrity": "sha512-l3LCuF6MgDNwTDKkdYGEihYjt5pRPbEg46rtlmnSPlUbgmB8LOIrKJbYYFBSbnPaJexMKtiPO8hmeRjRz2Td+A==", - "dev": true, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/has-tostringtag": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.0.tgz", - "integrity": "sha512-kFjcSNhnlGV1kyoGk7OXKSawH5JOb/LzUc5w9B02hOTO0dfFRjbHQKvg1d6cf3HbeUmtU9VbbV3qzZ2Teh97WQ==", - "dev": true, - "dependencies": { - "has-symbols": "^1.0.2" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/has-value": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/has-value/-/has-value-1.0.0.tgz", - "integrity": "sha512-IBXk4GTsLYdQ7Rvt+GRBrFSVEkmuOUy4re0Xjd9kJSUQpnTrWR4/y9RpfexN9vkAPMFuQoeWKwqzPozRTlasGw==", - "dev": true, - "peer": true, - "dependencies": { - "get-value": "^2.0.6", - "has-values": "^1.0.0", - "isobject": "^3.0.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/has-values": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/has-values/-/has-values-1.0.0.tgz", - "integrity": "sha512-ODYZC64uqzmtfGMEAX/FvZiRyWLpAC3vYnNunURUnkGVTS+mI0smVsWaPydRBsE3g+ok7h960jChO8mFcWlHaQ==", - "dev": true, - "peer": true, - "dependencies": { - "is-number": "^3.0.0", - "kind-of": "^4.0.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/has-values/node_modules/is-buffer": { - "version": "1.1.6", - "resolved": "https://registry.npmjs.org/is-buffer/-/is-buffer-1.1.6.tgz", - "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==", - "dev": true, - "peer": true - }, - "node_modules/has-values/node_modules/is-number": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/is-number/-/is-number-3.0.0.tgz", - "integrity": "sha512-4cboCqIpliH+mAvFNegjZQ4kgKc3ZUhQVr3HvWbSh5q3WH2v82ct+T2Y1hdU5Gdtorx/cLifQjqCbL7bpznLTg==", - "dev": true, - "peer": true, - "dependencies": { - "kind-of": "^3.0.2" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/has-values/node_modules/is-number/node_modules/kind-of": { - "version": "3.2.2", - "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz", - "integrity": "sha512-NOW9QQXMoZGg/oqnVNoNTTIFEIid1627WCffUBJEdMxYApq7mNE7CpzucIPc+ZQg25Phej7IJSmX3hO+oblOtQ==", - "dev": true, - "peer": true, - "dependencies": { - "is-buffer": "^1.1.5" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/has-values/node_modules/kind-of": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-4.0.0.tgz", - "integrity": "sha512-24XsCxmEbRwEDbz/qz3stgin8TTzZ1ESR56OMCN0ujYg+vRutNSiOj9bHH9u85DKgXguraugV5sFuvbD4FW/hw==", - "dev": true, - "peer": true, - "dependencies": { - "is-buffer": "^1.1.5" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/hasown": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.0.tgz", - "integrity": "sha512-vUptKVTpIJhcczKBbgnS+RtcuYMB8+oNzPK2/Hp3hanz8JmpATdmmgLgSaadVREkDm+e2giHwY3ZRkyjSIDDFA==", - "dev": true, - "dependencies": { - "function-bind": "^1.1.2" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/hosted-git-info": { - "version": "2.8.9", - "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.8.9.tgz", - "integrity": "sha512-mxIDAb9Lsm6DoOJ7xH+5+X4y1LU/4Hi50L9C5sIswK3JzULS4bwk1FvjdBgvYR4bzT4tuUQiC15FE2f5HbLvYw==", - "dev": true - }, - "node_modules/html-encoding-sniffer": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-2.0.1.tgz", - "integrity": "sha512-D5JbOMBIR/TVZkubHT+OyT2705QvogUW4IBn6nHd756OwieSF9aDYFj4dv6HHEVGYbHaLETa3WggZYWWMyy3ZQ==", - "dev": true, - "peer": true, - "dependencies": { - "whatwg-encoding": "^1.0.5" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/html-escaper": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz", - "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==", - "dev": true, - "peer": true - }, - "node_modules/html-tags": { - "version": "3.3.1", - "resolved": "https://registry.npmjs.org/html-tags/-/html-tags-3.3.1.tgz", - "integrity": "sha512-ztqyC3kLto0e9WbNp0aeP+M3kTt+nbaIveGmUxAtZa+8iFgKLUOD4YKM5j+f3QD89bra7UeumolZHKuOXnTmeQ==", - "dev": true, - "engines": { - "node": ">=8" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/htmlparser2": { - "version": "3.10.1", - "resolved": "https://registry.npmjs.org/htmlparser2/-/htmlparser2-3.10.1.tgz", - "integrity": "sha512-IgieNijUMbkDovyoKObU1DUhm1iwNYE/fuifEoEHfd1oZKZDaONBSkal7Y01shxsM49R4XaMdGez3WnF9UfiCQ==", - "dev": true, - "dependencies": { - "domelementtype": "^1.3.1", - "domhandler": "^2.3.0", - "domutils": "^1.5.1", - "entities": "^1.1.1", - "inherits": "^2.0.1", - "readable-stream": "^3.1.1" - } - }, - "node_modules/http-proxy-agent": { - "version": "4.0.1", - "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-4.0.1.tgz", - "integrity": "sha512-k0zdNgqWTGA6aeIRVpvfVob4fL52dTfaehylg0Y4UvSySvOq/Y+BOyPrgpUrA7HylqvU8vIZGsRuXmspskV0Tg==", - "dev": true, - "peer": true, - "dependencies": { - "@tootallnate/once": "1", - "agent-base": "6", - "debug": "4" - }, - "engines": { - "node": ">= 6" - } - }, - "node_modules/https-proxy-agent": { - "version": "5.0.1", - "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz", - "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==", - "dev": true, - "peer": true, - "dependencies": { - "agent-base": "6", - "debug": "4" - }, - "engines": { - "node": ">= 6" - } - }, - "node_modules/human-signals": { - "version": "1.1.1", - "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-1.1.1.tgz", - "integrity": "sha512-SEQu7vl8KjNL2eoGBLF3+wAjpsNfA9XMlXAYj/3EdaNfAlxKthD1xjEQfGOUhllCGGJVNY34bRr6lPINhNjyZw==", - "dev": true, - "peer": true, - "engines": { - "node": ">=8.12.0" - } - }, - "node_modules/husky": { - "version": "4.3.8", - "resolved": "https://registry.npmjs.org/husky/-/husky-4.3.8.tgz", - "integrity": "sha512-LCqqsB0PzJQ/AlCgfrfzRe3e3+NvmefAdKQhRYpxS4u6clblBoDdzzvHi8fmxKRzvMxPY/1WZWzomPZww0Anow==", - "dev": true, - "hasInstallScript": true, - "dependencies": { - "chalk": "^4.0.0", - "ci-info": "^2.0.0", - "compare-versions": "^3.6.0", - "cosmiconfig": "^7.0.0", - "find-versions": "^4.0.0", - "opencollective-postinstall": "^2.0.2", - "pkg-dir": "^5.0.0", - "please-upgrade-node": "^3.2.0", - "slash": "^3.0.0", - "which-pm-runs": "^1.0.0" - }, - "bin": { - "husky-run": "bin/run.js", - "husky-upgrade": "lib/upgrader/bin.js" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/husky" - } - }, - "node_modules/iconv-lite": { - "version": "0.4.24", - "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz", - "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==", - "dev": true, - "dependencies": { - "safer-buffer": ">= 2.1.2 < 3" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/ignore": { - "version": "5.2.4", - "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.2.4.tgz", - "integrity": "sha512-MAb38BcSbH0eHNBxn7ql2NH/kX33OkB3lZ1BNdh7ENeRChHTYsTvWrMubiIAMNS2llXEEgZ1MUOBtXChP3kaFQ==", - "dev": true, - "engines": { - "node": ">= 4" - } - }, - "node_modules/import-fresh": { - "version": "3.3.0", - "resolved": "https://registry.npmjs.org/import-fresh/-/import-fresh-3.3.0.tgz", - "integrity": "sha512-veYYhQa+D1QBKznvhUHxb8faxlrwUnxseDAbAp457E0wLNio2bOSKnjYDhMj+YiAq61xrMGhQk9iXVk5FzgQMw==", - "dev": true, - "dependencies": { - "parent-module": "^1.0.0", - "resolve-from": "^4.0.0" - }, - "engines": { - "node": ">=6" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/import-lazy": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/import-lazy/-/import-lazy-4.0.0.tgz", - "integrity": "sha512-rKtvo6a868b5Hu3heneU+L4yEQ4jYKLtjpnPeUdK7h0yzXGmyBTypknlkCvHFBqfX9YlorEiMM6Dnq/5atfHkw==", - "dev": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/import-local": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/import-local/-/import-local-3.1.0.tgz", - "integrity": "sha512-ASB07uLtnDs1o6EHjKpX34BKYDSqnFerfTOJL2HvMqF70LnxpjkzDB8J44oT9pu4AMPkQwf8jl6szgvNd2tRIg==", - "dev": true, - "peer": true, - "dependencies": { - "pkg-dir": "^4.2.0", - "resolve-cwd": "^3.0.0" - }, - "bin": { - "import-local-fixture": "fixtures/cli.js" - }, - "engines": { - "node": ">=8" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/import-local/node_modules/find-up": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz", - "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==", - "dev": true, - "peer": true, - "dependencies": { - "locate-path": "^5.0.0", - "path-exists": "^4.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/import-local/node_modules/locate-path": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz", - "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==", - "dev": true, - "peer": true, - "dependencies": { - "p-locate": "^4.1.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/import-local/node_modules/p-limit": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz", - "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==", - "dev": true, - "peer": true, - "dependencies": { - "p-try": "^2.0.0" - }, - "engines": { - "node": ">=6" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/import-local/node_modules/p-locate": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz", - "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==", - "dev": true, - "peer": true, - "dependencies": { - "p-limit": "^2.2.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/import-local/node_modules/path-exists": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz", - "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==", - "dev": true, - "peer": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/import-local/node_modules/pkg-dir": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/pkg-dir/-/pkg-dir-4.2.0.tgz", - "integrity": "sha512-HRDzbaKjC+AOWVXxAU/x54COGeIv9eb+6CkDSQoNTt4XyWoIJvuPsXizxu/Fr23EiekbtZwmh1IcIG/l/a10GQ==", - "dev": true, - "peer": true, - "dependencies": { - "find-up": "^4.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/imurmurhash": { - "version": "0.1.4", - "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz", - "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==", - "dev": true, - "engines": { - "node": ">=0.8.19" - } - }, - "node_modules/indent-string": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/indent-string/-/indent-string-4.0.0.tgz", - "integrity": "sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==", - "dev": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/inflight": { - "version": "1.0.6", - "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz", - "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==", - "dev": true, - "dependencies": { - "once": "^1.3.0", - "wrappy": "1" - } - }, - "node_modules/inherits": { - "version": "2.0.4", - "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz", - "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==", - "dev": true - }, - "node_modules/ini": { - "version": "1.3.8", - "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz", - "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==", - "dev": true - }, - "node_modules/inquirer": { - "version": "7.3.3", - "resolved": "https://registry.npmjs.org/inquirer/-/inquirer-7.3.3.tgz", - "integrity": "sha512-JG3eIAj5V9CwcGvuOmoo6LB9kbAYT8HXffUl6memuszlwDC/qvFAJw49XJ5NROSFNPxp3iQg1GqkFhaY/CR0IA==", - "dev": true, - "dependencies": { - "ansi-escapes": "^4.2.1", - "chalk": "^4.1.0", - "cli-cursor": "^3.1.0", - "cli-width": "^3.0.0", - "external-editor": "^3.0.3", - "figures": "^3.0.0", - "lodash": "^4.17.19", - "mute-stream": "0.0.8", - "run-async": "^2.4.0", - "rxjs": "^6.6.0", - "string-width": "^4.1.0", - "strip-ansi": "^6.0.0", - "through": "^2.3.6" - }, - "engines": { - "node": ">=8.0.0" - } - }, - "node_modules/internal-slot": { - "version": "1.0.6", - "resolved": "https://registry.npmjs.org/internal-slot/-/internal-slot-1.0.6.tgz", - "integrity": "sha512-Xj6dv+PsbtwyPpEflsejS+oIZxmMlV44zAhG479uYu89MsjcYOhCFnNyKrkJrihbsiasQyY0afoCl/9BLR65bg==", - "dev": true, - "dependencies": { - "get-intrinsic": "^1.2.2", - "hasown": "^2.0.0", - "side-channel": "^1.0.4" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/ip-regex": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/ip-regex/-/ip-regex-4.3.0.tgz", - "integrity": "sha512-B9ZWJxHHOHUhUjCPrMpLD4xEq35bUTClHM1S6CBU5ixQnkZmwipwgc96vAd7AAGM9TGHvJR+Uss+/Ak6UphK+Q==", - "dev": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/is-accessor-descriptor": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/is-accessor-descriptor/-/is-accessor-descriptor-1.0.1.tgz", - "integrity": "sha512-YBUanLI8Yoihw923YeFUS5fs0fF2f5TSFTNiYAAzhhDscDa3lEqYuz1pDOEP5KvX94I9ey3vsqjJcLVFVU+3QA==", - "dev": true, - "peer": true, - "dependencies": { - "hasown": "^2.0.0" - }, - "engines": { - "node": ">= 0.10" - } - }, - "node_modules/is-alphabetical": { - "version": "1.0.4", - "resolved": "https://registry.npmjs.org/is-alphabetical/-/is-alphabetical-1.0.4.tgz", - "integrity": "sha512-DwzsA04LQ10FHTZuL0/grVDk4rFoVH1pjAToYwBrHSxcrBIGQuXrQMtD5U1b0U2XVgKZCTLLP8u2Qxqhy3l2Vg==", - "dev": true, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/is-alphanumeric": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/is-alphanumeric/-/is-alphanumeric-1.0.0.tgz", - "integrity": "sha512-ZmRL7++ZkcMOfDuWZuMJyIVLr2keE1o/DeNWh1EmgqGhUcV+9BIVsx0BcSBOHTZqzjs4+dISzr2KAeBEWGgXeA==", - "dev": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/is-alphanumerical": { - "version": "1.0.4", - "resolved": "https://registry.npmjs.org/is-alphanumerical/-/is-alphanumerical-1.0.4.tgz", - "integrity": "sha512-UzoZUr+XfVz3t3v4KyGEniVL9BDRoQtY7tOyrRybkVNjDFWyo1yhXNGrrBTQxp3ib9BLAWs7k2YKBQsFRkZG9A==", - "dev": true, - "dependencies": { - "is-alphabetical": "^1.0.0", - "is-decimal": "^1.0.0" - }, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/is-array-buffer": { - "version": "3.0.2", - "resolved": "https://registry.npmjs.org/is-array-buffer/-/is-array-buffer-3.0.2.tgz", - "integrity": "sha512-y+FyyR/w8vfIRq4eQcM1EYgSTnmHXPqaF+IgzgraytCFq5Xh8lllDVmAZolPJiZttZLeFSINPYMaEJ7/vWUa1w==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "get-intrinsic": "^1.2.0", - "is-typed-array": "^1.1.10" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/is-arrayish": { - "version": "0.2.1", - "resolved": "https://registry.npmjs.org/is-arrayish/-/is-arrayish-0.2.1.tgz", - "integrity": "sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg==", - "dev": true - }, - "node_modules/is-async-function": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/is-async-function/-/is-async-function-2.0.0.tgz", - "integrity": "sha512-Y1JXKrfykRJGdlDwdKlLpLyMIiWqWvuSd17TvZk68PLAOGOoF4Xyav1z0Xhoi+gCYjZVeC5SI+hYFOfvXmGRCA==", - "dev": true, - "dependencies": { - "has-tostringtag": "^1.0.0" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/is-bigint": { - "version": "1.0.4", - "resolved": "https://registry.npmjs.org/is-bigint/-/is-bigint-1.0.4.tgz", - "integrity": "sha512-zB9CruMamjym81i2JZ3UMn54PKGsQzsJeo6xvN3HJJ4CAsQNB6iRutp2To77OfCNuoxspsIhzaPoO1zyCEhFOg==", - "dev": true, - "dependencies": { - "has-bigints": "^1.0.1" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/is-boolean-object": { - "version": "1.1.2", - "resolved": "https://registry.npmjs.org/is-boolean-object/-/is-boolean-object-1.1.2.tgz", - "integrity": "sha512-gDYaKHJmnj4aWxyj6YHyXVpdQawtVLHU5cb+eztPGczf6cjuTdwve5ZIEfgXqH4e57An1D1AKf8CZ3kYrQRqYA==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "has-tostringtag": "^1.0.0" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/is-buffer": { - "version": "2.0.5", - "resolved": "https://registry.npmjs.org/is-buffer/-/is-buffer-2.0.5.tgz", - "integrity": "sha512-i2R6zNFDwgEHJyQUtJEk0XFi1i0dPFn/oqjK3/vPCcDeJvW5NQ83V8QbicfF1SupOaB0h8ntgBC2YiE7dfyctQ==", - "dev": true, - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/feross" - }, - { - "type": "patreon", - "url": "https://www.patreon.com/feross" - }, - { - "type": "consulting", - "url": "https://feross.org/support" - } - ], - "engines": { - "node": ">=4" - } - }, - "node_modules/is-callable": { - "version": "1.2.7", - "resolved": "https://registry.npmjs.org/is-callable/-/is-callable-1.2.7.tgz", - "integrity": "sha512-1BC0BVFhS/p0qtw6enp8e+8OD0UrK0oFLztSjNzhcKA3WDuJxxAPXzPuPtKkjEY9UUoEWlX/8fgKeu2S8i9JTA==", - "dev": true, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/is-ci": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/is-ci/-/is-ci-2.0.0.tgz", - "integrity": "sha512-YfJT7rkpQB0updsdHLGWrvhBJfcfzNNawYDNIyQXJz0IViGf75O8EBPKSdvw2rF+LGCsX4FZ8tcr3b19LcZq4w==", - "dev": true, - "dependencies": { - "ci-info": "^2.0.0" - }, - "bin": { - "is-ci": "bin.js" - } - }, - "node_modules/is-core-module": { - "version": "2.13.1", - "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.13.1.tgz", - "integrity": "sha512-hHrIjvZsftOsvKSn2TRYl63zvxsgE0K+0mYMoH6gD4omR5IWB2KynivBQczo3+wF1cCkjzvptnI9Q0sPU66ilw==", - "dev": true, - "dependencies": { - "hasown": "^2.0.0" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/is-data-descriptor": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/is-data-descriptor/-/is-data-descriptor-1.0.1.tgz", - "integrity": "sha512-bc4NlCDiCr28U4aEsQ3Qs2491gVq4V8G7MQyws968ImqjKuYtTJXrl7Vq7jsN7Ly/C3xj5KWFrY7sHNeDkAzXw==", - "dev": true, - "peer": true, - "dependencies": { - "hasown": "^2.0.0" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/is-date-object": { - "version": "1.0.5", - "resolved": "https://registry.npmjs.org/is-date-object/-/is-date-object-1.0.5.tgz", - "integrity": "sha512-9YQaSxsAiSwcvS33MBk3wTCVnWK+HhF8VZR2jRxehM16QcVOdHqPn4VPHmRK4lSr38n9JriurInLcP90xsYNfQ==", - "dev": true, - "dependencies": { - "has-tostringtag": "^1.0.0" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/is-decimal": { - "version": "1.0.4", - "resolved": "https://registry.npmjs.org/is-decimal/-/is-decimal-1.0.4.tgz", - "integrity": "sha512-RGdriMmQQvZ2aqaQq3awNA6dCGtKpiDFcOzrTWrDAT2MiWrKQVPmxLGHl7Y2nNu6led0kEyoX0enY0qXYsv9zw==", - "dev": true, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/is-descriptor": { - "version": "1.0.3", - "resolved": "https://registry.npmjs.org/is-descriptor/-/is-descriptor-1.0.3.tgz", - "integrity": "sha512-JCNNGbwWZEVaSPtS45mdtrneRWJFp07LLmykxeFV5F6oBvNF8vHSfJuJgoT472pSfk+Mf8VnlrspaFBHWM8JAw==", - "dev": true, - "peer": true, - "dependencies": { - "is-accessor-descriptor": "^1.0.1", - "is-data-descriptor": "^1.0.1" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/is-docker": { - "version": "2.2.1", - "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-2.2.1.tgz", - "integrity": "sha512-F+i2BKsFrH66iaUFc0woD8sLy8getkwTwtOBjvs56Cx4CgJDeKQeqfz8wAYiSb8JOprWhHH5p77PbmYCvvUuXQ==", - "dev": true, - "bin": { - "is-docker": "cli.js" - }, - "engines": { - "node": ">=8" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/is-extendable": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/is-extendable/-/is-extendable-1.0.1.tgz", - "integrity": "sha512-arnXMxT1hhoKo9k1LZdmlNyJdDDfy2v0fXjFlmok4+i8ul/6WlbVge9bhM74OpNPQPMGUToDtz+KXa1PneJxOA==", - "dev": true, - "peer": true, - "dependencies": { - "is-plain-object": "^2.0.4" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/is-extglob": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz", - "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==", - "dev": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/is-finalizationregistry": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/is-finalizationregistry/-/is-finalizationregistry-1.0.2.tgz", - "integrity": "sha512-0by5vtUJs8iFQb5TYUHHPudOR+qXYIMKtiUzvLIZITZUjknFmziyBJuLhVRc+Ds0dREFlskDNJKYIdIzu/9pfw==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/is-fullwidth-code-point": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz", - "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==", - "dev": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/is-generator-fn": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/is-generator-fn/-/is-generator-fn-2.1.0.tgz", - "integrity": "sha512-cTIB4yPYL/Grw0EaSzASzg6bBy9gqCofvWN8okThAYIxKJZC+udlRAmGbM0XLeniEJSs8uEgHPGuHSe1XsOLSQ==", - "dev": true, - "peer": true, - "engines": { - "node": ">=6" - } - }, - "node_modules/is-generator-function": { - "version": "1.0.10", - "resolved": "https://registry.npmjs.org/is-generator-function/-/is-generator-function-1.0.10.tgz", - "integrity": "sha512-jsEjy9l3yiXEQ+PsXdmBwEPcOxaXWLspKdplFUVI9vq1iZgIekeC0L167qeu86czQaxed3q/Uzuw0swL0irL8A==", - "dev": true, - "dependencies": { - "has-tostringtag": "^1.0.0" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/is-glob": { - "version": "4.0.3", - "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz", - "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==", - "dev": true, - "dependencies": { - "is-extglob": "^2.1.1" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/is-hexadecimal": { - "version": "1.0.4", - "resolved": "https://registry.npmjs.org/is-hexadecimal/-/is-hexadecimal-1.0.4.tgz", - "integrity": "sha512-gyPJuv83bHMpocVYoqof5VDiZveEoGoFL8m3BXNb2VW8Xs+rz9kqO8LOQ5DH6EsuvilT1ApazU0pyl+ytbPtlw==", - "dev": true, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/is-map": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/is-map/-/is-map-2.0.2.tgz", - "integrity": "sha512-cOZFQQozTha1f4MxLFzlgKYPTyj26picdZTx82hbc/Xf4K/tZOOXSCkMvU4pKioRXGDLJRn0GM7Upe7kR721yg==", - "dev": true, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/is-negative-zero": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/is-negative-zero/-/is-negative-zero-2.0.2.tgz", - "integrity": "sha512-dqJvarLawXsFbNDeJW7zAz8ItJ9cd28YufuuFzh0G8pNHjJMnY08Dv7sYX2uF5UpQOwieAeOExEYAWWfu7ZZUA==", - "dev": true, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/is-number": { - "version": "7.0.0", - "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz", - "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==", - "dev": true, - "engines": { - "node": ">=0.12.0" - } - }, - "node_modules/is-number-object": { - "version": "1.0.7", - "resolved": "https://registry.npmjs.org/is-number-object/-/is-number-object-1.0.7.tgz", - "integrity": "sha512-k1U0IRzLMo7ZlYIfzRu23Oh6MiIFasgpb9X76eqfFZAqwH44UI4KTBvBYIZ1dSL9ZzChTB9ShHfLkR4pdW5krQ==", - "dev": true, - "dependencies": { - "has-tostringtag": "^1.0.0" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/is-obj": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/is-obj/-/is-obj-1.0.1.tgz", - "integrity": "sha512-l4RyHgRqGN4Y3+9JHVrNqO+tN0rV5My76uW5/nuO4K1b6vw5G8d/cmFjP9tRfEsdhZNt0IFdZuK/c2Vr4Nb+Qg==", - "dev": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/is-path-inside": { - "version": "3.0.3", - "resolved": "https://registry.npmjs.org/is-path-inside/-/is-path-inside-3.0.3.tgz", - "integrity": "sha512-Fd4gABb+ycGAmKou8eMftCupSir5lRxqf4aD/vd0cD2qc4HL07OjCeuHMr8Ro4CoMaeCKDB0/ECBOVWjTwUvPQ==", - "dev": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/is-plain-obj": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/is-plain-obj/-/is-plain-obj-1.1.0.tgz", - "integrity": "sha512-yvkRyxmFKEOQ4pNXCmJG5AEQNlXJS5LaONXo5/cLdTZdWvsZ1ioJEonLGAosKlMWE8lwUy/bJzMjcw8az73+Fg==", - "dev": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/is-plain-object": { - "version": "2.0.4", - "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-2.0.4.tgz", - "integrity": "sha512-h5PpgXkWitc38BBMYawTYMWJHFZJVnBquFE57xFpjB8pJFiF6gZ+bU+WyI/yqXiFR5mdLsgYNaPe8uao6Uv9Og==", - "dev": true, - "peer": true, - "dependencies": { - "isobject": "^3.0.1" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/is-potential-custom-element-name": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/is-potential-custom-element-name/-/is-potential-custom-element-name-1.0.1.tgz", - "integrity": "sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==", - "dev": true, - "peer": true - }, - "node_modules/is-regex": { - "version": "1.1.4", - "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.1.4.tgz", - "integrity": "sha512-kvRdxDsxZjhzUX07ZnLydzS1TU/TJlTUHHY4YLL87e37oUA49DfkLqgy+VjFocowy29cKvcSiu+kIv728jTTVg==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "has-tostringtag": "^1.0.0" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/is-regexp": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/is-regexp/-/is-regexp-1.0.0.tgz", - "integrity": "sha512-7zjFAPO4/gwyQAAgRRmqeEeyIICSdmCqa3tsVHMdBzaXXRiqopZL4Cyghg/XulGWrtABTpbnYYzzIRffLkP4oA==", - "dev": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/is-set": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/is-set/-/is-set-2.0.2.tgz", - "integrity": "sha512-+2cnTEZeY5z/iXGbLhPrOAaK/Mau5k5eXq9j14CpRTftq0pAJu2MwVRSZhyZWBzx3o6X795Lz6Bpb6R0GKf37g==", - "dev": true, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/is-shared-array-buffer": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/is-shared-array-buffer/-/is-shared-array-buffer-1.0.2.tgz", - "integrity": "sha512-sqN2UDu1/0y6uvXyStCOzyhAjCSlHceFoMKJW8W9EU9cvic/QdsZ0kEU93HEy3IUEFZIiH/3w+AH/UQbPHNdhA==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/is-stream": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz", - "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==", - "dev": true, - "engines": { - "node": ">=8" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/is-string": { - "version": "1.0.7", - "resolved": "https://registry.npmjs.org/is-string/-/is-string-1.0.7.tgz", - "integrity": "sha512-tE2UXzivje6ofPW7l23cjDOMa09gb7xlAqG6jG5ej6uPV32TlWP3NKPigtaGeHNu9fohccRYvIiZMfOOnOYUtg==", - "dev": true, - "dependencies": { - "has-tostringtag": "^1.0.0" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/is-symbol": { - "version": "1.0.4", - "resolved": "https://registry.npmjs.org/is-symbol/-/is-symbol-1.0.4.tgz", - "integrity": "sha512-C/CPBqKWnvdcxqIARxyOh4v1UUEOCHpgDa0WYgpKDFMszcrPcffg5uhwSgPCLD2WWxmq6isisz87tzT01tuGhg==", - "dev": true, - "dependencies": { - "has-symbols": "^1.0.2" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/is-typed-array": { - "version": "1.1.12", - "resolved": "https://registry.npmjs.org/is-typed-array/-/is-typed-array-1.1.12.tgz", - "integrity": "sha512-Z14TF2JNG8Lss5/HMqt0//T9JeHXttXy5pH/DBU4vi98ozO2btxzq9MwYDZYnKwU8nRsz/+GVFVRDq3DkVuSPg==", - "dev": true, - "dependencies": { - "which-typed-array": "^1.1.11" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/is-typedarray": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/is-typedarray/-/is-typedarray-1.0.0.tgz", - "integrity": "sha512-cyA56iCMHAh5CdzjJIa4aohJyeO1YbwLi3Jc35MmRU6poroFjIGZzUzupGiRPOjgHg9TLu43xbpwXk523fMxKA==", - "dev": true - }, - "node_modules/is-unicode-supported": { - "version": "0.1.0", - "resolved": "https://registry.npmjs.org/is-unicode-supported/-/is-unicode-supported-0.1.0.tgz", - "integrity": "sha512-knxG2q4UC3u8stRGyAVJCOdxFmv5DZiRcdlIaAQXAbSfJya+OhopNotLQrstBhququ4ZpuKbDc/8S6mgXgPFPw==", - "dev": true, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/is-url-superb": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/is-url-superb/-/is-url-superb-3.0.0.tgz", - "integrity": "sha512-3faQP+wHCGDQT1qReM5zCPx2mxoal6DzbzquFlCYJLWyy4WPTved33ea2xFbX37z4NoriEwZGIYhFtx8RUB5wQ==", - "dev": true, - "dependencies": { - "url-regex": "^5.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/is-weakmap": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/is-weakmap/-/is-weakmap-2.0.1.tgz", - "integrity": "sha512-NSBR4kH5oVj1Uwvv970ruUkCV7O1mzgVFO4/rev2cLRda9Tm9HrL70ZPut4rOHgY0FNrUu9BCbXA2sdQ+x0chA==", - "dev": true, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/is-weakref": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/is-weakref/-/is-weakref-1.0.2.tgz", - "integrity": "sha512-qctsuLZmIQ0+vSSMfoVvyFe2+GSEvnmZ2ezTup1SBse9+twCCeial6EEi3Nc2KFcf6+qz2FBPnjXsk8xhKSaPQ==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/is-weakset": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/is-weakset/-/is-weakset-2.0.2.tgz", - "integrity": "sha512-t2yVvttHkQktwnNNmBQ98AhENLdPUTDTE21uPqAQ0ARwQfGeQKRVS0NNurH7bTf7RrvcVn1OOge45CnBeHCSmg==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "get-intrinsic": "^1.1.1" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/is-whitespace-character": { - "version": "1.0.4", - "resolved": "https://registry.npmjs.org/is-whitespace-character/-/is-whitespace-character-1.0.4.tgz", - "integrity": "sha512-SDweEzfIZM0SJV0EUga669UTKlmL0Pq8Lno0QDQsPnvECB3IM2aP0gdx5TrU0A01MAPfViaZiI2V1QMZLaKK5w==", - "dev": true, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/is-windows": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/is-windows/-/is-windows-1.0.2.tgz", - "integrity": "sha512-eXK1UInq2bPmjyX6e3VHIzMLobc4J94i4AWn+Hpq3OU5KkrRC96OAcR3PRJ/pGu6m8TRnBHP9dkXQVsT/COVIA==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/is-word-character": { - "version": "1.0.4", - "resolved": "https://registry.npmjs.org/is-word-character/-/is-word-character-1.0.4.tgz", - "integrity": "sha512-5SMO8RVennx3nZrqtKwCGyyetPE9VDba5ugvKLaD4KopPG5kR4mQ7tNt/r7feL5yt5h3lpuBbIUmCOG2eSzXHA==", - "dev": true, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/is-wsl": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-2.2.0.tgz", - "integrity": "sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==", - "dev": true, - "dependencies": { - "is-docker": "^2.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/isarray": { - "version": "2.0.5", - "resolved": "https://registry.npmjs.org/isarray/-/isarray-2.0.5.tgz", - "integrity": "sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==", - "dev": true - }, - "node_modules/isexe": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz", - "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==", - "dev": true - }, - "node_modules/isobject": { - "version": "3.0.1", - "resolved": "https://registry.npmjs.org/isobject/-/isobject-3.0.1.tgz", - "integrity": "sha512-WhB9zCku7EGTj/HQQRz5aUQEUeoQZH2bWcltRErOpymJ4boYE6wL9Tbr23krRPSZ+C5zqNSrSw+Cc7sZZ4b7vg==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/istanbul-lib-coverage": { - "version": "3.2.0", - "resolved": "https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.0.tgz", - "integrity": "sha512-eOeJ5BHCmHYvQK7xt9GkdHuzuCGS1Y6g9Gvnx3Ym33fz/HpLRYxiS0wHNr+m/MBC8B647Xt608vCDEvhl9c6Mw==", - "dev": true, - "peer": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/istanbul-lib-instrument": { - "version": "4.0.3", - "resolved": "https://registry.npmjs.org/istanbul-lib-instrument/-/istanbul-lib-instrument-4.0.3.tgz", - "integrity": "sha512-BXgQl9kf4WTCPCCpmFGoJkz/+uhvm7h7PFKUYxh7qarQd3ER33vHG//qaE8eN25l07YqZPpHXU9I09l/RD5aGQ==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/core": "^7.7.5", - "@istanbuljs/schema": "^0.1.2", - "istanbul-lib-coverage": "^3.0.0", - "semver": "^6.3.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/istanbul-lib-instrument/node_modules/semver": { - "version": "6.3.1", - "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz", - "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==", - "dev": true, - "peer": true, - "bin": { - "semver": "bin/semver.js" - } - }, - "node_modules/istanbul-lib-report": { - "version": "3.0.1", - "resolved": "https://registry.npmjs.org/istanbul-lib-report/-/istanbul-lib-report-3.0.1.tgz", - "integrity": "sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==", - "dev": true, - "peer": true, - "dependencies": { - "istanbul-lib-coverage": "^3.0.0", - "make-dir": "^4.0.0", - "supports-color": "^7.1.0" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/istanbul-lib-source-maps": { - "version": "4.0.1", - "resolved": "https://registry.npmjs.org/istanbul-lib-source-maps/-/istanbul-lib-source-maps-4.0.1.tgz", - "integrity": "sha512-n3s8EwkdFIJCG3BPKBYvskgXGoy88ARzvegkitk60NxRdwltLOTaH7CUiMRXvwYorl0Q712iEjcWB+fK/MrWVw==", - "dev": true, - "peer": true, - "dependencies": { - "debug": "^4.1.1", - "istanbul-lib-coverage": "^3.0.0", - "source-map": "^0.6.1" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/istanbul-reports": { - "version": "3.1.6", - "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.1.6.tgz", - "integrity": "sha512-TLgnMkKg3iTDsQ9PbPTdpfAK2DzjF9mqUG7RMgcQl8oFjad8ob4laGxv5XV5U9MAfx8D6tSJiUyuAwzLicaxlg==", - "dev": true, - "peer": true, - "dependencies": { - "html-escaper": "^2.0.0", - "istanbul-lib-report": "^3.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/iterator.prototype": { - "version": "1.1.2", - "resolved": "https://registry.npmjs.org/iterator.prototype/-/iterator.prototype-1.1.2.tgz", - "integrity": "sha512-DR33HMMr8EzwuRL8Y9D3u2BMj8+RqSE850jfGu59kS7tbmPLzGkZmVSfyCFSDxuZiEY6Rzt3T2NA/qU+NwVj1w==", - "dev": true, - "dependencies": { - "define-properties": "^1.2.1", - "get-intrinsic": "^1.2.1", - "has-symbols": "^1.0.3", - "reflect.getprototypeof": "^1.0.4", - "set-function-name": "^2.0.1" - } - }, - "node_modules/jake": { - "version": "10.8.7", - "resolved": "https://registry.npmjs.org/jake/-/jake-10.8.7.tgz", - "integrity": "sha512-ZDi3aP+fG/LchyBzUM804VjddnwfSfsdeYkwt8NcbKRvo4rFkjhs456iLFn3k2ZUWvNe4i48WACDbza8fhq2+w==", - "dev": true, - "dependencies": { - "async": "^3.2.3", - "chalk": "^4.0.2", - "filelist": "^1.0.4", - "minimatch": "^3.1.2" - }, - "bin": { - "jake": "bin/cli.js" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/jest": { - "version": "26.6.3", - "resolved": "https://registry.npmjs.org/jest/-/jest-26.6.3.tgz", - "integrity": "sha512-lGS5PXGAzR4RF7V5+XObhqz2KZIDUA1yD0DG6pBVmy10eh0ZIXQImRuzocsI/N2XZ1GrLFwTS27In2i2jlpq1Q==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/core": "^26.6.3", - "import-local": "^3.0.2", - "jest-cli": "^26.6.3" - }, - "bin": { - "jest": "bin/jest.js" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-changed-files": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/jest-changed-files/-/jest-changed-files-26.6.2.tgz", - "integrity": "sha512-fDS7szLcY9sCtIip8Fjry9oGf3I2ht/QT21bAHm5Dmf0mD4X3ReNUf17y+bO6fR8WgbIZTlbyG1ak/53cbRzKQ==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/types": "^26.6.2", - "execa": "^4.0.0", - "throat": "^5.0.0" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-cli": { - "version": "26.6.3", - "resolved": "https://registry.npmjs.org/jest-cli/-/jest-cli-26.6.3.tgz", - "integrity": "sha512-GF9noBSa9t08pSyl3CY4frMrqp+aQXFGFkf5hEPbh/pIUFYWMK6ZLTfbmadxJVcJrdRoChlWQsA2VkJcDFK8hg==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/core": "^26.6.3", - "@jest/test-result": "^26.6.2", - "@jest/types": "^26.6.2", - "chalk": "^4.0.0", - "exit": "^0.1.2", - "graceful-fs": "^4.2.4", - "import-local": "^3.0.2", - "is-ci": "^2.0.0", - "jest-config": "^26.6.3", - "jest-util": "^26.6.2", - "jest-validate": "^26.6.2", - "prompts": "^2.0.1", - "yargs": "^15.4.1" - }, - "bin": { - "jest": "bin/jest.js" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-cli/node_modules/cliui": { - "version": "6.0.0", - "resolved": "https://registry.npmjs.org/cliui/-/cliui-6.0.0.tgz", - "integrity": "sha512-t6wbgtoCXvAzst7QgXxJYqPt0usEfbgQdftEPbLL/cvv6HPE5VgvqCuAIDR0NgU52ds6rFwqrgakNLrHEjCbrQ==", - "dev": true, - "peer": true, - "dependencies": { - "string-width": "^4.2.0", - "strip-ansi": "^6.0.0", - "wrap-ansi": "^6.2.0" - } - }, - "node_modules/jest-cli/node_modules/find-up": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz", - "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==", - "dev": true, - "peer": true, - "dependencies": { - "locate-path": "^5.0.0", - "path-exists": "^4.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/jest-cli/node_modules/locate-path": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz", - "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==", - "dev": true, - "peer": true, - "dependencies": { - "p-locate": "^4.1.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/jest-cli/node_modules/p-limit": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz", - "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==", - "dev": true, - "peer": true, - "dependencies": { - "p-try": "^2.0.0" - }, - "engines": { - "node": ">=6" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/jest-cli/node_modules/p-locate": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz", - "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==", - "dev": true, - "peer": true, - "dependencies": { - "p-limit": "^2.2.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/jest-cli/node_modules/path-exists": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz", - "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==", - "dev": true, - "peer": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/jest-cli/node_modules/wrap-ansi": { - "version": "6.2.0", - "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-6.2.0.tgz", - "integrity": "sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==", - "dev": true, - "peer": true, - "dependencies": { - "ansi-styles": "^4.0.0", - "string-width": "^4.1.0", - "strip-ansi": "^6.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/jest-cli/node_modules/y18n": { - "version": "4.0.3", - "resolved": "https://registry.npmjs.org/y18n/-/y18n-4.0.3.tgz", - "integrity": "sha512-JKhqTOwSrqNA1NY5lSztJ1GrBiUodLMmIZuLiDaMRJ+itFd+ABVE8XBjOvIWL+rSqNDC74LCSFmlb/U4UZ4hJQ==", - "dev": true, - "peer": true - }, - "node_modules/jest-cli/node_modules/yargs": { - "version": "15.4.1", - "resolved": "https://registry.npmjs.org/yargs/-/yargs-15.4.1.tgz", - "integrity": "sha512-aePbxDmcYW++PaqBsJ+HYUFwCdv4LVvdnhBy78E57PIor8/OVvhMrADFFEDh8DHDFRv/O9i3lPhsENjO7QX0+A==", - "dev": true, - "peer": true, - "dependencies": { - "cliui": "^6.0.0", - "decamelize": "^1.2.0", - "find-up": "^4.1.0", - "get-caller-file": "^2.0.1", - "require-directory": "^2.1.1", - "require-main-filename": "^2.0.0", - "set-blocking": "^2.0.0", - "string-width": "^4.2.0", - "which-module": "^2.0.0", - "y18n": "^4.0.0", - "yargs-parser": "^18.1.2" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/jest-cli/node_modules/yargs-parser": { - "version": "18.1.3", - "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-18.1.3.tgz", - "integrity": "sha512-o50j0JeToy/4K6OZcaQmW6lyXXKhq7csREXcDwk2omFPJEwUNOVtJKvmDr9EI1fAJZUyZcRF7kxGBWmRXudrCQ==", - "dev": true, - "peer": true, - "dependencies": { - "camelcase": "^5.0.0", - "decamelize": "^1.2.0" - }, - "engines": { - "node": ">=6" - } - }, - "node_modules/jest-config": { - "version": "26.6.3", - "resolved": "https://registry.npmjs.org/jest-config/-/jest-config-26.6.3.tgz", - "integrity": "sha512-t5qdIj/bCj2j7NFVHb2nFB4aUdfucDn3JRKgrZnplb8nieAirAzRSHP8uDEd+qV6ygzg9Pz4YG7UTJf94LPSyg==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/core": "^7.1.0", - "@jest/test-sequencer": "^26.6.3", - "@jest/types": "^26.6.2", - "babel-jest": "^26.6.3", - "chalk": "^4.0.0", - "deepmerge": "^4.2.2", - "glob": "^7.1.1", - "graceful-fs": "^4.2.4", - "jest-environment-jsdom": "^26.6.2", - "jest-environment-node": "^26.6.2", - "jest-get-type": "^26.3.0", - "jest-jasmine2": "^26.6.3", - "jest-regex-util": "^26.0.0", - "jest-resolve": "^26.6.2", - "jest-util": "^26.6.2", - "jest-validate": "^26.6.2", - "micromatch": "^4.0.2", - "pretty-format": "^26.6.2" - }, - "engines": { - "node": ">= 10.14.2" - }, - "peerDependencies": { - "ts-node": ">=9.0.0" - }, - "peerDependenciesMeta": { - "ts-node": { - "optional": true - } - } - }, - "node_modules/jest-diff": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-26.6.2.tgz", - "integrity": "sha512-6m+9Z3Gv9wN0WFVasqjCL/06+EFCMTqDEUl/b87HYK2rAPTyfz4ZIuSlPhY51PIQRWx5TaxeF1qmXKe9gfN3sA==", - "dev": true, - "peer": true, - "dependencies": { - "chalk": "^4.0.0", - "diff-sequences": "^26.6.2", - "jest-get-type": "^26.3.0", - "pretty-format": "^26.6.2" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-docblock": { - "version": "26.0.0", - "resolved": "https://registry.npmjs.org/jest-docblock/-/jest-docblock-26.0.0.tgz", - "integrity": "sha512-RDZ4Iz3QbtRWycd8bUEPxQsTlYazfYn/h5R65Fc6gOfwozFhoImx+affzky/FFBuqISPTqjXomoIGJVKBWoo0w==", - "dev": true, - "peer": true, - "dependencies": { - "detect-newline": "^3.0.0" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-each": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/jest-each/-/jest-each-26.6.2.tgz", - "integrity": "sha512-Mer/f0KaATbjl8MCJ+0GEpNdqmnVmDYqCTJYTvoo7rqmRiDllmp2AYN+06F93nXcY3ur9ShIjS+CO/uD+BbH4A==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/types": "^26.6.2", - "chalk": "^4.0.0", - "jest-get-type": "^26.3.0", - "jest-util": "^26.6.2", - "pretty-format": "^26.6.2" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-environment-jsdom": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/jest-environment-jsdom/-/jest-environment-jsdom-26.6.2.tgz", - "integrity": "sha512-jgPqCruTlt3Kwqg5/WVFyHIOJHsiAvhcp2qiR2QQstuG9yWox5+iHpU3ZrcBxW14T4fe5Z68jAfLRh7joCSP2Q==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/environment": "^26.6.2", - "@jest/fake-timers": "^26.6.2", - "@jest/types": "^26.6.2", - "@types/node": "*", - "jest-mock": "^26.6.2", - "jest-util": "^26.6.2", - "jsdom": "^16.4.0" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-environment-node": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/jest-environment-node/-/jest-environment-node-26.6.2.tgz", - "integrity": "sha512-zhtMio3Exty18dy8ee8eJ9kjnRyZC1N4C1Nt/VShN1apyXc8rWGtJ9lI7vqiWcyyXS4BVSEn9lxAM2D+07/Tag==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/environment": "^26.6.2", - "@jest/fake-timers": "^26.6.2", - "@jest/types": "^26.6.2", - "@types/node": "*", - "jest-mock": "^26.6.2", - "jest-util": "^26.6.2" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-get-type": { - "version": "26.3.0", - "resolved": "https://registry.npmjs.org/jest-get-type/-/jest-get-type-26.3.0.tgz", - "integrity": "sha512-TpfaviN1R2pQWkIihlfEanwOXK0zcxrKEE4MlU6Tn7keoXdN6/3gK/xl0yEh8DOunn5pOVGKf8hB4R9gVh04ig==", - "dev": true, - "peer": true, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-haste-map": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/jest-haste-map/-/jest-haste-map-26.6.2.tgz", - "integrity": "sha512-easWIJXIw71B2RdR8kgqpjQrbMRWQBgiBwXYEhtGUTaX+doCjBheluShdDMeR8IMfJiTqH4+zfhtg29apJf/8w==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/types": "^26.6.2", - "@types/graceful-fs": "^4.1.2", - "@types/node": "*", - "anymatch": "^3.0.3", - "fb-watchman": "^2.0.0", - "graceful-fs": "^4.2.4", - "jest-regex-util": "^26.0.0", - "jest-serializer": "^26.6.2", - "jest-util": "^26.6.2", - "jest-worker": "^26.6.2", - "micromatch": "^4.0.2", - "sane": "^4.0.3", - "walker": "^1.0.7" - }, - "engines": { - "node": ">= 10.14.2" - }, - "optionalDependencies": { - "fsevents": "^2.1.2" - } - }, - "node_modules/jest-jasmine2": { - "version": "26.6.3", - "resolved": "https://registry.npmjs.org/jest-jasmine2/-/jest-jasmine2-26.6.3.tgz", - "integrity": "sha512-kPKUrQtc8aYwBV7CqBg5pu+tmYXlvFlSFYn18ev4gPFtrRzB15N2gW/Roew3187q2w2eHuu0MU9TJz6w0/nPEg==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/traverse": "^7.1.0", - "@jest/environment": "^26.6.2", - "@jest/source-map": "^26.6.2", - "@jest/test-result": "^26.6.2", - "@jest/types": "^26.6.2", - "@types/node": "*", - "chalk": "^4.0.0", - "co": "^4.6.0", - "expect": "^26.6.2", - "is-generator-fn": "^2.0.0", - "jest-each": "^26.6.2", - "jest-matcher-utils": "^26.6.2", - "jest-message-util": "^26.6.2", - "jest-runtime": "^26.6.3", - "jest-snapshot": "^26.6.2", - "jest-util": "^26.6.2", - "pretty-format": "^26.6.2", - "throat": "^5.0.0" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-leak-detector": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/jest-leak-detector/-/jest-leak-detector-26.6.2.tgz", - "integrity": "sha512-i4xlXpsVSMeKvg2cEKdfhh0H39qlJlP5Ex1yQxwF9ubahboQYMgTtz5oML35AVA3B4Eu+YsmwaiKVev9KCvLxg==", - "dev": true, - "peer": true, - "dependencies": { - "jest-get-type": "^26.3.0", - "pretty-format": "^26.6.2" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-matcher-utils": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/jest-matcher-utils/-/jest-matcher-utils-26.6.2.tgz", - "integrity": "sha512-llnc8vQgYcNqDrqRDXWwMr9i7rS5XFiCwvh6DTP7Jqa2mqpcCBBlpCbn+trkG0KNhPu/h8rzyBkriOtBstvWhw==", - "dev": true, - "peer": true, - "dependencies": { - "chalk": "^4.0.0", - "jest-diff": "^26.6.2", - "jest-get-type": "^26.3.0", - "pretty-format": "^26.6.2" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-message-util": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-26.6.2.tgz", - "integrity": "sha512-rGiLePzQ3AzwUshu2+Rn+UMFk0pHN58sOG+IaJbk5Jxuqo3NYO1U2/MIR4S1sKgsoYSXSzdtSa0TgrmtUwEbmA==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/code-frame": "^7.0.0", - "@jest/types": "^26.6.2", - "@types/stack-utils": "^2.0.0", - "chalk": "^4.0.0", - "graceful-fs": "^4.2.4", - "micromatch": "^4.0.2", - "pretty-format": "^26.6.2", - "slash": "^3.0.0", - "stack-utils": "^2.0.2" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-mock": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/jest-mock/-/jest-mock-26.6.2.tgz", - "integrity": "sha512-YyFjePHHp1LzpzYcmgqkJ0nm0gg/lJx2aZFzFy1S6eUqNjXsOqTK10zNRff2dNfssgokjkG65OlWNcIlgd3zew==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/types": "^26.6.2", - "@types/node": "*" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-pnp-resolver": { - "version": "1.2.3", - "resolved": "https://registry.npmjs.org/jest-pnp-resolver/-/jest-pnp-resolver-1.2.3.tgz", - "integrity": "sha512-+3NpwQEnRoIBtx4fyhblQDPgJI0H1IEIkX7ShLUjPGA7TtUTvI1oiKi3SR4oBR0hQhQR80l4WAe5RrXBwWMA8w==", - "dev": true, - "peer": true, - "engines": { - "node": ">=6" - }, - "peerDependencies": { - "jest-resolve": "*" - }, - "peerDependenciesMeta": { - "jest-resolve": { - "optional": true - } - } - }, - "node_modules/jest-regex-util": { - "version": "26.0.0", - "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-26.0.0.tgz", - "integrity": "sha512-Gv3ZIs/nA48/Zvjrl34bf+oD76JHiGDUxNOVgUjh3j890sblXryjY4rss71fPtD/njchl6PSE2hIhvyWa1eT0A==", - "dev": true, - "peer": true, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-resolve": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/jest-resolve/-/jest-resolve-26.6.2.tgz", - "integrity": "sha512-sOxsZOq25mT1wRsfHcbtkInS+Ek7Q8jCHUB0ZUTP0tc/c41QHriU/NunqMfCUWsL4H3MHpvQD4QR9kSYhS7UvQ==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/types": "^26.6.2", - "chalk": "^4.0.0", - "graceful-fs": "^4.2.4", - "jest-pnp-resolver": "^1.2.2", - "jest-util": "^26.6.2", - "read-pkg-up": "^7.0.1", - "resolve": "^1.18.1", - "slash": "^3.0.0" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-resolve-dependencies": { - "version": "26.6.3", - "resolved": "https://registry.npmjs.org/jest-resolve-dependencies/-/jest-resolve-dependencies-26.6.3.tgz", - "integrity": "sha512-pVwUjJkxbhe4RY8QEWzN3vns2kqyuldKpxlxJlzEYfKSvY6/bMvxoFrYYzUO1Gx28yKWN37qyV7rIoIp2h8fTg==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/types": "^26.6.2", - "jest-regex-util": "^26.0.0", - "jest-snapshot": "^26.6.2" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-runner": { - "version": "26.6.3", - "resolved": "https://registry.npmjs.org/jest-runner/-/jest-runner-26.6.3.tgz", - "integrity": "sha512-atgKpRHnaA2OvByG/HpGA4g6CSPS/1LK0jK3gATJAoptC1ojltpmVlYC3TYgdmGp+GLuhzpH30Gvs36szSL2JQ==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/console": "^26.6.2", - "@jest/environment": "^26.6.2", - "@jest/test-result": "^26.6.2", - "@jest/types": "^26.6.2", - "@types/node": "*", - "chalk": "^4.0.0", - "emittery": "^0.7.1", - "exit": "^0.1.2", - "graceful-fs": "^4.2.4", - "jest-config": "^26.6.3", - "jest-docblock": "^26.0.0", - "jest-haste-map": "^26.6.2", - "jest-leak-detector": "^26.6.2", - "jest-message-util": "^26.6.2", - "jest-resolve": "^26.6.2", - "jest-runtime": "^26.6.3", - "jest-util": "^26.6.2", - "jest-worker": "^26.6.2", - "source-map-support": "^0.5.6", - "throat": "^5.0.0" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-runtime": { - "version": "26.6.3", - "resolved": "https://registry.npmjs.org/jest-runtime/-/jest-runtime-26.6.3.tgz", - "integrity": "sha512-lrzyR3N8sacTAMeonbqpnSka1dHNux2uk0qqDXVkMv2c/A3wYnvQ4EXuI013Y6+gSKSCxdaczvf4HF0mVXHRdw==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/console": "^26.6.2", - "@jest/environment": "^26.6.2", - "@jest/fake-timers": "^26.6.2", - "@jest/globals": "^26.6.2", - "@jest/source-map": "^26.6.2", - "@jest/test-result": "^26.6.2", - "@jest/transform": "^26.6.2", - "@jest/types": "^26.6.2", - "@types/yargs": "^15.0.0", - "chalk": "^4.0.0", - "cjs-module-lexer": "^0.6.0", - "collect-v8-coverage": "^1.0.0", - "exit": "^0.1.2", - "glob": "^7.1.3", - "graceful-fs": "^4.2.4", - "jest-config": "^26.6.3", - "jest-haste-map": "^26.6.2", - "jest-message-util": "^26.6.2", - "jest-mock": "^26.6.2", - "jest-regex-util": "^26.0.0", - "jest-resolve": "^26.6.2", - "jest-snapshot": "^26.6.2", - "jest-util": "^26.6.2", - "jest-validate": "^26.6.2", - "slash": "^3.0.0", - "strip-bom": "^4.0.0", - "yargs": "^15.4.1" - }, - "bin": { - "jest-runtime": "bin/jest-runtime.js" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-runtime/node_modules/cliui": { - "version": "6.0.0", - "resolved": "https://registry.npmjs.org/cliui/-/cliui-6.0.0.tgz", - "integrity": "sha512-t6wbgtoCXvAzst7QgXxJYqPt0usEfbgQdftEPbLL/cvv6HPE5VgvqCuAIDR0NgU52ds6rFwqrgakNLrHEjCbrQ==", - "dev": true, - "peer": true, - "dependencies": { - "string-width": "^4.2.0", - "strip-ansi": "^6.0.0", - "wrap-ansi": "^6.2.0" - } - }, - "node_modules/jest-runtime/node_modules/find-up": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz", - "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==", - "dev": true, - "peer": true, - "dependencies": { - "locate-path": "^5.0.0", - "path-exists": "^4.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/jest-runtime/node_modules/locate-path": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz", - "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==", - "dev": true, - "peer": true, - "dependencies": { - "p-locate": "^4.1.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/jest-runtime/node_modules/p-limit": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz", - "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==", - "dev": true, - "peer": true, - "dependencies": { - "p-try": "^2.0.0" - }, - "engines": { - "node": ">=6" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/jest-runtime/node_modules/p-locate": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz", - "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==", - "dev": true, - "peer": true, - "dependencies": { - "p-limit": "^2.2.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/jest-runtime/node_modules/path-exists": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz", - "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==", - "dev": true, - "peer": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/jest-runtime/node_modules/wrap-ansi": { - "version": "6.2.0", - "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-6.2.0.tgz", - "integrity": "sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==", - "dev": true, - "peer": true, - "dependencies": { - "ansi-styles": "^4.0.0", - "string-width": "^4.1.0", - "strip-ansi": "^6.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/jest-runtime/node_modules/y18n": { - "version": "4.0.3", - "resolved": "https://registry.npmjs.org/y18n/-/y18n-4.0.3.tgz", - "integrity": "sha512-JKhqTOwSrqNA1NY5lSztJ1GrBiUodLMmIZuLiDaMRJ+itFd+ABVE8XBjOvIWL+rSqNDC74LCSFmlb/U4UZ4hJQ==", - "dev": true, - "peer": true - }, - "node_modules/jest-runtime/node_modules/yargs": { - "version": "15.4.1", - "resolved": "https://registry.npmjs.org/yargs/-/yargs-15.4.1.tgz", - "integrity": "sha512-aePbxDmcYW++PaqBsJ+HYUFwCdv4LVvdnhBy78E57PIor8/OVvhMrADFFEDh8DHDFRv/O9i3lPhsENjO7QX0+A==", - "dev": true, - "peer": true, - "dependencies": { - "cliui": "^6.0.0", - "decamelize": "^1.2.0", - "find-up": "^4.1.0", - "get-caller-file": "^2.0.1", - "require-directory": "^2.1.1", - "require-main-filename": "^2.0.0", - "set-blocking": "^2.0.0", - "string-width": "^4.2.0", - "which-module": "^2.0.0", - "y18n": "^4.0.0", - "yargs-parser": "^18.1.2" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/jest-runtime/node_modules/yargs-parser": { - "version": "18.1.3", - "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-18.1.3.tgz", - "integrity": "sha512-o50j0JeToy/4K6OZcaQmW6lyXXKhq7csREXcDwk2omFPJEwUNOVtJKvmDr9EI1fAJZUyZcRF7kxGBWmRXudrCQ==", - "dev": true, - "peer": true, - "dependencies": { - "camelcase": "^5.0.0", - "decamelize": "^1.2.0" - }, - "engines": { - "node": ">=6" - } - }, - "node_modules/jest-serializer": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/jest-serializer/-/jest-serializer-26.6.2.tgz", - "integrity": "sha512-S5wqyz0DXnNJPd/xfIzZ5Xnp1HrJWBczg8mMfMpN78OJ5eDxXyf+Ygld9wX1DnUWbIbhM1YDY95NjR4CBXkb2g==", - "dev": true, - "peer": true, - "dependencies": { - "@types/node": "*", - "graceful-fs": "^4.2.4" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-snapshot": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/jest-snapshot/-/jest-snapshot-26.6.2.tgz", - "integrity": "sha512-OLhxz05EzUtsAmOMzuupt1lHYXCNib0ECyuZ/PZOx9TrZcC8vL0x+DUG3TL+GLX3yHG45e6YGjIm0XwDc3q3og==", - "dev": true, - "peer": true, - "dependencies": { - "@babel/types": "^7.0.0", - "@jest/types": "^26.6.2", - "@types/babel__traverse": "^7.0.4", - "@types/prettier": "^2.0.0", - "chalk": "^4.0.0", - "expect": "^26.6.2", - "graceful-fs": "^4.2.4", - "jest-diff": "^26.6.2", - "jest-get-type": "^26.3.0", - "jest-haste-map": "^26.6.2", - "jest-matcher-utils": "^26.6.2", - "jest-message-util": "^26.6.2", - "jest-resolve": "^26.6.2", - "natural-compare": "^1.4.0", - "pretty-format": "^26.6.2", - "semver": "^7.3.2" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-util": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-26.6.2.tgz", - "integrity": "sha512-MDW0fKfsn0OI7MS7Euz6h8HNDXVQ0gaM9uW6RjfDmd1DAFcaxX9OqIakHIqhbnmF08Cf2DLDG+ulq8YQQ0Lp0Q==", - "dev": true, - "dependencies": { - "@jest/types": "^26.6.2", - "@types/node": "*", - "chalk": "^4.0.0", - "graceful-fs": "^4.2.4", - "is-ci": "^2.0.0", - "micromatch": "^4.0.2" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-validate": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/jest-validate/-/jest-validate-26.6.2.tgz", - "integrity": "sha512-NEYZ9Aeyj0i5rQqbq+tpIOom0YS1u2MVu6+euBsvpgIme+FOfRmoC4R5p0JiAUpaFvFy24xgrpMknarR/93XjQ==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/types": "^26.6.2", - "camelcase": "^6.0.0", - "chalk": "^4.0.0", - "jest-get-type": "^26.3.0", - "leven": "^3.1.0", - "pretty-format": "^26.6.2" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-validate/node_modules/camelcase": { - "version": "6.3.0", - "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz", - "integrity": "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==", - "dev": true, - "peer": true, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/jest-watcher": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/jest-watcher/-/jest-watcher-26.6.2.tgz", - "integrity": "sha512-WKJob0P/Em2csiVthsI68p6aGKTIcsfjH9Gsx1f0A3Italz43e3ho0geSAVsmj09RWOELP1AZ/DXyJgOgDKxXQ==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/test-result": "^26.6.2", - "@jest/types": "^26.6.2", - "@types/node": "*", - "ansi-escapes": "^4.2.1", - "chalk": "^4.0.0", - "jest-util": "^26.6.2", - "string-length": "^4.0.1" - }, - "engines": { - "node": ">= 10.14.2" - } - }, - "node_modules/jest-worker": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-26.6.2.tgz", - "integrity": "sha512-KWYVV1c4i+jbMpaBC+U++4Va0cp8OisU185o73T1vo99hqi7w8tSJfUXYswwqqrjzwxa6KpRK54WhPvwf5w6PQ==", - "dev": true, - "peer": true, - "dependencies": { - "@types/node": "*", - "merge-stream": "^2.0.0", - "supports-color": "^7.0.0" - }, - "engines": { - "node": ">= 10.13.0" - } - }, - "node_modules/js-tokens": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz", - "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==", - "dev": true - }, - "node_modules/js-yaml": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz", - "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==", - "dev": true, - "dependencies": { - "argparse": "^2.0.1" - }, - "bin": { - "js-yaml": "bin/js-yaml.js" - } - }, - "node_modules/jsdom": { - "version": "16.7.0", - "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-16.7.0.tgz", - "integrity": "sha512-u9Smc2G1USStM+s/x1ru5Sxrl6mPYCbByG1U/hUmqaVsm4tbNyS7CicOSRyuGQYZhTu0h84qkZZQ/I+dzizSVw==", - "dev": true, - "peer": true, - "dependencies": { - "abab": "^2.0.5", - "acorn": "^8.2.4", - "acorn-globals": "^6.0.0", - "cssom": "^0.4.4", - "cssstyle": "^2.3.0", - "data-urls": "^2.0.0", - "decimal.js": "^10.2.1", - "domexception": "^2.0.1", - "escodegen": "^2.0.0", - "form-data": "^3.0.0", - "html-encoding-sniffer": "^2.0.1", - "http-proxy-agent": "^4.0.1", - "https-proxy-agent": "^5.0.0", - "is-potential-custom-element-name": "^1.0.1", - "nwsapi": "^2.2.0", - "parse5": "6.0.1", - "saxes": "^5.0.1", - "symbol-tree": "^3.2.4", - "tough-cookie": "^4.0.0", - "w3c-hr-time": "^1.0.2", - "w3c-xmlserializer": "^2.0.0", - "webidl-conversions": "^6.1.0", - "whatwg-encoding": "^1.0.5", - "whatwg-mimetype": "^2.3.0", - "whatwg-url": "^8.5.0", - "ws": "^7.4.6", - "xml-name-validator": "^3.0.0" - }, - "engines": { - "node": ">=10" - }, - "peerDependencies": { - "canvas": "^2.5.0" - }, - "peerDependenciesMeta": { - "canvas": { - "optional": true - } - } - }, - "node_modules/jsesc": { - "version": "2.5.2", - "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-2.5.2.tgz", - "integrity": "sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==", - "dev": true, - "bin": { - "jsesc": "bin/jsesc" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/json-buffer": { - "version": "3.0.1", - "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz", - "integrity": "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==", - "dev": true - }, - "node_modules/json-parse-better-errors": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/json-parse-better-errors/-/json-parse-better-errors-1.0.2.tgz", - "integrity": "sha512-mrqyZKfX5EhL7hvqcV6WG1yYjnjeuYDzDhhcAAUrq8Po85NBQBJP+ZDUT75qZQ98IkUoBqdkExkukOU7Ts2wrw==", - "dev": true - }, - "node_modules/json-parse-even-better-errors": { - "version": "2.3.1", - "resolved": "https://registry.npmjs.org/json-parse-even-better-errors/-/json-parse-even-better-errors-2.3.1.tgz", - "integrity": "sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==", - "dev": true - }, - "node_modules/json-schema-traverse": { - "version": "0.4.1", - "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz", - "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==", - "dev": true - }, - "node_modules/json-stable-stringify-without-jsonify": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz", - "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==", - "dev": true - }, - "node_modules/json5": { - "version": "2.2.3", - "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz", - "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==", - "dev": true, - "bin": { - "json5": "lib/cli.js" - }, - "engines": { - "node": ">=6" - } - }, - "node_modules/jsonfile": { - "version": "6.1.0", - "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.1.0.tgz", - "integrity": "sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==", - "dev": true, - "dependencies": { - "universalify": "^2.0.0" - }, - "optionalDependencies": { - "graceful-fs": "^4.1.6" - } - }, - "node_modules/jsonfile/node_modules/universalify": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz", - "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==", - "dev": true, - "engines": { - "node": ">= 10.0.0" - } - }, - "node_modules/jsx-ast-utils": { - "version": "3.3.5", - "resolved": "https://registry.npmjs.org/jsx-ast-utils/-/jsx-ast-utils-3.3.5.tgz", - "integrity": "sha512-ZZow9HBI5O6EPgSJLUb8n2NKgmVWTwCvHGwFuJlMjvLFqlGG6pjirPhtdsseaLZjSibD8eegzmYpUZwoIlj2cQ==", - "dev": true, - "dependencies": { - "array-includes": "^3.1.6", - "array.prototype.flat": "^1.3.1", - "object.assign": "^4.1.4", - "object.values": "^1.1.6" - }, - "engines": { - "node": ">=4.0" - } - }, - "node_modules/keyv": { - "version": "4.5.4", - "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz", - "integrity": "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==", - "dev": true, - "dependencies": { - "json-buffer": "3.0.1" - } - }, - "node_modules/kind-of": { - "version": "6.0.3", - "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-6.0.3.tgz", - "integrity": "sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw==", - "dev": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/kleur": { - "version": "3.0.3", - "resolved": "https://registry.npmjs.org/kleur/-/kleur-3.0.3.tgz", - "integrity": "sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w==", - "dev": true, - "peer": true, - "engines": { - "node": ">=6" - } - }, - "node_modules/known-css-properties": { - "version": "0.20.0", - "resolved": "https://registry.npmjs.org/known-css-properties/-/known-css-properties-0.20.0.tgz", - "integrity": "sha512-URvsjaA9ypfreqJ2/ylDr5MUERhJZ+DhguoWRr2xgS5C7aGCalXo+ewL+GixgKBfhT2vuL02nbIgNGqVWgTOYw==", - "dev": true - }, - "node_modules/language-subtag-registry": { - "version": "0.3.22", - "resolved": "https://registry.npmjs.org/language-subtag-registry/-/language-subtag-registry-0.3.22.tgz", - "integrity": "sha512-tN0MCzyWnoz/4nHS6uxdlFWoUZT7ABptwKPQ52Ea7URk6vll88bWBVhodtnlfEuCcKWNGoc+uGbw1cwa9IKh/w==", - "dev": true - }, - "node_modules/language-tags": { - "version": "1.0.5", - "resolved": "https://registry.npmjs.org/language-tags/-/language-tags-1.0.5.tgz", - "integrity": "sha512-qJhlO9cGXi6hBGKoxEG/sKZDAHD5Hnu9Hs4WbOY3pCWXDhw0N8x1NenNzm2EnNLkLkk7J2SdxAkDSbb6ftT+UQ==", - "dev": true, - "dependencies": { - "language-subtag-registry": "~0.3.2" - } - }, - "node_modules/leven": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/leven/-/leven-3.1.0.tgz", - "integrity": "sha512-qsda+H8jTaUaN/x5vzW2rzc+8Rw4TAQ/4KjB46IwK5VH+IlVeeeje/EoZRpiXvIqjFgK84QffqPztGI3VBLG1A==", - "dev": true, - "peer": true, - "engines": { - "node": ">=6" - } - }, - "node_modules/levn": { - "version": "0.4.1", - "resolved": "https://registry.npmjs.org/levn/-/levn-0.4.1.tgz", - "integrity": "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==", - "dev": true, - "dependencies": { - "prelude-ls": "^1.2.1", - "type-check": "~0.4.0" - }, - "engines": { - "node": ">= 0.8.0" - } - }, - "node_modules/lines-and-columns": { - "version": "1.2.4", - "resolved": "https://registry.npmjs.org/lines-and-columns/-/lines-and-columns-1.2.4.tgz", - "integrity": "sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==", - "dev": true - }, - "node_modules/lint-staged": { - "version": "11.1.2", - "resolved": "https://registry.npmjs.org/lint-staged/-/lint-staged-11.1.2.tgz", - "integrity": "sha512-6lYpNoA9wGqkL6Hew/4n1H6lRqF3qCsujVT0Oq5Z4hiSAM7S6NksPJ3gnr7A7R52xCtiZMcEUNNQ6d6X5Bvh9w==", - "dev": true, - "dependencies": { - "chalk": "^4.1.1", - "cli-truncate": "^2.1.0", - "commander": "^7.2.0", - "cosmiconfig": "^7.0.0", - "debug": "^4.3.1", - "enquirer": "^2.3.6", - "execa": "^5.0.0", - "listr2": "^3.8.2", - "log-symbols": "^4.1.0", - "micromatch": "^4.0.4", - "normalize-path": "^3.0.0", - "please-upgrade-node": "^3.2.0", - "string-argv": "0.3.1", - "stringify-object": "^3.3.0" - }, - "bin": { - "lint-staged": "bin/lint-staged.js" - }, - "funding": { - "url": "https://opencollective.com/lint-staged" - } - }, - "node_modules/lint-staged/node_modules/chalk": { - "version": "4.1.2", - "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz", - "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==", - "dev": true, - "dependencies": { - "ansi-styles": "^4.1.0", - "supports-color": "^7.1.0" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/chalk/chalk?sponsor=1" - } - }, - "node_modules/lint-staged/node_modules/execa": { - "version": "5.1.1", - "resolved": "https://registry.npmjs.org/execa/-/execa-5.1.1.tgz", - "integrity": "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==", - "dev": true, - "dependencies": { - "cross-spawn": "^7.0.3", - "get-stream": "^6.0.0", - "human-signals": "^2.1.0", - "is-stream": "^2.0.0", - "merge-stream": "^2.0.0", - "npm-run-path": "^4.0.1", - "onetime": "^5.1.2", - "signal-exit": "^3.0.3", - "strip-final-newline": "^2.0.0" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sindresorhus/execa?sponsor=1" - } - }, - "node_modules/lint-staged/node_modules/get-stream": { - "version": "6.0.1", - "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz", - "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==", - "dev": true, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/lint-staged/node_modules/human-signals": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-2.1.0.tgz", - "integrity": "sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==", - "dev": true, - "engines": { - "node": ">=10.17.0" - } - }, - "node_modules/listr2": { - "version": "3.14.0", - "resolved": "https://registry.npmjs.org/listr2/-/listr2-3.14.0.tgz", - "integrity": "sha512-TyWI8G99GX9GjE54cJ+RrNMcIFBfwMPxc3XTFiAYGN4s10hWROGtOg7+O6u6LE3mNkyld7RSLE6nrKBvTfcs3g==", - "dev": true, - "dependencies": { - "cli-truncate": "^2.1.0", - "colorette": "^2.0.16", - "log-update": "^4.0.0", - "p-map": "^4.0.0", - "rfdc": "^1.3.0", - "rxjs": "^7.5.1", - "through": "^2.3.8", - "wrap-ansi": "^7.0.0" - }, - "engines": { - "node": ">=10.0.0" - }, - "peerDependencies": { - "enquirer": ">= 2.3.0 < 3" - }, - "peerDependenciesMeta": { - "enquirer": { - "optional": true - } - } - }, - "node_modules/listr2/node_modules/rxjs": { - "version": "7.8.1", - "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.1.tgz", - "integrity": "sha512-AA3TVj+0A2iuIoQkWEK/tqFjBq2j+6PO6Y0zJcvzLAFhEFIO3HL0vls9hWLncZbAAbK0mar7oZ4V079I/qPMxg==", - "dev": true, - "dependencies": { - "tslib": "^2.1.0" - } - }, - "node_modules/load-json-file": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/load-json-file/-/load-json-file-4.0.0.tgz", - "integrity": "sha512-Kx8hMakjX03tiGTLAIdJ+lL0htKnXjEZN6hk/tozf/WOuYGdZBJrZ+rCJRbVCugsjB3jMLn9746NsQIf5VjBMw==", - "dev": true, - "dependencies": { - "graceful-fs": "^4.1.2", - "parse-json": "^4.0.0", - "pify": "^3.0.0", - "strip-bom": "^3.0.0" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/load-json-file/node_modules/parse-json": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/parse-json/-/parse-json-4.0.0.tgz", - "integrity": "sha512-aOIos8bujGN93/8Ox/jPLh7RwVnPEysynVFE+fQZyg6jKELEHwzgKdLRFHUgXJL6kylijVSBC4BvN9OmsB48Rw==", - "dev": true, - "dependencies": { - "error-ex": "^1.3.1", - "json-parse-better-errors": "^1.0.1" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/load-json-file/node_modules/strip-bom": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-3.0.0.tgz", - "integrity": "sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==", - "dev": true, - "engines": { - "node": ">=4" - } - }, - "node_modules/locate-path": { - "version": "7.2.0", - "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-7.2.0.tgz", - "integrity": "sha512-gvVijfZvn7R+2qyPX8mAuKcFGDf6Nc61GdvGafQsHL0sBIxfKzA+usWn4GFC/bk+QdwPUD4kWFJLhElipq+0VA==", - "dev": true, - "dependencies": { - "p-locate": "^6.0.0" - }, - "engines": { - "node": "^12.20.0 || ^14.13.1 || >=16.0.0" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/lodash": { - "version": "4.17.21", - "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz", - "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==", - "dev": true - }, - "node_modules/lodash.merge": { - "version": "4.6.2", - "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz", - "integrity": "sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==", - "dev": true - }, - "node_modules/lodash.truncate": { - "version": "4.4.2", - "resolved": "https://registry.npmjs.org/lodash.truncate/-/lodash.truncate-4.4.2.tgz", - "integrity": "sha512-jttmRe7bRse52OsWIMDLaXxWqRAmtIUccAQ3garviCqJjafXOfNMO0yMfNpdD6zbGaTU0P5Nz7e7gAT6cKmJRw==", - "dev": true - }, - "node_modules/log-symbols": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/log-symbols/-/log-symbols-4.1.0.tgz", - "integrity": "sha512-8XPvpAA8uyhfteu8pIvQxpJZ7SYYdpUivZpGy6sFsBuKRY/7rQGavedeB8aK+Zkyq6upMFVL/9AW6vOYzfRyLg==", - "dev": true, - "dependencies": { - "chalk": "^4.1.0", - "is-unicode-supported": "^0.1.0" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/log-update": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/log-update/-/log-update-4.0.0.tgz", - "integrity": "sha512-9fkkDevMefjg0mmzWFBW8YkFP91OrizzkW3diF7CpG+S2EYdy4+TVfGwz1zeF8x7hCx1ovSPTOE9Ngib74qqUg==", - "dev": true, - "dependencies": { - "ansi-escapes": "^4.3.0", - "cli-cursor": "^3.1.0", - "slice-ansi": "^4.0.0", - "wrap-ansi": "^6.2.0" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/log-update/node_modules/slice-ansi": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/slice-ansi/-/slice-ansi-4.0.0.tgz", - "integrity": "sha512-qMCMfhY040cVHT43K9BFygqYbUPFZKHOg7K73mtTWJRb8pyP3fzf4Ixd5SzdEJQ6MRUg/WBnOLxghZtKKurENQ==", - "dev": true, - "dependencies": { - "ansi-styles": "^4.0.0", - "astral-regex": "^2.0.0", - "is-fullwidth-code-point": "^3.0.0" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/chalk/slice-ansi?sponsor=1" - } - }, - "node_modules/log-update/node_modules/wrap-ansi": { - "version": "6.2.0", - "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-6.2.0.tgz", - "integrity": "sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==", - "dev": true, - "dependencies": { - "ansi-styles": "^4.0.0", - "string-width": "^4.1.0", - "strip-ansi": "^6.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/longest-streak": { - "version": "2.0.4", - "resolved": "https://registry.npmjs.org/longest-streak/-/longest-streak-2.0.4.tgz", - "integrity": "sha512-vM6rUVCVUJJt33bnmHiZEvr7wPT78ztX7rojL+LW51bHtLh6HTjx84LA5W4+oa6aKEJA7jJu5LR6vQRBpA5DVg==", - "dev": true, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/loose-envify": { - "version": "1.4.0", - "resolved": "https://registry.npmjs.org/loose-envify/-/loose-envify-1.4.0.tgz", - "integrity": "sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==", - "dev": true, - "dependencies": { - "js-tokens": "^3.0.0 || ^4.0.0" - }, - "bin": { - "loose-envify": "cli.js" - } - }, - "node_modules/lru-cache": { - "version": "5.1.1", - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz", - "integrity": "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==", - "dev": true, - "dependencies": { - "yallist": "^3.0.2" - } - }, - "node_modules/make-dir": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-4.0.0.tgz", - "integrity": "sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==", - "dev": true, - "peer": true, - "dependencies": { - "semver": "^7.5.3" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/make-error": { - "version": "1.3.6", - "resolved": "https://registry.npmjs.org/make-error/-/make-error-1.3.6.tgz", - "integrity": "sha512-s8UhlNe7vPKomQhC1qFelMokr/Sc3AgNbso3n74mVPA5LTZwkB9NlXf4XPamLxJE8h0gh73rM94xvwRT2CVInw==", - "dev": true - }, - "node_modules/makeerror": { - "version": "1.0.12", - "resolved": "https://registry.npmjs.org/makeerror/-/makeerror-1.0.12.tgz", - "integrity": "sha512-JmqCvUhmt43madlpFzG4BQzG2Z3m6tvQDNKdClZnO3VbIudJYmxsT0FNJMeiB2+JTSlTQTSbU8QdesVmwJcmLg==", - "dev": true, - "peer": true, - "dependencies": { - "tmpl": "1.0.5" - } - }, - "node_modules/map-cache": { - "version": "0.2.2", - "resolved": "https://registry.npmjs.org/map-cache/-/map-cache-0.2.2.tgz", - "integrity": "sha512-8y/eV9QQZCiyn1SprXSrCmqJN0yNRATe+PO8ztwqrvrbdRLA3eYJF0yaR0YayLWkMbsQSKWS9N2gPcGEc4UsZg==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/map-obj": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/map-obj/-/map-obj-4.3.0.tgz", - "integrity": "sha512-hdN1wVrZbb29eBGiGjJbeP8JbKjq1urkHJ/LIP/NY48MZ1QVXUsQBV1G1zvYFHn1XE06cwjBsOI2K3Ulnj1YXQ==", - "dev": true, - "engines": { - "node": ">=8" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/map-visit": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/map-visit/-/map-visit-1.0.0.tgz", - "integrity": "sha512-4y7uGv8bd2WdM9vpQsiQNo41Ln1NvhvDRuVt0k2JZQ+ezN2uaQes7lZeZ+QQUHOLQAtDaBJ+7wCbi+ab/KFs+w==", - "dev": true, - "peer": true, - "dependencies": { - "object-visit": "^1.0.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/markdown-escapes": { - "version": "1.0.4", - "resolved": "https://registry.npmjs.org/markdown-escapes/-/markdown-escapes-1.0.4.tgz", - "integrity": "sha512-8z4efJYk43E0upd0NbVXwgSTQs6cT3T06etieCMEg7dRbzCbxUCK/GHlX8mhHRDcp+OLlHkPKsvqQTCvsRl2cg==", - "dev": true, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/markdown-table": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/markdown-table/-/markdown-table-2.0.0.tgz", - "integrity": "sha512-Ezda85ToJUBhM6WGaG6veasyym+Tbs3cMAw/ZhOPqXiYsr0jgocBV3j3nx+4lk47plLlIqjwuTm/ywVI+zjJ/A==", - "dev": true, - "dependencies": { - "repeat-string": "^1.0.0" - }, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/mathml-tag-names": { - "version": "2.1.3", - "resolved": "https://registry.npmjs.org/mathml-tag-names/-/mathml-tag-names-2.1.3.tgz", - "integrity": "sha512-APMBEanjybaPzUrfqU0IMU5I0AswKMH7k8OTLs0vvV4KZpExkTkY87nR/zpbuTPj+gARop7aGUbl11pnDfW6xg==", - "dev": true, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/mdast-util-compact": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/mdast-util-compact/-/mdast-util-compact-2.0.1.tgz", - "integrity": "sha512-7GlnT24gEwDrdAwEHrU4Vv5lLWrEer4KOkAiKT9nYstsTad7Oc1TwqT2zIMKRdZF7cTuaf+GA1E4Kv7jJh8mPA==", - "dev": true, - "dependencies": { - "unist-util-visit": "^2.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/mdast-util-compact/node_modules/unist-util-visit": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/unist-util-visit/-/unist-util-visit-2.0.3.tgz", - "integrity": "sha512-iJ4/RczbJMkD0712mGktuGpm/U4By4FfDonL7N/9tATGIF4imikjOuagyMY53tnZq3NP6BcmlrHhEKAfGWjh7Q==", - "dev": true, - "dependencies": { - "@types/unist": "^2.0.0", - "unist-util-is": "^4.0.0", - "unist-util-visit-parents": "^3.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/mdast-util-compact/node_modules/unist-util-visit-parents": { - "version": "3.1.1", - "resolved": "https://registry.npmjs.org/unist-util-visit-parents/-/unist-util-visit-parents-3.1.1.tgz", - "integrity": "sha512-1KROIZWo6bcMrZEwiH2UrXDyalAa0uqzWCxCJj6lPOvTve2WkfgCytoDTPaMnodXh1WrXOq0haVYHj99ynJlsg==", - "dev": true, - "dependencies": { - "@types/unist": "^2.0.0", - "unist-util-is": "^4.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/mdast-util-from-markdown": { - "version": "0.8.5", - "resolved": "https://registry.npmjs.org/mdast-util-from-markdown/-/mdast-util-from-markdown-0.8.5.tgz", - "integrity": "sha512-2hkTXtYYnr+NubD/g6KGBS/0mFmBcifAsI0yIWRiRo0PjVs6SSOSOdtzbp6kSGnShDN6G5aWZpKQ2lWRy27mWQ==", - "dev": true, - "dependencies": { - "@types/mdast": "^3.0.0", - "mdast-util-to-string": "^2.0.0", - "micromark": "~2.11.0", - "parse-entities": "^2.0.0", - "unist-util-stringify-position": "^2.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/mdast-util-from-markdown/node_modules/mdast-util-to-string": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/mdast-util-to-string/-/mdast-util-to-string-2.0.0.tgz", - "integrity": "sha512-AW4DRS3QbBayY/jJmD8437V1Gombjf8RSOUCMFBuo5iHi58AGEgVCKQ+ezHkZZDpAQS75hcBMpLqjpJTjtUL7w==", - "dev": true, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/mdast-util-from-markdown/node_modules/unist-util-stringify-position": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-2.0.3.tgz", - "integrity": "sha512-3faScn5I+hy9VleOq/qNbAd6pAx7iH5jYBMS9I1HgQVijz/4mv5Bvw5iw1sC/90CODiKo81G/ps8AJrISn687g==", - "dev": true, - "dependencies": { - "@types/unist": "^2.0.2" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/mdast-util-to-markdown": { - "version": "0.6.5", - "resolved": "https://registry.npmjs.org/mdast-util-to-markdown/-/mdast-util-to-markdown-0.6.5.tgz", - "integrity": "sha512-XeV9sDE7ZlOQvs45C9UKMtfTcctcaj/pGwH8YLbMHoMOXNNCn2LsqVQOqrF1+/NU8lKDAqozme9SCXWyo9oAcQ==", - "dev": true, - "dependencies": { - "@types/unist": "^2.0.0", - "longest-streak": "^2.0.0", - "mdast-util-to-string": "^2.0.0", - "parse-entities": "^2.0.0", - "repeat-string": "^1.0.0", - "zwitch": "^1.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/mdast-util-to-markdown/node_modules/mdast-util-to-string": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/mdast-util-to-string/-/mdast-util-to-string-2.0.0.tgz", - "integrity": "sha512-AW4DRS3QbBayY/jJmD8437V1Gombjf8RSOUCMFBuo5iHi58AGEgVCKQ+ezHkZZDpAQS75hcBMpLqjpJTjtUL7w==", - "dev": true, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/mdast-util-to-string": { - "version": "3.2.0", - "resolved": "https://registry.npmjs.org/mdast-util-to-string/-/mdast-util-to-string-3.2.0.tgz", - "integrity": "sha512-V4Zn/ncyN1QNSqSBxTrMOLpjr+IKdHl2v3KVLoWmDPscP4r9GcCi71gjgvUV1SFSKh92AjAG4peFuBl2/YgCJg==", - "dev": true, - "dependencies": { - "@types/mdast": "^3.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/meow": { - "version": "8.1.2", - "resolved": "https://registry.npmjs.org/meow/-/meow-8.1.2.tgz", - "integrity": "sha512-r85E3NdZ+mpYk1C6RjPFEMSE+s1iZMuHtsHAqY0DT3jZczl0diWUZ8g6oU7h0M9cD2EL+PzaYghhCLzR0ZNn5Q==", - "dev": true, - "dependencies": { - "@types/minimist": "^1.2.0", - "camelcase-keys": "^6.2.2", - "decamelize-keys": "^1.1.0", - "hard-rejection": "^2.1.0", - "minimist-options": "4.1.0", - "normalize-package-data": "^3.0.0", - "read-pkg-up": "^7.0.1", - "redent": "^3.0.0", - "trim-newlines": "^3.0.0", - "type-fest": "^0.18.0", - "yargs-parser": "^20.2.3" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/meow/node_modules/hosted-git-info": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-4.1.0.tgz", - "integrity": "sha512-kyCuEOWjJqZuDbRHzL8V93NzQhwIB71oFWSyzVo+KPZI+pnQPPxucdkrOZvkLRnrf5URsQM+IJ09Dw29cRALIA==", - "dev": true, - "dependencies": { - "lru-cache": "^6.0.0" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/meow/node_modules/lru-cache": { - "version": "6.0.0", - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz", - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==", - "dev": true, - "dependencies": { - "yallist": "^4.0.0" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/meow/node_modules/normalize-package-data": { - "version": "3.0.3", - "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-3.0.3.tgz", - "integrity": "sha512-p2W1sgqij3zMMyRC067Dg16bfzVH+w7hyegmpIvZ4JNjqtGOVAIvLmjBx3yP7YTe9vKJgkoNOPjwQGogDoMXFA==", - "dev": true, - "dependencies": { - "hosted-git-info": "^4.0.1", - "is-core-module": "^2.5.0", - "semver": "^7.3.4", - "validate-npm-package-license": "^3.0.1" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/meow/node_modules/type-fest": { - "version": "0.18.1", - "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.18.1.tgz", - "integrity": "sha512-OIAYXk8+ISY+qTOwkHtKqzAuxchoMiD9Udx+FSGQDuiRR+PJKJHc2NJAXlbhkGwTt/4/nKZxELY1w3ReWOL8mw==", - "dev": true, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/meow/node_modules/yallist": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz", - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==", - "dev": true - }, - "node_modules/merge-stream": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/merge-stream/-/merge-stream-2.0.0.tgz", - "integrity": "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==", - "dev": true - }, - "node_modules/merge2": { - "version": "1.4.1", - "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz", - "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==", - "dev": true, - "engines": { - "node": ">= 8" - } - }, - "node_modules/micromark": { - "version": "2.11.4", - "resolved": "https://registry.npmjs.org/micromark/-/micromark-2.11.4.tgz", - "integrity": "sha512-+WoovN/ppKolQOFIAajxi7Lu9kInbPxFuTBVEavFcL8eAfVstoc5MocPmqBeAdBOJV00uaVjegzH4+MA0DN/uA==", - "dev": true, - "funding": [ - { - "type": "GitHub Sponsors", - "url": "https://github.com/sponsors/unifiedjs" - }, - { - "type": "OpenCollective", - "url": "https://opencollective.com/unified" - } - ], - "dependencies": { - "debug": "^4.0.0", - "parse-entities": "^2.0.0" - } - }, - "node_modules/micromatch": { - "version": "4.0.5", - "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.5.tgz", - "integrity": "sha512-DMy+ERcEW2q8Z2Po+WNXuw3c5YaUSFjAO5GsJqfEl7UjvtIuFKO6ZrKvcItdy98dwFI2N1tg3zNIdKaQT+aNdA==", - "dev": true, - "dependencies": { - "braces": "^3.0.2", - "picomatch": "^2.3.1" - }, - "engines": { - "node": ">=8.6" - } - }, - "node_modules/mime-db": { - "version": "1.52.0", - "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz", - "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==", - "dev": true, - "engines": { - "node": ">= 0.6" - } - }, - "node_modules/mime-types": { - "version": "2.1.35", - "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz", - "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==", - "dev": true, - "dependencies": { - "mime-db": "1.52.0" - }, - "engines": { - "node": ">= 0.6" - } - }, - "node_modules/mimic-fn": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz", - "integrity": "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==", - "dev": true, - "engines": { - "node": ">=6" - } - }, - "node_modules/min-indent": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/min-indent/-/min-indent-1.0.1.tgz", - "integrity": "sha512-I9jwMn07Sy/IwOj3zVkVik2JTvgpaykDZEigL6Rx6N9LbMywwUSMtxET+7lVoDLLd3O3IXwJwvuuns8UB/HeAg==", - "dev": true, - "engines": { - "node": ">=4" - } - }, - "node_modules/minimatch": { - "version": "3.1.2", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz", - "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==", - "dev": true, - "dependencies": { - "brace-expansion": "^1.1.7" - }, - "engines": { - "node": "*" - } - }, - "node_modules/minimist": { - "version": "1.2.8", - "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz", - "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==", - "dev": true, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/minimist-options": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/minimist-options/-/minimist-options-4.1.0.tgz", - "integrity": "sha512-Q4r8ghd80yhO/0j1O3B2BjweX3fiHg9cdOwjJd2J76Q135c+NDxGCqdYKQ1SKBuFfgWbAUzBfvYjPUEeNgqN1A==", - "dev": true, - "dependencies": { - "arrify": "^1.0.1", - "is-plain-obj": "^1.1.0", - "kind-of": "^6.0.3" - }, - "engines": { - "node": ">= 6" - } - }, - "node_modules/mixin-deep": { - "version": "1.3.2", - "resolved": "https://registry.npmjs.org/mixin-deep/-/mixin-deep-1.3.2.tgz", - "integrity": "sha512-WRoDn//mXBiJ1H40rqa3vH0toePwSsGb45iInWlTySa+Uu4k3tYUSxa2v1KqAiLtvlrSzaExqS1gtk96A9zvEA==", - "dev": true, - "peer": true, - "dependencies": { - "for-in": "^1.0.2", - "is-extendable": "^1.0.1" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/mkdirp": { - "version": "1.0.4", - "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz", - "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==", - "dev": true, - "bin": { - "mkdirp": "bin/cmd.js" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/ms": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz", - "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==", - "dev": true - }, - "node_modules/mute-stream": { - "version": "0.0.8", - "resolved": "https://registry.npmjs.org/mute-stream/-/mute-stream-0.0.8.tgz", - "integrity": "sha512-nnbWWOkoWyUsTjKrhgD0dcz22mdkSnpYqbEjIm2nhwhuxlSkpywJmBo8h0ZqJdkp73mb90SssHkN4rsRaBAfAA==", - "dev": true - }, - "node_modules/nanoid": { - "version": "3.3.6", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.6.tgz", - "integrity": "sha512-BGcqMMJuToF7i1rt+2PWSNVnWIkGCU78jBG3RxO/bZlnZPK2Cmi2QaffxGO/2RvWi9sL+FAiRiXMgsyxQ1DIDA==", - "dev": true, - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/ai" - } - ], - "bin": { - "nanoid": "bin/nanoid.cjs" - }, - "engines": { - "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1" - } - }, - "node_modules/nanomatch": { - "version": "1.2.13", - "resolved": "https://registry.npmjs.org/nanomatch/-/nanomatch-1.2.13.tgz", - "integrity": "sha512-fpoe2T0RbHwBTBUOftAfBPaDEi06ufaUai0mE6Yn1kacc3SnTErfb/h+X94VXzI64rKFHYImXSvdwGGCmwOqCA==", - "dev": true, - "peer": true, - "dependencies": { - "arr-diff": "^4.0.0", - "array-unique": "^0.3.2", - "define-property": "^2.0.2", - "extend-shallow": "^3.0.2", - "fragment-cache": "^0.2.1", - "is-windows": "^1.0.2", - "kind-of": "^6.0.2", - "object.pick": "^1.3.0", - "regex-not": "^1.0.0", - "snapdragon": "^0.8.1", - "to-regex": "^3.0.1" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/natural-compare": { - "version": "1.4.0", - "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz", - "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==", - "dev": true - }, - "node_modules/natural-compare-lite": { - "version": "1.4.0", - "resolved": "https://registry.npmjs.org/natural-compare-lite/-/natural-compare-lite-1.4.0.tgz", - "integrity": "sha512-Tj+HTDSJJKaZnfiuw+iaF9skdPpTo2GtEly5JHnWV/hfv2Qj/9RKsGISQtLh2ox3l5EAGw487hnBee0sIJ6v2g==", - "dev": true - }, - "node_modules/next": { - "version": "14.1.0", - "resolved": "https://registry.npmjs.org/next/-/next-14.1.0.tgz", - "integrity": "sha512-wlzrsbfeSU48YQBjZhDzOwhWhGsy+uQycR8bHAOt1LY1bn3zZEcDyHQOEoN3aWzQ8LHCAJ1nqrWCc9XF2+O45Q==", - "dev": true, - "dependencies": { - "@next/env": "14.1.0", - "@swc/helpers": "0.5.2", - "busboy": "1.6.0", - "caniuse-lite": "^1.0.30001579", - "graceful-fs": "^4.2.11", - "postcss": "8.4.31", - "styled-jsx": "5.1.1" - }, - "bin": { - "next": "dist/bin/next" - }, - "engines": { - "node": ">=18.17.0" - }, - "optionalDependencies": { - "@next/swc-darwin-arm64": "14.1.0", - "@next/swc-darwin-x64": "14.1.0", - "@next/swc-linux-arm64-gnu": "14.1.0", - "@next/swc-linux-arm64-musl": "14.1.0", - "@next/swc-linux-x64-gnu": "14.1.0", - "@next/swc-linux-x64-musl": "14.1.0", - "@next/swc-win32-arm64-msvc": "14.1.0", - "@next/swc-win32-ia32-msvc": "14.1.0", - "@next/swc-win32-x64-msvc": "14.1.0" - }, - "peerDependencies": { - "@opentelemetry/api": "^1.1.0", - "react": "^18.2.0", - "react-dom": "^18.2.0", - "sass": "^1.3.0" - }, - "peerDependenciesMeta": { - "@opentelemetry/api": { - "optional": true - }, - "sass": { - "optional": true - } - } - }, - "node_modules/nice-try": { - "version": "1.0.5", - "resolved": "https://registry.npmjs.org/nice-try/-/nice-try-1.0.5.tgz", - "integrity": "sha512-1nh45deeb5olNY7eX82BkPO7SSxR5SSYJiPTrTdFUVYwAl8CKMA5N9PjTYkHiRjisVcxcQ1HXdLhx2qxxJzLNQ==", - "dev": true, - "peer": true - }, - "node_modules/node-fetch": { - "version": "2.7.0", - "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.7.0.tgz", - "integrity": "sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==", - "dev": true, - "dependencies": { - "whatwg-url": "^5.0.0" - }, - "engines": { - "node": "4.x || >=6.0.0" - }, - "peerDependencies": { - "encoding": "^0.1.0" - }, - "peerDependenciesMeta": { - "encoding": { - "optional": true - } - } - }, - "node_modules/node-fetch/node_modules/tr46": { - "version": "0.0.3", - "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz", - "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==", - "dev": true - }, - "node_modules/node-fetch/node_modules/webidl-conversions": { - "version": "3.0.1", - "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz", - "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==", - "dev": true - }, - "node_modules/node-fetch/node_modules/whatwg-url": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz", - "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==", - "dev": true, - "dependencies": { - "tr46": "~0.0.3", - "webidl-conversions": "^3.0.0" - } - }, - "node_modules/node-int64": { - "version": "0.4.0", - "resolved": "https://registry.npmjs.org/node-int64/-/node-int64-0.4.0.tgz", - "integrity": "sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw==", - "dev": true, - "peer": true - }, - "node_modules/node-notifier": { - "version": "8.0.2", - "resolved": "https://registry.npmjs.org/node-notifier/-/node-notifier-8.0.2.tgz", - "integrity": "sha512-oJP/9NAdd9+x2Q+rfphB2RJCHjod70RcRLjosiPMMu5gjIfwVnOUGq2nbTjTUbmy0DJ/tFIVT30+Qe3nzl4TJg==", - "dev": true, - "optional": true, - "peer": true, - "dependencies": { - "growly": "^1.3.0", - "is-wsl": "^2.2.0", - "semver": "^7.3.2", - "shellwords": "^0.1.1", - "uuid": "^8.3.0", - "which": "^2.0.2" - } - }, - "node_modules/node-releases": { - "version": "2.0.13", - "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.13.tgz", - "integrity": "sha512-uYr7J37ae/ORWdZeQ1xxMJe3NtdmqMC/JZK+geofDrkLUApKRHPd18/TxtBOJ4A0/+uUIliorNrfYV6s1b02eQ==", - "dev": true - }, - "node_modules/normalize-package-data": { - "version": "2.5.0", - "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-2.5.0.tgz", - "integrity": "sha512-/5CMN3T0R4XTj4DcGaexo+roZSdSFW/0AOOTROrjxzCG1wrWXEsGbRKevjlIL+ZDE4sZlJr5ED4YW0yqmkK+eA==", - "dev": true, - "dependencies": { - "hosted-git-info": "^2.1.4", - "resolve": "^1.10.0", - "semver": "2 || 3 || 4 || 5", - "validate-npm-package-license": "^3.0.1" - } - }, - "node_modules/normalize-package-data/node_modules/semver": { - "version": "5.7.2", - "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz", - "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==", - "dev": true, - "bin": { - "semver": "bin/semver" - } - }, - "node_modules/normalize-path": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz", - "integrity": "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==", - "dev": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/normalize-range": { - "version": "0.1.2", - "resolved": "https://registry.npmjs.org/normalize-range/-/normalize-range-0.1.2.tgz", - "integrity": "sha512-bdok/XvKII3nUpklnV6P2hxtMNrCboOjAcyBuQnWEhO665FwrSNRxU+AqpsyvO6LgGYPspN+lu5CLtw4jPRKNA==", - "dev": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/normalize-selector": { - "version": "0.2.0", - "resolved": "https://registry.npmjs.org/normalize-selector/-/normalize-selector-0.2.0.tgz", - "integrity": "sha512-dxvWdI8gw6eAvk9BlPffgEoGfM7AdijoCwOEJge3e3ulT2XLgmU7KvvxprOaCu05Q1uGRHmOhHe1r6emZoKyFw==", - "dev": true - }, - "node_modules/npm-run-path": { - "version": "4.0.1", - "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz", - "integrity": "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==", - "dev": true, - "dependencies": { - "path-key": "^3.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/num2fraction": { - "version": "1.2.2", - "resolved": "https://registry.npmjs.org/num2fraction/-/num2fraction-1.2.2.tgz", - "integrity": "sha512-Y1wZESM7VUThYY+4W+X4ySH2maqcA+p7UR+w8VWNWVAd6lwuXXWz/w/Cz43J/dI2I+PS6wD5N+bJUF+gjWvIqg==", - "dev": true - }, - "node_modules/nwsapi": { - "version": "2.2.7", - "resolved": "https://registry.npmjs.org/nwsapi/-/nwsapi-2.2.7.tgz", - "integrity": "sha512-ub5E4+FBPKwAZx0UwIQOjYWGHTEq5sPqHQNRN8Z9e4A7u3Tj1weLJsL59yH9vmvqEtBHaOmT6cYQKIZOxp35FQ==", - "dev": true, - "peer": true - }, - "node_modules/object-assign": { - "version": "4.1.1", - "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz", - "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==", - "dev": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/object-copy": { - "version": "0.1.0", - "resolved": "https://registry.npmjs.org/object-copy/-/object-copy-0.1.0.tgz", - "integrity": "sha512-79LYn6VAb63zgtmAteVOWo9Vdj71ZVBy3Pbse+VqxDpEP83XuujMrGqHIwAXJ5I/aM0zU7dIyIAhifVTPrNItQ==", - "dev": true, - "peer": true, - "dependencies": { - "copy-descriptor": "^0.1.0", - "define-property": "^0.2.5", - "kind-of": "^3.0.3" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/object-copy/node_modules/define-property": { - "version": "0.2.5", - "resolved": "https://registry.npmjs.org/define-property/-/define-property-0.2.5.tgz", - "integrity": "sha512-Rr7ADjQZenceVOAKop6ALkkRAmH1A4Gx9hV/7ZujPUN2rkATqFO0JZLZInbAjpZYoJ1gUx8MRMQVkYemcbMSTA==", - "dev": true, - "peer": true, - "dependencies": { - "is-descriptor": "^0.1.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/object-copy/node_modules/is-buffer": { - "version": "1.1.6", - "resolved": "https://registry.npmjs.org/is-buffer/-/is-buffer-1.1.6.tgz", - "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==", - "dev": true, - "peer": true - }, - "node_modules/object-copy/node_modules/is-descriptor": { - "version": "0.1.7", - "resolved": "https://registry.npmjs.org/is-descriptor/-/is-descriptor-0.1.7.tgz", - "integrity": "sha512-C3grZTvObeN1xud4cRWl366OMXZTj0+HGyk4hvfpx4ZHt1Pb60ANSXqCK7pdOTeUQpRzECBSTphqvD7U+l22Eg==", - "dev": true, - "peer": true, - "dependencies": { - "is-accessor-descriptor": "^1.0.1", - "is-data-descriptor": "^1.0.1" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/object-copy/node_modules/kind-of": { - "version": "3.2.2", - "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz", - "integrity": "sha512-NOW9QQXMoZGg/oqnVNoNTTIFEIid1627WCffUBJEdMxYApq7mNE7CpzucIPc+ZQg25Phej7IJSmX3hO+oblOtQ==", - "dev": true, - "peer": true, - "dependencies": { - "is-buffer": "^1.1.5" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/object-inspect": { - "version": "1.13.1", - "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.1.tgz", - "integrity": "sha512-5qoj1RUiKOMsCCNLV1CBiPYE10sziTsnmNxkAI/rZhiD63CF7IqdFGC/XzjWjpSgLf0LxXX3bDFIh0E18f6UhQ==", - "dev": true, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/object-keys": { - "version": "1.1.1", - "resolved": "https://registry.npmjs.org/object-keys/-/object-keys-1.1.1.tgz", - "integrity": "sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA==", - "dev": true, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/object-visit": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/object-visit/-/object-visit-1.0.1.tgz", - "integrity": "sha512-GBaMwwAVK9qbQN3Scdo0OyvgPW7l3lnaVMj84uTOZlswkX0KpF6fyDBJhtTthf7pymztoN36/KEr1DyhF96zEA==", - "dev": true, - "peer": true, - "dependencies": { - "isobject": "^3.0.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/object.assign": { - "version": "4.1.4", - "resolved": "https://registry.npmjs.org/object.assign/-/object.assign-4.1.4.tgz", - "integrity": "sha512-1mxKf0e58bvyjSCtKYY4sRe9itRk3PJpquJOjeIkz885CczcI4IvJJDLPS72oowuSh+pBxUFROpX+TU++hxhZQ==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "define-properties": "^1.1.4", - "has-symbols": "^1.0.3", - "object-keys": "^1.1.1" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/object.entries": { - "version": "1.1.7", - "resolved": "https://registry.npmjs.org/object.entries/-/object.entries-1.1.7.tgz", - "integrity": "sha512-jCBs/0plmPsOnrKAfFQXRG2NFjlhZgjjcBLSmTnEhU8U6vVTsVe8ANeQJCHTl3gSsI4J+0emOoCgoKlmQPMgmA==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "define-properties": "^1.2.0", - "es-abstract": "^1.22.1" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/object.fromentries": { - "version": "2.0.7", - "resolved": "https://registry.npmjs.org/object.fromentries/-/object.fromentries-2.0.7.tgz", - "integrity": "sha512-UPbPHML6sL8PI/mOqPwsH4G6iyXcCGzLin8KvEPenOZN5lpCNBZZQ+V62vdjB1mQHrmqGQt5/OJzemUA+KJmEA==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "define-properties": "^1.2.0", - "es-abstract": "^1.22.1" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/object.groupby": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/object.groupby/-/object.groupby-1.0.1.tgz", - "integrity": "sha512-HqaQtqLnp/8Bn4GL16cj+CUYbnpe1bh0TtEaWvybszDG4tgxCJuRpV8VGuvNaI1fAnI4lUJzDG55MXcOH4JZcQ==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "define-properties": "^1.2.0", - "es-abstract": "^1.22.1", - "get-intrinsic": "^1.2.1" - } - }, - "node_modules/object.hasown": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/object.hasown/-/object.hasown-1.1.3.tgz", - "integrity": "sha512-fFI4VcYpRHvSLXxP7yiZOMAd331cPfd2p7PFDVbgUsYOfCT3tICVqXWngbjr4m49OvsBwUBQ6O2uQoJvy3RexA==", - "dev": true, - "dependencies": { - "define-properties": "^1.2.0", - "es-abstract": "^1.22.1" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/object.pick": { - "version": "1.3.0", - "resolved": "https://registry.npmjs.org/object.pick/-/object.pick-1.3.0.tgz", - "integrity": "sha512-tqa/UMy/CCoYmj+H5qc07qvSL9dqcs/WZENZ1JbtWBlATP+iVOe778gE6MSijnyCnORzDuX6hU+LA4SZ09YjFQ==", - "dev": true, - "peer": true, - "dependencies": { - "isobject": "^3.0.1" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/object.values": { - "version": "1.1.7", - "resolved": "https://registry.npmjs.org/object.values/-/object.values-1.1.7.tgz", - "integrity": "sha512-aU6xnDFYT3x17e/f0IiiwlGPTy2jzMySGfUB4fq6z7CV8l85CWHDk5ErhyhpfDHhrOMwGFhSQkhMGHaIotA6Ng==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "define-properties": "^1.2.0", - "es-abstract": "^1.22.1" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/once": { - "version": "1.4.0", - "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz", - "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==", - "dev": true, - "dependencies": { - "wrappy": "1" - } - }, - "node_modules/onetime": { - "version": "5.1.2", - "resolved": "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz", - "integrity": "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==", - "dev": true, - "dependencies": { - "mimic-fn": "^2.1.0" - }, - "engines": { - "node": ">=6" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/open": { - "version": "7.3.0", - "resolved": "https://registry.npmjs.org/open/-/open-7.3.0.tgz", - "integrity": "sha512-mgLwQIx2F/ye9SmbrUkurZCnkoXyXyu9EbHtJZrICjVAJfyMArdHp3KkixGdZx1ZHFPNIwl0DDM1dFFqXbTLZw==", - "dev": true, - "dependencies": { - "is-docker": "^2.0.0", - "is-wsl": "^2.1.1" - }, - "engines": { - "node": ">=8" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/opencollective-postinstall": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/opencollective-postinstall/-/opencollective-postinstall-2.0.3.tgz", - "integrity": "sha512-8AV/sCtuzUeTo8gQK5qDZzARrulB3egtLzFgteqB2tcT4Mw7B8Kt7JcDHmltjz6FOAHsvTevk70gZEbhM4ZS9Q==", - "dev": true, - "bin": { - "opencollective-postinstall": "index.js" - } - }, - "node_modules/optionator": { - "version": "0.9.3", - "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.3.tgz", - "integrity": "sha512-JjCoypp+jKn1ttEFExxhetCKeJt9zhAgAve5FXHixTvFDW/5aEktX9bufBKLRRMdU7bNtpLfcGu94B3cdEJgjg==", - "dev": true, - "dependencies": { - "@aashutoshrathi/word-wrap": "^1.2.3", - "deep-is": "^0.1.3", - "fast-levenshtein": "^2.0.6", - "levn": "^0.4.1", - "prelude-ls": "^1.2.1", - "type-check": "^0.4.0" - }, - "engines": { - "node": ">= 0.8.0" - } - }, - "node_modules/os-tmpdir": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/os-tmpdir/-/os-tmpdir-1.0.2.tgz", - "integrity": "sha512-D2FR03Vir7FIu45XBY20mTb+/ZSWB00sjU9jdQXt83gDrI4Ztz5Fs7/yy74g2N5SVQY4xY1qDr4rNddwYRVX0g==", - "dev": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/p-each-series": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/p-each-series/-/p-each-series-2.2.0.tgz", - "integrity": "sha512-ycIL2+1V32th+8scbpTvyHNaHe02z0sjgh91XXjAk+ZeXoPN4Z46DVUnzdso0aX4KckKw0FNNFHdjZ2UsZvxiA==", - "dev": true, - "peer": true, - "engines": { - "node": ">=8" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/p-finally": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/p-finally/-/p-finally-1.0.0.tgz", - "integrity": "sha512-LICb2p9CB7FS+0eR1oqWnHhp0FljGLZCWBE9aix0Uye9W8LTQPwMTYVGWQWIw9RdQiDg4+epXQODwIYJtSJaow==", - "dev": true, - "peer": true, - "engines": { - "node": ">=4" - } - }, - "node_modules/p-limit": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-4.0.0.tgz", - "integrity": "sha512-5b0R4txpzjPWVw/cXXUResoD4hb6U/x9BH08L7nw+GN1sezDzPdxeRvpc9c433fZhBan/wusjbCsqwqm4EIBIQ==", - "dev": true, - "dependencies": { - "yocto-queue": "^1.0.0" - }, - "engines": { - "node": "^12.20.0 || ^14.13.1 || >=16.0.0" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/p-locate": { - "version": "6.0.0", - "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-6.0.0.tgz", - "integrity": "sha512-wPrq66Llhl7/4AGC6I+cqxT07LhXvWL08LNXz1fENOw0Ap4sRZZ/gZpTTJ5jpurzzzfS2W/Ge9BY3LgLjCShcw==", - "dev": true, - "dependencies": { - "p-limit": "^4.0.0" - }, - "engines": { - "node": "^12.20.0 || ^14.13.1 || >=16.0.0" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/p-map": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/p-map/-/p-map-4.0.0.tgz", - "integrity": "sha512-/bjOqmgETBYB5BoEeGVea8dmvHb2m9GLy1E9W43yeyfP6QQCZGFNa+XRceJEuDB6zqr+gKpIAmlLebMpykw/MQ==", - "dev": true, - "dependencies": { - "aggregate-error": "^3.0.0" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/p-try": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/p-try/-/p-try-2.2.0.tgz", - "integrity": "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==", - "dev": true, - "engines": { - "node": ">=6" - } - }, - "node_modules/parent-module": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz", - "integrity": "sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==", - "dev": true, - "dependencies": { - "callsites": "^3.0.0" - }, - "engines": { - "node": ">=6" - } - }, - "node_modules/parse-entities": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/parse-entities/-/parse-entities-2.0.0.tgz", - "integrity": "sha512-kkywGpCcRYhqQIchaWqZ875wzpS/bMKhz5HnN3p7wveJTkTtyAB/AlnS0f8DFSqYW1T82t6yEAkEcB+A1I3MbQ==", - "dev": true, - "dependencies": { - "character-entities": "^1.0.0", - "character-entities-legacy": "^1.0.0", - "character-reference-invalid": "^1.0.0", - "is-alphanumerical": "^1.0.0", - "is-decimal": "^1.0.0", - "is-hexadecimal": "^1.0.0" - }, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/parse-json": { - "version": "5.2.0", - "resolved": "https://registry.npmjs.org/parse-json/-/parse-json-5.2.0.tgz", - "integrity": "sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg==", - "dev": true, - "dependencies": { - "@babel/code-frame": "^7.0.0", - "error-ex": "^1.3.1", - "json-parse-even-better-errors": "^2.3.0", - "lines-and-columns": "^1.1.6" - }, - "engines": { - "node": ">=8" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/parse5": { - "version": "6.0.1", - "resolved": "https://registry.npmjs.org/parse5/-/parse5-6.0.1.tgz", - "integrity": "sha512-Ofn/CTFzRGTTxwpNEs9PP93gXShHcTq255nzRYSKe8AkVpZY7e1fpmTfOyoIvjP5HG7Z2ZM7VS9PPhQGW2pOpw==", - "dev": true, - "peer": true - }, - "node_modules/pascalcase": { - "version": "0.1.1", - "resolved": "https://registry.npmjs.org/pascalcase/-/pascalcase-0.1.1.tgz", - "integrity": "sha512-XHXfu/yOQRy9vYOtUDVMN60OEJjW013GoObG1o+xwQTpB9eYJX/BjXMsdW13ZDPruFhYYn0AG22w0xgQMwl3Nw==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/path-exists": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-5.0.0.tgz", - "integrity": "sha512-RjhtfwJOxzcFmNOi6ltcbcu4Iu+FL3zEj83dk4kAS+fVpTxXLO1b38RvJgT/0QwvV/L3aY9TAnyv0EOqW4GoMQ==", - "dev": true, - "engines": { - "node": "^12.20.0 || ^14.13.1 || >=16.0.0" - } - }, - "node_modules/path-is-absolute": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz", - "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==", - "dev": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/path-key": { - "version": "3.1.1", - "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz", - "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==", - "dev": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/path-parse": { - "version": "1.0.7", - "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz", - "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==", - "dev": true - }, - "node_modules/path-type": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/path-type/-/path-type-4.0.0.tgz", - "integrity": "sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==", - "dev": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/picocolors": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.0.0.tgz", - "integrity": "sha512-1fygroTLlHu66zi26VoTDv8yRgm0Fccecssto+MhsZ0D/DGW2sm8E8AjW7NU5VVTRt5GxbeZ5qBuJr+HyLYkjQ==", - "dev": true - }, - "node_modules/picomatch": { - "version": "2.3.1", - "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz", - "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==", - "dev": true, - "engines": { - "node": ">=8.6" - }, - "funding": { - "url": "https://github.com/sponsors/jonschlinkert" - } - }, - "node_modules/pify": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/pify/-/pify-3.0.0.tgz", - "integrity": "sha512-C3FsVNH1udSEX48gGX1xfvwTWfsYWj5U+8/uK15BGzIGrKoUpghX8hWZwa/OFnakBiiVNmBvemTJR5mcy7iPcg==", - "dev": true, - "engines": { - "node": ">=4" - } - }, - "node_modules/pirates": { - "version": "4.0.6", - "resolved": "https://registry.npmjs.org/pirates/-/pirates-4.0.6.tgz", - "integrity": "sha512-saLsH7WeYYPiD25LDuLRRY/i+6HaPYr6G1OUlN39otzkSTxKnubR9RTxS3/Kk50s1g2JTgFwWQDQyplC5/SHZg==", - "dev": true, - "peer": true, - "engines": { - "node": ">= 6" - } - }, - "node_modules/pkg-conf": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/pkg-conf/-/pkg-conf-2.1.0.tgz", - "integrity": "sha512-C+VUP+8jis7EsQZIhDYmS5qlNtjv2yP4SNtjXK9AP1ZcTRlnSfuumaTnRfYZnYgUUYVIKqL0fRvmUGDV2fmp6g==", - "dev": true, - "dependencies": { - "find-up": "^2.0.0", - "load-json-file": "^4.0.0" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/pkg-conf/node_modules/find-up": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/find-up/-/find-up-2.1.0.tgz", - "integrity": "sha512-NWzkk0jSJtTt08+FBFMvXoeZnOJD+jTtsRmBYbAIzJdX6l7dLgR7CTubCM5/eDdPUBvLCeVasP1brfVR/9/EZQ==", - "dev": true, - "dependencies": { - "locate-path": "^2.0.0" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/pkg-conf/node_modules/locate-path": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-2.0.0.tgz", - "integrity": "sha512-NCI2kiDkyR7VeEKm27Kda/iQHyKJe1Bu0FlTbYp3CqJu+9IFe9bLyAjMxf5ZDDbEg+iMPzB5zYyUTSm8wVTKmA==", - "dev": true, - "dependencies": { - "p-locate": "^2.0.0", - "path-exists": "^3.0.0" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/pkg-conf/node_modules/p-limit": { - "version": "1.3.0", - "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-1.3.0.tgz", - "integrity": "sha512-vvcXsLAJ9Dr5rQOPk7toZQZJApBl2K4J6dANSsEuh6QI41JYcsS/qhTGa9ErIUUgK3WNQoJYvylxvjqmiqEA9Q==", - "dev": true, - "dependencies": { - "p-try": "^1.0.0" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/pkg-conf/node_modules/p-locate": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-2.0.0.tgz", - "integrity": "sha512-nQja7m7gSKuewoVRen45CtVfODR3crN3goVQ0DDZ9N3yHxgpkuBhZqsaiotSQRrADUrne346peY7kT3TSACykg==", - "dev": true, - "dependencies": { - "p-limit": "^1.1.0" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/pkg-conf/node_modules/p-try": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/p-try/-/p-try-1.0.0.tgz", - "integrity": "sha512-U1etNYuMJoIz3ZXSrrySFjsXQTWOx2/jdi86L+2pRvph/qMKL6sbcCYdH23fqsbm8TH2Gn0OybpT4eSFlCVHww==", - "dev": true, - "engines": { - "node": ">=4" - } - }, - "node_modules/pkg-conf/node_modules/path-exists": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-3.0.0.tgz", - "integrity": "sha512-bpC7GYwiDYQ4wYLe+FA8lhRjhQCMcQGuSgGGqDkg/QerRWw9CmGRT0iSOVRSZJ29NMLZgIzqaljJ63oaL4NIJQ==", - "dev": true, - "engines": { - "node": ">=4" - } - }, - "node_modules/pkg-dir": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/pkg-dir/-/pkg-dir-5.0.0.tgz", - "integrity": "sha512-NPE8TDbzl/3YQYY7CSS228s3g2ollTFnc+Qi3tqmqJp9Vg2ovUpixcJEo2HJScN2Ez+kEaal6y70c0ehqJBJeA==", - "dev": true, - "dependencies": { - "find-up": "^5.0.0" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/pkg-dir/node_modules/find-up": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz", - "integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==", - "dev": true, - "dependencies": { - "locate-path": "^6.0.0", - "path-exists": "^4.0.0" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/pkg-dir/node_modules/locate-path": { - "version": "6.0.0", - "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz", - "integrity": "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==", - "dev": true, - "dependencies": { - "p-locate": "^5.0.0" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/pkg-dir/node_modules/p-limit": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz", - "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==", - "dev": true, - "dependencies": { - "yocto-queue": "^0.1.0" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/pkg-dir/node_modules/p-locate": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-5.0.0.tgz", - "integrity": "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==", - "dev": true, - "dependencies": { - "p-limit": "^3.0.2" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/pkg-dir/node_modules/path-exists": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz", - "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==", - "dev": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/pkg-dir/node_modules/yocto-queue": { - "version": "0.1.0", - "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz", - "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==", - "dev": true, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/please-upgrade-node": { - "version": "3.2.0", - "resolved": "https://registry.npmjs.org/please-upgrade-node/-/please-upgrade-node-3.2.0.tgz", - "integrity": "sha512-gQR3WpIgNIKwBMVLkpMUeR3e1/E1y42bqDQZfql+kDeXd8COYfM8PQA4X6y7a8u9Ua9FHmsrrmirW2vHs45hWg==", - "dev": true, - "dependencies": { - "semver-compare": "^1.0.0" - } - }, - "node_modules/posix-character-classes": { - "version": "0.1.1", - "resolved": "https://registry.npmjs.org/posix-character-classes/-/posix-character-classes-0.1.1.tgz", - "integrity": "sha512-xTgYBc3fuo7Yt7JbiuFxSYGToMoz8fLoE6TC9Wx1P/u+LfeThMOAqmuyECnlBaaJb+u1m9hHiXUEtwW4OzfUJg==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/postcss": { - "version": "8.4.31", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.31.tgz", - "integrity": "sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==", - "dev": true, - "funding": [ - { - "type": "opencollective", - "url": "https://opencollective.com/postcss/" - }, - { - "type": "tidelift", - "url": "https://tidelift.com/funding/github/npm/postcss" - }, - { - "type": "github", - "url": "https://github.com/sponsors/ai" - } - ], - "dependencies": { - "nanoid": "^3.3.6", - "picocolors": "^1.0.0", - "source-map-js": "^1.0.2" - }, - "engines": { - "node": "^10 || ^12 || >=14" - } - }, - "node_modules/postcss-html": { - "version": "0.36.0", - "resolved": "https://registry.npmjs.org/postcss-html/-/postcss-html-0.36.0.tgz", - "integrity": "sha512-HeiOxGcuwID0AFsNAL0ox3mW6MHH5cstWN1Z3Y+n6H+g12ih7LHdYxWwEA/QmrebctLjo79xz9ouK3MroHwOJw==", - "dev": true, - "dependencies": { - "htmlparser2": "^3.10.0" - }, - "peerDependencies": { - "postcss": ">=5.0.0", - "postcss-syntax": ">=0.36.0" - } - }, - "node_modules/postcss-less": { - "version": "3.1.4", - "resolved": "https://registry.npmjs.org/postcss-less/-/postcss-less-3.1.4.tgz", - "integrity": "sha512-7TvleQWNM2QLcHqvudt3VYjULVB49uiW6XzEUFmvwHzvsOEF5MwBrIXZDJQvJNFGjJQTzSzZnDoCJ8h/ljyGXA==", - "dev": true, - "dependencies": { - "postcss": "^7.0.14" - }, - "engines": { - "node": ">=6.14.4" - } - }, - "node_modules/postcss-less/node_modules/picocolors": { - "version": "0.2.1", - "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-0.2.1.tgz", - "integrity": "sha512-cMlDqaLEqfSaW8Z7N5Jw+lyIW869EzT73/F5lhtY9cLGoVxSXznfgfXMO0Z5K0o0Q2TkTXq+0KFsdnSe3jDViA==", - "dev": true - }, - "node_modules/postcss-less/node_modules/postcss": { - "version": "7.0.39", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-7.0.39.tgz", - "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==", - "dev": true, - "dependencies": { - "picocolors": "^0.2.1", - "source-map": "^0.6.1" - }, - "engines": { - "node": ">=6.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/postcss/" - } - }, - "node_modules/postcss-media-query-parser": { - "version": "0.2.3", - "resolved": "https://registry.npmjs.org/postcss-media-query-parser/-/postcss-media-query-parser-0.2.3.tgz", - "integrity": "sha512-3sOlxmbKcSHMjlUXQZKQ06jOswE7oVkXPxmZdoB1r5l0q6gTFTQSHxNxOrCccElbW7dxNytifNEo8qidX2Vsig==", - "dev": true - }, - "node_modules/postcss-resolve-nested-selector": { - "version": "0.1.1", - "resolved": "https://registry.npmjs.org/postcss-resolve-nested-selector/-/postcss-resolve-nested-selector-0.1.1.tgz", - "integrity": "sha512-HvExULSwLqHLgUy1rl3ANIqCsvMS0WHss2UOsXhXnQaZ9VCc2oBvIpXrl00IUFT5ZDITME0o6oiXeiHr2SAIfw==", - "dev": true - }, - "node_modules/postcss-safe-parser": { - "version": "4.0.2", - "resolved": "https://registry.npmjs.org/postcss-safe-parser/-/postcss-safe-parser-4.0.2.tgz", - "integrity": "sha512-Uw6ekxSWNLCPesSv/cmqf2bY/77z11O7jZGPax3ycZMFU/oi2DMH9i89AdHc1tRwFg/arFoEwX0IS3LCUxJh1g==", - "dev": true, - "dependencies": { - "postcss": "^7.0.26" - }, - "engines": { - "node": ">=6.0.0" - } - }, - "node_modules/postcss-safe-parser/node_modules/picocolors": { - "version": "0.2.1", - "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-0.2.1.tgz", - "integrity": "sha512-cMlDqaLEqfSaW8Z7N5Jw+lyIW869EzT73/F5lhtY9cLGoVxSXznfgfXMO0Z5K0o0Q2TkTXq+0KFsdnSe3jDViA==", - "dev": true - }, - "node_modules/postcss-safe-parser/node_modules/postcss": { - "version": "7.0.39", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-7.0.39.tgz", - "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==", - "dev": true, - "dependencies": { - "picocolors": "^0.2.1", - "source-map": "^0.6.1" - }, - "engines": { - "node": ">=6.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/postcss/" - } - }, - "node_modules/postcss-sass": { - "version": "0.4.4", - "resolved": "https://registry.npmjs.org/postcss-sass/-/postcss-sass-0.4.4.tgz", - "integrity": "sha512-BYxnVYx4mQooOhr+zer0qWbSPYnarAy8ZT7hAQtbxtgVf8gy+LSLT/hHGe35h14/pZDTw1DsxdbrwxBN++H+fg==", - "dev": true, - "dependencies": { - "gonzales-pe": "^4.3.0", - "postcss": "^7.0.21" - } - }, - "node_modules/postcss-sass/node_modules/picocolors": { - "version": "0.2.1", - "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-0.2.1.tgz", - "integrity": "sha512-cMlDqaLEqfSaW8Z7N5Jw+lyIW869EzT73/F5lhtY9cLGoVxSXznfgfXMO0Z5K0o0Q2TkTXq+0KFsdnSe3jDViA==", - "dev": true - }, - "node_modules/postcss-sass/node_modules/postcss": { - "version": "7.0.39", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-7.0.39.tgz", - "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==", - "dev": true, - "dependencies": { - "picocolors": "^0.2.1", - "source-map": "^0.6.1" - }, - "engines": { - "node": ">=6.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/postcss/" - } - }, - "node_modules/postcss-scss": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/postcss-scss/-/postcss-scss-2.1.1.tgz", - "integrity": "sha512-jQmGnj0hSGLd9RscFw9LyuSVAa5Bl1/KBPqG1NQw9w8ND55nY4ZEsdlVuYJvLPpV+y0nwTV5v/4rHPzZRihQbA==", - "dev": true, - "dependencies": { - "postcss": "^7.0.6" - }, - "engines": { - "node": ">=6.0.0" - } - }, - "node_modules/postcss-scss/node_modules/picocolors": { - "version": "0.2.1", - "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-0.2.1.tgz", - "integrity": "sha512-cMlDqaLEqfSaW8Z7N5Jw+lyIW869EzT73/F5lhtY9cLGoVxSXznfgfXMO0Z5K0o0Q2TkTXq+0KFsdnSe3jDViA==", - "dev": true - }, - "node_modules/postcss-scss/node_modules/postcss": { - "version": "7.0.39", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-7.0.39.tgz", - "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==", - "dev": true, - "dependencies": { - "picocolors": "^0.2.1", - "source-map": "^0.6.1" - }, - "engines": { - "node": ">=6.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/postcss/" - } - }, - "node_modules/postcss-selector-parser": { - "version": "6.0.13", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.0.13.tgz", - "integrity": "sha512-EaV1Gl4mUEV4ddhDnv/xtj7sxwrwxdetHdWUGnT4VJQf+4d05v6lHYZr8N573k5Z0BViss7BDhfWtKS3+sfAqQ==", - "dev": true, - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/postcss-sorting": { - "version": "5.0.1", - "resolved": "https://registry.npmjs.org/postcss-sorting/-/postcss-sorting-5.0.1.tgz", - "integrity": "sha512-Y9fUFkIhfrm6i0Ta3n+89j56EFqaNRdUKqXyRp6kvTcSXnmgEjaVowCXH+JBe9+YKWqd4nc28r2sgwnzJalccA==", - "dev": true, - "dependencies": { - "lodash": "^4.17.14", - "postcss": "^7.0.17" - }, - "engines": { - "node": ">=8.7.0" - } - }, - "node_modules/postcss-sorting/node_modules/picocolors": { - "version": "0.2.1", - "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-0.2.1.tgz", - "integrity": "sha512-cMlDqaLEqfSaW8Z7N5Jw+lyIW869EzT73/F5lhtY9cLGoVxSXznfgfXMO0Z5K0o0Q2TkTXq+0KFsdnSe3jDViA==", - "dev": true - }, - "node_modules/postcss-sorting/node_modules/postcss": { - "version": "7.0.39", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-7.0.39.tgz", - "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==", - "dev": true, - "dependencies": { - "picocolors": "^0.2.1", - "source-map": "^0.6.1" - }, - "engines": { - "node": ">=6.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/postcss/" - } - }, - "node_modules/postcss-syntax": { - "version": "0.36.2", - "resolved": "https://registry.npmjs.org/postcss-syntax/-/postcss-syntax-0.36.2.tgz", - "integrity": "sha512-nBRg/i7E3SOHWxF3PpF5WnJM/jQ1YpY9000OaVXlAQj6Zp/kIqJxEDWIZ67tAd7NLuk7zqN4yqe9nc0oNAOs1w==", - "dev": true, - "peerDependencies": { - "postcss": ">=5.0.0" - } - }, - "node_modules/postcss-value-parser": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-4.2.0.tgz", - "integrity": "sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==", - "dev": true - }, - "node_modules/postcss-values-parser": { - "version": "3.2.1", - "resolved": "https://registry.npmjs.org/postcss-values-parser/-/postcss-values-parser-3.2.1.tgz", - "integrity": "sha512-SQ7/88VE9LhJh9gc27/hqnSU/aZaREVJcRVccXBmajgP2RkjdJzNyH/a9GCVMI5nsRhT0jC5HpUMwfkz81DVVg==", - "dev": true, - "dependencies": { - "color-name": "^1.1.4", - "is-url-superb": "^3.0.0", - "postcss": "^7.0.5", - "url-regex": "^5.0.0" - }, - "engines": { - "node": ">=6.14.4" - } - }, - "node_modules/postcss-values-parser/node_modules/picocolors": { - "version": "0.2.1", - "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-0.2.1.tgz", - "integrity": "sha512-cMlDqaLEqfSaW8Z7N5Jw+lyIW869EzT73/F5lhtY9cLGoVxSXznfgfXMO0Z5K0o0Q2TkTXq+0KFsdnSe3jDViA==", - "dev": true - }, - "node_modules/postcss-values-parser/node_modules/postcss": { - "version": "7.0.39", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-7.0.39.tgz", - "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==", - "dev": true, - "dependencies": { - "picocolors": "^0.2.1", - "source-map": "^0.6.1" - }, - "engines": { - "node": ">=6.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/postcss/" - } - }, - "node_modules/prelude-ls": { - "version": "1.2.1", - "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz", - "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==", - "dev": true, - "engines": { - "node": ">= 0.8.0" - } - }, - "node_modules/prettier": { - "version": "2.2.1", - "resolved": "https://registry.npmjs.org/prettier/-/prettier-2.2.1.tgz", - "integrity": "sha512-PqyhM2yCjg/oKkFPtTGUojv7gnZAoG80ttl45O6x2Ug/rMJw4wcc9k6aaf2hibP7BGVCCM33gZoGjyvt9mm16Q==", - "dev": true, - "bin": { - "prettier": "bin-prettier.js" - }, - "engines": { - "node": ">=10.13.0" - } - }, - "node_modules/prettier-linter-helpers": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/prettier-linter-helpers/-/prettier-linter-helpers-1.0.0.tgz", - "integrity": "sha512-GbK2cP9nraSSUF9N2XwUwqfzlAFlMNYYl+ShE/V+H8a9uNl/oUqB1w2EL54Jh0OlyRSd8RfWYJ3coVS4TROP2w==", - "dev": true, - "dependencies": { - "fast-diff": "^1.1.2" - }, - "engines": { - "node": ">=6.0.0" - } - }, - "node_modules/pretty-format": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-26.6.2.tgz", - "integrity": "sha512-7AeGuCYNGmycyQbCqd/3PWH4eOoX/OiCa0uphp57NVTeAGdJGaAliecxwBDHYQCIvrW7aDBZCYeNTP/WX69mkg==", - "dev": true, - "peer": true, - "dependencies": { - "@jest/types": "^26.6.2", - "ansi-regex": "^5.0.0", - "ansi-styles": "^4.0.0", - "react-is": "^17.0.1" - }, - "engines": { - "node": ">= 10" - } - }, - "node_modules/prompts": { - "version": "2.4.2", - "resolved": "https://registry.npmjs.org/prompts/-/prompts-2.4.2.tgz", - "integrity": "sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q==", - "dev": true, - "peer": true, - "dependencies": { - "kleur": "^3.0.3", - "sisteransi": "^1.0.5" - }, - "engines": { - "node": ">= 6" - } - }, - "node_modules/prop-types": { - "version": "15.8.1", - "resolved": "https://registry.npmjs.org/prop-types/-/prop-types-15.8.1.tgz", - "integrity": "sha512-oj87CgZICdulUohogVAR7AjlC0327U4el4L6eAvOqCeudMDVU0NThNaV+b9Df4dXgSP1gXMTnPdhfe/2qDH5cg==", - "dev": true, - "dependencies": { - "loose-envify": "^1.4.0", - "object-assign": "^4.1.1", - "react-is": "^16.13.1" - } - }, - "node_modules/prop-types/node_modules/react-is": { - "version": "16.13.1", - "resolved": "https://registry.npmjs.org/react-is/-/react-is-16.13.1.tgz", - "integrity": "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ==", - "dev": true - }, - "node_modules/psl": { - "version": "1.9.0", - "resolved": "https://registry.npmjs.org/psl/-/psl-1.9.0.tgz", - "integrity": "sha512-E/ZsdU4HLs/68gYzgGTkMicWTLPdAftJLfJFlLUAAKZGkStNU72sZjT66SnMDVOfOWY/YAoiD7Jxa9iHvngcag==", - "dev": true, - "peer": true - }, - "node_modules/pump": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.0.tgz", - "integrity": "sha512-LwZy+p3SFs1Pytd/jYct4wpv49HiYCqd9Rlc5ZVdk0V+8Yzv6jR5Blk3TRmPL1ft69TxP0IMZGJ+WPFU2BFhww==", - "dev": true, - "peer": true, - "dependencies": { - "end-of-stream": "^1.1.0", - "once": "^1.3.1" - } - }, - "node_modules/punycode": { - "version": "2.3.1", - "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz", - "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==", - "dev": true, - "engines": { - "node": ">=6" - } - }, - "node_modules/querystringify": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/querystringify/-/querystringify-2.2.0.tgz", - "integrity": "sha512-FIqgj2EUvTa7R50u0rGsyTftzjYmv/a3hO345bZNrqabNqjtgiDMgmo4mkUjd+nzU5oF3dClKqFIPUKybUyqoQ==", - "dev": true, - "peer": true - }, - "node_modules/queue-microtask": { - "version": "1.2.3", - "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz", - "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==", - "dev": true, - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/feross" - }, - { - "type": "patreon", - "url": "https://www.patreon.com/feross" - }, - { - "type": "consulting", - "url": "https://feross.org/support" - } - ] - }, - "node_modules/quick-lru": { - "version": "4.0.1", - "resolved": "https://registry.npmjs.org/quick-lru/-/quick-lru-4.0.1.tgz", - "integrity": "sha512-ARhCpm70fzdcvNQfPoy49IaanKkTlRWF2JMzqhcJbhSFRZv7nPTvZJdcY7301IPmvW+/p0RgIWnQDLJxifsQ7g==", - "dev": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/react": { - "version": "18.2.0", - "resolved": "https://registry.npmjs.org/react/-/react-18.2.0.tgz", - "integrity": "sha512-/3IjMdb2L9QbBdWiW5e3P2/npwMBaU9mHCSCUzNln0ZCYbcfTsGbTJrU/kGemdH2IWmB2ioZ+zkxtmq6g09fGQ==", - "dev": true, - "peer": true, - "dependencies": { - "loose-envify": "^1.1.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/react-dom": { - "version": "18.2.0", - "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.2.0.tgz", - "integrity": "sha512-6IMTriUmvsjHUjNtEDudZfuDQUoWXVxKHhlEGSk81n4YFS+r/Kl99wXiwlVXtPBtJenozv2P+hxDsw9eA7Xo6g==", - "dev": true, - "peer": true, - "dependencies": { - "loose-envify": "^1.1.0", - "scheduler": "^0.23.0" - }, - "peerDependencies": { - "react": "^18.2.0" - } - }, - "node_modules/react-is": { - "version": "17.0.2", - "resolved": "https://registry.npmjs.org/react-is/-/react-is-17.0.2.tgz", - "integrity": "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==", - "dev": true, - "peer": true - }, - "node_modules/read-pkg": { - "version": "5.2.0", - "resolved": "https://registry.npmjs.org/read-pkg/-/read-pkg-5.2.0.tgz", - "integrity": "sha512-Ug69mNOpfvKDAc2Q8DRpMjjzdtrnv9HcSMX+4VsZxD1aZ6ZzrIE7rlzXBtWTyhULSMKg076AW6WR5iZpD0JiOg==", - "dev": true, - "dependencies": { - "@types/normalize-package-data": "^2.4.0", - "normalize-package-data": "^2.5.0", - "parse-json": "^5.0.0", - "type-fest": "^0.6.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/read-pkg-up": { - "version": "7.0.1", - "resolved": "https://registry.npmjs.org/read-pkg-up/-/read-pkg-up-7.0.1.tgz", - "integrity": "sha512-zK0TB7Xd6JpCLmlLmufqykGE+/TlOePD6qKClNW7hHDKFh/J7/7gCWGR7joEQEW1bKq3a3yUZSObOoWLFQ4ohg==", - "dev": true, - "dependencies": { - "find-up": "^4.1.0", - "read-pkg": "^5.2.0", - "type-fest": "^0.8.1" - }, - "engines": { - "node": ">=8" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/read-pkg-up/node_modules/find-up": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz", - "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==", - "dev": true, - "dependencies": { - "locate-path": "^5.0.0", - "path-exists": "^4.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/read-pkg-up/node_modules/locate-path": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz", - "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==", - "dev": true, - "dependencies": { - "p-locate": "^4.1.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/read-pkg-up/node_modules/p-limit": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz", - "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==", - "dev": true, - "dependencies": { - "p-try": "^2.0.0" - }, - "engines": { - "node": ">=6" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/read-pkg-up/node_modules/p-locate": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz", - "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==", - "dev": true, - "dependencies": { - "p-limit": "^2.2.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/read-pkg-up/node_modules/path-exists": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz", - "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==", - "dev": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/read-pkg-up/node_modules/type-fest": { - "version": "0.8.1", - "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.8.1.tgz", - "integrity": "sha512-4dbzIzqvjtgiM5rw1k5rEHtBANKmdudhGyBEajN01fEyhaAIhsoKNy6y7+IN93IfpFtwY9iqi7kD+xwKhQsNJA==", - "dev": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/read-pkg/node_modules/type-fest": { - "version": "0.6.0", - "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.6.0.tgz", - "integrity": "sha512-q+MB8nYR1KDLrgr4G5yemftpMC7/QLqVndBmEEdqzmNj5dcFOO4Oo8qlwZE3ULT3+Zim1F8Kq4cBnikNhlCMlg==", - "dev": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/readable-stream": { - "version": "3.6.2", - "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz", - "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==", - "dev": true, - "dependencies": { - "inherits": "^2.0.3", - "string_decoder": "^1.1.1", - "util-deprecate": "^1.0.1" - }, - "engines": { - "node": ">= 6" - } - }, - "node_modules/readdirp": { - "version": "3.5.0", - "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.5.0.tgz", - "integrity": "sha512-cMhu7c/8rdhkHXWsY+osBhfSy0JikwpHK/5+imo+LpeasTF8ouErHrlYkwT0++njiyuDvc7OFY5T3ukvZ8qmFQ==", - "dev": true, - "dependencies": { - "picomatch": "^2.2.1" - }, - "engines": { - "node": ">=8.10.0" - } - }, - "node_modules/redent": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/redent/-/redent-3.0.0.tgz", - "integrity": "sha512-6tDA8g98We0zd0GvVeMT9arEOnTw9qM03L9cJXaCjrip1OO764RDBLBfrB4cwzNGDj5OA5ioymC9GkizgWJDUg==", - "dev": true, - "dependencies": { - "indent-string": "^4.0.0", - "strip-indent": "^3.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/reflect.getprototypeof": { - "version": "1.0.4", - "resolved": "https://registry.npmjs.org/reflect.getprototypeof/-/reflect.getprototypeof-1.0.4.tgz", - "integrity": "sha512-ECkTw8TmJwW60lOTR+ZkODISW6RQ8+2CL3COqtiJKLd6MmB45hN51HprHFziKLGkAuTGQhBb91V8cy+KHlaCjw==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "define-properties": "^1.2.0", - "es-abstract": "^1.22.1", - "get-intrinsic": "^1.2.1", - "globalthis": "^1.0.3", - "which-builtin-type": "^1.1.3" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/regenerator-runtime": { - "version": "0.14.0", - "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.14.0.tgz", - "integrity": "sha512-srw17NI0TUWHuGa5CFGGmhfNIeja30WMBfbslPNhf6JrqQlLN5gcrvig1oqPxiVaXb0oW0XRKtH6Nngs5lKCIA==", - "dev": true - }, - "node_modules/regex-not": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/regex-not/-/regex-not-1.0.2.tgz", - "integrity": "sha512-J6SDjUgDxQj5NusnOtdFxDwN/+HWykR8GELwctJ7mdqhcyy1xEc4SRFHUXvxTp661YaVKAjfRLZ9cCqS6tn32A==", - "dev": true, - "peer": true, - "dependencies": { - "extend-shallow": "^3.0.2", - "safe-regex": "^1.1.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/regexp.prototype.flags": { - "version": "1.5.1", - "resolved": "https://registry.npmjs.org/regexp.prototype.flags/-/regexp.prototype.flags-1.5.1.tgz", - "integrity": "sha512-sy6TXMN+hnP/wMy+ISxg3krXx7BAtWVO4UouuCN/ziM9UEne0euamVNafDfvC83bRNr95y0V5iijeDQFUNpvrg==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "define-properties": "^1.2.0", - "set-function-name": "^2.0.0" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/remark": { - "version": "12.0.1", - "resolved": "https://registry.npmjs.org/remark/-/remark-12.0.1.tgz", - "integrity": "sha512-gS7HDonkdIaHmmP/+shCPejCEEW+liMp/t/QwmF0Xt47Rpuhl32lLtDV1uKWvGoq+kxr5jSgg5oAIpGuyULjUw==", - "dev": true, - "dependencies": { - "remark-parse": "^8.0.0", - "remark-stringify": "^8.0.0", - "unified": "^9.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/remark-mdx": { - "version": "1.6.22", - "resolved": "https://registry.npmjs.org/remark-mdx/-/remark-mdx-1.6.22.tgz", - "integrity": "sha512-phMHBJgeV76uyFkH4rvzCftLfKCr2RZuF+/gmVcaKrpsihyzmhXjA0BEMDaPTXG5y8qZOKPVo83NAOX01LPnOQ==", - "dev": true, - "dependencies": { - "@babel/core": "7.12.9", - "@babel/helper-plugin-utils": "7.10.4", - "@babel/plugin-proposal-object-rest-spread": "7.12.1", - "@babel/plugin-syntax-jsx": "7.12.1", - "@mdx-js/util": "1.6.22", - "is-alphabetical": "1.0.4", - "remark-parse": "8.0.3", - "unified": "9.2.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/remark-mdx/node_modules/@babel/core": { - "version": "7.12.9", - "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.12.9.tgz", - "integrity": "sha512-gTXYh3M5wb7FRXQy+FErKFAv90BnlOuNn1QkCK2lREoPAjrQCO49+HVSrFoe5uakFAF5eenS75KbO2vQiLrTMQ==", - "dev": true, - "dependencies": { - "@babel/code-frame": "^7.10.4", - "@babel/generator": "^7.12.5", - "@babel/helper-module-transforms": "^7.12.1", - "@babel/helpers": "^7.12.5", - "@babel/parser": "^7.12.7", - "@babel/template": "^7.12.7", - "@babel/traverse": "^7.12.9", - "@babel/types": "^7.12.7", - "convert-source-map": "^1.7.0", - "debug": "^4.1.0", - "gensync": "^1.0.0-beta.1", - "json5": "^2.1.2", - "lodash": "^4.17.19", - "resolve": "^1.3.2", - "semver": "^5.4.1", - "source-map": "^0.5.0" - }, - "engines": { - "node": ">=6.9.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/babel" - } - }, - "node_modules/remark-mdx/node_modules/@babel/helper-plugin-utils": { - "version": "7.10.4", - "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.10.4.tgz", - "integrity": "sha512-O4KCvQA6lLiMU9l2eawBPMf1xPP8xPfB3iEQw150hOVTqj/rfXz0ThTb4HEzqQfs2Bmo5Ay8BzxfzVtBrr9dVg==", - "dev": true - }, - "node_modules/remark-mdx/node_modules/is-plain-obj": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/is-plain-obj/-/is-plain-obj-2.1.0.tgz", - "integrity": "sha512-YWnfyRwxL/+SsrWYfOpUtz5b3YD+nyfkHvjbcanzk8zgyO4ASD67uVMRt8k5bM4lLMDnXfriRhOpemw+NfT1eA==", - "dev": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/remark-mdx/node_modules/semver": { - "version": "5.7.2", - "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz", - "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==", - "dev": true, - "bin": { - "semver": "bin/semver" - } - }, - "node_modules/remark-mdx/node_modules/source-map": { - "version": "0.5.7", - "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.5.7.tgz", - "integrity": "sha512-LbrmJOMUSdEVxIKvdcJzQC+nQhe8FUZQTXQy6+I75skNgn3OoQ0DZA8YnFa7gp8tqtL3KPf1kmo0R5DoApeSGQ==", - "dev": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/remark-mdx/node_modules/unified": { - "version": "9.2.0", - "resolved": "https://registry.npmjs.org/unified/-/unified-9.2.0.tgz", - "integrity": "sha512-vx2Z0vY+a3YoTj8+pttM3tiJHCwY5UFbYdiWrwBEbHmK8pvsPj2rtAX2BFfgXen8T39CJWblWRDT4L5WGXtDdg==", - "dev": true, - "dependencies": { - "bail": "^1.0.0", - "extend": "^3.0.0", - "is-buffer": "^2.0.0", - "is-plain-obj": "^2.0.0", - "trough": "^1.0.0", - "vfile": "^4.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/remark-mdx/node_modules/unist-util-stringify-position": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-2.0.3.tgz", - "integrity": "sha512-3faScn5I+hy9VleOq/qNbAd6pAx7iH5jYBMS9I1HgQVijz/4mv5Bvw5iw1sC/90CODiKo81G/ps8AJrISn687g==", - "dev": true, - "dependencies": { - "@types/unist": "^2.0.2" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/remark-mdx/node_modules/vfile": { - "version": "4.2.1", - "resolved": "https://registry.npmjs.org/vfile/-/vfile-4.2.1.tgz", - "integrity": "sha512-O6AE4OskCG5S1emQ/4gl8zK586RqA3srz3nfK/Viy0UPToBc5Trp9BVFb1u0CjsKrAWwnpr4ifM/KBXPWwJbCA==", - "dev": true, - "dependencies": { - "@types/unist": "^2.0.0", - "is-buffer": "^2.0.0", - "unist-util-stringify-position": "^2.0.0", - "vfile-message": "^2.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/remark-mdx/node_modules/vfile-message": { - "version": "2.0.4", - "resolved": "https://registry.npmjs.org/vfile-message/-/vfile-message-2.0.4.tgz", - "integrity": "sha512-DjssxRGkMvifUOJre00juHoP9DPWuzjxKuMDrhNbk2TdaYYBNMStsNhEOt3idrtI12VQYM/1+iM0KOzXi4pxwQ==", - "dev": true, - "dependencies": { - "@types/unist": "^2.0.0", - "unist-util-stringify-position": "^2.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/remark-parse": { - "version": "8.0.3", - "resolved": "https://registry.npmjs.org/remark-parse/-/remark-parse-8.0.3.tgz", - "integrity": "sha512-E1K9+QLGgggHxCQtLt++uXltxEprmWzNfg+MxpfHsZlrddKzZ/hZyWHDbK3/Ap8HJQqYJRXP+jHczdL6q6i85Q==", - "dev": true, - "dependencies": { - "ccount": "^1.0.0", - "collapse-white-space": "^1.0.2", - "is-alphabetical": "^1.0.0", - "is-decimal": "^1.0.0", - "is-whitespace-character": "^1.0.0", - "is-word-character": "^1.0.0", - "markdown-escapes": "^1.0.0", - "parse-entities": "^2.0.0", - "repeat-string": "^1.5.4", - "state-toggle": "^1.0.0", - "trim": "0.0.1", - "trim-trailing-lines": "^1.0.0", - "unherit": "^1.0.4", - "unist-util-remove-position": "^2.0.0", - "vfile-location": "^3.0.0", - "xtend": "^4.0.1" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/remark-stringify": { - "version": "8.1.1", - "resolved": "https://registry.npmjs.org/remark-stringify/-/remark-stringify-8.1.1.tgz", - "integrity": "sha512-q4EyPZT3PcA3Eq7vPpT6bIdokXzFGp9i85igjmhRyXWmPs0Y6/d2FYwUNotKAWyLch7g0ASZJn/KHHcHZQ163A==", - "dev": true, - "dependencies": { - "ccount": "^1.0.0", - "is-alphanumeric": "^1.0.0", - "is-decimal": "^1.0.0", - "is-whitespace-character": "^1.0.0", - "longest-streak": "^2.0.1", - "markdown-escapes": "^1.0.0", - "markdown-table": "^2.0.0", - "mdast-util-compact": "^2.0.0", - "parse-entities": "^2.0.0", - "repeat-string": "^1.5.4", - "state-toggle": "^1.0.0", - "stringify-entities": "^3.0.0", - "unherit": "^1.0.4", - "xtend": "^4.0.1" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/remove-trailing-separator": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/remove-trailing-separator/-/remove-trailing-separator-1.1.0.tgz", - "integrity": "sha512-/hS+Y0u3aOfIETiaiirUFwDBDzmXPvO+jAfKTitUngIPzdKc6Z0LoFjM/CK5PL4C+eKwHohlHAb6H0VFfmmUsw==", - "dev": true, - "peer": true - }, - "node_modules/repeat-element": { - "version": "1.1.4", - "resolved": "https://registry.npmjs.org/repeat-element/-/repeat-element-1.1.4.tgz", - "integrity": "sha512-LFiNfRcSu7KK3evMyYOuCzv3L10TW7yC1G2/+StMjK8Y6Vqd2MG7r/Qjw4ghtuCOjFvlnms/iMmLqpvW/ES/WQ==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/repeat-string": { - "version": "1.6.1", - "resolved": "https://registry.npmjs.org/repeat-string/-/repeat-string-1.6.1.tgz", - "integrity": "sha512-PV0dzCYDNfRi1jCDbJzpW7jNNDRuCOG/jI5ctQcGKt/clZD+YcPS3yIlWuTJMmESC8aevCFmWJy5wjAFgNqN6w==", - "dev": true, - "engines": { - "node": ">=0.10" - } - }, - "node_modules/require-directory": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz", - "integrity": "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==", - "dev": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/require-from-string": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz", - "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==", - "dev": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/require-main-filename": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/require-main-filename/-/require-main-filename-2.0.0.tgz", - "integrity": "sha512-NKN5kMDylKuldxYLSUfrbo5Tuzh4hd+2E8NPPX02mZtn1VuREQToYe/ZdlJy+J3uCpfaiGF05e7B8W0iXbQHmg==", - "dev": true, - "peer": true - }, - "node_modules/requires-port": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/requires-port/-/requires-port-1.0.0.tgz", - "integrity": "sha512-KigOCHcocU3XODJxsu8i/j8T9tzT4adHiecwORRQ0ZZFcp7ahwXuRU1m+yuO90C5ZUyGeGfocHDI14M3L3yDAQ==", - "dev": true, - "peer": true - }, - "node_modules/resolve": { - "version": "1.22.8", - "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.8.tgz", - "integrity": "sha512-oKWePCxqpd6FlLvGV1VU0x7bkPmmCNolxzjMf4NczoDnQcIWrAF+cPtZn5i6n+RfD2d9i0tzpKnG6Yk168yIyw==", - "dev": true, - "dependencies": { - "is-core-module": "^2.13.0", - "path-parse": "^1.0.7", - "supports-preserve-symlinks-flag": "^1.0.0" - }, - "bin": { - "resolve": "bin/resolve" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/resolve-cwd": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/resolve-cwd/-/resolve-cwd-3.0.0.tgz", - "integrity": "sha512-OrZaX2Mb+rJCpH/6CpSqt9xFVpN++x01XnN2ie9g6P5/3xelLAkXWVADpdz1IHD/KFfEXyE6V0U01OQ3UO2rEg==", - "dev": true, - "peer": true, - "dependencies": { - "resolve-from": "^5.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/resolve-cwd/node_modules/resolve-from": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-5.0.0.tgz", - "integrity": "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==", - "dev": true, - "peer": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/resolve-from": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-4.0.0.tgz", - "integrity": "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==", - "dev": true, - "engines": { - "node": ">=4" - } - }, - "node_modules/resolve-pkg-maps": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/resolve-pkg-maps/-/resolve-pkg-maps-1.0.0.tgz", - "integrity": "sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==", - "dev": true, - "funding": { - "url": "https://github.com/privatenumber/resolve-pkg-maps?sponsor=1" - } - }, - "node_modules/resolve-url": { - "version": "0.2.1", - "resolved": "https://registry.npmjs.org/resolve-url/-/resolve-url-0.2.1.tgz", - "integrity": "sha512-ZuF55hVUQaaczgOIwqWzkEcEidmlD/xl44x1UZnhOXcYuFN2S6+rcxpG+C1N3So0wvNI3DmJICUFfu2SxhBmvg==", - "deprecated": "https://github.com/lydell/resolve-url#deprecated", - "dev": true, - "peer": true - }, - "node_modules/restore-cursor": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/restore-cursor/-/restore-cursor-3.1.0.tgz", - "integrity": "sha512-l+sSefzHpj5qimhFSE5a8nufZYAM3sBSVMAPtYkmC+4EH2anSGaEMXSD0izRQbu9nfyQ9y5JrVmp7E8oZrUjvA==", - "dev": true, - "dependencies": { - "onetime": "^5.1.0", - "signal-exit": "^3.0.2" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/ret": { - "version": "0.1.15", - "resolved": "https://registry.npmjs.org/ret/-/ret-0.1.15.tgz", - "integrity": "sha512-TTlYpa+OL+vMMNG24xSlQGEJ3B/RzEfUlLct7b5G/ytav+wPrplCpVMFuwzXbkecJrb6IYo1iFb0S9v37754mg==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.12" - } - }, - "node_modules/reusify": { - "version": "1.0.4", - "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.0.4.tgz", - "integrity": "sha512-U9nH88a3fc/ekCF1l0/UP1IosiuIjyTh7hBvXVMHYgVcfGvt897Xguj2UOLDeI5BG2m7/uwyaLVT6fbtCwTyzw==", - "dev": true, - "engines": { - "iojs": ">=1.0.0", - "node": ">=0.10.0" - } - }, - "node_modules/rfdc": { - "version": "1.3.0", - "resolved": "https://registry.npmjs.org/rfdc/-/rfdc-1.3.0.tgz", - "integrity": "sha512-V2hovdzFbOi77/WajaSMXk2OLm+xNIeQdMMuB7icj7bk6zi2F8GGAxigcnDFpJHbNyNcgyJDiP+8nOrY5cZGrA==", - "dev": true - }, - "node_modules/rimraf": { - "version": "3.0.2", - "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-3.0.2.tgz", - "integrity": "sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==", - "dev": true, - "dependencies": { - "glob": "^7.1.3" - }, - "bin": { - "rimraf": "bin.js" - }, - "funding": { - "url": "https://github.com/sponsors/isaacs" - } - }, - "node_modules/rivet-graphql": { - "version": "0.6.0-canary-20230309231927", - "resolved": "https://registry.npmjs.org/rivet-graphql/-/rivet-graphql-0.6.0-canary-20230309231927.tgz", - "integrity": "sha512-6+HlBIKGty0+XULdpQaXwFpXgItmNUOCSZ8a6Eit/kJzXPp7YVyBMvCN9ozaRVqHUK8PiToGB+jg+jo8/V+bgw==", - "dev": true, - "dependencies": { - "@graphql-typed-document-node/core": "^3.1.2", - "graphql": "^16.6.0", - "graphql-request": "~5.1.0" - } - }, - "node_modules/rsvp": { - "version": "4.8.5", - "resolved": "https://registry.npmjs.org/rsvp/-/rsvp-4.8.5.tgz", - "integrity": "sha512-nfMOlASu9OnRJo1mbEk2cz0D56a1MBNrJ7orjRZQG10XDyuvwksKbuXNp6qa+kbn839HwjwhBzhFmdsaEAfauA==", - "dev": true, - "peer": true, - "engines": { - "node": "6.* || >= 7.*" - } - }, - "node_modules/run-async": { - "version": "2.4.1", - "resolved": "https://registry.npmjs.org/run-async/-/run-async-2.4.1.tgz", - "integrity": "sha512-tvVnVv01b8c1RrA6Ep7JkStj85Guv/YrMcwqYQnwjsAS2cTmmPGBBjAjpCW7RrSodNSoE2/qg9O4bceNvUuDgQ==", - "dev": true, - "engines": { - "node": ">=0.12.0" - } - }, - "node_modules/run-parallel": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz", - "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==", - "dev": true, - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/feross" - }, - { - "type": "patreon", - "url": "https://www.patreon.com/feross" - }, - { - "type": "consulting", - "url": "https://feross.org/support" - } - ], - "dependencies": { - "queue-microtask": "^1.2.2" - } - }, - "node_modules/rxjs": { - "version": "6.6.7", - "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-6.6.7.tgz", - "integrity": "sha512-hTdwr+7yYNIT5n4AMYp85KA6yw2Va0FLa3Rguvbpa4W3I5xynaBZo41cM3XM+4Q6fRMj3sBYIR1VAmZMXYJvRQ==", - "dev": true, - "dependencies": { - "tslib": "^1.9.0" - }, - "engines": { - "npm": ">=2.0.0" - } - }, - "node_modules/rxjs/node_modules/tslib": { - "version": "1.14.1", - "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz", - "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==", - "dev": true - }, - "node_modules/safe-array-concat": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/safe-array-concat/-/safe-array-concat-1.0.1.tgz", - "integrity": "sha512-6XbUAseYE2KtOuGueyeobCySj9L4+66Tn6KQMOPQJrAJEowYKW/YR/MGJZl7FdydUdaFu4LYyDZjxf4/Nmo23Q==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "get-intrinsic": "^1.2.1", - "has-symbols": "^1.0.3", - "isarray": "^2.0.5" - }, - "engines": { - "node": ">=0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/safe-buffer": { - "version": "5.2.1", - "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz", - "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==", - "dev": true, - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/feross" - }, - { - "type": "patreon", - "url": "https://www.patreon.com/feross" - }, - { - "type": "consulting", - "url": "https://feross.org/support" - } - ] - }, - "node_modules/safe-regex": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/safe-regex/-/safe-regex-1.1.0.tgz", - "integrity": "sha512-aJXcif4xnaNUzvUuC5gcb46oTS7zvg4jpMTnuqtrEPlR3vFr4pxtdTwaF1Qs3Enjn9HK+ZlwQui+a7z0SywIzg==", - "dev": true, - "peer": true, - "dependencies": { - "ret": "~0.1.10" - } - }, - "node_modules/safe-regex-test": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/safe-regex-test/-/safe-regex-test-1.0.0.tgz", - "integrity": "sha512-JBUUzyOgEwXQY1NuPtvcj/qcBDbDmEvWufhlnXZIm75DEHp+afM1r1ujJpJsV/gSM4t59tpDyPi1sd6ZaPFfsA==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "get-intrinsic": "^1.1.3", - "is-regex": "^1.1.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/safer-buffer": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz", - "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==", - "dev": true - }, - "node_modules/sane": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/sane/-/sane-4.1.0.tgz", - "integrity": "sha512-hhbzAgTIX8O7SHfp2c8/kREfEn4qO/9q8C9beyY6+tvZ87EpoZ3i1RIEvp27YBswnNbY9mWd6paKVmKbAgLfZA==", - "deprecated": "some dependency vulnerabilities fixed, support for node < 10 dropped, and newer ECMAScript syntax/features added", - "dev": true, - "peer": true, - "dependencies": { - "@cnakazawa/watch": "^1.0.3", - "anymatch": "^2.0.0", - "capture-exit": "^2.0.0", - "exec-sh": "^0.3.2", - "execa": "^1.0.0", - "fb-watchman": "^2.0.0", - "micromatch": "^3.1.4", - "minimist": "^1.1.1", - "walker": "~1.0.5" - }, - "bin": { - "sane": "src/cli.js" - }, - "engines": { - "node": "6.* || 8.* || >= 10.*" - } - }, - "node_modules/sane/node_modules/anymatch": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/anymatch/-/anymatch-2.0.0.tgz", - "integrity": "sha512-5teOsQWABXHHBFP9y3skS5P3d/WfWXpv3FUpy+LorMrNYaT9pI4oLMQX7jzQ2KklNpGpWHzdCXTDT2Y3XGlZBw==", - "dev": true, - "peer": true, - "dependencies": { - "micromatch": "^3.1.4", - "normalize-path": "^2.1.1" - } - }, - "node_modules/sane/node_modules/braces": { - "version": "2.3.2", - "resolved": "https://registry.npmjs.org/braces/-/braces-2.3.2.tgz", - "integrity": "sha512-aNdbnj9P8PjdXU4ybaWLK2IF3jc/EoDYbC7AazW6to3TRsfXxscC9UXOB5iDiEQrkyIbWp2SLQda4+QAa7nc3w==", - "dev": true, - "peer": true, - "dependencies": { - "arr-flatten": "^1.1.0", - "array-unique": "^0.3.2", - "extend-shallow": "^2.0.1", - "fill-range": "^4.0.0", - "isobject": "^3.0.1", - "repeat-element": "^1.1.2", - "snapdragon": "^0.8.1", - "snapdragon-node": "^2.0.1", - "split-string": "^3.0.2", - "to-regex": "^3.0.1" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/sane/node_modules/braces/node_modules/extend-shallow": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz", - "integrity": "sha512-zCnTtlxNoAiDc3gqY2aYAWFx7XWWiasuF2K8Me5WbN8otHKTUKBwjPtNpRs/rbUZm7KxWAaNj7P1a/p52GbVug==", - "dev": true, - "peer": true, - "dependencies": { - "is-extendable": "^0.1.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/sane/node_modules/cross-spawn": { - "version": "6.0.5", - "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-6.0.5.tgz", - "integrity": "sha512-eTVLrBSt7fjbDygz805pMnstIs2VTBNkRm0qxZd+M7A5XDdxVRWO5MxGBXZhjY4cqLYLdtrGqRf8mBPmzwSpWQ==", - "dev": true, - "peer": true, - "dependencies": { - "nice-try": "^1.0.4", - "path-key": "^2.0.1", - "semver": "^5.5.0", - "shebang-command": "^1.2.0", - "which": "^1.2.9" - }, - "engines": { - "node": ">=4.8" - } - }, - "node_modules/sane/node_modules/execa": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/execa/-/execa-1.0.0.tgz", - "integrity": "sha512-adbxcyWV46qiHyvSp50TKt05tB4tK3HcmF7/nxfAdhnox83seTDbwnaqKO4sXRy7roHAIFqJP/Rw/AuEbX61LA==", - "dev": true, - "peer": true, - "dependencies": { - "cross-spawn": "^6.0.0", - "get-stream": "^4.0.0", - "is-stream": "^1.1.0", - "npm-run-path": "^2.0.0", - "p-finally": "^1.0.0", - "signal-exit": "^3.0.0", - "strip-eof": "^1.0.0" - }, - "engines": { - "node": ">=6" - } - }, - "node_modules/sane/node_modules/fill-range": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-4.0.0.tgz", - "integrity": "sha512-VcpLTWqWDiTerugjj8e3+esbg+skS3M9e54UuR3iCeIDMXCLTsAH8hTSzDQU/X6/6t3eYkOKoZSef2PlU6U1XQ==", - "dev": true, - "peer": true, - "dependencies": { - "extend-shallow": "^2.0.1", - "is-number": "^3.0.0", - "repeat-string": "^1.6.1", - "to-regex-range": "^2.1.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/sane/node_modules/fill-range/node_modules/extend-shallow": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz", - "integrity": "sha512-zCnTtlxNoAiDc3gqY2aYAWFx7XWWiasuF2K8Me5WbN8otHKTUKBwjPtNpRs/rbUZm7KxWAaNj7P1a/p52GbVug==", - "dev": true, - "peer": true, - "dependencies": { - "is-extendable": "^0.1.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/sane/node_modules/get-stream": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-4.1.0.tgz", - "integrity": "sha512-GMat4EJ5161kIy2HevLlr4luNjBgvmj413KaQA7jt4V8B4RDsfpHk7WQ9GVqfYyyx8OS/L66Kox+rJRNklLK7w==", - "dev": true, - "peer": true, - "dependencies": { - "pump": "^3.0.0" - }, - "engines": { - "node": ">=6" - } - }, - "node_modules/sane/node_modules/is-buffer": { - "version": "1.1.6", - "resolved": "https://registry.npmjs.org/is-buffer/-/is-buffer-1.1.6.tgz", - "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==", - "dev": true, - "peer": true - }, - "node_modules/sane/node_modules/is-extendable": { - "version": "0.1.1", - "resolved": "https://registry.npmjs.org/is-extendable/-/is-extendable-0.1.1.tgz", - "integrity": "sha512-5BMULNob1vgFX6EjQw5izWDxrecWK9AM72rugNr0TFldMOi0fj6Jk+zeKIt0xGj4cEfQIJth4w3OKWOJ4f+AFw==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/sane/node_modules/is-number": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/is-number/-/is-number-3.0.0.tgz", - "integrity": "sha512-4cboCqIpliH+mAvFNegjZQ4kgKc3ZUhQVr3HvWbSh5q3WH2v82ct+T2Y1hdU5Gdtorx/cLifQjqCbL7bpznLTg==", - "dev": true, - "peer": true, - "dependencies": { - "kind-of": "^3.0.2" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/sane/node_modules/is-number/node_modules/kind-of": { - "version": "3.2.2", - "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz", - "integrity": "sha512-NOW9QQXMoZGg/oqnVNoNTTIFEIid1627WCffUBJEdMxYApq7mNE7CpzucIPc+ZQg25Phej7IJSmX3hO+oblOtQ==", - "dev": true, - "peer": true, - "dependencies": { - "is-buffer": "^1.1.5" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/sane/node_modules/is-stream": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-1.1.0.tgz", - "integrity": "sha512-uQPm8kcs47jx38atAcWTVxyltQYoPT68y9aWYdV6yWXSyW8mzSat0TL6CiWdZeCdF3KrAvpVtnHbTv4RN+rqdQ==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/sane/node_modules/micromatch": { - "version": "3.1.10", - "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-3.1.10.tgz", - "integrity": "sha512-MWikgl9n9M3w+bpsY3He8L+w9eF9338xRl8IAO5viDizwSzziFEyUzo2xrrloB64ADbTf8uA8vRqqttDTOmccg==", - "dev": true, - "peer": true, - "dependencies": { - "arr-diff": "^4.0.0", - "array-unique": "^0.3.2", - "braces": "^2.3.1", - "define-property": "^2.0.2", - "extend-shallow": "^3.0.2", - "extglob": "^2.0.4", - "fragment-cache": "^0.2.1", - "kind-of": "^6.0.2", - "nanomatch": "^1.2.9", - "object.pick": "^1.3.0", - "regex-not": "^1.0.0", - "snapdragon": "^0.8.1", - "to-regex": "^3.0.2" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/sane/node_modules/normalize-path": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-2.1.1.tgz", - "integrity": "sha512-3pKJwH184Xo/lnH6oyP1q2pMd7HcypqqmRs91/6/i2CGtWwIKGCkOOMTm/zXbgTEWHw1uNpNi/igc3ePOYHb6w==", - "dev": true, - "peer": true, - "dependencies": { - "remove-trailing-separator": "^1.0.1" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/sane/node_modules/npm-run-path": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-2.0.2.tgz", - "integrity": "sha512-lJxZYlT4DW/bRUtFh1MQIWqmLwQfAxnqWG4HhEdjMlkrJYnJn0Jrr2u3mgxqaWsdiBc76TYkTG/mhrnYTuzfHw==", - "dev": true, - "peer": true, - "dependencies": { - "path-key": "^2.0.0" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/sane/node_modules/path-key": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/path-key/-/path-key-2.0.1.tgz", - "integrity": "sha512-fEHGKCSmUSDPv4uoj8AlD+joPlq3peND+HRYyxFz4KPw4z926S/b8rIuFs2FYJg3BwsxJf6A9/3eIdLaYC+9Dw==", - "dev": true, - "peer": true, - "engines": { - "node": ">=4" - } - }, - "node_modules/sane/node_modules/semver": { - "version": "5.7.2", - "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz", - "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==", - "dev": true, - "peer": true, - "bin": { - "semver": "bin/semver" - } - }, - "node_modules/sane/node_modules/shebang-command": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-1.2.0.tgz", - "integrity": "sha512-EV3L1+UQWGor21OmnvojK36mhg+TyIKDh3iFBKBohr5xeXIhNBcx8oWdgkTEEQ+BEFFYdLRuqMfd5L84N1V5Vg==", - "dev": true, - "peer": true, - "dependencies": { - "shebang-regex": "^1.0.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/sane/node_modules/shebang-regex": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-1.0.0.tgz", - "integrity": "sha512-wpoSFAxys6b2a2wHZ1XpDSgD7N9iVjg29Ph9uV/uaP9Ex/KXlkTZTeddxDPSYQpgvzKLGJke2UU0AzoGCjNIvQ==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/sane/node_modules/to-regex-range": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-2.1.1.tgz", - "integrity": "sha512-ZZWNfCjUokXXDGXFpZehJIkZqq91BcULFq/Pi7M5i4JnxXdhMKAK682z8bCW3o8Hj1wuuzoKcW3DfVzaP6VuNg==", - "dev": true, - "peer": true, - "dependencies": { - "is-number": "^3.0.0", - "repeat-string": "^1.6.1" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/sane/node_modules/which": { - "version": "1.3.1", - "resolved": "https://registry.npmjs.org/which/-/which-1.3.1.tgz", - "integrity": "sha512-HxJdYWq1MTIQbJ3nw0cqssHoTNU267KlrDuGZ1WYlxDStUtKUhOaJmh112/TZmHxxUfuJqPXSOm7tDyas0OSIQ==", - "dev": true, - "peer": true, - "dependencies": { - "isexe": "^2.0.0" - }, - "bin": { - "which": "bin/which" - } - }, - "node_modules/saxes": { - "version": "5.0.1", - "resolved": "https://registry.npmjs.org/saxes/-/saxes-5.0.1.tgz", - "integrity": "sha512-5LBh1Tls8c9xgGjw3QrMwETmTMVk0oFgvrFSvWx62llR2hcEInrKNZ2GZCCuuy2lvWrdl5jhbpeqc5hRYKFOcw==", - "dev": true, - "peer": true, - "dependencies": { - "xmlchars": "^2.2.0" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/scheduler": { - "version": "0.23.0", - "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.23.0.tgz", - "integrity": "sha512-CtuThmgHNg7zIZWAXi3AsyIzA3n4xx7aNyjwC2VJldO2LMVDhFK+63xGqq6CsJH4rTAt6/M+N4GhZiDYPx9eUw==", - "dev": true, - "peer": true, - "dependencies": { - "loose-envify": "^1.1.0" - } - }, - "node_modules/semver": { - "version": "7.5.4", - "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz", - "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==", - "dev": true, - "dependencies": { - "lru-cache": "^6.0.0" - }, - "bin": { - "semver": "bin/semver.js" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/semver-compare": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/semver-compare/-/semver-compare-1.0.0.tgz", - "integrity": "sha512-YM3/ITh2MJ5MtzaM429anh+x2jiLVjqILF4m4oyQB18W7Ggea7BfqdH/wGMK7dDiMghv/6WG7znWMwUDzJiXow==", - "dev": true - }, - "node_modules/semver-regex": { - "version": "3.1.4", - "resolved": "https://registry.npmjs.org/semver-regex/-/semver-regex-3.1.4.tgz", - "integrity": "sha512-6IiqeZNgq01qGf0TId0t3NvKzSvUsjcpdEO3AQNeIjR6A2+ckTnQlDpl4qu1bjRv0RzN3FP9hzFmws3lKqRWkA==", - "dev": true, - "engines": { - "node": ">=8" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/semver/node_modules/lru-cache": { - "version": "6.0.0", - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz", - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==", - "dev": true, - "dependencies": { - "yallist": "^4.0.0" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/semver/node_modules/yallist": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz", - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==", - "dev": true - }, - "node_modules/set-blocking": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/set-blocking/-/set-blocking-2.0.0.tgz", - "integrity": "sha512-KiKBS8AnWGEyLzofFfmvKwpdPzqiy16LvQfK3yv/fVH7Bj13/wl3JSR1J+rfgRE9q7xUJK4qvgS8raSOeLUehw==", - "dev": true, - "peer": true - }, - "node_modules/set-function-length": { - "version": "1.1.1", - "resolved": "https://registry.npmjs.org/set-function-length/-/set-function-length-1.1.1.tgz", - "integrity": "sha512-VoaqjbBJKiWtg4yRcKBQ7g7wnGnLV3M8oLvVWwOk2PdYY6PEFegR1vezXR0tw6fZGF9csVakIRjrJiy2veSBFQ==", - "dev": true, - "dependencies": { - "define-data-property": "^1.1.1", - "get-intrinsic": "^1.2.1", - "gopd": "^1.0.1", - "has-property-descriptors": "^1.0.0" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/set-function-name": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/set-function-name/-/set-function-name-2.0.1.tgz", - "integrity": "sha512-tMNCiqYVkXIZgc2Hnoy2IvC/f8ezc5koaRFkCjrpWzGpCd3qbZXPzVy9MAZzK1ch/X0jvSkojys3oqJN0qCmdA==", - "dev": true, - "dependencies": { - "define-data-property": "^1.0.1", - "functions-have-names": "^1.2.3", - "has-property-descriptors": "^1.0.0" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/set-value": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/set-value/-/set-value-2.0.1.tgz", - "integrity": "sha512-JxHc1weCN68wRY0fhCoXpyK55m/XPHafOmK4UWD7m2CI14GMcFypt4w/0+NV5f/ZMby2F6S2wwA7fgynh9gWSw==", - "dev": true, - "peer": true, - "dependencies": { - "extend-shallow": "^2.0.1", - "is-extendable": "^0.1.1", - "is-plain-object": "^2.0.3", - "split-string": "^3.0.1" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/set-value/node_modules/extend-shallow": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz", - "integrity": "sha512-zCnTtlxNoAiDc3gqY2aYAWFx7XWWiasuF2K8Me5WbN8otHKTUKBwjPtNpRs/rbUZm7KxWAaNj7P1a/p52GbVug==", - "dev": true, - "peer": true, - "dependencies": { - "is-extendable": "^0.1.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/set-value/node_modules/is-extendable": { - "version": "0.1.1", - "resolved": "https://registry.npmjs.org/is-extendable/-/is-extendable-0.1.1.tgz", - "integrity": "sha512-5BMULNob1vgFX6EjQw5izWDxrecWK9AM72rugNr0TFldMOi0fj6Jk+zeKIt0xGj4cEfQIJth4w3OKWOJ4f+AFw==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/shebang-command": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz", - "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==", - "dev": true, - "dependencies": { - "shebang-regex": "^3.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/shebang-regex": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz", - "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==", - "dev": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/shellwords": { - "version": "0.1.1", - "resolved": "https://registry.npmjs.org/shellwords/-/shellwords-0.1.1.tgz", - "integrity": "sha512-vFwSUfQvqybiICwZY5+DAWIPLKsWO31Q91JSKl3UYv+K5c2QRPzn0qzec6QPu1Qc9eHYItiP3NdJqNVqetYAww==", - "dev": true, - "optional": true, - "peer": true - }, - "node_modules/side-channel": { - "version": "1.0.4", - "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.0.4.tgz", - "integrity": "sha512-q5XPytqFEIKHkGdiMIrY10mvLRvnQh42/+GoBlFW3b2LXLE2xxJpZFdm94we0BaoV3RwJyGqg5wS7epxTv0Zvw==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.0", - "get-intrinsic": "^1.0.2", - "object-inspect": "^1.9.0" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/signal-exit": { - "version": "3.0.7", - "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz", - "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==", - "dev": true - }, - "node_modules/signale": { - "version": "1.4.0", - "resolved": "https://registry.npmjs.org/signale/-/signale-1.4.0.tgz", - "integrity": "sha512-iuh+gPf28RkltuJC7W5MRi6XAjTDCAPC/prJUpQoG4vIP3MJZ+GTydVnodXA7pwvTKb2cA0m9OFZW/cdWy/I/w==", - "dev": true, - "dependencies": { - "chalk": "^2.3.2", - "figures": "^2.0.0", - "pkg-conf": "^2.1.0" - }, - "engines": { - "node": ">=6" - } - }, - "node_modules/signale/node_modules/ansi-styles": { - "version": "3.2.1", - "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz", - "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==", - "dev": true, - "dependencies": { - "color-convert": "^1.9.0" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/signale/node_modules/chalk": { - "version": "2.4.2", - "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz", - "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==", - "dev": true, - "dependencies": { - "ansi-styles": "^3.2.1", - "escape-string-regexp": "^1.0.5", - "supports-color": "^5.3.0" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/signale/node_modules/color-convert": { - "version": "1.9.3", - "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz", - "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==", - "dev": true, - "dependencies": { - "color-name": "1.1.3" - } - }, - "node_modules/signale/node_modules/color-name": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz", - "integrity": "sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==", - "dev": true - }, - "node_modules/signale/node_modules/escape-string-regexp": { - "version": "1.0.5", - "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz", - "integrity": "sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==", - "dev": true, - "engines": { - "node": ">=0.8.0" - } - }, - "node_modules/signale/node_modules/figures": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/figures/-/figures-2.0.0.tgz", - "integrity": "sha512-Oa2M9atig69ZkfwiApY8F2Yy+tzMbazyvqv21R0NsSC8floSOC09BbT1ITWAdoMGQvJ/aZnR1KMwdx9tvHnTNA==", - "dev": true, - "dependencies": { - "escape-string-regexp": "^1.0.5" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/signale/node_modules/has-flag": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz", - "integrity": "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==", - "dev": true, - "engines": { - "node": ">=4" - } - }, - "node_modules/signale/node_modules/supports-color": { - "version": "5.5.0", - "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz", - "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==", - "dev": true, - "dependencies": { - "has-flag": "^3.0.0" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/sisteransi": { - "version": "1.0.5", - "resolved": "https://registry.npmjs.org/sisteransi/-/sisteransi-1.0.5.tgz", - "integrity": "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg==", - "dev": true, - "peer": true - }, - "node_modules/slash": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz", - "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==", - "dev": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/slice-ansi": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/slice-ansi/-/slice-ansi-3.0.0.tgz", - "integrity": "sha512-pSyv7bSTC7ig9Dcgbw9AuRNUb5k5V6oDudjZoMBSr13qpLBG7tB+zgCkARjq7xIUgdz5P1Qe8u+rSGdouOOIyQ==", - "dev": true, - "dependencies": { - "ansi-styles": "^4.0.0", - "astral-regex": "^2.0.0", - "is-fullwidth-code-point": "^3.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/slugify": { - "version": "1.4.6", - "resolved": "https://registry.npmjs.org/slugify/-/slugify-1.4.6.tgz", - "integrity": "sha512-ZdJIgv9gdrYwhXqxsH9pv7nXxjUEyQ6nqhngRxoAAOlmMGA28FDq5O4/5US4G2/Nod7d1ovNcgURQJ7kHq50KQ==", - "dev": true, - "engines": { - "node": ">=8.0.0" - } - }, - "node_modules/snapdragon": { - "version": "0.8.2", - "resolved": "https://registry.npmjs.org/snapdragon/-/snapdragon-0.8.2.tgz", - "integrity": "sha512-FtyOnWN/wCHTVXOMwvSv26d+ko5vWlIDD6zoUJ7LW8vh+ZBC8QdljveRP+crNrtBwioEUWy/4dMtbBjA4ioNlg==", - "dev": true, - "peer": true, - "dependencies": { - "base": "^0.11.1", - "debug": "^2.2.0", - "define-property": "^0.2.5", - "extend-shallow": "^2.0.1", - "map-cache": "^0.2.2", - "source-map": "^0.5.6", - "source-map-resolve": "^0.5.0", - "use": "^3.1.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/snapdragon-node": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/snapdragon-node/-/snapdragon-node-2.1.1.tgz", - "integrity": "sha512-O27l4xaMYt/RSQ5TR3vpWCAB5Kb/czIcqUFOM/C4fYcLnbZUc1PkjTAMjof2pBWaSTwOUd6qUHcFGVGj7aIwnw==", - "dev": true, - "peer": true, - "dependencies": { - "define-property": "^1.0.0", - "isobject": "^3.0.0", - "snapdragon-util": "^3.0.1" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/snapdragon-node/node_modules/define-property": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/define-property/-/define-property-1.0.0.tgz", - "integrity": "sha512-cZTYKFWspt9jZsMscWo8sc/5lbPC9Q0N5nBLgb+Yd915iL3udB1uFgS3B8YCx66UVHq018DAVFoee7x+gxggeA==", - "dev": true, - "peer": true, - "dependencies": { - "is-descriptor": "^1.0.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/snapdragon-util": { - "version": "3.0.1", - "resolved": "https://registry.npmjs.org/snapdragon-util/-/snapdragon-util-3.0.1.tgz", - "integrity": "sha512-mbKkMdQKsjX4BAL4bRYTj21edOf8cN7XHdYUJEe+Zn99hVEYcMvKPct1IqNe7+AZPirn8BCDOQBHQZknqmKlZQ==", - "dev": true, - "peer": true, - "dependencies": { - "kind-of": "^3.2.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/snapdragon-util/node_modules/is-buffer": { - "version": "1.1.6", - "resolved": "https://registry.npmjs.org/is-buffer/-/is-buffer-1.1.6.tgz", - "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==", - "dev": true, - "peer": true - }, - "node_modules/snapdragon-util/node_modules/kind-of": { - "version": "3.2.2", - "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz", - "integrity": "sha512-NOW9QQXMoZGg/oqnVNoNTTIFEIid1627WCffUBJEdMxYApq7mNE7CpzucIPc+ZQg25Phej7IJSmX3hO+oblOtQ==", - "dev": true, - "peer": true, - "dependencies": { - "is-buffer": "^1.1.5" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/snapdragon/node_modules/debug": { - "version": "2.6.9", - "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz", - "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==", - "dev": true, - "peer": true, - "dependencies": { - "ms": "2.0.0" - } - }, - "node_modules/snapdragon/node_modules/define-property": { - "version": "0.2.5", - "resolved": "https://registry.npmjs.org/define-property/-/define-property-0.2.5.tgz", - "integrity": "sha512-Rr7ADjQZenceVOAKop6ALkkRAmH1A4Gx9hV/7ZujPUN2rkATqFO0JZLZInbAjpZYoJ1gUx8MRMQVkYemcbMSTA==", - "dev": true, - "peer": true, - "dependencies": { - "is-descriptor": "^0.1.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/snapdragon/node_modules/extend-shallow": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz", - "integrity": "sha512-zCnTtlxNoAiDc3gqY2aYAWFx7XWWiasuF2K8Me5WbN8otHKTUKBwjPtNpRs/rbUZm7KxWAaNj7P1a/p52GbVug==", - "dev": true, - "peer": true, - "dependencies": { - "is-extendable": "^0.1.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/snapdragon/node_modules/is-descriptor": { - "version": "0.1.7", - "resolved": "https://registry.npmjs.org/is-descriptor/-/is-descriptor-0.1.7.tgz", - "integrity": "sha512-C3grZTvObeN1xud4cRWl366OMXZTj0+HGyk4hvfpx4ZHt1Pb60ANSXqCK7pdOTeUQpRzECBSTphqvD7U+l22Eg==", - "dev": true, - "peer": true, - "dependencies": { - "is-accessor-descriptor": "^1.0.1", - "is-data-descriptor": "^1.0.1" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/snapdragon/node_modules/is-extendable": { - "version": "0.1.1", - "resolved": "https://registry.npmjs.org/is-extendable/-/is-extendable-0.1.1.tgz", - "integrity": "sha512-5BMULNob1vgFX6EjQw5izWDxrecWK9AM72rugNr0TFldMOi0fj6Jk+zeKIt0xGj4cEfQIJth4w3OKWOJ4f+AFw==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/snapdragon/node_modules/ms": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz", - "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==", - "dev": true, - "peer": true - }, - "node_modules/snapdragon/node_modules/source-map": { - "version": "0.5.7", - "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.5.7.tgz", - "integrity": "sha512-LbrmJOMUSdEVxIKvdcJzQC+nQhe8FUZQTXQy6+I75skNgn3OoQ0DZA8YnFa7gp8tqtL3KPf1kmo0R5DoApeSGQ==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/source-map": { - "version": "0.6.1", - "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz", - "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==", - "dev": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/source-map-js": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.0.2.tgz", - "integrity": "sha512-R0XvVJ9WusLiqTCEiGCmICCMplcCkIwwR11mOSD9CR5u+IXYdiseeEuXCVAjS54zqwkLcPNnmU4OeJ6tUrWhDw==", - "dev": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/source-map-resolve": { - "version": "0.5.3", - "resolved": "https://registry.npmjs.org/source-map-resolve/-/source-map-resolve-0.5.3.tgz", - "integrity": "sha512-Htz+RnsXWk5+P2slx5Jh3Q66vhQj1Cllm0zvnaY98+NFx+Dv2CF/f5O/t8x+KaNdrdIAsruNzoh/KpialbqAnw==", - "deprecated": "See https://github.com/lydell/source-map-resolve#deprecated", - "dev": true, - "peer": true, - "dependencies": { - "atob": "^2.1.2", - "decode-uri-component": "^0.2.0", - "resolve-url": "^0.2.1", - "source-map-url": "^0.4.0", - "urix": "^0.1.0" - } - }, - "node_modules/source-map-support": { - "version": "0.5.21", - "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.21.tgz", - "integrity": "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==", - "dev": true, - "peer": true, - "dependencies": { - "buffer-from": "^1.0.0", - "source-map": "^0.6.0" - } - }, - "node_modules/source-map-url": { - "version": "0.4.1", - "resolved": "https://registry.npmjs.org/source-map-url/-/source-map-url-0.4.1.tgz", - "integrity": "sha512-cPiFOTLUKvJFIg4SKVScy4ilPPW6rFgMgfuZJPNoDuMs3nC1HbMUycBoJw77xFIp6z1UJQJOfx6C9GMH80DiTw==", - "deprecated": "See https://github.com/lydell/source-map-url#deprecated", - "dev": true, - "peer": true - }, - "node_modules/spdx-correct": { - "version": "3.2.0", - "resolved": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-3.2.0.tgz", - "integrity": "sha512-kN9dJbvnySHULIluDHy32WHRUu3Og7B9sbY7tsFLctQkIqnMh3hErYgdMjTYuqmcXX+lK5T1lnUt3G7zNswmZA==", - "dev": true, - "dependencies": { - "spdx-expression-parse": "^3.0.0", - "spdx-license-ids": "^3.0.0" - } - }, - "node_modules/spdx-exceptions": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/spdx-exceptions/-/spdx-exceptions-2.3.0.tgz", - "integrity": "sha512-/tTrYOC7PPI1nUAgx34hUpqXuyJG+DTHJTnIULG4rDygi4xu/tfgmq1e1cIRwRzwZgo4NLySi+ricLkZkw4i5A==", - "dev": true - }, - "node_modules/spdx-expression-parse": { - "version": "3.0.1", - "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz", - "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==", - "dev": true, - "dependencies": { - "spdx-exceptions": "^2.1.0", - "spdx-license-ids": "^3.0.0" - } - }, - "node_modules/spdx-license-ids": { - "version": "3.0.16", - "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.16.tgz", - "integrity": "sha512-eWN+LnM3GR6gPu35WxNgbGl8rmY1AEmoMDvL/QD6zYmPWgywxWqJWNdLGT+ke8dKNWrcYgYjPpG5gbTfghP8rw==", - "dev": true - }, - "node_modules/specificity": { - "version": "0.4.1", - "resolved": "https://registry.npmjs.org/specificity/-/specificity-0.4.1.tgz", - "integrity": "sha512-1klA3Gi5PD1Wv9Q0wUoOQN1IWAuPu0D1U03ThXTr0cJ20+/iq2tHSDnK7Kk/0LXJ1ztUB2/1Os0wKmfyNgUQfg==", - "dev": true, - "bin": { - "specificity": "bin/specificity" - } - }, - "node_modules/split-string": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/split-string/-/split-string-3.1.0.tgz", - "integrity": "sha512-NzNVhJDYpwceVVii8/Hu6DKfD2G+NrQHlS/V/qgv763EYudVwEcMQNxd2lh+0VrUByXN/oJkl5grOhYWvQUYiw==", - "dev": true, - "peer": true, - "dependencies": { - "extend-shallow": "^3.0.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/sprintf-js": { - "version": "1.0.3", - "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz", - "integrity": "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==", - "dev": true, - "peer": true - }, - "node_modules/stack-utils": { - "version": "2.0.6", - "resolved": "https://registry.npmjs.org/stack-utils/-/stack-utils-2.0.6.tgz", - "integrity": "sha512-XlkWvfIm6RmsWtNJx+uqtKLS8eqFbxUg0ZzLXqY0caEy9l7hruX8IpiDnjsLavoBgqCCR71TqWO8MaXYheJ3RQ==", - "dev": true, - "peer": true, - "dependencies": { - "escape-string-regexp": "^2.0.0" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/stack-utils/node_modules/escape-string-regexp": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-2.0.0.tgz", - "integrity": "sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==", - "dev": true, - "peer": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/state-toggle": { - "version": "1.0.3", - "resolved": "https://registry.npmjs.org/state-toggle/-/state-toggle-1.0.3.tgz", - "integrity": "sha512-d/5Z4/2iiCnHw6Xzghyhb+GcmF89bxwgXG60wjIiZaxnymbyOmI8Hk4VqHXiVVp6u2ysaskFfXg3ekCj4WNftQ==", - "dev": true, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/static-extend": { - "version": "0.1.2", - "resolved": "https://registry.npmjs.org/static-extend/-/static-extend-0.1.2.tgz", - "integrity": "sha512-72E9+uLc27Mt718pMHt9VMNiAL4LMsmDbBva8mxWUCkT07fSzEGMYUCk0XWY6lp0j6RBAG4cJ3mWuZv2OE3s0g==", - "dev": true, - "peer": true, - "dependencies": { - "define-property": "^0.2.5", - "object-copy": "^0.1.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/static-extend/node_modules/define-property": { - "version": "0.2.5", - "resolved": "https://registry.npmjs.org/define-property/-/define-property-0.2.5.tgz", - "integrity": "sha512-Rr7ADjQZenceVOAKop6ALkkRAmH1A4Gx9hV/7ZujPUN2rkATqFO0JZLZInbAjpZYoJ1gUx8MRMQVkYemcbMSTA==", - "dev": true, - "peer": true, - "dependencies": { - "is-descriptor": "^0.1.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/static-extend/node_modules/is-descriptor": { - "version": "0.1.7", - "resolved": "https://registry.npmjs.org/is-descriptor/-/is-descriptor-0.1.7.tgz", - "integrity": "sha512-C3grZTvObeN1xud4cRWl366OMXZTj0+HGyk4hvfpx4ZHt1Pb60ANSXqCK7pdOTeUQpRzECBSTphqvD7U+l22Eg==", - "dev": true, - "peer": true, - "dependencies": { - "is-accessor-descriptor": "^1.0.1", - "is-data-descriptor": "^1.0.1" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/streamsearch": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/streamsearch/-/streamsearch-1.1.0.tgz", - "integrity": "sha512-Mcc5wHehp9aXz1ax6bZUyY5afg9u2rv5cqQI3mRrYkGC8rW2hM02jWuwjtL++LS5qinSyhj2QfLyNsuc+VsExg==", - "dev": true, - "engines": { - "node": ">=10.0.0" - } - }, - "node_modules/string_decoder": { - "version": "1.3.0", - "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz", - "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==", - "dev": true, - "dependencies": { - "safe-buffer": "~5.2.0" - } - }, - "node_modules/string-argv": { - "version": "0.3.1", - "resolved": "https://registry.npmjs.org/string-argv/-/string-argv-0.3.1.tgz", - "integrity": "sha512-a1uQGz7IyVy9YwhqjZIZu1c8JO8dNIe20xBmSS6qu9kv++k3JGzCVmprbNN5Kn+BgzD5E7YYwg1CcjuJMRNsvg==", - "dev": true, - "engines": { - "node": ">=0.6.19" - } - }, - "node_modules/string-length": { - "version": "4.0.2", - "resolved": "https://registry.npmjs.org/string-length/-/string-length-4.0.2.tgz", - "integrity": "sha512-+l6rNN5fYHNhZZy41RXsYptCjA2Igmq4EG7kZAYFQI1E1VTXarr6ZPXBg6eq7Y6eK4FEhY6AJlyuFIb/v/S0VQ==", - "dev": true, - "peer": true, - "dependencies": { - "char-regex": "^1.0.2", - "strip-ansi": "^6.0.0" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/string-width": { - "version": "4.2.3", - "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz", - "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==", - "dev": true, - "dependencies": { - "emoji-regex": "^8.0.0", - "is-fullwidth-code-point": "^3.0.0", - "strip-ansi": "^6.0.1" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/string-width/node_modules/emoji-regex": { - "version": "8.0.0", - "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz", - "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==", - "dev": true - }, - "node_modules/string.prototype.matchall": { - "version": "4.0.10", - "resolved": "https://registry.npmjs.org/string.prototype.matchall/-/string.prototype.matchall-4.0.10.tgz", - "integrity": "sha512-rGXbGmOEosIQi6Qva94HUjgPs9vKW+dkG7Y8Q5O2OYkWL6wFaTRZO8zM4mhP94uX55wgyrXzfS2aGtGzUL7EJQ==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "define-properties": "^1.2.0", - "es-abstract": "^1.22.1", - "get-intrinsic": "^1.2.1", - "has-symbols": "^1.0.3", - "internal-slot": "^1.0.5", - "regexp.prototype.flags": "^1.5.0", - "set-function-name": "^2.0.0", - "side-channel": "^1.0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/string.prototype.trim": { - "version": "1.2.8", - "resolved": "https://registry.npmjs.org/string.prototype.trim/-/string.prototype.trim-1.2.8.tgz", - "integrity": "sha512-lfjY4HcixfQXOfaqCvcBuOIapyaroTXhbkfJN3gcB1OtyupngWK4sEET9Knd0cXd28kTUqu/kHoV4HKSJdnjiQ==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "define-properties": "^1.2.0", - "es-abstract": "^1.22.1" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/string.prototype.trimend": { - "version": "1.0.7", - "resolved": "https://registry.npmjs.org/string.prototype.trimend/-/string.prototype.trimend-1.0.7.tgz", - "integrity": "sha512-Ni79DqeB72ZFq1uH/L6zJ+DKZTkOtPIHovb3YZHQViE+HDouuU4mBrLOLDn5Dde3RF8qw5qVETEjhu9locMLvA==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "define-properties": "^1.2.0", - "es-abstract": "^1.22.1" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/string.prototype.trimstart": { - "version": "1.0.7", - "resolved": "https://registry.npmjs.org/string.prototype.trimstart/-/string.prototype.trimstart-1.0.7.tgz", - "integrity": "sha512-NGhtDFu3jCEm7B4Fy0DpLewdJQOZcQ0rGbwQ/+stjnrp2i+rlKeCvos9hOIeCmqwratM47OBxY7uFZzjxHXmrg==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "define-properties": "^1.2.0", - "es-abstract": "^1.22.1" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/stringify-entities": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/stringify-entities/-/stringify-entities-3.1.0.tgz", - "integrity": "sha512-3FP+jGMmMV/ffZs86MoghGqAoqXAdxLrJP4GUdrDN1aIScYih5tuIO3eF4To5AJZ79KDZ8Fpdy7QJnK8SsL1Vg==", - "dev": true, - "dependencies": { - "character-entities-html4": "^1.0.0", - "character-entities-legacy": "^1.0.0", - "xtend": "^4.0.0" - }, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/stringify-object": { - "version": "3.3.0", - "resolved": "https://registry.npmjs.org/stringify-object/-/stringify-object-3.3.0.tgz", - "integrity": "sha512-rHqiFh1elqCQ9WPLIC8I0Q/g/wj5J1eMkyoiD6eoQApWHP0FtlK7rqnhmabL5VUY9JQCcqwwvlOaSuutekgyrw==", - "dev": true, - "dependencies": { - "get-own-enumerable-property-symbols": "^3.0.0", - "is-obj": "^1.0.1", - "is-regexp": "^1.0.0" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/strip-ansi": { - "version": "6.0.1", - "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz", - "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==", - "dev": true, - "dependencies": { - "ansi-regex": "^5.0.1" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/strip-bom": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-4.0.0.tgz", - "integrity": "sha512-3xurFv5tEgii33Zi8Jtp55wEIILR9eh34FAW00PZf+JnSsTmV/ioewSgQl97JHvgjoRGwPShsWm+IdrxB35d0w==", - "dev": true, - "peer": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/strip-eof": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/strip-eof/-/strip-eof-1.0.0.tgz", - "integrity": "sha512-7FCwGGmx8mD5xQd3RPUvnSpUXHM3BWuzjtpD4TXsfcZ9EL4azvVVUscFYwD9nx8Kh+uCBC00XBtAykoMHwTh8Q==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/strip-final-newline": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/strip-final-newline/-/strip-final-newline-2.0.0.tgz", - "integrity": "sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA==", - "dev": true, - "engines": { - "node": ">=6" - } - }, - "node_modules/strip-indent": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/strip-indent/-/strip-indent-3.0.0.tgz", - "integrity": "sha512-laJTa3Jb+VQpaC6DseHhF7dXVqHTfJPCRDaEbid/drOhgitgYku/letMUqOXFoWV0zIIUbjpdH2t+tYj4bQMRQ==", - "dev": true, - "dependencies": { - "min-indent": "^1.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/strip-json-comments": { - "version": "3.1.1", - "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz", - "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==", - "dev": true, - "engines": { - "node": ">=8" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/style-search": { - "version": "0.1.0", - "resolved": "https://registry.npmjs.org/style-search/-/style-search-0.1.0.tgz", - "integrity": "sha512-Dj1Okke1C3uKKwQcetra4jSuk0DqbzbYtXipzFlFMZtowbF1x7BKJwB9AayVMyFARvU8EDrZdcax4At/452cAg==", - "dev": true - }, - "node_modules/styled-jsx": { - "version": "5.1.1", - "resolved": "https://registry.npmjs.org/styled-jsx/-/styled-jsx-5.1.1.tgz", - "integrity": "sha512-pW7uC1l4mBZ8ugbiZrcIsiIvVx1UmTfw7UkC3Um2tmfUq9Bhk8IiyEIPl6F8agHgjzku6j0xQEZbfA5uSgSaCw==", - "dev": true, - "dependencies": { - "client-only": "0.0.1" - }, - "engines": { - "node": ">= 12.0.0" - }, - "peerDependencies": { - "react": ">= 16.8.0 || 17.x.x || ^18.0.0-0" - }, - "peerDependenciesMeta": { - "@babel/core": { - "optional": true - }, - "babel-plugin-macros": { - "optional": true - } - } - }, - "node_modules/stylelint": { - "version": "13.8.0", - "resolved": "https://registry.npmjs.org/stylelint/-/stylelint-13.8.0.tgz", - "integrity": "sha512-iHH3dv3UI23SLDrH4zMQDjLT9/dDIz/IpoFeuNxZmEx86KtfpjDOscxLTFioQyv+2vQjPlRZnK0UoJtfxLICXQ==", - "dev": true, - "dependencies": { - "@stylelint/postcss-css-in-js": "^0.37.2", - "@stylelint/postcss-markdown": "^0.36.2", - "autoprefixer": "^9.8.6", - "balanced-match": "^1.0.0", - "chalk": "^4.1.0", - "cosmiconfig": "^7.0.0", - "debug": "^4.2.0", - "execall": "^2.0.0", - "fast-glob": "^3.2.4", - "fastest-levenshtein": "^1.0.12", - "file-entry-cache": "^6.0.0", - "get-stdin": "^8.0.0", - "global-modules": "^2.0.0", - "globby": "^11.0.1", - "globjoin": "^0.1.4", - "html-tags": "^3.1.0", - "ignore": "^5.1.8", - "import-lazy": "^4.0.0", - "imurmurhash": "^0.1.4", - "known-css-properties": "^0.20.0", - "lodash": "^4.17.20", - "log-symbols": "^4.0.0", - "mathml-tag-names": "^2.1.3", - "meow": "^8.0.0", - "micromatch": "^4.0.2", - "normalize-selector": "^0.2.0", - "postcss": "^7.0.35", - "postcss-html": "^0.36.0", - "postcss-less": "^3.1.4", - "postcss-media-query-parser": "^0.2.3", - "postcss-resolve-nested-selector": "^0.1.1", - "postcss-safe-parser": "^4.0.2", - "postcss-sass": "^0.4.4", - "postcss-scss": "^2.1.1", - "postcss-selector-parser": "^6.0.4", - "postcss-syntax": "^0.36.2", - "postcss-value-parser": "^4.1.0", - "resolve-from": "^5.0.0", - "slash": "^3.0.0", - "specificity": "^0.4.1", - "string-width": "^4.2.0", - "strip-ansi": "^6.0.0", - "style-search": "^0.1.0", - "sugarss": "^2.0.0", - "svg-tags": "^1.0.0", - "table": "^6.0.3", - "v8-compile-cache": "^2.2.0", - "write-file-atomic": "^3.0.3" - }, - "bin": { - "stylelint": "bin/stylelint.js" - }, - "engines": { - "node": ">=10.13.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/stylelint" - } - }, - "node_modules/stylelint-config-css-modules": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/stylelint-config-css-modules/-/stylelint-config-css-modules-2.2.0.tgz", - "integrity": "sha512-+zjcDbot+zbuxy1UA31k4G2lUG+nHUwnLyii3uT2F09B8kT2YrT9LZYNfMtAWlDidrxr7sFd5HX9EqPHGU3WKA==", - "dev": true, - "peerDependencies": { - "stylelint": "11.x - 13.x" - } - }, - "node_modules/stylelint-config-prettier": { - "version": "8.0.2", - "resolved": "https://registry.npmjs.org/stylelint-config-prettier/-/stylelint-config-prettier-8.0.2.tgz", - "integrity": "sha512-TN1l93iVTXpF9NJstlvP7nOu9zY2k+mN0NSFQ/VEGz15ZIP9ohdDZTtCWHs5LjctAhSAzaILULGbgiM0ItId3A==", - "dev": true, - "bin": { - "stylelint-config-prettier": "bin/check.js", - "stylelint-config-prettier-check": "bin/check.js" - }, - "engines": { - "node": ">= 10", - "npm": ">= 5" - }, - "peerDependencies": { - "stylelint": ">=11.0.0" - } - }, - "node_modules/stylelint-config-recommended": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/stylelint-config-recommended/-/stylelint-config-recommended-3.0.0.tgz", - "integrity": "sha512-F6yTRuc06xr1h5Qw/ykb2LuFynJ2IxkKfCMf+1xqPffkxh0S09Zc902XCffcsw/XMFq/OzQ1w54fLIDtmRNHnQ==", - "dev": true, - "peerDependencies": { - "stylelint": ">=10.1.0" - } - }, - "node_modules/stylelint-config-standard": { - "version": "20.0.0", - "resolved": "https://registry.npmjs.org/stylelint-config-standard/-/stylelint-config-standard-20.0.0.tgz", - "integrity": "sha512-IB2iFdzOTA/zS4jSVav6z+wGtin08qfj+YyExHB3LF9lnouQht//YyB0KZq9gGz5HNPkddHOzcY8HsUey6ZUlA==", - "dev": true, - "dependencies": { - "stylelint-config-recommended": "^3.0.0" - }, - "peerDependencies": { - "stylelint": ">=10.1.0" - } - }, - "node_modules/stylelint-media-use-custom-media": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/stylelint-media-use-custom-media/-/stylelint-media-use-custom-media-2.0.0.tgz", - "integrity": "sha512-G7Hwma8HIMFJOChqrX9ie8hAGbtEMUbEjuiaR3olHIXjloDWqYlFHIJKsCyyckigkm+4LtCwtZDQASrVY4pRBg==", - "dev": true, - "engines": { - "node": ">=10.0.0" - }, - "peerDependencies": { - "stylelint": "10 - 13" - } - }, - "node_modules/stylelint-order": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/stylelint-order/-/stylelint-order-4.1.0.tgz", - "integrity": "sha512-sVTikaDvMqg2aJjh4r48jsdfmqLT+nqB1MOsaBnvM3OwLx4S+WXcsxsgk5w18h/OZoxZCxuyXMh61iBHcj9Qiw==", - "dev": true, - "dependencies": { - "lodash": "^4.17.15", - "postcss": "^7.0.31", - "postcss-sorting": "^5.0.1" - }, - "peerDependencies": { - "stylelint": "^10.0.1 || ^11.0.0 || ^12.0.0 || ^13.0.0" - } - }, - "node_modules/stylelint-order/node_modules/picocolors": { - "version": "0.2.1", - "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-0.2.1.tgz", - "integrity": "sha512-cMlDqaLEqfSaW8Z7N5Jw+lyIW869EzT73/F5lhtY9cLGoVxSXznfgfXMO0Z5K0o0Q2TkTXq+0KFsdnSe3jDViA==", - "dev": true - }, - "node_modules/stylelint-order/node_modules/postcss": { - "version": "7.0.39", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-7.0.39.tgz", - "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==", - "dev": true, - "dependencies": { - "picocolors": "^0.2.1", - "source-map": "^0.6.1" - }, - "engines": { - "node": ">=6.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/postcss/" - } - }, - "node_modules/stylelint-use-nesting": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/stylelint-use-nesting/-/stylelint-use-nesting-3.0.0.tgz", - "integrity": "sha512-BMzhXWbK5DdAYtZMQULn7VmWZXpy8Rwlx2PgeNYqKInQrKTJWM/TFKPScc+xvsGUc/6JPiUDeQQij9gFnOo8Kg==", - "dev": true, - "engines": { - "node": ">=10.0.0" - }, - "peerDependencies": { - "stylelint": "10 - 13" - } - }, - "node_modules/stylelint-value-no-unknown-custom-properties": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/stylelint-value-no-unknown-custom-properties/-/stylelint-value-no-unknown-custom-properties-3.0.0.tgz", - "integrity": "sha512-8WoOnZ4ELTxA1cDbhwolIVOutxHwbjpXmd0lL0Li3Iye078jSnEb1KO6pJ/ig5oDVGRApFeA25Fyy4qqmqwGgg==", - "dev": true, - "dependencies": { - "postcss-values-parser": "^3.2.1" - }, - "engines": { - "node": ">=10.0.0" - }, - "peerDependencies": { - "stylelint": "10 - 13" - } - }, - "node_modules/stylelint/node_modules/picocolors": { - "version": "0.2.1", - "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-0.2.1.tgz", - "integrity": "sha512-cMlDqaLEqfSaW8Z7N5Jw+lyIW869EzT73/F5lhtY9cLGoVxSXznfgfXMO0Z5K0o0Q2TkTXq+0KFsdnSe3jDViA==", - "dev": true - }, - "node_modules/stylelint/node_modules/postcss": { - "version": "7.0.39", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-7.0.39.tgz", - "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==", - "dev": true, - "dependencies": { - "picocolors": "^0.2.1", - "source-map": "^0.6.1" - }, - "engines": { - "node": ">=6.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/postcss/" - } - }, - "node_modules/stylelint/node_modules/resolve-from": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-5.0.0.tgz", - "integrity": "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==", - "dev": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/sugarss": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/sugarss/-/sugarss-2.0.0.tgz", - "integrity": "sha512-WfxjozUk0UVA4jm+U1d736AUpzSrNsQcIbyOkoE364GrtWmIrFdk5lksEupgWMD4VaT/0kVx1dobpiDumSgmJQ==", - "dev": true, - "dependencies": { - "postcss": "^7.0.2" - } - }, - "node_modules/sugarss/node_modules/picocolors": { - "version": "0.2.1", - "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-0.2.1.tgz", - "integrity": "sha512-cMlDqaLEqfSaW8Z7N5Jw+lyIW869EzT73/F5lhtY9cLGoVxSXznfgfXMO0Z5K0o0Q2TkTXq+0KFsdnSe3jDViA==", - "dev": true - }, - "node_modules/sugarss/node_modules/postcss": { - "version": "7.0.39", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-7.0.39.tgz", - "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==", - "dev": true, - "dependencies": { - "picocolors": "^0.2.1", - "source-map": "^0.6.1" - }, - "engines": { - "node": ">=6.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/postcss/" - } - }, - "node_modules/supports-color": { - "version": "7.2.0", - "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz", - "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==", - "dev": true, - "dependencies": { - "has-flag": "^4.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/supports-hyperlinks": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/supports-hyperlinks/-/supports-hyperlinks-2.3.0.tgz", - "integrity": "sha512-RpsAZlpWcDwOPQA22aCH4J0t7L8JmAvsCxfOSEwm7cQs3LshN36QaTkwd70DnBOXDWGssw2eUoc8CaRWT0XunA==", - "dev": true, - "peer": true, - "dependencies": { - "has-flag": "^4.0.0", - "supports-color": "^7.0.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/supports-preserve-symlinks-flag": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz", - "integrity": "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==", - "dev": true, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/svg-tags": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/svg-tags/-/svg-tags-1.0.0.tgz", - "integrity": "sha512-ovssysQTa+luh7A5Weu3Rta6FJlFBBbInjOh722LIt6klpU2/HtdUbszju/G4devcvk8PGt7FCLv5wftu3THUA==", - "dev": true - }, - "node_modules/symbol-tree": { - "version": "3.2.4", - "resolved": "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz", - "integrity": "sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==", - "dev": true, - "peer": true - }, - "node_modules/table": { - "version": "6.8.1", - "resolved": "https://registry.npmjs.org/table/-/table-6.8.1.tgz", - "integrity": "sha512-Y4X9zqrCftUhMeH2EptSSERdVKt/nEdijTOacGD/97EKjhQ/Qs8RTlEGABSJNNN8lac9kheH+af7yAkEWlgneA==", - "dev": true, - "dependencies": { - "ajv": "^8.0.1", - "lodash.truncate": "^4.4.2", - "slice-ansi": "^4.0.0", - "string-width": "^4.2.3", - "strip-ansi": "^6.0.1" - }, - "engines": { - "node": ">=10.0.0" - } - }, - "node_modules/table/node_modules/ajv": { - "version": "8.12.0", - "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.12.0.tgz", - "integrity": "sha512-sRu1kpcO9yLtYxBKvqfTeh9KzZEwO3STyX1HT+4CaDzC6HpTGYhIhPIzj9XuKU7KYDwnaeh5hcOwjy1QuJzBPA==", - "dev": true, - "dependencies": { - "fast-deep-equal": "^3.1.1", - "json-schema-traverse": "^1.0.0", - "require-from-string": "^2.0.2", - "uri-js": "^4.2.2" - }, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/epoberezkin" - } - }, - "node_modules/table/node_modules/json-schema-traverse": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz", - "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==", - "dev": true - }, - "node_modules/table/node_modules/slice-ansi": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/slice-ansi/-/slice-ansi-4.0.0.tgz", - "integrity": "sha512-qMCMfhY040cVHT43K9BFygqYbUPFZKHOg7K73mtTWJRb8pyP3fzf4Ixd5SzdEJQ6MRUg/WBnOLxghZtKKurENQ==", - "dev": true, - "dependencies": { - "ansi-styles": "^4.0.0", - "astral-regex": "^2.0.0", - "is-fullwidth-code-point": "^3.0.0" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/chalk/slice-ansi?sponsor=1" - } - }, - "node_modules/tapable": { - "version": "2.2.1", - "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.2.1.tgz", - "integrity": "sha512-GNzQvQTOIP6RyTfE2Qxb8ZVlNmw0n88vp1szwWRimP02mnTsx3Wtn5qRdqY9w2XduFNUgvOwhNnQsjwCp+kqaQ==", - "dev": true, - "engines": { - "node": ">=6" - } - }, - "node_modules/terminal-link": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/terminal-link/-/terminal-link-2.1.1.tgz", - "integrity": "sha512-un0FmiRUQNr5PJqy9kP7c40F5BOfpGlYTrxonDChEZB7pzZxRNp/bt+ymiy9/npwXya9KH99nJ/GXFIiUkYGFQ==", - "dev": true, - "peer": true, - "dependencies": { - "ansi-escapes": "^4.2.1", - "supports-hyperlinks": "^2.0.0" - }, - "engines": { - "node": ">=8" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/test-exclude": { - "version": "6.0.0", - "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-6.0.0.tgz", - "integrity": "sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==", - "dev": true, - "peer": true, - "dependencies": { - "@istanbuljs/schema": "^0.1.2", - "glob": "^7.1.4", - "minimatch": "^3.0.4" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/text-table": { - "version": "0.2.0", - "resolved": "https://registry.npmjs.org/text-table/-/text-table-0.2.0.tgz", - "integrity": "sha512-N+8UisAXDGk8PFXP4HAzVR9nbfmVJ3zYLAWiTIoqC5v5isinhr+r5uaO8+7r3BMfuNIufIsA7RdpVgacC2cSpw==", - "dev": true - }, - "node_modules/throat": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/throat/-/throat-5.0.0.tgz", - "integrity": "sha512-fcwX4mndzpLQKBS1DVYhGAcYaYt7vsHNIvQV+WXMvnow5cgjPphq5CaayLaGsjRdSCKZFNGt7/GYAuXaNOiYCA==", - "dev": true, - "peer": true - }, - "node_modules/through": { - "version": "2.3.8", - "resolved": "https://registry.npmjs.org/through/-/through-2.3.8.tgz", - "integrity": "sha512-w89qg7PI8wAdvX60bMDP+bFoD5Dvhm9oLheFp5O4a2QF0cSBGsBX4qZmadPMvVqlLJBBci+WqGGOAPvcDeNSVg==", - "dev": true - }, - "node_modules/tlds": { - "version": "1.244.0", - "resolved": "https://registry.npmjs.org/tlds/-/tlds-1.244.0.tgz", - "integrity": "sha512-nkacnxHmN5USM/cpmPx29sc2/AnmvUA9han0tNtAJ9yOhh4bPmZm4dGhyg/isWBIES4a70mjd0Q8FSaof6Vf0g==", - "dev": true, - "bin": { - "tlds": "bin.js" - } - }, - "node_modules/tmp": { - "version": "0.0.33", - "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.0.33.tgz", - "integrity": "sha512-jRCJlojKnZ3addtTOjdIqoRuPEKBvNXcGYqzO6zWZX8KfKEpnGY5jfggJQ3EjKuu8D4bJRr0y+cYJFmYbImXGw==", - "dev": true, - "dependencies": { - "os-tmpdir": "~1.0.2" - }, - "engines": { - "node": ">=0.6.0" - } - }, - "node_modules/tmpl": { - "version": "1.0.5", - "resolved": "https://registry.npmjs.org/tmpl/-/tmpl-1.0.5.tgz", - "integrity": "sha512-3f0uOEAQwIqGuWW2MVzYg8fV/QNnc/IpuJNG837rLuczAaLVHslWHZQj4IGiEl5Hs3kkbhwL9Ab7Hrsmuj+Smw==", - "dev": true, - "peer": true - }, - "node_modules/to-fast-properties": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/to-fast-properties/-/to-fast-properties-2.0.0.tgz", - "integrity": "sha512-/OaKK0xYrs3DmxRYqL/yDc+FxFUVYhDlXMhRmv3z915w2HF1tnN1omB354j8VUGO/hbRzyD6Y3sA7v7GS/ceog==", - "dev": true, - "engines": { - "node": ">=4" - } - }, - "node_modules/to-object-path": { - "version": "0.3.0", - "resolved": "https://registry.npmjs.org/to-object-path/-/to-object-path-0.3.0.tgz", - "integrity": "sha512-9mWHdnGRuh3onocaHzukyvCZhzvr6tiflAy/JRFXcJX0TjgfWA9pk9t8CMbzmBE4Jfw58pXbkngtBtqYxzNEyg==", - "dev": true, - "peer": true, - "dependencies": { - "kind-of": "^3.0.2" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/to-object-path/node_modules/is-buffer": { - "version": "1.1.6", - "resolved": "https://registry.npmjs.org/is-buffer/-/is-buffer-1.1.6.tgz", - "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==", - "dev": true, - "peer": true - }, - "node_modules/to-object-path/node_modules/kind-of": { - "version": "3.2.2", - "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz", - "integrity": "sha512-NOW9QQXMoZGg/oqnVNoNTTIFEIid1627WCffUBJEdMxYApq7mNE7CpzucIPc+ZQg25Phej7IJSmX3hO+oblOtQ==", - "dev": true, - "peer": true, - "dependencies": { - "is-buffer": "^1.1.5" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/to-regex": { - "version": "3.0.2", - "resolved": "https://registry.npmjs.org/to-regex/-/to-regex-3.0.2.tgz", - "integrity": "sha512-FWtleNAtZ/Ki2qtqej2CXTOayOH9bHDQF+Q48VpWyDXjbYxA4Yz8iDB31zXOBUlOHHKidDbqGVrTUvQMPmBGBw==", - "dev": true, - "peer": true, - "dependencies": { - "define-property": "^2.0.2", - "extend-shallow": "^3.0.2", - "regex-not": "^1.0.2", - "safe-regex": "^1.1.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/to-regex-range": { - "version": "5.0.1", - "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz", - "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==", - "dev": true, - "dependencies": { - "is-number": "^7.0.0" - }, - "engines": { - "node": ">=8.0" - } - }, - "node_modules/tough-cookie": { - "version": "4.1.3", - "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-4.1.3.tgz", - "integrity": "sha512-aX/y5pVRkfRnfmuX+OdbSdXvPe6ieKX/G2s7e98f4poJHnqH3281gDPm/metm6E/WRamfx7WC4HUqkWHfQHprw==", - "dev": true, - "peer": true, - "dependencies": { - "psl": "^1.1.33", - "punycode": "^2.1.1", - "universalify": "^0.2.0", - "url-parse": "^1.5.3" - }, - "engines": { - "node": ">=6" - } - }, - "node_modules/tough-cookie/node_modules/universalify": { - "version": "0.2.0", - "resolved": "https://registry.npmjs.org/universalify/-/universalify-0.2.0.tgz", - "integrity": "sha512-CJ1QgKmNg3CwvAv/kOFmtnEN05f0D/cn9QntgNOQlQF9dgvVTHj3t+8JPdjqawCHk7V/KA+fbUqzZ9XWhcqPUg==", - "dev": true, - "peer": true, - "engines": { - "node": ">= 4.0.0" - } - }, - "node_modules/tr46": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/tr46/-/tr46-2.1.0.tgz", - "integrity": "sha512-15Ih7phfcdP5YxqiB+iDtLoaTz4Nd35+IiAv0kQ5FNKHzXgdWqPoTIqEDDJmXceQt4JZk6lVPT8lnDlPpGDppw==", - "dev": true, - "peer": true, - "dependencies": { - "punycode": "^2.1.1" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/trim": { - "version": "0.0.1", - "resolved": "https://registry.npmjs.org/trim/-/trim-0.0.1.tgz", - "integrity": "sha512-YzQV+TZg4AxpKxaTHK3c3D+kRDCGVEE7LemdlQZoQXn0iennk10RsIoY6ikzAqJTc9Xjl9C1/waHom/J86ziAQ==", - "deprecated": "Use String.prototype.trim() instead", - "dev": true - }, - "node_modules/trim-newlines": { - "version": "3.0.1", - "resolved": "https://registry.npmjs.org/trim-newlines/-/trim-newlines-3.0.1.tgz", - "integrity": "sha512-c1PTsA3tYrIsLGkJkzHF+w9F2EyxfXGo4UyJc4pFL++FMjnq0HJS69T3M7d//gKrFKwy429bouPescbjecU+Zw==", - "dev": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/trim-trailing-lines": { - "version": "1.1.4", - "resolved": "https://registry.npmjs.org/trim-trailing-lines/-/trim-trailing-lines-1.1.4.tgz", - "integrity": "sha512-rjUWSqnfTNrjbB9NQWfPMH/xRK1deHeGsHoVfpxJ++XeYXE0d6B1En37AHfw3jtfTU7dzMzZL2jjpe8Qb5gLIQ==", - "dev": true, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/trough": { - "version": "1.0.5", - "resolved": "https://registry.npmjs.org/trough/-/trough-1.0.5.tgz", - "integrity": "sha512-rvuRbTarPXmMb79SmzEp8aqXNKcK+y0XaB298IXueQ8I2PsrATcPBCSPyK/dDNa2iWOhKlfNnOjdAOTBU/nkFA==", - "dev": true, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/ts-jest": { - "version": "26.5.6", - "resolved": "https://registry.npmjs.org/ts-jest/-/ts-jest-26.5.6.tgz", - "integrity": "sha512-rua+rCP8DxpA8b4DQD/6X2HQS8Zy/xzViVYfEs2OQu68tkCuKLV0Md8pmX55+W24uRIyAsf/BajRfxOs+R2MKA==", - "dev": true, - "dependencies": { - "bs-logger": "0.x", - "buffer-from": "1.x", - "fast-json-stable-stringify": "2.x", - "jest-util": "^26.1.0", - "json5": "2.x", - "lodash": "4.x", - "make-error": "1.x", - "mkdirp": "1.x", - "semver": "7.x", - "yargs-parser": "20.x" - }, - "bin": { - "ts-jest": "cli.js" - }, - "engines": { - "node": ">= 10" - }, - "peerDependencies": { - "jest": ">=26 <27", - "typescript": ">=3.8 <5.0" - } - }, - "node_modules/tsconfig-paths": { - "version": "3.14.2", - "resolved": "https://registry.npmjs.org/tsconfig-paths/-/tsconfig-paths-3.14.2.tgz", - "integrity": "sha512-o/9iXgCYc5L/JxCHPe3Hvh8Q/2xm5Z+p18PESBU6Ff33695QnCHBEjcytY2q19ua7Mbl/DavtBOLq+oG0RCL+g==", - "dev": true, - "dependencies": { - "@types/json5": "^0.0.29", - "json5": "^1.0.2", - "minimist": "^1.2.6", - "strip-bom": "^3.0.0" - } - }, - "node_modules/tsconfig-paths/node_modules/json5": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.2.tgz", - "integrity": "sha512-g1MWMLBiz8FKi1e4w0UyVL3w+iJceWAFBAaBnnGKOpNa5f8TLktkbre1+s6oICydWAm+HRUGTmI+//xv2hvXYA==", - "dev": true, - "dependencies": { - "minimist": "^1.2.0" - }, - "bin": { - "json5": "lib/cli.js" - } - }, - "node_modules/tsconfig-paths/node_modules/strip-bom": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-3.0.0.tgz", - "integrity": "sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==", - "dev": true, - "engines": { - "node": ">=4" - } - }, - "node_modules/tslib": { - "version": "2.6.2", - "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.6.2.tgz", - "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q==", - "dev": true - }, - "node_modules/tsutils": { - "version": "3.21.0", - "resolved": "https://registry.npmjs.org/tsutils/-/tsutils-3.21.0.tgz", - "integrity": "sha512-mHKK3iUXL+3UF6xL5k0PEhKRUBKPBCv/+RkEOpjRWxxx27KKRBmmA60A9pgOUvMi8GKhRMPEmjBRPzs2W7O1OA==", - "dev": true, - "dependencies": { - "tslib": "^1.8.1" - }, - "engines": { - "node": ">= 6" - }, - "peerDependencies": { - "typescript": ">=2.8.0 || >= 3.2.0-dev || >= 3.3.0-dev || >= 3.4.0-dev || >= 3.5.0-dev || >= 3.6.0-dev || >= 3.6.0-beta || >= 3.7.0-dev || >= 3.7.0-beta" - } - }, - "node_modules/tsutils/node_modules/tslib": { - "version": "1.14.1", - "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz", - "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==", - "dev": true - }, - "node_modules/type-check": { - "version": "0.4.0", - "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz", - "integrity": "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==", - "dev": true, - "dependencies": { - "prelude-ls": "^1.2.1" - }, - "engines": { - "node": ">= 0.8.0" - } - }, - "node_modules/type-detect": { - "version": "4.0.8", - "resolved": "https://registry.npmjs.org/type-detect/-/type-detect-4.0.8.tgz", - "integrity": "sha512-0fr/mIH1dlO+x7TlcMy+bIDqKPsw/70tVyeHW787goQjhmqaZe10uwLujubK9q9Lg6Fiho1KUKDYz0Z7k7g5/g==", - "dev": true, - "peer": true, - "engines": { - "node": ">=4" - } - }, - "node_modules/type-fest": { - "version": "0.20.2", - "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz", - "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==", - "dev": true, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/typed-array-buffer": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/typed-array-buffer/-/typed-array-buffer-1.0.0.tgz", - "integrity": "sha512-Y8KTSIglk9OZEr8zywiIHG/kmQ7KWyjseXs1CbSo8vC42w7hg2HgYTxSWwP0+is7bWDc1H+Fo026CpHFwm8tkw==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "get-intrinsic": "^1.2.1", - "is-typed-array": "^1.1.10" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/typed-array-byte-length": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/typed-array-byte-length/-/typed-array-byte-length-1.0.0.tgz", - "integrity": "sha512-Or/+kvLxNpeQ9DtSydonMxCx+9ZXOswtwJn17SNLvhptaXYDJvkFFP5zbfU/uLmvnBJlI4yrnXRxpdWH/M5tNA==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "for-each": "^0.3.3", - "has-proto": "^1.0.1", - "is-typed-array": "^1.1.10" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/typed-array-byte-offset": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/typed-array-byte-offset/-/typed-array-byte-offset-1.0.0.tgz", - "integrity": "sha512-RD97prjEt9EL8YgAgpOkf3O4IF9lhJFr9g0htQkm0rchFp/Vx7LW5Q8fSXXub7BXAODyUQohRMyOc3faCPd0hg==", - "dev": true, - "dependencies": { - "available-typed-arrays": "^1.0.5", - "call-bind": "^1.0.2", - "for-each": "^0.3.3", - "has-proto": "^1.0.1", - "is-typed-array": "^1.1.10" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/typed-array-length": { - "version": "1.0.4", - "resolved": "https://registry.npmjs.org/typed-array-length/-/typed-array-length-1.0.4.tgz", - "integrity": "sha512-KjZypGq+I/H7HI5HlOoGHkWUUGq+Q0TPhQurLbyrVrvnKTBgzLhIJ7j6J/XTQOi0d1RjyZ0wdas8bKs2p0x3Ng==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "for-each": "^0.3.3", - "is-typed-array": "^1.1.9" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/typedarray-to-buffer": { - "version": "3.1.5", - "resolved": "https://registry.npmjs.org/typedarray-to-buffer/-/typedarray-to-buffer-3.1.5.tgz", - "integrity": "sha512-zdu8XMNEDepKKR+XYOXAVPtWui0ly0NtohUscw+UmaHiAWT8hrV1rr//H6V+0DvJ3OQ19S979M0laLfX8rm82Q==", - "dev": true, - "dependencies": { - "is-typedarray": "^1.0.0" - } - }, - "node_modules/typescript": { - "version": "4.9.5", - "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.9.5.tgz", - "integrity": "sha512-1FXk9E2Hm+QzZQ7z+McJiHL4NW1F2EzMu9Nq9i3zAaGqibafqYwCVU6WyWAuyQRRzOlxou8xZSyXLEN8oKj24g==", - "dev": true, - "peer": true, - "bin": { - "tsc": "bin/tsc", - "tsserver": "bin/tsserver" - }, - "engines": { - "node": ">=4.2.0" - } - }, - "node_modules/unbox-primitive": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/unbox-primitive/-/unbox-primitive-1.0.2.tgz", - "integrity": "sha512-61pPlCD9h51VoreyJ0BReideM3MDKMKnh6+V9L08331ipq6Q8OFXZYiqP6n/tbHx4s5I9uRhcye6BrbkizkBDw==", - "dev": true, - "dependencies": { - "call-bind": "^1.0.2", - "has-bigints": "^1.0.2", - "has-symbols": "^1.0.3", - "which-boxed-primitive": "^1.0.2" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/undici-types": { - "version": "5.26.5", - "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz", - "integrity": "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA==", - "dev": true - }, - "node_modules/unherit": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/unherit/-/unherit-1.1.3.tgz", - "integrity": "sha512-Ft16BJcnapDKp0+J/rqFC3Rrk6Y/Ng4nzsC028k2jdDII/rdZ7Wd3pPT/6+vIIxRagwRc9K0IUX0Ra4fKvw+WQ==", - "dev": true, - "dependencies": { - "inherits": "^2.0.0", - "xtend": "^4.0.0" - }, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/unified": { - "version": "9.2.2", - "resolved": "https://registry.npmjs.org/unified/-/unified-9.2.2.tgz", - "integrity": "sha512-Sg7j110mtefBD+qunSLO1lqOEKdrwBFBrR6Qd8f4uwkhWNlbkaqwHse6e7QvD3AP/MNoJdEDLaf8OxYyoWgorQ==", - "dev": true, - "dependencies": { - "bail": "^1.0.0", - "extend": "^3.0.0", - "is-buffer": "^2.0.0", - "is-plain-obj": "^2.0.0", - "trough": "^1.0.0", - "vfile": "^4.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/unified-lint-rule": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/unified-lint-rule/-/unified-lint-rule-2.1.2.tgz", - "integrity": "sha512-JWudPtRN7TLFHVLEVZ+Rm8FUb6kCAtHxEXFgBGDxRSdNMnGyTU5zyYvduHSF/liExlFB3vdFvsAHnNVE/UjAwA==", - "dev": true, - "dependencies": { - "@types/unist": "^2.0.0", - "trough": "^2.0.0", - "unified": "^10.0.0", - "vfile": "^5.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/unified-lint-rule/node_modules/bail": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/bail/-/bail-2.0.2.tgz", - "integrity": "sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw==", - "dev": true, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/unified-lint-rule/node_modules/is-plain-obj": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/is-plain-obj/-/is-plain-obj-4.1.0.tgz", - "integrity": "sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==", - "dev": true, - "engines": { - "node": ">=12" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/unified-lint-rule/node_modules/trough": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/trough/-/trough-2.1.0.tgz", - "integrity": "sha512-AqTiAOLcj85xS7vQ8QkAV41hPDIJ71XJB4RCUrzo/1GM2CQwhkJGaf9Hgr7BOugMRpgGUrqRg/DrBDl4H40+8g==", - "dev": true, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/unified-lint-rule/node_modules/unified": { - "version": "10.1.2", - "resolved": "https://registry.npmjs.org/unified/-/unified-10.1.2.tgz", - "integrity": "sha512-pUSWAi/RAnVy1Pif2kAoeWNBa3JVrx0MId2LASj8G+7AiHWoKZNTomq6LG326T68U7/e263X6fTdcXIy7XnF7Q==", - "dev": true, - "dependencies": { - "@types/unist": "^2.0.0", - "bail": "^2.0.0", - "extend": "^3.0.0", - "is-buffer": "^2.0.0", - "is-plain-obj": "^4.0.0", - "trough": "^2.0.0", - "vfile": "^5.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/unified/node_modules/is-plain-obj": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/is-plain-obj/-/is-plain-obj-2.1.0.tgz", - "integrity": "sha512-YWnfyRwxL/+SsrWYfOpUtz5b3YD+nyfkHvjbcanzk8zgyO4ASD67uVMRt8k5bM4lLMDnXfriRhOpemw+NfT1eA==", - "dev": true, - "engines": { - "node": ">=8" - } - }, - "node_modules/unified/node_modules/unist-util-stringify-position": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-2.0.3.tgz", - "integrity": "sha512-3faScn5I+hy9VleOq/qNbAd6pAx7iH5jYBMS9I1HgQVijz/4mv5Bvw5iw1sC/90CODiKo81G/ps8AJrISn687g==", - "dev": true, - "dependencies": { - "@types/unist": "^2.0.2" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/unified/node_modules/vfile": { - "version": "4.2.1", - "resolved": "https://registry.npmjs.org/vfile/-/vfile-4.2.1.tgz", - "integrity": "sha512-O6AE4OskCG5S1emQ/4gl8zK586RqA3srz3nfK/Viy0UPToBc5Trp9BVFb1u0CjsKrAWwnpr4ifM/KBXPWwJbCA==", - "dev": true, - "dependencies": { - "@types/unist": "^2.0.0", - "is-buffer": "^2.0.0", - "unist-util-stringify-position": "^2.0.0", - "vfile-message": "^2.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/unified/node_modules/vfile-message": { - "version": "2.0.4", - "resolved": "https://registry.npmjs.org/vfile-message/-/vfile-message-2.0.4.tgz", - "integrity": "sha512-DjssxRGkMvifUOJre00juHoP9DPWuzjxKuMDrhNbk2TdaYYBNMStsNhEOt3idrtI12VQYM/1+iM0KOzXi4pxwQ==", - "dev": true, - "dependencies": { - "@types/unist": "^2.0.0", - "unist-util-stringify-position": "^2.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/union-value": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/union-value/-/union-value-1.0.1.tgz", - "integrity": "sha512-tJfXmxMeWYnczCVs7XAEvIV7ieppALdyepWMkHkwciRpZraG/xwT+s2JN8+pr1+8jCRf80FFzvr+MpQeeoF4Xg==", - "dev": true, - "peer": true, - "dependencies": { - "arr-union": "^3.1.0", - "get-value": "^2.0.6", - "is-extendable": "^0.1.1", - "set-value": "^2.0.1" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/union-value/node_modules/is-extendable": { - "version": "0.1.1", - "resolved": "https://registry.npmjs.org/is-extendable/-/is-extendable-0.1.1.tgz", - "integrity": "sha512-5BMULNob1vgFX6EjQw5izWDxrecWK9AM72rugNr0TFldMOi0fj6Jk+zeKIt0xGj4cEfQIJth4w3OKWOJ4f+AFw==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/unist-util-find-all-after": { - "version": "3.0.2", - "resolved": "https://registry.npmjs.org/unist-util-find-all-after/-/unist-util-find-all-after-3.0.2.tgz", - "integrity": "sha512-xaTC/AGZ0rIM2gM28YVRAFPIZpzbpDtU3dRmp7EXlNVA8ziQc4hY3H7BHXM1J49nEmiqc3svnqMReW+PGqbZKQ==", - "dev": true, - "dependencies": { - "unist-util-is": "^4.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/unist-util-is": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/unist-util-is/-/unist-util-is-4.1.0.tgz", - "integrity": "sha512-ZOQSsnce92GrxSqlnEEseX0gi7GH9zTJZ0p9dtu87WRb/37mMPO2Ilx1s/t9vBHrFhbgweUwb+t7cIn5dxPhZg==", - "dev": true, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/unist-util-remove-position": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/unist-util-remove-position/-/unist-util-remove-position-2.0.1.tgz", - "integrity": "sha512-fDZsLYIe2uT+oGFnuZmy73K6ZxOPG/Qcm+w7jbEjaFcJgbQ6cqjs/eSPzXhsmGpAsWPkqZM9pYjww5QTn3LHMA==", - "dev": true, - "dependencies": { - "unist-util-visit": "^2.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/unist-util-remove-position/node_modules/unist-util-visit": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/unist-util-visit/-/unist-util-visit-2.0.3.tgz", - "integrity": "sha512-iJ4/RczbJMkD0712mGktuGpm/U4By4FfDonL7N/9tATGIF4imikjOuagyMY53tnZq3NP6BcmlrHhEKAfGWjh7Q==", - "dev": true, - "dependencies": { - "@types/unist": "^2.0.0", - "unist-util-is": "^4.0.0", - "unist-util-visit-parents": "^3.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/unist-util-remove-position/node_modules/unist-util-visit-parents": { - "version": "3.1.1", - "resolved": "https://registry.npmjs.org/unist-util-visit-parents/-/unist-util-visit-parents-3.1.1.tgz", - "integrity": "sha512-1KROIZWo6bcMrZEwiH2UrXDyalAa0uqzWCxCJj6lPOvTve2WkfgCytoDTPaMnodXh1WrXOq0haVYHj99ynJlsg==", - "dev": true, - "dependencies": { - "@types/unist": "^2.0.0", - "unist-util-is": "^4.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/unist-util-stringify-position": { - "version": "3.0.3", - "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-3.0.3.tgz", - "integrity": "sha512-k5GzIBZ/QatR8N5X2y+drfpWG8IDBzdnVj6OInRNWm1oXrzydiaAT2OQiA8DPRRZyAKb9b6I2a6PxYklZD0gKg==", - "dev": true, - "dependencies": { - "@types/unist": "^2.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/unist-util-visit": { - "version": "4.1.2", - "resolved": "https://registry.npmjs.org/unist-util-visit/-/unist-util-visit-4.1.2.tgz", - "integrity": "sha512-MSd8OUGISqHdVvfY9TPhyK2VdUrPgxkUtWSuMHF6XAAFuL4LokseigBnZtPnJMu+FbynTkFNnFlyjxpVKujMRg==", - "dev": true, - "dependencies": { - "@types/unist": "^2.0.0", - "unist-util-is": "^5.0.0", - "unist-util-visit-parents": "^5.1.1" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/unist-util-visit-parents": { - "version": "5.1.3", - "resolved": "https://registry.npmjs.org/unist-util-visit-parents/-/unist-util-visit-parents-5.1.3.tgz", - "integrity": "sha512-x6+y8g7wWMyQhL1iZfhIPhDAs7Xwbn9nRosDXl7qoPTSCy0yNxnKc+hWokFifWQIDGi154rdUqKvbCa4+1kLhg==", - "dev": true, - "dependencies": { - "@types/unist": "^2.0.0", - "unist-util-is": "^5.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/unist-util-visit-parents/node_modules/unist-util-is": { - "version": "5.2.1", - "resolved": "https://registry.npmjs.org/unist-util-is/-/unist-util-is-5.2.1.tgz", - "integrity": "sha512-u9njyyfEh43npf1M+yGKDGVPbY/JWEemg5nH05ncKPfi+kBbKBJoTdsogMu33uhytuLlv9y0O7GH7fEdwLdLQw==", - "dev": true, - "dependencies": { - "@types/unist": "^2.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/unist-util-visit/node_modules/unist-util-is": { - "version": "5.2.1", - "resolved": "https://registry.npmjs.org/unist-util-is/-/unist-util-is-5.2.1.tgz", - "integrity": "sha512-u9njyyfEh43npf1M+yGKDGVPbY/JWEemg5nH05ncKPfi+kBbKBJoTdsogMu33uhytuLlv9y0O7GH7fEdwLdLQw==", - "dev": true, - "dependencies": { - "@types/unist": "^2.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/universalify": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/universalify/-/universalify-1.0.0.tgz", - "integrity": "sha512-rb6X1W158d7pRQBg5gkR8uPaSfiids68LTJQYOtEUhoJUWBdaQHsuT/EUduxXYxcrt4r5PJ4fuHW1MHT6p0qug==", - "dev": true, - "engines": { - "node": ">= 10.0.0" - } - }, - "node_modules/unset-value": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/unset-value/-/unset-value-1.0.0.tgz", - "integrity": "sha512-PcA2tsuGSF9cnySLHTLSh2qrQiJ70mn+r+Glzxv2TWZblxsxCC52BDlZoPCsz7STd9pN7EZetkWZBAvk4cgZdQ==", - "dev": true, - "peer": true, - "dependencies": { - "has-value": "^0.3.1", - "isobject": "^3.0.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/unset-value/node_modules/has-value": { - "version": "0.3.1", - "resolved": "https://registry.npmjs.org/has-value/-/has-value-0.3.1.tgz", - "integrity": "sha512-gpG936j8/MzaeID5Yif+577c17TxaDmhuyVgSwtnL/q8UUTySg8Mecb+8Cf1otgLoD7DDH75axp86ER7LFsf3Q==", - "dev": true, - "peer": true, - "dependencies": { - "get-value": "^2.0.3", - "has-values": "^0.1.4", - "isobject": "^2.0.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/unset-value/node_modules/has-value/node_modules/isobject": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/isobject/-/isobject-2.1.0.tgz", - "integrity": "sha512-+OUdGJlgjOBZDfxnDjYYG6zp487z0JGNQq3cYQYg5f5hKR+syHMsaztzGeml/4kGG55CSpKSpWTY+jYGgsHLgA==", - "dev": true, - "peer": true, - "dependencies": { - "isarray": "1.0.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/unset-value/node_modules/has-values": { - "version": "0.1.4", - "resolved": "https://registry.npmjs.org/has-values/-/has-values-0.1.4.tgz", - "integrity": "sha512-J8S0cEdWuQbqD9//tlZxiMuMNmxB8PlEwvYwuxsTmR1G5RXUePEX/SJn7aD0GMLieuZYSwNH0cQuJGwnYunXRQ==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/unset-value/node_modules/isarray": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz", - "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==", - "dev": true, - "peer": true - }, - "node_modules/update-browserslist-db": { - "version": "1.0.13", - "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.0.13.tgz", - "integrity": "sha512-xebP81SNcPuNpPP3uzeW1NYXxI3rxyJzF3pD6sH4jE7o/IX+WtSpwnVU+qIsDPyk0d3hmFQ7mjqc6AtV604hbg==", - "dev": true, - "funding": [ - { - "type": "opencollective", - "url": "https://opencollective.com/browserslist" - }, - { - "type": "tidelift", - "url": "https://tidelift.com/funding/github/npm/browserslist" - }, - { - "type": "github", - "url": "https://github.com/sponsors/ai" - } - ], - "dependencies": { - "escalade": "^3.1.1", - "picocolors": "^1.0.0" - }, - "bin": { - "update-browserslist-db": "cli.js" - }, - "peerDependencies": { - "browserslist": ">= 4.21.0" - } - }, - "node_modules/uri-js": { - "version": "4.4.1", - "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz", - "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==", - "dev": true, - "dependencies": { - "punycode": "^2.1.0" - } - }, - "node_modules/urix": { - "version": "0.1.0", - "resolved": "https://registry.npmjs.org/urix/-/urix-0.1.0.tgz", - "integrity": "sha512-Am1ousAhSLBeB9cG/7k7r2R0zj50uDRlZHPGbazid5s9rlF1F/QKYObEKSIunSjIOkJZqwRRLpvewjEkM7pSqg==", - "deprecated": "Please see https://github.com/lydell/urix#deprecated", - "dev": true, - "peer": true - }, - "node_modules/url-parse": { - "version": "1.5.10", - "resolved": "https://registry.npmjs.org/url-parse/-/url-parse-1.5.10.tgz", - "integrity": "sha512-WypcfiRhfeUP9vvF0j6rw0J3hrWrw6iZv3+22h6iRMJ/8z1Tj6XfLP4DsUix5MhMPnXpiHDoKyoZ/bdCkwBCiQ==", - "dev": true, - "peer": true, - "dependencies": { - "querystringify": "^2.1.1", - "requires-port": "^1.0.0" - } - }, - "node_modules/url-regex": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/url-regex/-/url-regex-5.0.0.tgz", - "integrity": "sha512-O08GjTiAFNsSlrUWfqF1jH0H1W3m35ZyadHrGv5krdnmPPoxP27oDTqux/579PtaroiSGm5yma6KT1mHFH6Y/g==", - "dev": true, - "dependencies": { - "ip-regex": "^4.1.0", - "tlds": "^1.203.0" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/use": { - "version": "3.1.1", - "resolved": "https://registry.npmjs.org/use/-/use-3.1.1.tgz", - "integrity": "sha512-cwESVXlO3url9YWlFW/TA9cshCEhtu7IKJ/p5soJ/gGpj7vbvFrAY/eIioQ6Dw23KjZhYgiIo8HOs1nQ2vr/oQ==", - "dev": true, - "peer": true, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/util-deprecate": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz", - "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==", - "dev": true - }, - "node_modules/uuid": { - "version": "8.3.2", - "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz", - "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==", - "dev": true, - "optional": true, - "peer": true, - "bin": { - "uuid": "dist/bin/uuid" - } - }, - "node_modules/v8-compile-cache": { - "version": "2.4.0", - "resolved": "https://registry.npmjs.org/v8-compile-cache/-/v8-compile-cache-2.4.0.tgz", - "integrity": "sha512-ocyWc3bAHBB/guyqJQVI5o4BZkPhznPYUG2ea80Gond/BgNWpap8TOmLSeeQG7bnh2KMISxskdADG59j7zruhw==", - "dev": true - }, - "node_modules/v8-to-istanbul": { - "version": "7.1.2", - "resolved": "https://registry.npmjs.org/v8-to-istanbul/-/v8-to-istanbul-7.1.2.tgz", - "integrity": "sha512-TxNb7YEUwkLXCQYeudi6lgQ/SZrzNO4kMdlqVxaZPUIUjCv6iSSypUQX70kNBSERpQ8fk48+d61FXk+tgqcWow==", - "dev": true, - "peer": true, - "dependencies": { - "@types/istanbul-lib-coverage": "^2.0.1", - "convert-source-map": "^1.6.0", - "source-map": "^0.7.3" - }, - "engines": { - "node": ">=10.10.0" - } - }, - "node_modules/v8-to-istanbul/node_modules/source-map": { - "version": "0.7.4", - "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.7.4.tgz", - "integrity": "sha512-l3BikUxvPOcn5E74dZiq5BGsTb5yEwhaTSzccU6t4sDOH8NWJCstKO5QT2CvtFoK6F0saL7p9xHAqHOlCPJygA==", - "dev": true, - "peer": true, - "engines": { - "node": ">= 8" - } - }, - "node_modules/validate-npm-package-license": { - "version": "3.0.4", - "resolved": "https://registry.npmjs.org/validate-npm-package-license/-/validate-npm-package-license-3.0.4.tgz", - "integrity": "sha512-DpKm2Ui/xN7/HQKCtpZxoRWBhZ9Z0kqtygG8XCgNQ8ZlDnxuQmWhj566j8fN4Cu3/JmbhsDo7fcAJq4s9h27Ew==", - "dev": true, - "dependencies": { - "spdx-correct": "^3.0.0", - "spdx-expression-parse": "^3.0.0" - } - }, - "node_modules/vfile": { - "version": "5.3.7", - "resolved": "https://registry.npmjs.org/vfile/-/vfile-5.3.7.tgz", - "integrity": "sha512-r7qlzkgErKjobAmyNIkkSpizsFPYiUPuJb5pNW1RB4JcYVZhs4lIbVqk8XPk033CV/1z8ss5pkax8SuhGpcG8g==", - "dev": true, - "dependencies": { - "@types/unist": "^2.0.0", - "is-buffer": "^2.0.0", - "unist-util-stringify-position": "^3.0.0", - "vfile-message": "^3.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/vfile-location": { - "version": "3.2.0", - "resolved": "https://registry.npmjs.org/vfile-location/-/vfile-location-3.2.0.tgz", - "integrity": "sha512-aLEIZKv/oxuCDZ8lkJGhuhztf/BW4M+iHdCwglA/eWc+vtuRFJj8EtgceYFX4LRjOhCAAiNHsKGssC6onJ+jbA==", - "dev": true, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/vfile-matter": { - "version": "4.0.1", - "resolved": "https://registry.npmjs.org/vfile-matter/-/vfile-matter-4.0.1.tgz", - "integrity": "sha512-ZeACdaxCOxhePpoLO4A5y/VgI9EuWBXu+sUk65aQ7lXBZDFg7X0tuOzigLJUtsQzazFt6K2m9SdlDxZdfL5vVg==", - "dev": true, - "dependencies": { - "is-buffer": "^2.0.0", - "vfile": "^5.0.0", - "yaml": "^2.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/vfile-message": { - "version": "3.1.4", - "resolved": "https://registry.npmjs.org/vfile-message/-/vfile-message-3.1.4.tgz", - "integrity": "sha512-fa0Z6P8HUrQN4BZaX05SIVXic+7kE3b05PWAtPuYP9QLHsLKYR7/AlLW3NtOrpXRLeawpDLMsVkmk5DG0NXgWw==", - "dev": true, - "dependencies": { - "@types/unist": "^2.0.0", - "unist-util-stringify-position": "^3.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/vfile-reporter": { - "version": "7.0.5", - "resolved": "https://registry.npmjs.org/vfile-reporter/-/vfile-reporter-7.0.5.tgz", - "integrity": "sha512-NdWWXkv6gcd7AZMvDomlQbK3MqFWL1RlGzMn++/O2TI+68+nqxCPTvLugdOtfSzXmjh+xUyhp07HhlrbJjT+mw==", - "dev": true, - "dependencies": { - "@types/supports-color": "^8.0.0", - "string-width": "^5.0.0", - "supports-color": "^9.0.0", - "unist-util-stringify-position": "^3.0.0", - "vfile": "^5.0.0", - "vfile-message": "^3.0.0", - "vfile-sort": "^3.0.0", - "vfile-statistics": "^2.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/vfile-reporter-json": { - "version": "3.3.0", - "resolved": "https://registry.npmjs.org/vfile-reporter-json/-/vfile-reporter-json-3.3.0.tgz", - "integrity": "sha512-/zgRtjxQ2UGJn+HViiZ7+nIXtUzkkXFQum3BmaS/bSyr10P0X41ETRqqwMJ95RtbKUah3m7pKb6oS1eZeXXHzQ==", - "dev": true, - "dependencies": { - "vfile": "^5.0.0", - "vfile-message": "^3.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/vfile-reporter/node_modules/ansi-regex": { - "version": "6.0.1", - "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.0.1.tgz", - "integrity": "sha512-n5M855fKb2SsfMIiFFoVrABHJC8QtHwVx+mHWP3QcEqBHYienj5dHSgjbxtC0WEZXYt4wcD6zrQElDPhFuZgfA==", - "dev": true, - "engines": { - "node": ">=12" - }, - "funding": { - "url": "https://github.com/chalk/ansi-regex?sponsor=1" - } - }, - "node_modules/vfile-reporter/node_modules/string-width": { - "version": "5.1.2", - "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz", - "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==", - "dev": true, - "dependencies": { - "eastasianwidth": "^0.2.0", - "emoji-regex": "^9.2.2", - "strip-ansi": "^7.0.1" - }, - "engines": { - "node": ">=12" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/vfile-reporter/node_modules/strip-ansi": { - "version": "7.1.0", - "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.0.tgz", - "integrity": "sha512-iq6eVVI64nQQTRYq2KtEg2d2uU7LElhTJwsH4YzIHZshxlgZms/wIc4VoDQTlG/IvVIrBKG06CrZnp0qv7hkcQ==", - "dev": true, - "dependencies": { - "ansi-regex": "^6.0.1" - }, - "engines": { - "node": ">=12" - }, - "funding": { - "url": "https://github.com/chalk/strip-ansi?sponsor=1" - } - }, - "node_modules/vfile-reporter/node_modules/supports-color": { - "version": "9.4.0", - "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-9.4.0.tgz", - "integrity": "sha512-VL+lNrEoIXww1coLPOmiEmK/0sGigko5COxI09KzHc2VJXJsQ37UaQ+8quuxjDeA7+KnLGTWRyOXSLLR2Wb4jw==", - "dev": true, - "engines": { - "node": ">=12" - }, - "funding": { - "url": "https://github.com/chalk/supports-color?sponsor=1" - } - }, - "node_modules/vfile-sort": { - "version": "3.0.1", - "resolved": "https://registry.npmjs.org/vfile-sort/-/vfile-sort-3.0.1.tgz", - "integrity": "sha512-1os1733XY6y0D5x0ugqSeaVJm9lYgj0j5qdcZQFyxlZOSy1jYarL77lLyb5gK4Wqr1d5OxmuyflSO3zKyFnTFw==", - "dev": true, - "dependencies": { - "vfile": "^5.0.0", - "vfile-message": "^3.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/vfile-statistics": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/vfile-statistics/-/vfile-statistics-2.0.1.tgz", - "integrity": "sha512-W6dkECZmP32EG/l+dp2jCLdYzmnDBIw6jwiLZSER81oR5AHRcVqL+k3Z+pfH1R73le6ayDkJRMk0sutj1bMVeg==", - "dev": true, - "dependencies": { - "vfile": "^5.0.0", - "vfile-message": "^3.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/unified" - } - }, - "node_modules/w3c-hr-time": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/w3c-hr-time/-/w3c-hr-time-1.0.2.tgz", - "integrity": "sha512-z8P5DvDNjKDoFIHK7q8r8lackT6l+jo/Ye3HOle7l9nICP9lf1Ci25fy9vHd0JOWewkIFzXIEig3TdKT7JQ5fQ==", - "deprecated": "Use your platform's native performance.now() and performance.timeOrigin.", - "dev": true, - "peer": true, - "dependencies": { - "browser-process-hrtime": "^1.0.0" - } - }, - "node_modules/w3c-xmlserializer": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/w3c-xmlserializer/-/w3c-xmlserializer-2.0.0.tgz", - "integrity": "sha512-4tzD0mF8iSiMiNs30BiLO3EpfGLZUT2MSX/G+o7ZywDzliWQ3OPtTZ0PTC3B3ca1UAf4cJMHB+2Bf56EriJuRA==", - "dev": true, - "peer": true, - "dependencies": { - "xml-name-validator": "^3.0.0" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/walker": { - "version": "1.0.8", - "resolved": "https://registry.npmjs.org/walker/-/walker-1.0.8.tgz", - "integrity": "sha512-ts/8E8l5b7kY0vlWLewOkDXMmPdLcVV4GmOQLyxuSswIJsweeFZtAsMF7k1Nszz+TYBQrlYRmzOnr398y1JemQ==", - "dev": true, - "peer": true, - "dependencies": { - "makeerror": "1.0.12" - } - }, - "node_modules/webidl-conversions": { - "version": "6.1.0", - "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-6.1.0.tgz", - "integrity": "sha512-qBIvFLGiBpLjfwmYAaHPXsn+ho5xZnGvyGvsarywGNc8VyQJUMHJ8OBKGGrPER0okBeMDaan4mNBlgBROxuI8w==", - "dev": true, - "peer": true, - "engines": { - "node": ">=10.4" - } - }, - "node_modules/whatwg-encoding": { - "version": "1.0.5", - "resolved": "https://registry.npmjs.org/whatwg-encoding/-/whatwg-encoding-1.0.5.tgz", - "integrity": "sha512-b5lim54JOPN9HtzvK9HFXvBma/rnfFeqsic0hSpjtDbVxR3dJKLc+KB4V6GgiGOvl7CY/KNh8rxSo9DKQrnUEw==", - "dev": true, - "peer": true, - "dependencies": { - "iconv-lite": "0.4.24" - } - }, - "node_modules/whatwg-mimetype": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-2.3.0.tgz", - "integrity": "sha512-M4yMwr6mAnQz76TbJm914+gPpB/nCwvZbJU28cUD6dR004SAxDLOOSUaB1JDRqLtaOV/vi0IC5lEAGFgrjGv/g==", - "dev": true, - "peer": true - }, - "node_modules/whatwg-url": { - "version": "8.7.0", - "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-8.7.0.tgz", - "integrity": "sha512-gAojqb/m9Q8a5IV96E3fHJM70AzCkgt4uXYX2O7EmuyOnLrViCQlsEBmF9UQIu3/aeAIp2U17rtbpZWNntQqdg==", - "dev": true, - "peer": true, - "dependencies": { - "lodash": "^4.7.0", - "tr46": "^2.1.0", - "webidl-conversions": "^6.1.0" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/which": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz", - "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==", - "dev": true, - "dependencies": { - "isexe": "^2.0.0" - }, - "bin": { - "node-which": "bin/node-which" - }, - "engines": { - "node": ">= 8" - } - }, - "node_modules/which-boxed-primitive": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/which-boxed-primitive/-/which-boxed-primitive-1.0.2.tgz", - "integrity": "sha512-bwZdv0AKLpplFY2KZRX6TvyuN7ojjr7lwkg6ml0roIy9YeuSr7JS372qlNW18UQYzgYK9ziGcerWqZOmEn9VNg==", - "dev": true, - "dependencies": { - "is-bigint": "^1.0.1", - "is-boolean-object": "^1.1.0", - "is-number-object": "^1.0.4", - "is-string": "^1.0.5", - "is-symbol": "^1.0.3" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/which-builtin-type": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/which-builtin-type/-/which-builtin-type-1.1.3.tgz", - "integrity": "sha512-YmjsSMDBYsM1CaFiayOVT06+KJeXf0o5M/CAd4o1lTadFAtacTUM49zoYxr/oroopFDfhvN6iEcBxUyc3gvKmw==", - "dev": true, - "dependencies": { - "function.prototype.name": "^1.1.5", - "has-tostringtag": "^1.0.0", - "is-async-function": "^2.0.0", - "is-date-object": "^1.0.5", - "is-finalizationregistry": "^1.0.2", - "is-generator-function": "^1.0.10", - "is-regex": "^1.1.4", - "is-weakref": "^1.0.2", - "isarray": "^2.0.5", - "which-boxed-primitive": "^1.0.2", - "which-collection": "^1.0.1", - "which-typed-array": "^1.1.9" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/which-collection": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/which-collection/-/which-collection-1.0.1.tgz", - "integrity": "sha512-W8xeTUwaln8i3K/cY1nGXzdnVZlidBcagyNFtBdD5kxnb4TvGKR7FfSIS3mYpwWS1QUCutfKz8IY8RjftB0+1A==", - "dev": true, - "dependencies": { - "is-map": "^2.0.1", - "is-set": "^2.0.1", - "is-weakmap": "^2.0.1", - "is-weakset": "^2.0.1" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/which-module": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/which-module/-/which-module-2.0.1.tgz", - "integrity": "sha512-iBdZ57RDvnOR9AGBhML2vFZf7h8vmBjhoaZqODJBFWHVtKkDmKuHai3cx5PgVMrX5YDNp27AofYbAwctSS+vhQ==", - "dev": true, - "peer": true - }, - "node_modules/which-pm-runs": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/which-pm-runs/-/which-pm-runs-1.1.0.tgz", - "integrity": "sha512-n1brCuqClxfFfq/Rb0ICg9giSZqCS+pLtccdag6C2HyufBrh3fBOiy9nb6ggRMvWOVH5GrdJskj5iGTZNxd7SA==", - "dev": true, - "engines": { - "node": ">=4" - } - }, - "node_modules/which-typed-array": { - "version": "1.1.13", - "resolved": "https://registry.npmjs.org/which-typed-array/-/which-typed-array-1.1.13.tgz", - "integrity": "sha512-P5Nra0qjSncduVPEAr7xhoF5guty49ArDTwzJ/yNuPIbZppyRxFQsRCWrocxIY+CnMVG+qfbU2FmDKyvSGClow==", - "dev": true, - "dependencies": { - "available-typed-arrays": "^1.0.5", - "call-bind": "^1.0.4", - "for-each": "^0.3.3", - "gopd": "^1.0.1", - "has-tostringtag": "^1.0.0" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/wrap-ansi": { - "version": "7.0.0", - "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz", - "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==", - "dev": true, - "dependencies": { - "ansi-styles": "^4.0.0", - "string-width": "^4.1.0", - "strip-ansi": "^6.0.0" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/chalk/wrap-ansi?sponsor=1" - } - }, - "node_modules/wrappy": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz", - "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==", - "dev": true - }, - "node_modules/write-file-atomic": { - "version": "3.0.3", - "resolved": "https://registry.npmjs.org/write-file-atomic/-/write-file-atomic-3.0.3.tgz", - "integrity": "sha512-AvHcyZ5JnSfq3ioSyjrBkH9yW4m7Ayk8/9My/DD9onKeu/94fwrMocemO2QAJFAlnnDN+ZDS+ZjAR5ua1/PV/Q==", - "dev": true, - "dependencies": { - "imurmurhash": "^0.1.4", - "is-typedarray": "^1.0.0", - "signal-exit": "^3.0.2", - "typedarray-to-buffer": "^3.1.5" - } - }, - "node_modules/ws": { - "version": "7.5.9", - "resolved": "https://registry.npmjs.org/ws/-/ws-7.5.9.tgz", - "integrity": "sha512-F+P9Jil7UiSKSkppIiD94dN07AwvFixvLIj1Og1Rl9GGMuNipJnV9JzjD6XuqmAeiswGvUmNLjr5cFuXwNS77Q==", - "dev": true, - "peer": true, - "engines": { - "node": ">=8.3.0" - }, - "peerDependencies": { - "bufferutil": "^4.0.1", - "utf-8-validate": "^5.0.2" - }, - "peerDependenciesMeta": { - "bufferutil": { - "optional": true - }, - "utf-8-validate": { - "optional": true - } - } - }, - "node_modules/xml-name-validator": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-3.0.0.tgz", - "integrity": "sha512-A5CUptxDsvxKJEU3yO6DuWBSJz/qizqzJKOMIfUJHETbBw/sFaDxgd6fxm1ewUaM0jZ444Fc5vC5ROYurg/4Pw==", - "dev": true, - "peer": true - }, - "node_modules/xmlchars": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz", - "integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==", - "dev": true, - "peer": true - }, - "node_modules/xtend": { - "version": "4.0.2", - "resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz", - "integrity": "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==", - "dev": true, - "engines": { - "node": ">=0.4" - } - }, - "node_modules/y18n": { - "version": "5.0.8", - "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz", - "integrity": "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==", - "dev": true, - "engines": { - "node": ">=10" - } - }, - "node_modules/yallist": { - "version": "3.1.1", - "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz", - "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==", - "dev": true - }, - "node_modules/yaml": { - "version": "2.3.3", - "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.3.3.tgz", - "integrity": "sha512-zw0VAJxgeZ6+++/su5AFoqBbZbrEakwu+X0M5HmcwUiBL7AzcuPKjj5we4xfQLp78LkEMpD0cOnUhmgOVy3KdQ==", - "dev": true, - "engines": { - "node": ">= 14" - } - }, - "node_modules/yargs": { - "version": "17.7.2", - "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.2.tgz", - "integrity": "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==", - "dev": true, - "dependencies": { - "cliui": "^8.0.1", - "escalade": "^3.1.1", - "get-caller-file": "^2.0.5", - "require-directory": "^2.1.1", - "string-width": "^4.2.3", - "y18n": "^5.0.5", - "yargs-parser": "^21.1.1" - }, - "engines": { - "node": ">=12" - } - }, - "node_modules/yargs-parser": { - "version": "20.2.9", - "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-20.2.9.tgz", - "integrity": "sha512-y11nGElTIV+CT3Zv9t7VKl+Q3hTQoT9a1Qzezhhl6Rp21gJ/IVTW7Z3y9EWXhuUBC2Shnf+DX0antecpAwSP8w==", - "dev": true, - "engines": { - "node": ">=10" - } - }, - "node_modules/yargs/node_modules/yargs-parser": { - "version": "21.1.1", - "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz", - "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==", - "dev": true, - "engines": { - "node": ">=12" - } - }, - "node_modules/yocto-queue": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-1.0.0.tgz", - "integrity": "sha512-9bnSc/HEW2uRy67wc+T8UwauLuPJVn28jb+GtJY16iiKWyvmYJRXVT4UamsAEGQfPohgr2q4Tq0sQbQlxTfi1g==", - "dev": true, - "engines": { - "node": ">=12.20" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/zod": { - "version": "3.22.4", - "resolved": "https://registry.npmjs.org/zod/-/zod-3.22.4.tgz", - "integrity": "sha512-iC+8Io04lddc+mVqQ9AZ7OQ2MrUKGN+oIQyq1vemgt46jwCwLfhq7/pwnBnNXXXZb8VTVLKwp9EDkx+ryxIWmg==", - "dev": true, - "funding": { - "url": "https://github.com/sponsors/colinhacks" - } - }, - "node_modules/zwitch": { - "version": "1.0.5", - "resolved": "https://registry.npmjs.org/zwitch/-/zwitch-1.0.5.tgz", - "integrity": "sha512-V50KMwwzqJV0NpZIZFwfOD5/lyny3WlSzRiXgA0G7VUnRlqttta1L6UQIHzd6EuBY/cHGfwTIck7w1yH6Q5zUw==", - "dev": true, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - } - } -} diff --git a/website/package.json b/website/package.json deleted file mode 100644 index 0a7354048..000000000 --- a/website/package.json +++ /dev/null @@ -1,30 +0,0 @@ -{ - "name": "boundary-docs", - "description": "Documentation website for Boundary", - "version": "1.0.0", - "author": "HashiCorp", - "engines": { - "node": ">=22.17.1", - "npm": ">=9.6.7" - }, - "devDependencies": { - "@hashicorp/platform-cli": "^2.6.0", - "@hashicorp/platform-content-conformance": "^0.0.10", - "husky": "4.3.8", - "next": "^14.1.0", - "prettier": "2.2.1" - }, - "husky": { - "hooks": { - "pre-commit": "next-hashicorp precommit" - } - }, - "scripts": { - "build": "./scripts/website-build.sh", - "format": "next-hashicorp format", - "generate:readme": "next-hashicorp markdown-blocks README.md", - "lint": "next-hashicorp lint", - "start": "./scripts/website-start.sh", - "content-check": "hc-content --config base-docs" - } -} diff --git a/website/prettier.config.js b/website/prettier.config.js deleted file mode 100644 index b3ac14ab0..000000000 --- a/website/prettier.config.js +++ /dev/null @@ -1,3 +0,0 @@ -module.exports = { - ...require('@hashicorp/platform-cli/config/prettier.config'), -} diff --git a/website/public/_favicon.ico b/website/public/_favicon.ico deleted file mode 100644 index 91edaa415..000000000 Binary files a/website/public/_favicon.ico and /dev/null differ diff --git a/website/public/data/vault/boundary-controller-policy.hcl b/website/public/data/vault/boundary-controller-policy.hcl deleted file mode 100644 index 41c513c13..000000000 --- a/website/public/data/vault/boundary-controller-policy.hcl +++ /dev/null @@ -1,40 +0,0 @@ -# Copyright IBM Corp. 2020, 2025 -# SPDX-License-Identifier: BUSL-1.1 - -# Allow Boundary to read and verify the properties of the token. This is -# provided by the "default" policy. -path "auth/token/lookup-self" { - capabilities = ["read"] -} - -# Allow Boundary to renew the token. This is provided by the "default" -# policy. -path "auth/token/renew-self" { - capabilities = ["update"] -} - -# Allow Boundary to revoke the token when the credential store is updated -# to use a new token or the credential store is deleted. This is provided -# by the "default" policy. -path "auth/token/revoke-self" { - capabilities = ["update"] -} - -# Allow Boundary to renew the credentials in active sessions. This is -# provided by the "default" policy. -path "sys/leases/renew" { - capabilities = ["update"] -} - -# Allow Boundary to revoke the credentials issued for a session when the -# session is terminated. -path "sys/leases/revoke" { - capabilities = ["update"] -} - -# Allow Boundary to read and verify the token's capabilities for each Vault -# path used by the credential store. This is provided by the "default" -# policy. -path "sys/capabilities-self" { - capabilities = ["update"] -} diff --git a/website/public/files/press-kit.zip b/website/public/files/press-kit.zip deleted file mode 100644 index e037e16ab..000000000 Binary files a/website/public/files/press-kit.zip and /dev/null differ diff --git a/website/public/ie-warning.js b/website/public/ie-warning.js deleted file mode 100644 index dcb6b8053..000000000 --- a/website/public/ie-warning.js +++ /dev/null @@ -1,36 +0,0 @@ -/** - * Copyright IBM Corp. 2020, 2025 - * SPDX-License-Identifier: BUSL-1.1 - */ - -!(function () { - 'use strict' - - const el = document.createElement('div'); - el.innerHTML = - '
' + - '

' + - ' Internet Explorer is no longer supported.' + - ' ' + - ' Learn more.' + - ' ' + - '

' + - '
' + - ''; - - document.body.insertBefore(el, document.body.childNodes[0]); -})(); diff --git a/website/public/img/api-pagination/pagination-workflow.png b/website/public/img/api-pagination/pagination-workflow.png deleted file mode 100644 index 8ef4c932e..000000000 Binary files a/website/public/img/api-pagination/pagination-workflow.png and /dev/null differ diff --git a/website/public/img/architecture-overview.png b/website/public/img/architecture-overview.png deleted file mode 100644 index fd9f2a307..000000000 Binary files a/website/public/img/architecture-overview.png and /dev/null differ diff --git a/website/public/img/boundary-core-workflow_dark.png b/website/public/img/boundary-core-workflow_dark.png deleted file mode 100644 index 405048314..000000000 Binary files a/website/public/img/boundary-core-workflow_dark.png and /dev/null differ diff --git a/website/public/img/boundary-core-workflow_light.png b/website/public/img/boundary-core-workflow_light.png deleted file mode 100644 index 61e76fb92..000000000 Binary files a/website/public/img/boundary-core-workflow_light.png and /dev/null differ diff --git a/website/public/img/boundary-domain-model-overview.jpg b/website/public/img/boundary-domain-model-overview.jpg deleted file mode 100644 index ce41a22e5..000000000 Binary files a/website/public/img/boundary-domain-model-overview.jpg and /dev/null differ diff --git a/website/public/img/boundary-network_dark.png b/website/public/img/boundary-network_dark.png deleted file mode 100644 index a3778c473..000000000 Binary files a/website/public/img/boundary-network_dark.png and /dev/null differ diff --git a/website/public/img/boundary-network_light.png b/website/public/img/boundary-network_light.png deleted file mode 100644 index 683e5eab4..000000000 Binary files a/website/public/img/boundary-network_light.png and /dev/null differ diff --git a/website/public/img/boundary.png b/website/public/img/boundary.png deleted file mode 100644 index 23597cdb5..000000000 Binary files a/website/public/img/boundary.png and /dev/null differ diff --git a/website/public/img/brokered-creds-ui.png b/website/public/img/brokered-creds-ui.png deleted file mode 100644 index 13d76addd..000000000 Binary files a/website/public/img/brokered-creds-ui.png and /dev/null differ diff --git a/website/public/img/component-relationship.png b/website/public/img/component-relationship.png deleted file mode 100644 index 2f8de5c4e..000000000 Binary files a/website/public/img/component-relationship.png and /dev/null differ diff --git a/website/public/img/concepts-multihop.png b/website/public/img/concepts-multihop.png deleted file mode 100644 index c7d7c4a5c..000000000 Binary files a/website/public/img/concepts-multihop.png and /dev/null differ diff --git a/website/public/img/credential-brokering.png b/website/public/img/credential-brokering.png deleted file mode 100644 index 27e3dce9f..000000000 Binary files a/website/public/img/credential-brokering.png and /dev/null differ diff --git a/website/public/img/credential-injection.png b/website/public/img/credential-injection.png deleted file mode 100644 index 7b5fcf5c9..000000000 Binary files a/website/public/img/credential-injection.png and /dev/null differ diff --git a/website/public/img/cta-bg.svg b/website/public/img/cta-bg.svg deleted file mode 100644 index 58553e526..000000000 --- a/website/public/img/cta-bg.svg +++ /dev/null @@ -1,22 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/website/public/img/desktop/macos/boundary-desktop-active.png b/website/public/img/desktop/macos/boundary-desktop-active.png deleted file mode 100644 index 509b634ba..000000000 Binary files a/website/public/img/desktop/macos/boundary-desktop-active.png and /dev/null differ diff --git a/website/public/img/desktop/macos/boundary-desktop-connect.png b/website/public/img/desktop/macos/boundary-desktop-connect.png deleted file mode 100644 index 252e18f61..000000000 Binary files a/website/public/img/desktop/macos/boundary-desktop-connect.png and /dev/null differ diff --git a/website/public/img/desktop/macos/boundary-desktop-drag-to-install.png b/website/public/img/desktop/macos/boundary-desktop-drag-to-install.png deleted file mode 100644 index a4b614c92..000000000 Binary files a/website/public/img/desktop/macos/boundary-desktop-drag-to-install.png and /dev/null differ diff --git a/website/public/img/desktop/macos/boundary-desktop-landing.png b/website/public/img/desktop/macos/boundary-desktop-landing.png deleted file mode 100644 index bd8fb5d11..000000000 Binary files a/website/public/img/desktop/macos/boundary-desktop-landing.png and /dev/null differ diff --git a/website/public/img/desktop/macos/boundary-desktop-login.png b/website/public/img/desktop/macos/boundary-desktop-login.png deleted file mode 100644 index 69c71f3ad..000000000 Binary files a/website/public/img/desktop/macos/boundary-desktop-login.png and /dev/null differ diff --git a/website/public/img/desktop/macos/boundary-desktop-open.png b/website/public/img/desktop/macos/boundary-desktop-open.png deleted file mode 100644 index 84974e140..000000000 Binary files a/website/public/img/desktop/macos/boundary-desktop-open.png and /dev/null differ diff --git a/website/public/img/desktop/macos/boundary-desktop-origin.png b/website/public/img/desktop/macos/boundary-desktop-origin.png deleted file mode 100644 index 42e9cb39b..000000000 Binary files a/website/public/img/desktop/macos/boundary-desktop-origin.png and /dev/null differ diff --git a/website/public/img/desktop/macos/boundary-desktop-pending.png b/website/public/img/desktop/macos/boundary-desktop-pending.png deleted file mode 100644 index 45c62b9b7..000000000 Binary files a/website/public/img/desktop/macos/boundary-desktop-pending.png and /dev/null differ diff --git a/website/public/img/desktop/macos/boundary-desktop-terminated.png b/website/public/img/desktop/macos/boundary-desktop-terminated.png deleted file mode 100644 index 4e437575d..000000000 Binary files a/website/public/img/desktop/macos/boundary-desktop-terminated.png and /dev/null differ diff --git a/website/public/img/desktop/windows/boundary-desktop-active.png b/website/public/img/desktop/windows/boundary-desktop-active.png deleted file mode 100644 index bac5c7bb4..000000000 Binary files a/website/public/img/desktop/windows/boundary-desktop-active.png and /dev/null differ diff --git a/website/public/img/desktop/windows/boundary-desktop-connect.png b/website/public/img/desktop/windows/boundary-desktop-connect.png deleted file mode 100644 index 3f9d778e2..000000000 Binary files a/website/public/img/desktop/windows/boundary-desktop-connect.png and /dev/null differ diff --git a/website/public/img/desktop/windows/boundary-desktop-landing.png b/website/public/img/desktop/windows/boundary-desktop-landing.png deleted file mode 100644 index 7ec1df305..000000000 Binary files a/website/public/img/desktop/windows/boundary-desktop-landing.png and /dev/null differ diff --git a/website/public/img/desktop/windows/boundary-desktop-login.png b/website/public/img/desktop/windows/boundary-desktop-login.png deleted file mode 100644 index 1c65552e2..000000000 Binary files a/website/public/img/desktop/windows/boundary-desktop-login.png and /dev/null differ diff --git a/website/public/img/desktop/windows/boundary-desktop-open.png b/website/public/img/desktop/windows/boundary-desktop-open.png deleted file mode 100644 index 077e518f8..000000000 Binary files a/website/public/img/desktop/windows/boundary-desktop-open.png and /dev/null differ diff --git a/website/public/img/desktop/windows/boundary-desktop-origin.png b/website/public/img/desktop/windows/boundary-desktop-origin.png deleted file mode 100644 index f30bf22fc..000000000 Binary files a/website/public/img/desktop/windows/boundary-desktop-origin.png and /dev/null differ diff --git a/website/public/img/desktop/windows/boundary-desktop-pending.png b/website/public/img/desktop/windows/boundary-desktop-pending.png deleted file mode 100644 index f9c546dcf..000000000 Binary files a/website/public/img/desktop/windows/boundary-desktop-pending.png and /dev/null differ diff --git a/website/public/img/desktop/windows/boundary-desktop-terminated.png b/website/public/img/desktop/windows/boundary-desktop-terminated.png deleted file mode 100644 index 872313355..000000000 Binary files a/website/public/img/desktop/windows/boundary-desktop-terminated.png and /dev/null differ diff --git a/website/public/img/hcp-deploy-form.png b/website/public/img/hcp-deploy-form.png deleted file mode 100644 index 2565d8dad..000000000 Binary files a/website/public/img/hcp-deploy-form.png and /dev/null differ diff --git a/website/public/img/hero-pattern.svg b/website/public/img/hero-pattern.svg deleted file mode 100644 index 0f266be7b..000000000 --- a/website/public/img/hero-pattern.svg +++ /dev/null @@ -1,56 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/website/public/img/how-boundary-works_dark.png b/website/public/img/how-boundary-works_dark.png deleted file mode 100644 index 1d11c8e97..000000000 Binary files a/website/public/img/how-boundary-works_dark.png and /dev/null differ diff --git a/website/public/img/how-boundary-works_light.png b/website/public/img/how-boundary-works_light.png deleted file mode 100644 index d7ab7a354..000000000 Binary files a/website/public/img/how-boundary-works_light.png and /dev/null differ diff --git a/website/public/img/iam-example-structure.png b/website/public/img/iam-example-structure.png deleted file mode 100644 index 5c260a90c..000000000 Binary files a/website/public/img/iam-example-structure.png and /dev/null differ diff --git a/website/public/img/inject-creds.png b/website/public/img/inject-creds.png deleted file mode 100644 index 17242da2b..000000000 Binary files a/website/public/img/inject-creds.png and /dev/null differ diff --git a/website/public/img/login-dev-mode.png b/website/public/img/login-dev-mode.png deleted file mode 100644 index 44756f759..000000000 Binary files a/website/public/img/login-dev-mode.png and /dev/null differ diff --git a/website/public/img/manage-id-acct-defined.png b/website/public/img/manage-id-acct-defined.png deleted file mode 100644 index 086fd9b3e..000000000 Binary files a/website/public/img/manage-id-acct-defined.png and /dev/null differ diff --git a/website/public/img/manage-id-acct-settings.png b/website/public/img/manage-id-acct-settings.png deleted file mode 100644 index 432a66bd5..000000000 Binary files a/website/public/img/manage-id-acct-settings.png and /dev/null differ diff --git a/website/public/img/manage-id-acct-undefined.png b/website/public/img/manage-id-acct-undefined.png deleted file mode 100644 index 378adb7c7..000000000 Binary files a/website/public/img/manage-id-acct-undefined.png and /dev/null differ diff --git a/website/public/img/manage-id-auth-method-defined.png b/website/public/img/manage-id-auth-method-defined.png deleted file mode 100644 index 7f12fa2ea..000000000 Binary files a/website/public/img/manage-id-auth-method-defined.png and /dev/null differ diff --git a/website/public/img/manage-id-auth-method-setting.png b/website/public/img/manage-id-auth-method-setting.png deleted file mode 100644 index 78878b1c0..000000000 Binary files a/website/public/img/manage-id-auth-method-setting.png and /dev/null differ diff --git a/website/public/img/manage-id-auth-method-undefined.png b/website/public/img/manage-id-auth-method-undefined.png deleted file mode 100644 index 1c0fee267..000000000 Binary files a/website/public/img/manage-id-auth-method-undefined.png and /dev/null differ diff --git a/website/public/img/manage-id-login.png b/website/public/img/manage-id-login.png deleted file mode 100644 index ba8e93ce1..000000000 Binary files a/website/public/img/manage-id-login.png and /dev/null differ diff --git a/website/public/img/manage-id-user-defined.png b/website/public/img/manage-id-user-defined.png deleted file mode 100644 index 3f75becfc..000000000 Binary files a/website/public/img/manage-id-user-defined.png and /dev/null differ diff --git a/website/public/img/manage-id-user-settings.png b/website/public/img/manage-id-user-settings.png deleted file mode 100644 index 49ef6a33b..000000000 Binary files a/website/public/img/manage-id-user-settings.png and /dev/null differ diff --git a/website/public/img/manage-id-user-undefined.png b/website/public/img/manage-id-user-undefined.png deleted file mode 100644 index 94dec9eee..000000000 Binary files a/website/public/img/manage-id-user-undefined.png and /dev/null differ diff --git a/website/public/img/manage-scopes-org-defined.png b/website/public/img/manage-scopes-org-defined.png deleted file mode 100644 index 4e9873072..000000000 Binary files a/website/public/img/manage-scopes-org-defined.png and /dev/null differ diff --git a/website/public/img/manage-scopes-org-settings.png b/website/public/img/manage-scopes-org-settings.png deleted file mode 100644 index dc73f9bb8..000000000 Binary files a/website/public/img/manage-scopes-org-settings.png and /dev/null differ diff --git a/website/public/img/manage-scopes-org-undefined.png b/website/public/img/manage-scopes-org-undefined.png deleted file mode 100644 index da255ee1a..000000000 Binary files a/website/public/img/manage-scopes-org-undefined.png and /dev/null differ diff --git a/website/public/img/manage-scopes-project-defined.png b/website/public/img/manage-scopes-project-defined.png deleted file mode 100644 index 2e6c0f4ee..000000000 Binary files a/website/public/img/manage-scopes-project-defined.png and /dev/null differ diff --git a/website/public/img/manage-scopes-project-settings.png b/website/public/img/manage-scopes-project-settings.png deleted file mode 100644 index 6ead3d9fb..000000000 Binary files a/website/public/img/manage-scopes-project-settings.png and /dev/null differ diff --git a/website/public/img/manage-scopes-project-undefined.png b/website/public/img/manage-scopes-project-undefined.png deleted file mode 100644 index 6dcf20b85..000000000 Binary files a/website/public/img/manage-scopes-project-undefined.png and /dev/null differ diff --git a/website/public/img/manage-targets-host-undefined.png b/website/public/img/manage-targets-host-undefined.png deleted file mode 100644 index f472f98ee..000000000 Binary files a/website/public/img/manage-targets-host-undefined.png and /dev/null differ diff --git a/website/public/img/manage-targets-new-host-2.png b/website/public/img/manage-targets-new-host-2.png deleted file mode 100644 index 94dd2452c..000000000 Binary files a/website/public/img/manage-targets-new-host-2.png and /dev/null differ diff --git a/website/public/img/manage-targets-new-host-defined.png b/website/public/img/manage-targets-new-host-defined.png deleted file mode 100644 index 682aaa4eb..000000000 Binary files a/website/public/img/manage-targets-new-host-defined.png and /dev/null differ diff --git a/website/public/img/manage-targets-new-host-set-defined.png b/website/public/img/manage-targets-new-host-set-defined.png deleted file mode 100644 index dd0f0a55e..000000000 Binary files a/website/public/img/manage-targets-new-host-set-defined.png and /dev/null differ diff --git a/website/public/img/manage-targets-new-host-set-settings.png b/website/public/img/manage-targets-new-host-set-settings.png deleted file mode 100644 index 2cc390e7e..000000000 Binary files a/website/public/img/manage-targets-new-host-set-settings.png and /dev/null differ diff --git a/website/public/img/manage-targets-new-host-set-undefined.png b/website/public/img/manage-targets-new-host-set-undefined.png deleted file mode 100644 index c3829ee79..000000000 Binary files a/website/public/img/manage-targets-new-host-set-undefined.png and /dev/null differ diff --git a/website/public/img/manage-targets-new-host.png b/website/public/img/manage-targets-new-host.png deleted file mode 100644 index f87bc7516..000000000 Binary files a/website/public/img/manage-targets-new-host.png and /dev/null differ diff --git a/website/public/img/manage-targets-new-target-defined.png b/website/public/img/manage-targets-new-target-defined.png deleted file mode 100644 index 79293fca5..000000000 Binary files a/website/public/img/manage-targets-new-target-defined.png and /dev/null differ diff --git a/website/public/img/manage-targets-new-target-project.png b/website/public/img/manage-targets-new-target-project.png deleted file mode 100644 index 2179c21d8..000000000 Binary files a/website/public/img/manage-targets-new-target-project.png and /dev/null differ diff --git a/website/public/img/manage-targets-new-target-settings.png b/website/public/img/manage-targets-new-target-settings.png deleted file mode 100644 index 677fd9e89..000000000 Binary files a/website/public/img/manage-targets-new-target-settings.png and /dev/null differ diff --git a/website/public/img/manage-targets-new-target-undefined.png b/website/public/img/manage-targets-new-target-undefined.png deleted file mode 100644 index c3bf1ed93..000000000 Binary files a/website/public/img/manage-targets-new-target-undefined.png and /dev/null differ diff --git a/website/public/img/multi-hop-workers.png b/website/public/img/multi-hop-workers.png deleted file mode 100644 index a8a12f699..000000000 Binary files a/website/public/img/multi-hop-workers.png and /dev/null differ diff --git a/website/public/img/og-image.png b/website/public/img/og-image.png deleted file mode 100644 index e85154cf6..000000000 Binary files a/website/public/img/og-image.png and /dev/null differ diff --git a/website/public/img/quick-start-targets.png b/website/public/img/quick-start-targets.png deleted file mode 100644 index 997656c6f..000000000 Binary files a/website/public/img/quick-start-targets.png and /dev/null differ diff --git a/website/public/img/security-model/boundary-architecture.png b/website/public/img/security-model/boundary-architecture.png deleted file mode 100644 index 18b122702..000000000 Binary files a/website/public/img/security-model/boundary-architecture.png and /dev/null differ diff --git a/website/public/img/security-model/data-at-rest.png b/website/public/img/security-model/data-at-rest.png deleted file mode 100644 index 1bdd5c196..000000000 Binary files a/website/public/img/security-model/data-at-rest.png and /dev/null differ diff --git a/website/public/img/security-model/data-in-transit.png b/website/public/img/security-model/data-in-transit.png deleted file mode 100644 index 676005bec..000000000 Binary files a/website/public/img/security-model/data-in-transit.png and /dev/null differ diff --git a/website/public/img/setup-wizard-address-target.png b/website/public/img/setup-wizard-address-target.png deleted file mode 100644 index 4ce2d374b..000000000 Binary files a/website/public/img/setup-wizard-address-target.png and /dev/null differ diff --git a/website/public/img/setup-wizard.png b/website/public/img/setup-wizard.png deleted file mode 100644 index 4cba252a7..000000000 Binary files a/website/public/img/setup-wizard.png and /dev/null differ diff --git a/website/public/img/single-region.png b/website/public/img/single-region.png deleted file mode 100644 index c5452873c..000000000 Binary files a/website/public/img/single-region.png and /dev/null differ diff --git a/website/public/img/ui/add-role-grant_dark.png b/website/public/img/ui/add-role-grant_dark.png deleted file mode 100644 index b1f1328b1..000000000 Binary files a/website/public/img/ui/add-role-grant_dark.png and /dev/null differ diff --git a/website/public/img/ui/add-role-grant_light.png b/website/public/img/ui/add-role-grant_light.png deleted file mode 100644 index 468cdf709..000000000 Binary files a/website/public/img/ui/add-role-grant_light.png and /dev/null differ diff --git a/website/public/img/ui/add-role-principal_dark.png b/website/public/img/ui/add-role-principal_dark.png deleted file mode 100644 index f3a2a05ab..000000000 Binary files a/website/public/img/ui/add-role-principal_dark.png and /dev/null differ diff --git a/website/public/img/ui/add-role-principal_light.png b/website/public/img/ui/add-role-principal_light.png deleted file mode 100644 index 9b4ccb87b..000000000 Binary files a/website/public/img/ui/add-role-principal_light.png and /dev/null differ diff --git a/website/public/img/ui/add-role-scopes_dark.png b/website/public/img/ui/add-role-scopes_dark.png deleted file mode 100644 index bc69074e7..000000000 Binary files a/website/public/img/ui/add-role-scopes_dark.png and /dev/null differ diff --git a/website/public/img/ui/add-role-scopes_light.png b/website/public/img/ui/add-role-scopes_light.png deleted file mode 100644 index 84fcd5cec..000000000 Binary files a/website/public/img/ui/add-role-scopes_light.png and /dev/null differ diff --git a/website/public/img/ui/enable-session-recording_dark.png b/website/public/img/ui/enable-session-recording_dark.png deleted file mode 100644 index 5a27b7494..000000000 Binary files a/website/public/img/ui/enable-session-recording_dark.png and /dev/null differ diff --git a/website/public/img/ui/enable-session-recording_light.png b/website/public/img/ui/enable-session-recording_light.png deleted file mode 100644 index 01094b63e..000000000 Binary files a/website/public/img/ui/enable-session-recording_light.png and /dev/null differ diff --git a/website/public/img/ui/multi-hop-egress-filter_dark.png b/website/public/img/ui/multi-hop-egress-filter_dark.png deleted file mode 100644 index 7887e7822..000000000 Binary files a/website/public/img/ui/multi-hop-egress-filter_dark.png and /dev/null differ diff --git a/website/public/img/ui/multi-hop-egress-filter_light.png b/website/public/img/ui/multi-hop-egress-filter_light.png deleted file mode 100644 index 0c60a55ef..000000000 Binary files a/website/public/img/ui/multi-hop-egress-filter_light.png and /dev/null differ diff --git a/website/public/img/ui/new-role_dark.png b/website/public/img/ui/new-role_dark.png deleted file mode 100644 index 4a7ff6150..000000000 Binary files a/website/public/img/ui/new-role_dark.png and /dev/null differ diff --git a/website/public/img/ui/new-role_light.png b/website/public/img/ui/new-role_light.png deleted file mode 100644 index 76212b6e2..000000000 Binary files a/website/public/img/ui/new-role_light.png and /dev/null differ diff --git a/website/public/img/ui/session-rec-worker-filter_dark.png b/website/public/img/ui/session-rec-worker-filter_dark.png deleted file mode 100644 index 58bccbded..000000000 Binary files a/website/public/img/ui/session-rec-worker-filter_dark.png and /dev/null differ diff --git a/website/public/img/ui/session-rec-worker-filter_light.png b/website/public/img/ui/session-rec-worker-filter_light.png deleted file mode 100644 index ed95d86cf..000000000 Binary files a/website/public/img/ui/session-rec-worker-filter_light.png and /dev/null differ diff --git a/website/public/img/ui/target-ingress-worker-filter_dark.png b/website/public/img/ui/target-ingress-worker-filter_dark.png deleted file mode 100644 index 855867d2a..000000000 Binary files a/website/public/img/ui/target-ingress-worker-filter_dark.png and /dev/null differ diff --git a/website/public/img/ui/target-ingress-worker-filter_light.png b/website/public/img/ui/target-ingress-worker-filter_light.png deleted file mode 100644 index 630898d34..000000000 Binary files a/website/public/img/ui/target-ingress-worker-filter_light.png and /dev/null differ diff --git a/website/public/img/ui/vault-worker-filter_dark.png b/website/public/img/ui/vault-worker-filter_dark.png deleted file mode 100644 index f910cb8db..000000000 Binary files a/website/public/img/ui/vault-worker-filter_dark.png and /dev/null differ diff --git a/website/public/img/ui/vault-worker-filter_light.png b/website/public/img/ui/vault-worker-filter_light.png deleted file mode 100644 index 871076729..000000000 Binary files a/website/public/img/ui/vault-worker-filter_light.png and /dev/null differ diff --git a/website/public/img/ui/worker-tags-api_dark.png b/website/public/img/ui/worker-tags-api_dark.png deleted file mode 100644 index 2c95e4560..000000000 Binary files a/website/public/img/ui/worker-tags-api_dark.png and /dev/null differ diff --git a/website/public/img/ui/worker-tags-api_light.png b/website/public/img/ui/worker-tags-api_light.png deleted file mode 100644 index 23aab991e..000000000 Binary files a/website/public/img/ui/worker-tags-api_light.png and /dev/null differ diff --git a/website/public/img/ui/worker-tags-config_dark.png b/website/public/img/ui/worker-tags-config_dark.png deleted file mode 100644 index efc592545..000000000 Binary files a/website/public/img/ui/worker-tags-config_dark.png and /dev/null differ diff --git a/website/public/img/ui/worker-tags-config_light.png b/website/public/img/ui/worker-tags-config_light.png deleted file mode 100644 index 4fe97e7ef..000000000 Binary files a/website/public/img/ui/worker-tags-config_light.png and /dev/null differ diff --git a/website/public/img/worker-deployment.png b/website/public/img/worker-deployment.png deleted file mode 100644 index 68d890f62..000000000 Binary files a/website/public/img/worker-deployment.png and /dev/null differ diff --git a/website/public/img/worker-tags.png b/website/public/img/worker-tags.png deleted file mode 100644 index b73e4b48f..000000000 Binary files a/website/public/img/worker-tags.png and /dev/null differ diff --git a/website/redirects.js b/website/redirects.js deleted file mode 100644 index 4e36c7573..000000000 --- a/website/redirects.js +++ /dev/null @@ -1,3290 +0,0 @@ -/** - * Copyright IBM Corp. 2020, 2025 - * SPDX-License-Identifier: BUSL-1.1 - * - * Example redirect: - * - * { - * source: '/vault/docs/some/path', - * destination: '/vault/docs/some/other/path', - * permanent: true - * } - * - */ - -module.exports = [ - { - source: '/boundary/docs/overview/what-is-boundary', - destination: '/boundary/docs/what-is-boundary', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:11|12|13|14|15|16|17|18)\\.x)/what-is-boundary', - destination: '/boundary/docs/:version/overview/what-is-boundary', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/overview/what-is-boundary', - destination: '/boundary/docs/:version/what-is-boundary', - permanent: true, - }, - { - source: '/boundary/docs/concepts', - destination: '/boundary/docs/what-is-boundary', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/concepts', - destination: '/boundary/docs/:version/what-is-boundary', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:11|12|13|14|15)\\.x)/concepts/aliases', - destination: '/boundary/docs/:version/overview/what-is-boundary', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:11|12|13)\\.x)/concepts/connection-workflows/:slug*', - destination: '/boundary/docs/:version/overview/what-is-boundary', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:11|12|13|14|15|16|17)\\.x)/concepts/transparent-sessions', - destination: '/boundary/docs/:version/overview/what-is-boundary', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:11|12|13)\\.x)/concepts/workers', - destination: '/boundary/docs/:version/overview/what-is-boundary', - permanent: true, - }, - { - source: '/boundary/docs/roadmap', - destination: '/boundary/docs/what-is-boundary', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:11|12|13|14|15|16|17|18)\\.x)/roadmap', - destination: '/boundary/docs/:version/overview/what-is-boundary', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/roadmap', - destination: '/boundary/docs/:version/what-is-boundary', - permanent: true, - }, - { - source: '/boundary/docs/oss', - destination: '/boundary/docs/what-is-boundary', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/oss', - destination: '/boundary/docs/:version/overview/what-is-boundary', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/oss', - destination: '/boundary/docs/:version/what-is-boundary', - permanent: true, - }, - { - source: '/boundary/docs/community', - destination: '/boundary/docs/what-is-boundary', - permanent: true, - }, - { - source: '/boundary/docs/use-cases', - destination: '/boundary/docs/overview/use-cases', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:11|12|13|14|15|16|17|18|19)\\.x)/use-cases', - destination: '/boundary/docs/:version/overview/use-cases', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:10)\\.x)/overview/use-cases', - destination: '/boundary/docs/:version/use-cases', - permanent: true, - }, - { - source: '/boundary/docs/overview/vs/other-software', - destination: '/boundary/docs/overview/use-cases', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/overview/vs/other-software', - destination: '/boundary/docs/:version/overview/use-cases', - permanent: true, - }, - { - source: '/boundary/docs/overview/vs/zero-trust', - destination: '/boundary/docs/overview/zero-trust', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:11|12|13|14|15|16|17|18)\\.x)/overview/zero-trust', - destination: '/boundary/docs/:version/overview/vs/zero-trust', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/overview/vs/zero-trust', - destination: '/boundary/docs/:version/overview/zero-trust', - permanent: true, - }, - { - source: '/boundary/docs/overview/vs/bastion-hosts', - destination: '/boundary/docs/overview/bastion-hosts', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/overview/vs/bastion-hosts', - destination: '/boundary/docs/:version/overview/bastion-hosts', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:11|12|13|14|15|16|17|18)\\.x)/overview/bastion-hosts', - destination: '/boundary/docs/:version/overview/vs/bastion-hosts', - permanent: true, - }, - { - source: '/boundary/docs/overview/vs/vpn', - destination: '/boundary/docs/overview/vpn', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:11|12|13|14|15|16|17|18)\\.x)/overview/vpn', - destination: '/boundary/docs/:version/overview/vs/vpn', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/overview/vs/vpn', - destination: '/boundary/docs/:version/overview/vpn', - permanent: true, - }, - { - source: '/boundary/docs/overview/vs/pam', - destination: '/boundary/docs/overview/pam', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:11|12|13|14|15|16|17|18)\\.x)/overview/pam', - destination: '/boundary/docs/:version/overview/vs/pam', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/overview/vs/pam', - destination: '/boundary/docs/:version/overview/pam', - permanent: true, - }, - { - source: '/boundary/docs/overview/vs/sdp', - destination: '/boundary/docs/overview/sdp', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:11|12|13|14|15|16|17|18)\\.x)/overview/sdp', - destination: '/boundary/docs/:version/overview/vs/sdp', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/overview/vs/sdp', - destination: '/boundary/docs/:version/overview/sdp', - permanent: true, - }, - { - source: '/boundary/docs/overview/vs/secrets-management', - destination: '/boundary/docs/overview/secrets-management', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:11|12|13|14|15|16|17|18)\\.x)/overview/secrets-management', - destination: '/boundary/docs/:version/overview/vs/secrets-management', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/overview/vs/secrets-management', - destination: '/boundary/docs/:version/overview/secrets-management', - permanent: true, - }, - { - source: '/boundary/docs/troubleshoot/faq', - destination: '/boundary/docs/overview/faq', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:12|13|14|15|16|17|18)\\.x)/overview/faq', - destination: '/boundary/docs/:version/troubleshoot/faq', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/troubleshoot/faq', - destination: '/boundary/docs/:version/overview/faq', - permanent: true, - }, - { - source: '/boundary/docs/getting-started/installing', - destination: '/boundary/docs/getting-started', - permanent: true, - }, - { - source: '/boundary/docs/installing', - destination: '/boundary/docs/getting-started', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/installing', - destination: '/boundary/docs/:version/install-boundary', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/installing', - destination: '/boundary/docs/:version/install-boundary', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/installing', - destination: '/boundary/docs/:version/deploy/self-managed', - permanent: true, - }, - { - source: '/boundary/docs/getting-started/installing/production', - destination: '/boundary/docs/getting-started', - permanent: true, - }, - { - source: '/boundary/docs/oss/installing/dev-mode', - destination: '/boundary/docs/getting-started/dev-mode', - permanent: true, - }, - { - source: '/boundary/docs/getting-started/dev-mode/dev-mode', - destination: '/boundary/docs/getting-started/dev-mode', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:9|10|11|12)\\.x)/getting-started/dev-mode', - destination: '/boundary/docs/:version/oss/installing/dev-mode', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/getting-started/dev-mode', - destination: '/boundary/docs/:version/getting-started/dev-mode/dev-mode', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/oss/installing/dev-mode', - destination: '/boundary/docs/:version/getting-started/dev-mode/dev-mode', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/getting-started/dev-mode/dev-mode', - destination: '/boundary/docs/:version/getting-started/dev-mode', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/oss/installing/dev-mode', - destination: '/boundary/docs/:version/getting-started/dev-mode', - permanent: true, - }, - { - source: '/boundary/docs/oss/installing/run-and-login', - destination: '/boundary/docs/getting-started/dev-mode/run-and-login', - permanent: true, - }, - { - source: '/boundary/docs/getting-started/run-and-login', - destination: '/boundary/docs/getting-started/dev-mode/run-and-login', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:9|10|11|12)\\.x)/getting-started/dev-mode/run-and-login', - destination: '/boundary/docs/:version/oss/installing/run-and-login', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18|19)\\.x)/getting-started/run-and-login', - destination: - '/boundary/docs/:version/getting-started/dev-mode/run-and-login', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18|19)\\.x)/oss/installing/run-and-login', - destination: - '/boundary/docs/:version/getting-started/dev-mode/run-and-login', - permanent: true, - }, - { - source: '/boundary/docs/oss/installing/connect-to-dev-target', - destination: - '/boundary/docs/getting-started/dev-mode/connect-to-dev-target', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:9|10|11|12)\\.x)/getting-started/dev-mode/connect-to-dev-target', - destination: '/boundary/docs/:version/oss/installing/connect-to-dev-target', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18|)\\.x)/oss/installing/connect-to-dev-target', - destination: - '/boundary/docs/:version/getting-started/dev-mode/connect-to-dev-target', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/oss/installing/connect-to-dev-target', - destination: - '/boundary/docs/:version/getting-started/dev-mode/connect-to-dev-target', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/install-boundary/architecture/:slug*', - destination: '/boundary/docs/:version/install-boundary/:slug*', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/install-boundary/architecture/:slug*', - destination: '/boundary/docs/:version/architecture/:slug*', - permanent: true, - }, - { - source: '/boundary/docs/install-boundary/system-requirements', - destination: '/boundary/docs/architecture/system-requirements', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/architecture/system-requirements', - destination: '/boundary/docs/:version/install-boundary/system-requirements', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/installing/postgres', - destination: '/boundary/docs/:version/install-boundary/system-requirements', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/installing/postgres', - destination: - '/boundary/docs/:version/install-boundary/architecture/system-requirements', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/install-boundary/system-requirements', - destination: - '/boundary/docs/:version/install-boundary/architecture/system-requirements', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/install-boundary/system-requirements', - destination: '/boundary/docs/:version/architecture/system-requirements', - permanent: true, - }, - { - source: '/boundary/docs/install-boundary/architecture/system-requirements', - destination: '/boundary/docs/architecture/system-requirements', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/architecture/system-requirements', - destination: - '/boundary/docs/:version/install-boundary/architecture/system-requirements', - permanent: true, - }, - { - source: '/boundary/docs/oss/installing/postgres', - destination: '/boundary/docs/architecture/system-requirements', - permanent: true, - }, - { - source: '/boundary/docs/installing/postgres', - destination: '/boundary/docs/architecture/system-requirements', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/oss/installing/postgres', - destination: '/boundary/docs/:version/install-boundary/system-requirements', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/oss/installing/postgres', - destination: - '/boundary/docs/:version/install-boundary/architecture/system-requirements', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/oss/installing/postgres', - destination: '/boundary/docs/:version/architecture/system-requirements', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/installing/postgres', - destination: '/boundary/docs/:version/architecture/system-requirements', - permanent: true, - }, - { - source: '/boundary/docs/install-boundary/postgres', - destination: '/boundary/docs/architecture/system-requirements', - permanent: true, - }, - { - source: - '/boundary/docs/install-boundary/architecture/recommended-architecture', - destination: '/boundary/docs/architecture/recommended-architecture', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/architecture/recommended-architecture', - destination: - '/boundary/docs/:version/install-boundary/architecture/recommended-architecture', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/install-boundary/recommended-architecture', - destination: - '/boundary/docs/:version/install-boundary/architecture/recommended-architecture', - permanent: true, - }, - { - source: '/boundary/docs/oss/installing/reference-architectures', - destination: '/boundary/docs/architecture/recommended-architecture', - permanent: true, - }, - { - source: '/boundary/docs/installing/reference-architectures', - destination: '/boundary/docs/architecture/recommended-architecture', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:9|10|11|12)\\.x)/architecture/recommended-architecture', - destination: - '/boundary/docs/:version/oss/installing/reference-architectures', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/installing/reference-architectures', - destination: - '/boundary/docs/:version/install-boundary/recommended-architecture', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/installing/reference-architectures', - destination: - '/boundary/docs/:version/install-boundary/architecture/recommended-architecture', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/oss/installing/reference-architectures', - destination: - '/boundary/docs/:version/install-boundary/recommended-architecture', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/oss/installing/reference-architectures', - destination: - '/boundary/docs/:version/install-boundary/architecture/recommended-architecture', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/oss/installing/reference-architectures', - destination: - '/boundary/docs/:version/architecture/recommended-architecture', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/installing/reference-architectures', - destination: - '/boundary/docs/:version/architecture/recommended-architecture', - permanent: true, - }, - { - source: '/boundary/docs/install-boundary/recommended-architecture', - destination: '/boundary/docs/architecture/recommended-architecture', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/architecture/recommended-architecture', - destination: - '/boundary/docs/:version/install-boundary/recommended-architecture', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/install-boundary/recommended-architecture', - destination: - '/boundary/docs/:version/architecture/recommended-architecture', - permanent: true, - }, - { - source: '/boundary/docs/install-boundary/architecture/fault-tolerance', - destination: '/boundary/docs/architecture/fault-tolerance', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/architecture/fault-tolerance', - destination: - '/boundary/docs/:version/install-boundary/architecture/fault-tolerance', - permanent: true, - }, - { - source: '/boundary/docs/install-boundary/fault-tolerance', - destination: '/boundary/docs/architecture/fault-tolerance', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/architecture/fault-tolerance', - destination: '/boundary/docs/:version/install-boundary/fault-tolerance', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/install-boundary/fault-tolerance', - destination: - '/boundary/docs/:version/install-boundary/architecture/fault-tolerance', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/install-boundary/fault-tolerance', - destination: '/boundary/docs/:version/architecture/fault-tolerance', - permanent: true, - }, - { - source: '/boundary/docs/install-boundary/architecture/high-availability', - destination: '/boundary/docs/architecture/high-availability', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/installing/high-availability', - destination: '/boundary/docs/:version/install-boundary/high-availability', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/installing/high-availability', - destination: - '/boundary/docs/:version/install-boundary/architecture/high-availability', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/architecture/high-availability', - destination: - '/boundary/docs/:version/install-boundary/architecture/high-availability', - permanent: true, - }, - { - source: '/boundary/docs/oss/installing/high-availability', - destination: '/boundary/docs/architecture/high-availability', - permanent: true, - }, - { - source: '/boundary/docs/installing/high-availability', - destination: '/boundary/docs/architecture/high-availability', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:9|10|11|12)\\.x)/architecture/high-availability', - destination: '/boundary/docs/:version/oss/installing/high-availability', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8)\\.x)/architecture/high-availability', - destination: '/boundary/docs/:version/installing/high-availability', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/oss/installing/high-availability', - destination: '/boundary/docs/:version/architecture/high-availability', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/installing/high-availability', - destination: '/boundary/docs/:version/architecture/high-availability', - permanent: true, - }, - { - source: '/boundary/docs/install-boundary/high-availability', - destination: '/boundary/docs/architecture/high-availability', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/architecture/high-availability', - destination: '/boundary/docs/:version/install-boundary/high-availability', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/oss/installing/high-availability', - destination: '/boundary/docs/:version/install-boundary/high-availability', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/install-boundary/high-availability', - destination: - '/boundary/docs/:version/install-boundary/architecture/high-availability', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/oss/installing/high-availability', - destination: - '/boundary/docs/:version/install-boundary/architecture/high-availability', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/install-boundary/high-availability', - destination: '/boundary/docs/:version/architecture/high-availability', - permanent: true, - }, - { - source: '/boundary/docs/install-boundary', - destination: '/boundary/docs/deploy/self-managed', - permanent: true, - }, - { - source: '/boundary/docs/deploy', - destination: '/boundary/docs/getting-started', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/deploy/self-managed', - destination: '/boundary/docs/:version/install-boundary', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/install-boundary', - destination: '/boundary/docs/:version/deploy/self-managed', - permanent: true, - }, - { - source: '/boundary/docs/install-boundary/install', - destination: '/boundary/docs/deploy/self-managed/install', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17)\\.x)/deploy/self-managed/install', - destination: '/boundary/docs/:version/install-boundary/install', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/install-boundary/install', - destination: '/boundary/docs/:version/deploy/self-managed/install', - permanent: true, - }, - { - source: '/boundary/docs/install-boundary/deploy', - destination: '/boundary/docs/deploy/self-managed/install', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:18)\\.x)/deploy/self-managed/install', - destination: '/boundary/docs/:version/install-boundary/deploy', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17)\\.x)/install-boundary/deploy', - destination: '/boundary/docs/:version/install-boundary/install', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:18)\\.x)/install-boundary/install', - destination: '/boundary/docs/:version/install-boundary/deploy', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/install-boundary/deploy', - destination: '/boundary/docs/:version/deploy/self-managed/install', - permanent: true, - }, - { - source: '/boundary/docs/install-boundary/self-managed/deploy', - destination: '/boundary/docs/deploy/self-managed/install', - permanent: true, - }, - { - source: '/boundary/docs/install-boundary/configure-controllers', - destination: '/boundary/docs/deploy/self-managed/configure-controllers', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/deploy/self-managed/configure-controllers', - destination: - '/boundary/docs/:version/install-boundary/configure-controllers', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/install-boundary/configure-controllers', - destination: - '/boundary/docs/:version/deploy/self-managed/configure-controllers', - permanent: true, - }, - { - source: '/boundary/docs/install-boundary/configure-workers', - destination: '/boundary/docs/deploy/self-managed/deploy-workers', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/deploy/self-managed/deploy-workers', - destination: '/boundary/docs/:version/install-boundary/configure-workers', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/install-boundary/configure-workers', - destination: '/boundary/docs/:version/deploy/self-managed/deploy-workers', - permanent: true, - }, - { - source: '/boundary/docs/install-boundary/initialize', - destination: '/boundary/docs/deploy/self-managed/initialize', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/install-boundary/initialize', - destination: '/boundary/docs/:version/install-boundary/no-gen-resources', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/installing/no-gen-resources', - destination: '/boundary/docs/:version/install-boundary/no-gen-resources', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/install-boundary/no-gen-resources', - destination: '/boundary/docs/:version/install-boundary/initialize', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/installing/no-gen-resources', - destination: '/boundary/docs/:version/install-boundary/initialize', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/deploy/self-managed/initialize', - destination: '/boundary/docs/:version/install-boundary/initialize', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/install-boundary/initialize', - destination: '/boundary/docs/:version/deploy/self-managed/initialize', - permanent: true, - }, - { - source: '/boundary/docs/oss/installing/no-gen-resources', - destination: '/boundary/docs/deploy/self-managed/initialize', - permanent: true, - }, - { - source: '/boundary/docs/installing/no-gen-resources', - destination: '/boundary/docs/deploy/self-managed/initialize', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:9|10|11|12)\\.x)/deploy/self-managed/initialize', - destination: '/boundary/docs/:version/oss/installing/no-gen-resources', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:9|10|11|12)\\.x)/oss/installing/no-gen-resources', - destination: '/boundary/docs/:version/deploy/self-managed/initialize', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/oss/installing/no-gen-resources', - destination: '/boundary/docs/:version/install-boundary/no-gen-resources', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/oss/installing/no-gen-resources', - destination: '/boundary/docs/:version/install-boundary/initialize', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/oss/installing/no-gen-resources', - destination: '/boundary/docs/:version/deploy/self-managed/initialize', - permanent: true, - }, - { - source: '/boundary/docs/install-boundary/no-gen-resources', - destination: '/boundary/docs/deploy/self-managed/initialize', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/deploy/self-managed/initialize', - destination: '/boundary/docs/:version/install-boundary/no-gen-resources', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/install-boundary/no-gen-resources', - destination: '/boundary/docs/:version/deploy/self-managed/initialize', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/installing/no-gen-resources', - destination: '/boundary/docs/:version/deploy/self-managed/initialize', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8)\\.x)/deploy/self-managed/initialize', - destination: '/boundary/docs/:version/installing/no-gen-resources', - permanent: true, - }, - { - source: '/boundary/docs/install-boundary/install-clients', - destination: '/boundary/docs/deploy/self-managed/install-clients', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:18)\\.x)/deploy/self-managed/install-clients', - destination: '/boundary/docs/:version/install-boundary/install-clients', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17)\\.x)/deploy/self-managed/install-clients', - destination: '/boundary/docs/:version/install-boundary', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/install-boundary/install-clients', - destination: '/boundary/docs/:version/deploy/self-managed/install-clients', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/install-boundary/install-clients', - destination: '/boundary/docs/:version/install-boundary', - permanent: true, - }, - { - source: '/boundary/docs/install-boundary/self-managed/install-clients', - destination: '/boundary/docs/deploy/self-managed/install-clients', - permanent: true, - }, - { - source: '/boundary/docs/install-boundary/systemd', - destination: '/boundary/docs/deploy/self-managed/systemd', - permanent: true, - }, - { - source: '/boundary/docs/install-boundary/self-managed/systemd', - destination: '/boundary/docs/deploy/self-managed/systemd', - permanent: true, - }, - { - source: '/boundary/docs/oss/installing/systemd', - destination: '/boundary/docs/deploy/self-managed/systemd', - permanent: true, - }, - { - source: '/boundary/docs/installing/systemd', - destination: '/boundary/docs/deploy/self-managed/systemd', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/installing/systemd', - destination: '/boundary/docs/:version/install-boundary/systemd', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/oss/installing/systemd', - destination: '/boundary/docs/:version/install-boundary/systemd', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/oss/installing/systemd', - destination: '/boundary/docs/:version/deploy/self-managed/systemd', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/installing/systemd', - destination: '/boundary/docs/:version/deploy/self-managed/systemd', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/deploy/self-managed/systemd', - destination: '/boundary/docs/:version/install-boundary', - permanent: true, - }, - { - source: '/boundary/docs/oss/installing', - destination: '/boundary/docs/deploy/self-managed', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/oss/installing', - destination: '/boundary/docs/:version/install-boundary', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/oss/installing', - destination: '/boundary/docs/:version/deploy/self-managed', - permanent: true, - }, - { - source: '/boundary/docs/getting-started/connect-to-target', - destination: '/boundary/docs/hcp/get-started/connect-to-target', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:9|10|11|12|13|14|15|16|17|18|19)\\.x)/getting-started/connect-to-target', - destination: '/boundary/docs/:version/hcp/get-started/connect-to-target', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:9|10|11|12)\\.x)/hcp/get-started/connect-to-target', - destination: '/boundary/docs/:version/getting-started/connect-to-target', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8)\\.x)/targets/connections', - destination: '/boundary/docs/:version/getting-started/connect-to-target', - permanent: true, - }, - { - source: '/boundary/docs/getting-started/deploy-and-login', - destination: '/boundary/docs/hcp/get-started/deploy-and-login', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18|19)\\.x)/getting-started/deploy-and-login', - destination: '/boundary/docs/:version/hcp/get-started/deploy-and-login', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:9|10|11|12)\\.x)/hcp/get-started/deploy-and-login', - destination: '/boundary/docs/:version/getting-started/deploy-and-login', - permanent: true, - }, - { - source: '/boundary/docs/install-boundary/terraform-patterns/:slug*', - destination: '/boundary/docs/deploy/terraform-patterns/:slug*', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/install-boundary/terraform-patterns/:slug*', - destination: '/boundary/docs/:version/install-boundary', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/install-boundary/terraform-patterns/:slug*', - destination: '/boundary/docs/:version/deploy/terraform-patterns/:slug*', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/deploy/terraform-patterns/:slug*', - destination: - '/boundary/docs/:version/install-boundary/terraform-patterns/:slug*', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/deploy/terraform-patterns/:slug*', - destination: '/boundary/docs/:version/install-boundary', - permanent: true, - }, - { - source: '/boundary/docs/oss/developing/building', - destination: '/boundary/docs/developing/building', - permanent: true, - }, - { - source: '/boundary/docs/oss/developing', - destination: '/boundary/docs/developing', - permanent: true, - }, - { - source: '/boundary/docs/oss/developing/ui', - destination: '/boundary/docs/developing/ui', - permanent: true, - }, - { - source: '/boundary/docs/concepts/security/data-encryption', - destination: '/boundary/docs/secure/encryption/data-encryption', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/secure/encryption/data-encryption', - destination: '/boundary/docs/:version/concepts/security/data-encryption', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/concepts/security/data-encryption', - destination: '/boundary/docs/:version/secure/encryption/data-encryption', - permanent: true, - }, - { - source: '/boundary/docs/concepts/security', - destination: '/boundary/docs/secure/encryption/data-encryption', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/concepts/security', - destination: '/boundary/docs/:version/secure/encryption/data-encryption', - permanent: true, - }, - { - source: '/boundary/docs/concepts/security/connections-tls', - destination: '/boundary/docs/secure/encryption/connections-tls', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/secure/encryption/connections-tls', - destination: '/boundary/docs/:version/concepts/security/connections-tls', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/concepts/security/connections-tls', - destination: '/boundary/docs/:version/secure/encryption/connections-tls', - permanent: true, - }, - { - source: '/boundary/docs/oss/operations', - destination: '/boundary/docs/monitor', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:9|10|11|12)\\.x)/monitor', - destination: '/boundary/docs/:version/oss/operations', - permanent: true, - }, - { - source: '/boundary/docs/operations', - destination: '/boundary/docs/monitor', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/monitor', - destination: '/boundary/docs/:version/operations', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/operations', - destination: '/boundary/docs/:version/monitor', - permanent: true, - }, - { - source: '/boundary/docs/configuration/listener', - destination: '/boundary/docs/monitor/listeners', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/configuration/listener/:slug*', - destination: '/boundary/docs/:version/monitor/listeners/:slug*', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/monitor/listeners', - destination: '/boundary/docs/:version/configuration/listener', - permanent: true, - }, - { - source: '/boundary/docs/configuration/listener/tcp', - destination: '/boundary/docs/monitor/listeners/tcp', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/monitor/listeners/tcp', - destination: '/boundary/docs/:version/configuration/listener/tcp', - permanent: true, - }, - { - source: '/boundary/docs/configuration/listener/unix', - destination: '/boundary/docs/monitor/listeners/unix', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/monitor/listeners/unix', - destination: '/boundary/docs/:version/configuration/listener/unix', - permanent: true, - }, - { - source: '/boundary/docs/oss/operations/metrics', - destination: '/boundary/docs/monitor/metrics', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:9|10|11|12)\\.x)/monitor/metrics', - destination: '/boundary/docs/:version/oss/operations/metrics', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/oss/operations/metrics', - destination: '/boundary/docs/:version/operations/metrics', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/oss/operations/metrics', - destination: '/boundary/docs/:version/monitor/metrics', - permanent: true, - }, - { - source: '/boundary/docs/operations/metrics', - destination: '/boundary/docs/monitor/metrics', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/operations/metrics', - destination: '/boundary/docs/:version/monitor/metrics', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:8|13|14|15|16|17|18)\\.x)/monitor/metrics', - destination: '/boundary/docs/:version/operations/metrics', - permanent: true, - }, - { - source: '/boundary/docs/operations/health', - destination: '/boundary/docs/monitor/health', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:8|13|14|15|16|17|18)\\.x)/monitor/health', - destination: '/boundary/docs/:version/operations/health', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/operations/health', - destination: '/boundary/docs/:version/monitor/health', - permanent: true, - }, - { - source: '/boundary/docs/oss/operations/health', - destination: '/boundary/docs/monitor/health', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:9|10|11|12)\\.x)/monitor/health', - destination: '/boundary/docs/:version/oss/operations/health', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/oss/operations/health', - destination: '/boundary/docs/:version/operations/health', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/oss/operations/health', - destination: '/boundary/docs/:version/monitor/health', - permanent: true, - }, - { - source: '/boundary/docs/configuration/events', - destination: '/boundary/docs/monitor/events/events', - permanent: true, - }, - { - source: '/boundary/docs/monitor/events', - destination: '/boundary/docs/monitor/events/events', - permanent: true, - }, - { - source: '/boundary/docs/configuration/events/overview', - destination: '/boundary/docs/monitor/events/events', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/configuration/events', - destination: '/boundary/docs/:version/monitor/events/events', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/configuration/events/overview', - destination: '/boundary/docs/:version/monitor/events/events', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:10|11|12|13|14|15|16|17|18)\\.x)/configuration/events/overview', - destination: '/boundary/docs/:version/configuration/events', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:10|11|12|13|14|15|16|17|18)\\.x)/monitor/events/events', - destination: '/boundary/docs/:version/configuration/events', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:5|6|7|8|9)\\.x)/monitor/events/events', - destination: '/boundary/docs/:version/configuration/events/overview', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/monitor/events', - destination: '/boundary/docs/:version/monitor/events/events', - permanent: true, - }, - { - source: '/boundary/docs/concepts/filtering/events', - destination: '/boundary/docs/monitor/events/filter-events', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/monitor/events/filter-events', - destination: '/boundary/docs/:version/concepts/filtering/events', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/concepts/filtering/events', - destination: '/boundary/docs/:version/monitor/events/filter-events', - permanent: true, - }, - { - source: '/boundary/docs/configuration/events/common', - destination: '/boundary/docs/monitor/events/common', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:9|10|11|12|13|14|15|16|17|18)\\.x)/configuration/events/common-sink-parameters', - destination: '/boundary/docs/:version/configuration/events/common', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/configuration/events/common', - destination: '/boundary/docs/:version/monitor/events/common', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/monitor/events/common', - destination: '/boundary/docs/:version/configuration/events/common', - permanent: true, - }, - { - source: '/boundary/docs/configuration/events/file', - destination: '/boundary/docs/monitor/events/file', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/monitor/events/file', - destination: '/boundary/docs/:version/configuration/events/file', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:9|10|11|12|13|14|15|16|17|18)\\.x)/configuration/events/file-sink', - destination: '/boundary/docs/:version/configuration/events/file', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/configuration/events/file', - destination: '/boundary/docs/:version/monitor/events/file', - permanent: true, - }, - { - source: '/boundary/docs/configuration/events/stderr', - destination: '/boundary/docs/monitor/events/stderr', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/monitor/events/stderr', - destination: '/boundary/docs/:version/configuration/events/stderr', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/configuration/events/stderr-sink', - destination: '/boundary/docs/:version/configuration/events/stderr', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/configuration/events/stderr', - destination: '/boundary/docs/:version/monitor/events/stderr', - permanent: true, - }, - { - source: '/boundary/docs/release-notes', - destination: '/boundary/docs', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/release-notes', - destination: '/boundary/docs/:version', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13)\\.x)/release-notes/v0_14_0', - destination: '/boundary/docs/:version', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14)\\.x)/release-notes/v0_15_0', - destination: '/boundary/docs/:version', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15)\\.x)/release-notes/v0_16_0', - destination: '/boundary/docs/:version', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16)\\.x)/release-notes/v0_17_0', - destination: '/boundary/docs/:version', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17)\\.x)/release-notes/v0_18_0', - destination: '/boundary/docs/:version', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/release-notes/v0_19_0', - destination: '/boundary/docs/:version', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19)\\.x)/release-notes/v0_20_0', - destination: '/boundary/docs/:version', - permanent: true, - }, - { - source: '/boundary/docs/configuration/worker', - destination: '/boundary/docs/workers', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|10|11|12|13|14|15|16|17|18)\\.x)/workers', - destination: '/boundary/docs/:version/configuration/worker', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/configuration/worker', - destination: '/boundary/docs/:version/workers', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:9)\\.x)/workers', - destination: '/boundary/docs/:version/configuration/worker/overview', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:9)\\.x)/configuration/worker', - destination: '/boundary/docs/:version/configuration/worker/overview', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:10|11|12|13|14|15)\\.x)/configuration/worker/overview', - destination: '/boundary/docs/:version/configuration/worker', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:10|11|12|13|14|15|16|17|18)\\.x)/workers/create', - destination: '/boundary/docs/:version/configuration/worker', - permanent: true, - }, - { - source: '/boundary/docs/configuration/worker/worker-configuration', - destination: '/boundary/docs/workers/registration', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:10|11|12|13|14)\\.x)/workers/registration', - destination: '/boundary/docs/:version/configuration/worker', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/workers/registration', - destination: - '/boundary/docs/:version/configuration/worker/worker-configuration', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:9|10|11|12|13|14)\\.x)/configuration/worker/worker-configuration', - destination: '/boundary/docs/:version/configuration/worker', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:9|10|11|12|13|14|15|16|17|18)\\.x)/configuration/workers', - destination: '/boundary/docs/:version/configuration/worker', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/configuration/worker/worker-configuration', - destination: '/boundary/docs/:version/workers/registration', - permanent: true, - }, - { - source: '/boundary/docs/configuration/worker/kms-worker', - destination: '/boundary/docs/workers/registration', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/configuration/worker/kms-worker', - destination: - '/boundary/docs/:version/configuration/worker/worker-configuration', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/configuration/worker/kms-worker', - destination: '/boundary/docs/:version/workers/registration', - permanent: true, - }, - { - source: '/boundary/docs/configuration/worker/pki-worker', - destination: '/boundary/docs/workers/registration', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/configuration/worker/pki-worker', - destination: - '/boundary/docs/:version/configuration/worker/worker-configuration', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/configuration/worker/pki-worker', - destination: '/boundary/docs/:version/workers/registration', - permanent: true, - }, - { - source: '/boundary/docs/concepts/connection-workflows/multi-hop', - destination: '/boundary/docs/workers/multi-hop', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:9|10|11|12|13)\\.x)/workers/multi-hop', - destination: '/boundary/docs/:version/configuration/worker', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:14|15|16|17|18)\\.x)/workers/multi-hop', - destination: - '/boundary/docs/:version/concepts/connection-workflows/multi-hop', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/concepts/connection-workflows/multi-hop', - destination: '/boundary/docs/:version/workers/multi-hop', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:9|10|11|12|13)\\.x)/workers/multi-hop/enterprise', - destination: '/boundary/docs/:version/configuration/worker', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:9|10|11|12|13)\\.x)/workers/multi-hop/hcp', - destination: '/boundary/docs/:version/configuration/worker', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:14|15|16|17|18)\\.x)/workers/multi-hop/enterprise', - destination: - '/boundary/docs/:version/concepts/connection-workflows/multi-hop', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:14|15|16|17|18)\\.x)/workers/multi-hop/hcp', - destination: - '/boundary/docs/:version/concepts/connection-workflows/multi-hop', - permanent: true, - }, - { - source: '/boundary/docs/concepts/filtering/worker-tags', - destination: '/boundary/docs/workers/worker-tags', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/workers/worker-tags', - destination: '/boundary/docs/:version/concepts/filtering/worker-tags', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/workers/filters', - destination: '/boundary/docs/:version/concepts/filtering/worker-tags', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/concepts/filtering/worker-tags', - destination: '/boundary/docs/:version/workers/worker-tags', - permanent: true, - }, - { - source: '/boundary/docs/concepts/service-discovery', - destination: '/boundary/docs/hosts', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:8|9|10|11|12)\\.x)/hosts', - destination: '/boundary/docs/:version/concepts/service-discovery', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/concepts/service-discovery', - destination: '/boundary/docs/:version/concepts/host-discovery', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/concepts/service-discovery', - destination: '/boundary/docs/:version/hosts', - permanent: true, - }, - { - source: '/boundary/docs/concepts/host-discovery', - destination: '/boundary/docs/hosts', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/hosts', - destination: '/boundary/docs/:version/concepts/host-discovery', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/concepts/host-discovery/:slug*', - destination: '/boundary/docs/:version/hosts/:slug*', - permanent: true, - }, - { - source: '/boundary/docs/concepts/host-discovery/aws', - destination: '/boundary/docs/hosts/aws', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/hosts/aws', - destination: '/boundary/docs/:version/concepts/host-discovery/aws', - permanent: true, - }, - { - source: '/boundary/docs/concepts/host-discovery/azure', - destination: '/boundary/docs/hosts/azure', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/hosts/azure', - destination: '/boundary/docs/:version/concepts/host-discovery/azure', - permanent: true, - }, - { - source: '/boundary/docs/concepts/host-discovery/gcp', - destination: '/boundary/docs/hosts/gcp', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/hosts/gcp', - destination: '/boundary/docs/:version/concepts/host-discovery', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:8|9|10|11|12)\\.x)/hosts/gcp', - destination: '/boundary/docs/:version/concepts/service-discovery', - permanent: true, - }, - { - source: '/boundary/docs/configuration/target-aliases', - destination: '/boundary/docs/targets/configuration', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15)\\.x)/configuration/target-aliases/:slug*', - destination: '/boundary/docs/:version', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:16|17)\\.x)/configuration/target-aliases/:slug*', - destination: '/boundary/docs/:version/concepts/aliases', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17)\\.x)/targets/configuration', - destination: '/boundary/docs/:version/concepts/domain-model/targets', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:18)\\.x)/targets/configuration', - destination: '/boundary/docs/:version/configuration/target-aliases', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/configuration/target-aliases', - destination: '/boundary/docs/:version/targets/configuration', - permanent: true, - }, - { - source: '/boundary/docs/configuration/target-aliases/connect-target-alias', - destination: '/boundary/docs/targets/connections/connect-target-alias', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17)\\.x)/targets/connections/connect-target-alias', - destination: '/boundary/docs/:version/concepts/domain-model/targets', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:18)\\.x)/targets/connections/connect-target-alias', - destination: - '/boundary/docs/:version/configuration/target-aliases/connect-target-alias', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/configuration/target-aliases/connect-target-alias', - destination: - '/boundary/docs/:version/targets/connections/connect-target-alias', - permanent: true, - }, - { - source: '/boundary/docs/configuration/target-aliases/create-target-alias', - destination: '/boundary/docs/targets/configuration/create-target-alias', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17)\\.x)/targets/configuration/create-target-alias', - destination: '/boundary/docs/:version/concepts/domain-model/targets', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:18)\\.x)/targets/configuration/create-target-alias', - destination: - '/boundary/docs/:version/configuration/target-aliases/create-target-alias', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/configuration/target-aliases/create-target-alias', - destination: - '/boundary/docs/:version/targets/configuration/create-target-alias', - permanent: true, - }, - { - source: '/boundary/docs/configuration/target-aliases/transparent-sessions', - destination: - '/boundary/docs/targets/configuration/configure-transparent-sessions', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17)\\.x)/targets/configuration/configure-transparent-sessions', - destination: '/boundary/docs/:version/concepts/domain-model/targets', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:18)\\.x)/targets/configuration/configure-transparent-sessions', - destination: - '/boundary/docs/:version/configuration/target-aliases/transparent-sessions', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/configuration/target-aliases/transparent-sessions', - destination: - '/boundary/docs/:version/targets/configuration/configure-transparent-sessions', - permanent: true, - }, - { - source: '/boundary/docs/concepts/connection-workflows', - destination: '/boundary/docs/targets/connections', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13)\\.x)/targets/connections', - destination: '/boundary/docs/:version/concepts/domain-model/targets', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:14|15|16|17|18)\\.x)/targets/connections', - destination: '/boundary/docs/:version/concepts/connection-workflows', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/concepts/connection-workflows', - destination: '/boundary/docs/:version/targets/connections', - permanent: true, - }, - { - source: '/boundary/docs/concepts/connection-workflows/connect-helpers', - destination: '/boundary/docs/targets/connections/connect-helpers', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13)\\.x)/targets/connections/connect-helpers', - destination: '/boundary/docs/:version/concepts/domain-model/targets', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:14|15|16|17|18)\\.x)/targets/connections/connect-helpers', - destination: - '/boundary/docs/:version/concepts/connection-workflows/connect-helpers', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/concepts/connection-workflows/connect-helpers', - destination: '/boundary/docs/:version/targets/connections/connect-helpers', - permanent: true, - }, - { - source: '/boundary/docs/concepts/connection-workflows/exec-flag', - destination: '/boundary/docs/targets/connections/exec-flag', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13)\\.x)/targets/connections/exec-flag', - destination: '/boundary/docs/:version/concepts/domain-model/targets', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:14|15|16|17|18)\\.x)/targets/connections/exec-flag', - destination: - '/boundary/docs/:version/concepts/connection-workflows/exec-flag', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/concepts/connection-workflows/exec-flag', - destination: '/boundary/docs/:version/targets/connections/exec-flag', - permanent: true, - }, - { - source: '/boundary/docs/common-workflows/workflow-ssh-proxycommand', - destination: '/boundary/docs/targets/connections/workflow-ssh-proxycommand', - permanent: true, - }, - { - source: - '/boundary/docs/concepts/connection-workflows/workflow-ssh-proxycommand', - destination: '/boundary/docs/targets/connections/workflow-ssh-proxycommand', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13)\\.x)/targets/connections/workflow-ssh-proxycommand', - destination: '/boundary/docs/:version/concepts/domain-model/targets', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:14|15|16|17|18)\\.x)/targets/connections/workflow-ssh-proxycommand', - destination: - '/boundary/docs/:version/concepts/connection-workflows/workflow-ssh-proxycommand', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/concepts/connection-workflows/workflow-ssh-proxycommand', - destination: - '/boundary/docs/:version/targets/connections/workflow-ssh-proxycommand', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17)\\.x)/targets/connections/transparent-sessions', - destination: '/boundary/docs/:version/concepts/domain-model/targets', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:18)\\.x)/targets/connections/transparent-sessions', - destination: - '/boundary/docs/:version/configuration/target-aliases/transparent-sessions', - permanent: true, - }, - { - source: '/boundary/docs/configuration/credential-management', - destination: '/boundary/docs/credentials', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/credentials/:slug*', - destination: '/boundary/docs/:version/concepts/credential-management', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/configuration/credential-management/:slug*', - destination: '/boundary/docs/:version/credentials/:slug*', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/credentials', - destination: '/boundary/docs/:version/configuration/credential-management', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/configuration/credential-management/:slug*', - destination: '/boundary/docs/:version/concepts/credential-management', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/credentials/rdp-testing-and-compatibility-matrix', - destination: '/boundary/docs/:version/configuration/credential-management', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/credentials/rdp-testing-and-compatibility-matrix', - destination: '/boundary/docs/:version/credentials', - permanent: true, - }, - { - source: - '/boundary/docs/configuration/credential-management/configure-credential-brokering', - destination: '/boundary/docs/credentials/configure-credential-brokering', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/credentials/configure-credential-brokering', - destination: - '/boundary/docs/:version/configuration/credential-management/configure-credential-brokering', - permanent: true, - }, - { - source: - '/boundary/docs/configuration/credential-management/configure-credential-injection', - destination: '/boundary/docs/credentials/configure-credential-injection', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/credentials/configure-credential-injection', - destination: - '/boundary/docs/:version/configuration/credential-management/configure-credential-injection', - permanent: true, - }, - { - source: - '/boundary/docs/configuration/credential-management/static-cred-boundary', - destination: '/boundary/docs/credentials/static-cred-boundary', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/credentials/static-cred-boundary', - destination: - '/boundary/docs/:version/configuration/credential-management/static-cred-boundary', - permanent: true, - }, - { - source: - '/boundary/docs/configuration/credential-management/static-cred-vault', - destination: '/boundary/docs/credentials/static-cred-vault', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/credentials/static-cred-vault', - destination: - '/boundary/docs/:version/configuration/credential-management/static-cred-vault', - permanent: true, - }, - { - source: '/boundary/docs/configuration/session-recording', - destination: '/boundary/docs/session-recording', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/session-recording', - destination: '/boundary/docs/:version/configuration/session-recording', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/configuration/session-recording', - destination: '/boundary/docs/:version/session-recording', - permanent: true, - }, - { - source: '/boundary/docs/operations/session-recordings', - destination: '/boundary/docs/session-recording', - permanent: true, - }, - { - source: - '/boundary/docs/configuration/session-recording/configure-worker-storage', - destination: - '/boundary/docs/session-recording/configuration/configure-worker-storage', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15)\\.x)/configuration/session-recording/configure-worker-storage', - destination: - '/boundary/docs/:version/configuration/session-recording/create-storage-bucket', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:16|17|18)\\.x)/session-recording/configuration/configure-worker-storage', - destination: - '/boundary/docs/:version/configuration/session-recording/configure-worker-storage', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/configuration/session-recording/configure-worker-storage', - destination: - '/boundary/docs/:version/session-recording/configuration/configure-worker-storage', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15)\\.x)/session-recording/configuration/configure-worker-storage', - destination: - '/boundary/docs/:version/configuration/session-recording/create-storage-bucket', - permanent: true, - }, - { - source: '/boundary/docs/configuration/session-recording/storage-providers', - destination: - '/boundary/docs/session-recording/configuration/storage-providers', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/configuration/session-recording/storage-providers/:slug*', - destination: - '/boundary/docs/:version/session-recording/configuration/storage-providers/:slug*', - permanent: true, - }, - { - source: - '/boundary/docs/configuration/session-recording/storage-providers/configure-s3', - destination: - '/boundary/docs/session-recording/configuration/storage-providers/configure-s3', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15)\\.x)/configuration/session-recording/storage-providers/configure-s3', - destination: '/boundary/docs/:version/configuration/session-recording', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15)\\.x)/session-recording/configuration/storage-providers/configure-s3', - destination: '/boundary/docs/:version/configuration/session-recording', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:16|17|18)\\.x)/session-recording/configuration/storage-providers/configure-s3', - destination: - '/boundary/docs/:version/configuration/session-recording/storage-providers/configure-s3', - permanent: true, - }, - { - source: - '/boundary/docs/configuration/session-recording/storage-providers/configure-minio', - destination: - '/boundary/docs/session-recording/configuration/storage-providers/configure-minio', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15)\\.x)/configuration/session-recording/storage-providers/configure-minio', - destination: '/boundary/docs/:version/configuration/session-recording', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15)\\.x)/session-recording/configuration/storage-providers/configure-minio', - destination: '/boundary/docs/:version/configuration/session-recording', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:16|17|18)\\.x)/session-recording/configuration/storage-providers/configure-minio', - destination: - '/boundary/docs/:version/configuration/session-recording/storage-providers/configure-minio', - permanent: true, - }, - { - source: - '/boundary/docs/configuration/session-recording/storage-providers/configure-s3-compliant', - destination: - '/boundary/docs/session-recording/configuration/storage-providers/configure-s3-compliant', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16)\\.x)/configuration/session-recording/storage-providers/configure-s3-compliant', - destination: '/boundary/docs/:version/configuration/session-recording', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16)\\.x)/session-recording/configuration/storage-providers/configure-s3-compliant', - destination: '/boundary/docs/:version/configuration/session-recording', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:17|18)\\.x)/session-recording/configuration/storage-providers/configure-s3-compliant', - destination: - '/boundary/docs/:version/configuration/session-recording/storage-providers/configure-s3-compliant', - permanent: true, - }, - { - source: - '/boundary/docs/configuration/session-recording/create-storage-bucket', - destination: - '/boundary/docs/session-recording/configuration/create-storage-bucket', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/session-recording/configuration/create-storage-bucket', - destination: - '/boundary/docs/:version/configuration/session-recording/create-storage-bucket', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/configuration/session-recording/create-storage-bucket', - destination: - '/boundary/docs/:version/session-recording/configuration/create-storage-bucket', - permanent: true, - }, - { - source: - '/boundary/docs/configuration/session-recording/enable-session-recording', - destination: - '/boundary/docs/session-recording/configuration/enable-session-recording', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/session-recording/configuration/enable-session-recording', - destination: - '/boundary/docs/:version/configuration/session-recording/enable-session-recording', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/configuration/session-recording/enable-session-recording', - destination: - '/boundary/docs/:version/session-recording/configuration/enable-session-recording', - permanent: true, - }, - { - source: '/boundary/docs/operations/manage-recorded-sessions', - destination: - '/boundary/docs/session-recording/configuration/manage-recorded-sessions', - permanent: true, - }, - { - source: - '/boundary/docs/operations/session-recordings/manage-recorded-sessions', - destination: - '/boundary/docs/session-recording/configuration/manage-recorded-sessions', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13)\\.x)/operations/session-recordings', - destination: '/boundary/docs/:version/operations/manage-recorded-sessions', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13)\\.x)/operations/session-recordings/manage-recorded-sessions', - destination: '/boundary/docs/:version/operations/manage-recorded-sessions', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13)\\.x)/session-recording/configuration/manage-recorded-sessions', - destination: '/boundary/docs/:version/operations/manage-recorded-sessions', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:14|15|16|17|18)\\.x)/operations/manage-recorded-sessions', - destination: '/boundary/docs/:version/operations/session-recordings', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:14|15|16|17|18)\\.x)/session-recording/configuration/manage-recorded-sessions', - destination: - '/boundary/docs/:version/operations/session-recordings/manage-recorded-sessions', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19|20)\\.x)/operations/manage-recorded-sessions', - destination: '/boundary/docs/:version/session-recording', - permanent: true, - }, - { - source: '/boundary/docs/troubleshoot/troubleshoot-recorded-sessions', - destination: - '/boundary/docs/session-recording/configuration/troubleshoot-recorded-sessions', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/session-recording/configuration/troubleshoot-recorded-sessions', - destination: - '/boundary/docs/:version/troubleshoot/troubleshoot-recorded-sessions', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/troubleshoot/troubleshoot-recorded-sessions', - destination: - '/boundary/docs/:version/session-recording/configuration/troubleshoot-recorded-sessions', - permanent: true, - }, - { - source: - '/boundary/docs/configuration/session-recording/configure-storage-policy', - destination: - '/boundary/docs/session-recording/compliance/configure-storage-policy', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/configuration/session-recording/configure-storage-policy', - destination: '/boundary/docs/:version/configuration/session-recording', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/session-recording/compliance/configure-storage-policy', - destination: '/boundary/docs/:version/configuration/session-recording', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/session-recording/compliance/configure-storage-policy', - destination: - '/boundary/docs/:version/configuration/session-recording/configure-storage-policy', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/configuration/session-recording/configure-storage-policy', - destination: - '/boundary/docs/:version/session-recording/compliance/configure-storage-policy', - permanent: true, - }, - { - source: - '/boundary/docs/configuration/session-recording/update-storage-policy', - destination: - '/boundary/docs/session-recording/compliance/update-storage-policy', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/configuration/session-recording/update-storage-policy', - destination: '/boundary/docs/:version/configuration/session-recording', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/session-recording/compliance/update-storage-policy', - destination: '/boundary/docs/:version/configuration/session-recording', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/session-recording/compliance/update-storage-policy', - destination: - '/boundary/docs/:version/configuration/session-recording/update-storage-policy', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/configuration/session-recording/update-storage-policy', - destination: - '/boundary/docs/:version/session-recording/compliance/update-storage-policy', - permanent: true, - }, - { - source: '/boundary/docs/operations/session-recordings/validate-data-store', - destination: - '/boundary/docs/session-recording/compliance/validate-data-store', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13)\\.x)/operations/session-recordings/validate-data-store', - destination: '/boundary/docs/:version/configuration/session-recording', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13)\\.x)/session-recording/compliance/validate-data-store', - destination: '/boundary/docs/:version/configuration/session-recording', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:14|15|16|17|18)\\.x)/session-recording/compliance/validate-data-store', - destination: - '/boundary/docs/:version/operations/session-recordings/validate-data-store', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/operations/session-recordings/validate-data-store', - destination: - '/boundary/docs/:version/session-recording/compliance/validate-data-store', - permanent: true, - }, - { - source: - '/boundary/docs/operations/session-recordings/validate-session-recordings', - destination: - '/boundary/docs/session-recording/compliance/validate-session-recordings', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13)\\.x)/operations/session-recordings/validate-session-recordings', - destination: '/boundary/docs/:version/configuration/session-recording', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13)\\.x)/session-recording/compliance/validate-session-recordings', - destination: '/boundary/docs/:version/configuration/session-recording', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:14|15|16|17|18)\\.x)/session-recording/compliance/validate-session-recordings', - destination: - '/boundary/docs/:version/operations/session-recordings/validate-session-recordings', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/operations/session-recordings', - destination: '/boundary/docs/:version/session-recording', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/operations/session-recordings/manage-recorded-sessions', - destination: '/boundary/docs/:version/session-recording', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/operations/session-recordings/validate-session-recordings', - destination: - '/boundary/docs/:version/session-recording/compliance/validate-session-recordings', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/session-recording/data/bsr-file-structure', - destination: '/boundary/docs/:version/concepts/auditing', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/session-recording/data/read-bsr-file', - destination: '/boundary/docs/:version/concepts/auditing', - permanent: true, - }, - { - source: '/boundary/docs/configuration/identity-access-management', - destination: '/boundary/docs/rbac', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/configuration/identity-access-management/:slug*', - destination: '/boundary/docs/:version/rbac/:slug*', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:17|18)\\.x)/rbac', - destination: - '/boundary/docs/:version/configuration/identity-access-management', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16)\\.x)/configuration/identity-access-management', - destination: '/boundary/docs/:version/concepts/security/permissions', - permanent: true, - }, - { - source: '/boundary/docs/concepts/security/permissions', - destination: '/boundary/docs/rbac', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:17|18)\\.x)/concepts/security/permissions/:slug*', - destination: '/boundary/docs/:version/rbac/:slug*', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/concepts/security/permissions/:slug*', - destination: - '/boundary/docs/:version/configuration/identity-access-management/:slug*', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16)\\.x)/rbac', - destination: '/boundary/docs/:version/concepts/security/permissions', - permanent: true, - }, - { - source: - '/boundary/docs/concepts/security/permissions/assignable-permissions', - destination: '/boundary/docs/rbac/assignable-permissions', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:8|9|10|11|12|13|14|15|16)\\.x)/rbac/assignable-permissions', - destination: - '/boundary/docs/:version/concepts/security/permissions/assignable-permissions', - permanent: true, - }, - { - source: - '/boundary/docs/configuration/identity-access-management/assignable-permissions', - destination: '/boundary/docs/rbac/assignable-permissions', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:17|18)\\.x)/rbac/assignable-permissions', - destination: - '/boundary/docs/:version/configuration/identity-access-management/assignable-permissions', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16)\\.x)/configuration/identity-access-management/assignable-permissions', - destination: - '/boundary/docs/:version/concepts/security/permissions/assignable-permissions', - permanent: true, - }, - { - source: - '/boundary/docs/concepts/security/permissions/permission-grant-formats', - destination: '/boundary/docs/rbac/permission-grant-formats', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:8|9|10|11|12|13|14|15|16)\\.x)/rbac/permission-grant-formats', - destination: - '/boundary/docs/:version/concepts/security/permissions/permission-grant-formats', - permanent: true, - }, - { - source: - '/boundary/docs/configuration/identity-access-management/permission-grant-formats', - destination: '/boundary/docs/rbac/permission-grant-formats', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16)\\.x)/configuration/identity-access-management/permission-grant-formats', - destination: - '/boundary/docs/:version/concepts/security/permissions/permission-grant-formats', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:17|18)\\.x)/rbac/permission-grant-formats', - destination: - '/boundary/docs/:version/configuration/identity-access-management/permission-grant-formats', - permanent: true, - }, - { - source: '/boundary/docs/common-workflows/manage-roles', - destination: '/boundary/docs/rbac/manage-roles', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/rbac/manage-roles', - destination: '/boundary/docs/:version/common-workflows/manage-roles', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/common-workflows/manage-roles', - destination: '/boundary/docs/:version/rbac/manage-roles', - permanent: true, - }, - { - source: '/boundary/docs/concepts/security/permissions/resource-table', - destination: '/boundary/docs/rbac/resource-table', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:8|9|10|11|12|13|14|15|16)\\.x)/rbac/resource-table', - destination: - '/boundary/docs/:version/concepts/security/permissions/resource-table', - permanent: true, - }, - { - source: - '/boundary/docs/configuration/identity-access-management/resource-table', - destination: '/boundary/docs/rbac/resource-table', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16)\\.x)/configuration/identity-access-management/resource-table', - destination: - '/boundary/docs/:version/concepts/security/permissions/resource-table', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:17|18)\\.x)/rbac/resource-table', - destination: - '/boundary/docs/:version/configuration/identity-access-management/resource-table', - permanent: true, - }, - { - source: '/boundary/docs/common-workflows/manage-users-groups', - destination: '/boundary/docs/rbac/users/manage-users-groups', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/rbac/users/manage-users-groups', - destination: '/boundary/docs/:version/common-workflows/manage-users-groups', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/common-workflows/manage-users-groups', - destination: '/boundary/docs/:version/rbac/users/manage-users-groups', - permanent: true, - }, - { - source: '/boundary/docs/concepts/filtering/oidc-managed-groups', - destination: '/boundary/docs/rbac/users/managed-groups', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:4|5|6|7|8|9|10|11|12|13|14|15)\\.x)/rbac/users/managed-groups', - destination: - '/boundary/docs/:version/concepts/filtering/oidc-managed-groups', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:4|5|6|7|8|9|10|11|12|13|14|15)\\.x)/concepts/filtering/managed-groups', - destination: - '/boundary/docs/:version/concepts/filtering/oidc-managed-groups', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:16|17|18)\\.x)/concepts/filtering/oidc-managed-groups', - destination: '/boundary/docs/:version/concepts/filtering/managed-groups', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/concepts/filtering/oidc-managed-groups', - destination: '/boundary/docs/:version/rbac/users/managed-groups', - permanent: true, - }, - { - source: '/boundary/docs/concepts/filtering/managed-groups', - destination: '/boundary/docs/rbac/users/managed-groups', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:16|17|18)\\.x)/rbac/users/managed-groups', - destination: '/boundary/docs/:version/concepts/filtering/managed-groups', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/concepts/filtering/managed-groups', - destination: '/boundary/docs/:version/rbac/users/managed-groups', - permanent: true, - }, - { - source: '/boundary/docs/integrations', - destination: '/boundary/docs', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:13|14|19)\\.x)/integrations', - destination: '/boundary/docs/:version', - permanent: true, - }, - { - source: '/boundary/docs/integrations/vault', - destination: '/boundary/docs/vault', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/integrations/vault', - destination: '/boundary/docs/:version', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/vault', - destination: '/boundary/docs/:version', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/vault', - destination: '/boundary/docs/:version/integrations/vault', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/integrations/vault', - destination: '/boundary/docs/:version/vault', - permanent: true, - }, - { - source: '/boundary/docs/api-clients/go-sdk', - destination: '/boundary/docs/go-sdk', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/go-sdk', - destination: '/boundary/docs/:version/api-clients/go-sdk', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/api-clients/go-sdk', - destination: '/boundary/docs/:version/go-sdk', - permanent: true, - }, - { - source: '/boundary/docs/api-clients/client-agent', - destination: '/boundary/docs/client-agent', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17)\\.x)/api-clients/client-agent', - destination: '/boundary/docs/:version', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:18)\\.x)/client-agent', - destination: '/boundary/docs/:version/api-clients/client-agent', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/api-clients/client-agent', - destination: '/boundary/docs/:version/client-agent', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17)\\.x)/client-agent/:slug*', - destination: '/boundary/docs/:version', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:18)\\.x)/client-agent/:slug*', - destination: '/boundary/docs/:version/api-clients/client-agent', - permanent: true, - }, - { - source: '/boundary/docs/api-clients/client-cache', - destination: '/boundary/docs/client-cache', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14)\\.x)/api-clients/client-cache', - destination: '/boundary/docs/:version/api-clients/api', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14)\\.x)/client-cache', - destination: '/boundary/docs/:version/api-clients/api', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/client-cache', - destination: '/boundary/docs/:version/api-clients/client-cache', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/api-clients/client-cache', - destination: '/boundary/docs/:version/client-cache', - permanent: true, - }, - { - source: '/boundary/docs/api-clients/api', - destination: '/boundary/docs/api', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/api', - destination: '/boundary/docs/:version/api-clients/api', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/api-clients/api', - destination: '/boundary/docs/:version/api', - permanent: true, - }, - { - source: '/boundary/docs/api-clients/api/pagination', - destination: '/boundary/docs/api/pagination', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/api-clients/api/pagination', - destination: '/boundary/docs/:version/api-clients/api', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/api/pagination', - destination: '/boundary/docs/:version/api-clients/api', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/api/pagination', - destination: '/boundary/docs/:version/api-clients/api/pagination', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/api-clients/api/pagination', - destination: '/boundary/docs/:version/api/pagination', - permanent: true, - }, - { - source: '/boundary/docs/api-clients/api/rate-limiting', - destination: '/boundary/docs/api/rate-limiting', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/api-clients/api/rate-limiting', - destination: '/boundary/docs/:version/api-clients/api', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:13|14)\\.x)/api/rate-limiting', - destination: '/boundary/docs/:version/api-clients/api', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/api/rate-limiting', - destination: '/boundary/docs/:version/api-clients/api/rate-limiting', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/api-clients/api/rate-limiting', - destination: '/boundary/docs/:version/api/rate-limiting', - permanent: true, - }, - { - source: '/boundary/docs/api-clients/cli', - destination: '/boundary/docs/commands/', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12)\\.x)/commands', - destination: '/boundary/docs/:version/api-clients/cli', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18|19)\\.x)/api-clients/cli', - destination: '/boundary/docs/:version/commands', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19)\\.x)/commands/connect/cassandra', - destination: '/boundary/docs/:version/commands', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19)\\.x)/commands/connect/mysql', - destination: '/boundary/docs/:version/commands', - permanent: true, - }, - { - source: '/boundary/docs/commands/daemon/:slug*', - destination: '/boundary/docs/commands/cache/:slug*', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16)\\.x)/commands/cache/:slug*', - destination: '/boundary/docs/:version/commands', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14)\\.x)/commands/daemon/:slug*', - destination: '/boundary/docs/:version/commands', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:17|18|19)\\.x)/commands/daemon/:slug*', - destination: '/boundary/docs/:version/commands/cache/:slug*', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14)\\.x)/commands/delete', - destination: '/boundary/docs/:version/commands', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14)\\.x)/commands/read', - destination: '/boundary/docs/:version/commands', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14)\\.x)/commands/search', - destination: '/boundary/docs/:version/commands', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14)\\.x)/commands/update', - destination: '/boundary/docs/:version/commands', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14)\\.x)/commands/roles/add-grant-scopes', - destination: '/boundary/docs/:version/commands', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14)\\.x)/commands/roles/remove-grant-scopes', - destination: '/boundary/docs/:version/commands', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14)\\.x)/commands/roles/set-grant-scopes', - destination: '/boundary/docs/:version/commands', - permanent: true, - }, - { - source: '/boundary/docs/concepts/domain-model', - destination: '/boundary/docs/domain-model', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/domain-model', - destination: '/boundary/docs/:version/concepts/domain-model', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/concepts/domain-model/:slug*', - destination: '/boundary/docs/:version/domain-model/:slug*', - permanent: true, - }, - { - source: '/boundary/docs/concepts/domain-model/accounts', - destination: '/boundary/docs/domain-model/accounts', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/domain-model/accounts', - destination: '/boundary/docs/:version/concepts/domain-model/accounts', - permanent: true, - }, - { - source: '/boundary/docs/concepts/domain-model/aliases', - destination: '/boundary/docs/domain-model/aliases', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15)\\.x)/concepts/domain-model/aliases', - destination: '/boundary/docs/:version/concepts/domain-model', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15)\\.x)/domain-model/aliases', - destination: '/boundary/docs/:version/concepts/domain-model', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:16|17|18)\\.x)/domain-model/aliases', - destination: '/boundary/docs/:version/concepts/domain-model/aliases', - permanent: true, - }, - { - source: '/boundary/docs/concepts/domain-model/auth-methods', - destination: '/boundary/docs/domain-model/auth-methods', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/domain-model/auth-methods', - destination: '/boundary/docs/:version/concepts/domain-model/auth-methods', - permanent: true, - }, - { - source: '/boundary/docs/concepts/domain-model/credentials', - destination: '/boundary/docs/domain-model/credentials', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/domain-model/credentials', - destination: '/boundary/docs/:version/concepts/domain-model/credentials', - permanent: true, - }, - { - source: '/boundary/docs/concepts/domain-model/credential-libraries', - destination: '/boundary/docs/domain-model/credential-libraries', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/domain-model/credential-libraries', - destination: - '/boundary/docs/:version/concepts/domain-model/credential-libraries', - permanent: true, - }, - { - source: '/boundary/docs/concepts/domain-model/credential-stores', - destination: '/boundary/docs/domain-model/credential-stores', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/domain-model/credential-stores', - destination: - '/boundary/docs/:version/concepts/domain-model/credential-stores', - permanent: true, - }, - { - source: '/boundary/docs/concepts/domain-model/groups', - destination: '/boundary/docs/domain-model/groups', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/domain-model/groups', - destination: '/boundary/docs/:version/concepts/domain-model/groups', - permanent: true, - }, - { - source: '/boundary/docs/concepts/domain-model/hosts', - destination: '/boundary/docs/domain-model/hosts', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/domain-model/hosts', - destination: '/boundary/docs/:version/concepts/domain-model/hosts', - permanent: true, - }, - { - source: '/boundary/docs/concepts/domain-model/host-catalogs', - destination: '/boundary/docs/domain-model/host-catalogs', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/domain-model/host-catalogs', - destination: '/boundary/docs/:version/concepts/domain-model/host-catalogs', - permanent: true, - }, - { - source: '/boundary/docs/concepts/domain-model/host-sets', - destination: '/boundary/docs/domain-model/host-sets', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/domain-model/host-sets', - destination: '/boundary/docs/:version/concepts/domain-model/host-sets', - permanent: true, - }, - { - source: '/boundary/docs/concepts/domain-model/managed-groups', - destination: '/boundary/docs/domain-model/managed-groups', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/domain-model/managed-groups', - destination: '/boundary/docs/:version/concepts/domain-model/managed-groups', - permanent: true, - }, - { - source: '/boundary/docs/concepts/domain-model/roles', - destination: '/boundary/docs/domain-model/roles', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/domain-model/roles', - destination: '/boundary/docs/:version/concepts/domain-model/roles', - permanent: true, - }, - { - source: '/boundary/docs/concepts/domain-model/scopes', - destination: '/boundary/docs/domain-model/scopes', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/domain-model/scopes', - destination: '/boundary/docs/:version/concepts/domain-model/scopes', - permanent: true, - }, - { - source: '/boundary/docs/concepts/domain-model/sessions', - destination: '/boundary/docs/domain-model/sessions', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/domain-model/sessions', - destination: '/boundary/docs/:version/concepts/domain-model/sessions', - permanent: true, - }, - { - source: '/boundary/docs/concepts/domain-model/session-connections', - destination: '/boundary/docs/domain-model/session-connections', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:8|9|10|11|12|13|14|15|16|17|18)\\.x)/domain-model/session-connections', - destination: - '/boundary/docs/:version/concepts/domain-model/session-connections', - permanent: true, - }, - { - source: '/boundary/docs/concepts/domain-model/session-recordings', - destination: '/boundary/docs/domain-model/session-recordings', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/domain-model/session-recordings', - destination: - '/boundary/docs/:version/concepts/domain-model/session-recordings', - permanent: true, - }, - { - source: '/boundary/docs/concepts/domain-model/storage-buckets', - destination: '/boundary/docs/domain-model/storage-buckets', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:13|14|15|16|17|18)\\.x)/domain-model/storage-buckets', - destination: - '/boundary/docs/:version/concepts/domain-model/storage-buckets', - permanent: true, - }, - { - source: '/boundary/docs/concepts/domain-model/storage-policy', - destination: '/boundary/docs/domain-model/storage-policy', - permanent: true, - }, - { - source: '/boundary/docs/concepts/domain-model/storage-policies', - destination: '/boundary/docs/domain-model/storage-policy', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14)\\.x)/concepts/domain-model/storage-policy', - destination: '/boundary/docs/:version/concepts/domain-model', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14)\\.x)/domain-model/storage-policy', - destination: '/boundary/docs/:version/concepts/domain-model', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14)\\.x)/concepts/domain-model/storage-policies', - destination: '/boundary/docs/:version/concepts/domain-model', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/domain-model/storage-policy', - destination: '/boundary/docs/:version/concepts/domain-model/storage-policy', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:15|16|17|18)\\.x)/concepts/domain-model/storage-policies', - destination: '/boundary/docs/:version/concepts/domain-model/storage-policy', - permanent: true, - }, - { - source: '/boundary/docs/concepts/domain-model/targets', - destination: '/boundary/docs/domain-model/targets', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/domain-model/targets', - destination: '/boundary/docs/:version/concepts/domain-model/targets', - permanent: true, - }, - { - source: '/boundary/docs/concepts/domain-model/users', - destination: '/boundary/docs/domain-model/users', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/domain-model/users', - destination: '/boundary/docs/:version/concepts/domain-model/users', - permanent: true, - }, - { - source: '/boundary/docs/concepts/filtering', - destination: '/boundary/docs/filtering', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/filtering', - destination: '/boundary/docs/:version/concepts/filtering', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:19)\\.x)/concepts/filtering', - destination: '/boundary/docs/:version/filtering', - permanent: true, - }, - { - source: '/boundary/docs/concepts/filtering/resource-listing', - destination: '/boundary/docs/filtering', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/concepts/filtering/resource-listing', - destination: '/boundary/docs/:version/filtering', - permanent: true, - }, - { - source: '/boundary/docs/troubleshoot/common-errors', - destination: '/boundary/docs/errors', - permanent: true, - }, - { - source: '/boundary/docs/:version(v0\\.(?:12|13|14|15|16|17|18)\\.x)/errors', - destination: '/boundary/docs/:version/troubleshoot/common-errors', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:19)\\.x)/troubleshoot/common-errors', - destination: '/boundary/docs/:version/errors', - permanent: true, - }, - { - source: - '/boundary/docs/configuration/target-aliases/interoperability-matrix', - destination: '/boundary/docs/interoperability-matrix/index', - permanent: true, - }, - { - source: - '/boundary/docs/:version(v0\\.(?:1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18)\\.x)/interoperability-matrix', - destination: '/boundary/docs/:version', - permanent: true, - }, -] diff --git a/website/scripts/should-build.sh b/website/scripts/should-build.sh deleted file mode 100644 index 4baf8c12f..000000000 --- a/website/scripts/should-build.sh +++ /dev/null @@ -1,21 +0,0 @@ -#!/usr/bin/env bash -# Copyright IBM Corp. 2020, 2025 -# SPDX-License-Identifier: BUSL-1.1 - - -###################################################### -# NOTE: This file is managed by the Digital Team's # -# Terraform configuration @ hashicorp/mktg-terraform # -###################################################### - -# This is run during the website build step to determine if we should skip the build or not. -# More information: https://vercel.com/docs/platform/projects#ignored-build-step - -if [[ "$VERCEL_GIT_COMMIT_REF" == "stable-website" ]] ; then - # Proceed with the build if the branch is stable-website - echo "✅ - Build can proceed" - exit 1; -else - # Check for differences in the website directory - git diff --quiet HEAD^ HEAD ./ ../internal/gen/controller.swagger.json -fi \ No newline at end of file diff --git a/website/scripts/website-build.sh b/website/scripts/website-build.sh deleted file mode 100755 index a094cdbeb..000000000 --- a/website/scripts/website-build.sh +++ /dev/null @@ -1,55 +0,0 @@ -# Copyright IBM Corp. 2020, 2025 -# SPDX-License-Identifier: BUSL-1.1 - -###################################################### -# NOTE: This file is managed by the Digital Team's # -# Terraform configuration @ hashicorp/mktg-terraform # -###################################################### - -# Repo which we are cloning and executing npm run build:deploy-preview within -REPO_TO_CLONE=dev-portal -# Set the subdirectory name for the base project -PREVIEW_DIR=website-preview -# The directory we want to clone the project into -CLONE_DIR=website-preview -# The product for which we are building the deploy preview -PRODUCT=boundary -# Preview mode, controls the UI rendered (either the product site or developer). Can be `io` or `developer` -PREVIEW_MODE=developer - -# Get the git branch of the commit that triggered the deploy preview -# This will power remote image assets in local and deploy previews -CURRENT_GIT_BRANCH=$VERCEL_GIT_COMMIT_REF - -# This is where content files live, relative to the website-preview dir. If omitted, "../content" will be used -LOCAL_CONTENT_DIR= - -from_cache=false - -if [ -d "$PREVIEW_DIR" ]; then - echo "$PREVIEW_DIR found" - CLONE_DIR="$PREVIEW_DIR-tmp" - from_cache=true -fi - -# Clone the base project, if needed -echo "⏳ Cloning the $REPO_TO_CLONE repo, this might take a while..." -git clone --depth=1 "https://github.com/hashicorp/$REPO_TO_CLONE.git" "$CLONE_DIR" - -if [ "$from_cache" = true ]; then - echo "Setting up $PREVIEW_DIR" - cp -R "./$CLONE_DIR/." "./$PREVIEW_DIR" -fi - -# cd into the preview directory project -cd "$PREVIEW_DIR" - -# Run the build:deploy-preview start script -PREVIEW_FROM_REPO=$PRODUCT \ -IS_CONTENT_PREVIEW=true \ -PREVIEW_MODE=$PREVIEW_MODE \ -REPO=$PRODUCT \ -HASHI_ENV=project-preview \ -LOCAL_CONTENT_DIR=$LOCAL_CONTENT_DIR \ -CURRENT_GIT_BRANCH=$CURRENT_GIT_BRANCH \ -npm run build:deploy-preview \ No newline at end of file diff --git a/website/scripts/website-start.sh b/website/scripts/website-start.sh deleted file mode 100755 index a89c17371..000000000 --- a/website/scripts/website-start.sh +++ /dev/null @@ -1,47 +0,0 @@ -# Copyright IBM Corp. 2020, 2025 -# SPDX-License-Identifier: BUSL-1.1 - -###################################################### -# NOTE: This file is managed by the Digital Team's # -# Terraform configuration @ hashicorp/mktg-terraform # -###################################################### - -# Repo which we are cloning and executing npm run build:deploy-preview within -REPO_TO_CLONE=dev-portal -# Set the subdirectory name for the dev-portal app -PREVIEW_DIR=website-preview -# The product for which we are building the deploy preview -PRODUCT=boundary -# Preview mode, controls the UI rendered (either the product site or developer). Can be `io` or `developer` -PREVIEW_MODE=developer - -# Get the git branch of the commit that triggered the deploy preview -# This will power remote image assets in local and deploy previews -CURRENT_GIT_BRANCH=$(git rev-parse --abbrev-ref HEAD) - -# This is where content files live, relative to the website-preview dir. If omitted, "../content" will be used -LOCAL_CONTENT_DIR= - -should_pull=true - -# Clone the dev-portal project, if needed -if [ ! -d "$PREVIEW_DIR" ]; then - echo "⏳ Cloning the $REPO_TO_CLONE repo, this might take a while..." - git clone --depth=1 https://github.com/hashicorp/$REPO_TO_CLONE.git "$PREVIEW_DIR" - should_pull=false -fi - -cd "$PREVIEW_DIR" - -# If the directory already existed, pull to ensure the clone is fresh -if [ "$should_pull" = true ]; then - git pull origin main -fi - -# Run the dev-portal content-repo start script -REPO=$PRODUCT \ -PREVIEW_FROM_REPO=$PRODUCT \ -LOCAL_CONTENT_DIR=$LOCAL_CONTENT_DIR \ -CURRENT_GIT_BRANCH=$CURRENT_GIT_BRANCH \ -PREVIEW_MODE=$PREVIEW_MODE \ -npm run start:local-preview \ No newline at end of file diff --git a/website/vercel.json b/website/vercel.json deleted file mode 100644 index 0e6117e60..000000000 --- a/website/vercel.json +++ /dev/null @@ -1,7 +0,0 @@ -{ - "version": 2, - "public": true, - "github": { - "silent": true - } -}