Configuration

The server file

listen_address = "127.0.0.1:7600"
health_listen_address = "127.0.0.1:7601"
persistence_path = "/var/lib/liminal/store"

[[channels]]
name = "console.topology"
durable = false

[[channels]]
name = "demo.hello"
durable = true

[websocket]
listen_address = "127.0.0.1:7602"
path = "/ws"
allowed_origins = ["http://127.0.0.1:5178"]

[auth.lys]
issuer = "https://lys.example"
network_id = "example"
live = true

[participant]
wire_frame_limit = 65536

• listen_address: the wire, where seats, workers and peers connect.
• health_listen_address: the health page.
• persistence_path: the store directory. The services registry and the tap-placement journal live beside it, named after it.
• [[channels]]: each named channel and whether it is durable.
• [websocket]: the console’s listener, path and allowed origins.
• [auth.lys]: the issuer, the network, whether admission is live, the API address and the app credential path. [[auth.lys.templates]] names each service template: its command, arguments, subjects and environment.
• [auth.lys.machine]: this liminal’s identity key, agent id and audience; machines the peers admitted by public key; [[auth.lys.machine.links]] each outbound link with its peer, address and exports.
• [participant]: the bounds of conversations, receipts and retained records.

The seat file

server = "127.0.0.1:7600"
channel = "console.topology"

[lys]
issuer = "https://lys.example"
agent = "agent-3f2a9c41d0b8e7a6c5f4e3d2b1a09876"
key_file = "/absolute/path/to/agent.key"

[limits]
frame_bytes = 65536
record_bytes = 1048576
reply_timeout_ms = 10000
flow_steps = 8
request_bytes = 65536

frame_bytes

The largest wire frame the ticket sends or accepts.

record_bytes

The largest record the ticket accepts.

request_bytes

The largest request body a call may carry.

reply_timeout_ms

How long a call waits for its reply before it is unanswered.

flow_steps

The most steps one flow may run.

Refusals

liminal check names the first invalid field and exits non-zero. A store path that is not a directory, a channel named twice, or a link whose peer is not in machines are refused before anything starts.