OpexFlow reads YAML (config.yaml by default). Any string value supports ${ENV_VAR}
substitution, useful for secrets. Top-level sections:
| Key | Description |
|---|---|
connector |
Identity + delivery: name, push_endpoint (must include the /api/inbound-webhooks/receive/<token> path for OpexMX; leave it empty on a receiver-only node such as a hosted instance, where the push sink is skipped), hmac_secret (required with a push_endpoint), push_headers (extra headers on every push, e.g. an iPaaS API key or Cloudflare Access service-token headers; ${ENV} values, masked in GET /api/config, at most 16, the signature and body headers are reserved), poll_interval_ms, push_queue, batch, backfill, preprocess. API/runtime: bind_addr (default 127.0.0.1), health_check_port (default 3000), api_token, cors_origins, data_dir, adapter_read_timeout_ms, mcp (enabled, read_only: the MCP server for AI agents). See Security and Operations. |
auth |
Top-level. Users, roles and sign-in: oidc (issuer, client_id, client_secret, scopes, role_claim, role_map, default_role, redirect_url, require_mfa_for_admin, mfa_values, token_auth), token_login (show the token form, default true), session_ttl_secs (default 28800), secure_cookie, audit.retention_days (default 1825 = 5 years). Without it the single connector.api_token is an admin token and the audit log still runs. See Security. |
storage |
retention_days (default 7), max_size_mb (0 = no cap). |
ha |
Opt-in active-standby pair: enabled, node_id, backend (auto/nats/postgres), lease_ttl_secs, renew_secs, bucket, key, postgres_lock_key. Top-level. See High availability. |
opcua_server |
Top-level. Serves the live tags to SCADA/MES clients over OPC-UA, read-only: enabled, endpoint (default opc.tcp://127.0.0.1:4840), advertised_host, security_policies (default Basic256Sha256), security_modes, anonymous, users, pki_dir, trust_client_certs, allow_insecure, max_devices. See OPC-UA server. |
adapters |
modbus, ethernetip, opcua, http, focas, mtconnect, pi device definitions. nats, mqtt, clickhouse, postgres are top-level, not nested here. |
nats / mqtt |
Stream sources (ingest), also usable as sinks. |
transform |
Caps (timeout_ms, memory_limit_mb, on_error), executor limits, OpenAPI specs; its default / sources routes and pipelines_dir only seed the flow document on first start (once flow.json exists the flow is edited on the canvas and these routes are ignored). |
clickhouse / postgres |
Sink connection config. Postgres expects TimescaleDB. |
ai |
OpenAI-compatible codegen endpoint (see AI generator). |
telemetry |
Stall-alert threshold, sample interval, alert channels: webhook, Telegram, email (SMTP), Microsoft Teams, WhatsApp, plus the pipeline-failure alert window (see Alerts). |
secrets |
Providers behind ${secret:name}: vault (addr, mount, prefix, namespace, token / token_file or role_id + secret_id, ca_cert), cache_ttl_secs, order. Top-level. Accepts ${ENV} only. See Data protection. |
environment |
Top-level. name (dev / staging / prod / …), color, protected (refuse direct deploys, read-only editor). See Environments. |
vars |
Top-level map of ${var:NAME} values for this instance (more in <data_dir>/vars.json). Not for secrets. See Variables. |
versions |
keep: retain only the newest N flow versions (default: all). See Version history. |
promotion |
name, key_file, trusted_sources (name, public_key), targets (name, url, token, environment), approver_role (admin or editor). See Promotion. |
finance |
Top-level. cases (auto_clear, digest: enabled, time, timezone, weekdays_only), approvals (sweep_secs, max_resume_attempts), go_live (approver_role, approver_users, ttl_hours): exception cases, the approve node and the go-live sign-off for posting in a protected environment. See Finance controls. |
git |
auto_commit + repo: commit the exported layout to a local repository on every deploy. See Git export. |
privacy |
mask: field-name patterns, regex: value patterns and the @pii / @pii-values presets that are masked to *** in traces, debug, dead letters, event log, job log and samples. Top-level. See Data protection. |
${VAR} substitution applies to every string value in the file; write $$ for a literal $ ($${ gives ${). Run opex-flow --check-config config.yaml to validate. An unknown sink name in sinks: is a config error.
${secret:name} works in the same places (config values, http node auth and templates, webhook
secrets): it is resolved from the local encrypted store or Vault/OpenBao, see
Data protection.