App Configuration

Common questions this page answers:

How do I configure Bailo?

Where are the configuration files?

How does configuration inheritance work?

Configuration files

If you use Helm this information does not apply to you.

We use Helm to automatically configure the application for you. Within helm you can manually alter this configuration in infrastructure/helm/bailo/config/production.yaml and infrastructure/helm/bailo/config/environment.yaml

Bailo uses node-config for application configuration. node-config organizes hierarchical configurations, allowing the user to set a series of overrides over a base configuration.

The default set of configuration can be found in config/default.js, with overrides for other environments included in the same folder. For production environments, configuration should be placed in either production.cjs or local.js to override the default configuration.

The full order of configuration inheritance can be found on the node-config wiki.

Configuration Specification

Please Refer to the following specification for details on setup and modification.

These are automatically updated with type documentation from our main branch on Github.

api

Express listen configuration. These values define where the backend API binds internally. This is functionally the same as http.Server.listen(), and will bind connections to nginx at /api/v2.

port

number - Port number to expose the express backend on (usually 3001)

app

Public-facing application metadata used in:

email links
registry authentication

During build time certificates are generated with open SSL. These are used to authenticate the backend against the registry. You can generate the certificates manually using npm run certs

protocol

string - URL scheme used in generated links (e.g. https)

host

string - Public domain or hostname used in emails

port

number - Public port used in email links

privateKey

string - X.509 private key for registry authentication

publicKey

string - X.509 public certificate for registry token verification

jwks

string - JSON Web Key Set used by the registry

httpClient

Default options for outbound HTTP/S requests.

defaultOpts

AgentOptions - Default HTTPS agent options (proxy, TLS, etc.)

proxy

string - Optional proxy URL for outbound requests

noProxy

string[] - Hostnames that bypass the configured proxy

connectors

Defines which external systems Bailo integrates with.

authentication

{ kind: AuthenticationKindKeys; } - Authentication strategy

'silly' - No authentication every user is Joe Blogs
'oauth' - Uses open authorisation to authenticate users.

authorisation

{ kind: "basic"; } - Authorisation strategy

'basic' - Usual checks on access apply

audit

{ kind: AuditKindKeys; } - Audit strategy

'silly' - No events are tracked
'stdout' - Events are streamed via standard output

artefactScanners

Artefact scanners Information specific to how Bailo connects with the file and image scanners

kinds

ArtefactScanKindKeys[] - Enabled artefact scanners

retryDelayInMinutes

number - Retry delay between scan attempts of a given artefact (minutes)

maxInitRetries

number - Maximum number of initialisation retries

initRetryDelay

number - Retry delay between initialisation attempts (minutes)

scanTimeoutMs

number - Maximum time allowed for a single artefact scan (milliseconds)

metrics

Metrics connector configuration

kind

"simple" - Metrics connector strategy

federation

Enables searching and discovery across Bailo peers.

state

FederationStateKeys - Status of federation search

'enabled' - Creates peer connections
'readOnly' - Used for creating a peer itself without any peers
'disabled' - Doesn't create peer connections

id

string - Unique peer identifier

isEscalationEnabled

boolean - Allow escalation across federated peers

peers

Known federation peers

state

FederationStateKeys - Whether a peer is enabled

baseUrl

string - The url of the peer to communicate to

label

string - Does nothing

kind

PeerKindKeys - Either another Bailo instance or hugging face

cache

Defines how long search requests should exist for

query

number - Time to live in seconds

smtp

Controls outbound email behaviour.

enabled

boolean - Enable or disable all email sending

transporter

TransportOption - Transport provider

connection

SMTP Connection

Connection information for an SMTP server. Settings are passed directly to node-mailer.

host

string - Hostname for SMTP

port

number - SMTP port

tls

{ rejectUnauthorized: boolean; } - Additional options for making requests with an email socket

lifecycle

{ preReminderIntervals: string[]; postReminderInterval: string; } - Reminder schedule for model card review lifecycle emails. Refer to: https://github.com/agenda/human-interval#uses

from

string - From address used by Bailo, can be different from the SMTP server details.

ses

region

string - AWS region

log

level

LevelWithSilentOrString - Pino log level

s3

Defines storage behavior. Used for all artifacts including:

registry artifacts
files

credentials

{ accessKeyId: string; secretAccessKey: string; } - Object store credentials (do not store in plaintext in production)

endpoint

string - Object storage endpoint

region

string - AWS region

forcePathStyle

boolean - Use path-style rather than virtual-hosted-style bucket addressing

rejectUnauthorized

boolean - Validate the TLS certificate used by the object storage endpoint

responseChecksumValidation

ResponseChecksumValidation | Provider<ResponseChecksumValidation> - AWS SDK response checksum validation behaviour

automaticallyCreateBuckets

boolean - Automatically create buckets if missing

multipartChunkSize

number - Multipart upload chunk size (bytes)

buckets

default bucket names for uploads/files and registry/images

uploads

string - Bucket used for uploaded files

registry

string - Bucket used for registry artefacts

mongo

A mongo connection URI, can contain replica set information, etc.

uri

string - MongoDB connection URI (no credentials embedded)

user

string - Username override (for secret-based auth)

pass

string - Password override (for secret-based auth)

transactions

boolean - Enable MongoDB transactions (requires replica set)

registry

connection

Defines service information about the registry

internal

string - Internal registry endpoint

insecure

boolean - Allow self‑signed certificates

service

string - Registry audience

issuer

string - Registry issuer

ui

Some features on the UI are dynamic and customisable.

The UI object contains all information that is user facing.

issues

Contact details for help page

label

string - If you have experienced any issues with Bailo, then please report it to the blank.

supportHref

string - Support contact email

contactHref

string - Help contact email

helpPopoverText

Customisable text on frontend

manualEntryAccess

string - This text appears in under the "Manage Model Access" within each of the model settings

modelDetails

Sets of customisable tags on the marketplace for discoverability

organisations

string[] - Organisation a model can belong to

states

string[] - Status of Lifecycle

roleDisplayNames

Frontend appearance for user roles on the frontend.

owner

string - This role includes all permissions, such as managing model access and model deletion

contributor

string - This role allows users edit the model card and draft releases

consumer

string - This provides read only permissions for the model. If a model is private, these users will be able to view the model and create access requests

session

Secret used to sign express-sessions should be difficult to parse by a human

Should be rotated as best practice

secret

string - Express session signing secret

oauth

Defines behaviour for user authorisation if the connector is enabled

provider

string - Redirect for the login to set a session cookie

grant

any - Grant configuration options

cognito

Cognito

Defines configuration for Open Authorisation

identityProviderClient

Cognito identity provider client

region

string - AWS Region

credentials

Credentials to access Cognito

accessKeyId

string - Cognito access key

secretAccessKey

string - Cognito secret key

adminGroupName

string - Cognito admin group name

defaultSchemas

Defines default schemas that are loaded on startup. Use require to import.

eg. require('../src/scripts/example_schemas/minimal_model_schema.json')

modelCards

Model card schemas that define the model card forms

name

string - Name of the schema that appears

id

string - Unique identifier for the schema

description

string - Description of the schemas functions

jsonSchema

Schema - The file to mount the contents of each schema eg. require('../src/scripts/example_schemas/minimal_model_schema.json')

reviewRoles

string[] - Roles required to review

accessRequests

Access request schemas that define the access request forms

name

string - Name of the schema that appears

id

string - Unique identifier for the schema

description

string - Description of the schemas functions

jsonSchema

Schema - The file to mount the contents of each schema eg. require('../src/scripts/example_schemas/minimal_model_schema.json')

reviewRoles

string[] - Roles required to review

dataCards

Data card schemas that define the data card forms

name

string - Name of the schema that appears

id

string - Unique identifier for the schema

description

string - Description of the schemas functions

jsonSchema

Schema - The file to mount the contents of each schema eg. require('../src/scripts/example_schemas/minimal_model_schema.json')

reviewRoles

string[] - Roles required to review

defaultReviewRoles

DefaultReviewRole[] - Roles that can be used after startup

instrumentation

enabled

boolean - Enable open telemetry for performance metrics

serviceName

string - defined as per [https://github.com/open-telemetry/opentelemetry-js/blob/main/semantic-conventions/README.md#unstable-semconv]

endpoint

string - Trace exporter host

authenticationToken

string - Authorisation header using the Bearer scheme

debug

boolean - Sets logger level to debug

stroom

sendEvents

boolean - Send events to STROOM

url

string - STROOM endpoint

environment

string - STROOM environment name

interval

number - Delay between event batches (milliseconds)

generator

string - Event generator name

rejectUnauthorized

boolean - Validate the STROOM TLS certificate

xmlns

string - XML namespace for generated events

schemaLocation

string - XML schema location for generated events

version

string - Event schema version

headers

Record<string, string> - Additional HTTP headers sent to STROOM

batchSizeLimit

number - Maximum number of events in a batch

artefactScanning

Scanning for files and images within models, including AV and CVEs.

Scanners operate a priority queue

clamdscan

ClamAV is an open-source file scanning toolkit.

This section gives some configuration for Bailo to access the container in order to scan files

concurrency

number - Number of files scanned at one time

streamMaxLength

string - Maximum bytes allowed in a stream from clamd.conf (example format: '2G')

host

string - Internal address to model scan API

port

number - Port number for model scan api

artefactscan

Artefactscan includes Trivy and ModelScan

ModelScan is an open source tool to scan specifically on models
Trivy identifies known vulnerabilities in container image layers

Bailo Artefactscan REST API