nuts-knooppunt

Configuration

The Knooppunt application supports configuration through YAML files and environment variables.

Sources

Configuration is loaded in the following order (later sources override earlier ones):

  1. Default values
  2. YAML configuration files, loaded from:
  3. Environment variables with KNPT_ prefix

Configuration Options

Environment variables use the prefix KNPT_ followed by the configuration path in uppercase with underscores (if you enable NUTS node as embedded service within your Knooppunt, those variables are prefixed with NUTS_):

Environment Variable YAML Path Description
General    
KNPT_STRICTMODE strictmode Enables secure operation mode. Disabling it allows connection to plain HTTP servers. It also sets the Nuts node’s strict mode configuration parameter.
Defaults to true.
HTTP    
KNPT_HTTP_PUBLIC_ADDRESS http.public.address TCP address for the public HTTP interface.
Defaults to :8080.
KNPT_HTTP_PUBLIC_URL http.public.url (Optional) Public base URL. If not specified, defaults to http://<hostname>:<port>.
KNPT_HTTP_INTERNAL_ADDRESS http.internal.address TCP address for the internal HTTP interface.
Defaults to :8081.
KNPT_HTTP_INTERNAL_URL http.internal.url (Optional) Internal base URL. If not specified, defaults to http://<hostname>:<port>.
Authentication / Nuts    
KNPT_NUTS_ENABLED nuts.enabled Enable embedded Nuts node.
Defaults to false.
NUTS_* config/nuts.yml file Nuts specific configuration variables are either prefixed with NUTS_ or are present in config/nuts.yml file
Addressing / mCSD    
KNPT_MCSDADMIN_FHIRBASEURL mcsdadmin.fhirbaseurl (Optional) FHIR base URL of the local mCSD Administration Directory, if managed through the mCSD Web Application.
KNPT_MCSDADMIN_AUTH_TOKENENDPOINT mcsdadmin.auth.tokenendpoint (Optional) OAuth2 token endpoint URL for authenticating requests to the local mCSD Administration Directory.
KNPT_MCSDADMIN_AUTH_CLIENTID mcsdadmin.auth.clientid (Optional) OAuth2 client ID for authenticating requests to the local mCSD Administration Directory.
KNPT_MCSDADMIN_AUTH_CLIENTSECRET mcsdadmin.auth.clientsecret (Optional) OAuth2 client secret for authenticating requests to the local mCSD Administration Directory.
KNPT_MCSDADMIN_AUTH_SCOPES mcsdadmin.auth.scopes (Optional) OAuth2 scopes for authenticating requests to the local mCSD Administration Directory. Multiple values can be specified as a comma-separated list.
KNPT_MCSD_QUERY_FHIRBASEURL mcsd.query.fhirbaseurl FHIR base URL of the local mCSD Query Directory to synchronize to.
KNPT_MCSD_ADMIN_<KEY>_FHIRBASEURL mcsd.admin.<key>.fhirbaseurl Map of root directories (mCSD Admin Directory FHIR base URLs) to synchronize from.
KNPT_MCSD_AUTH_TOKENENDPOINT mcsd.auth.tokenendpoint (Optional) OAuth2 token endpoint URL for authenticating requests to the local mCSD Query Directory.
KNPT_MCSD_AUTH_CLIENTID mcsd.auth.clientid (Optional) OAuth2 client ID for authenticating requests to the local mCSD Query Directory.
KNPT_MCSD_AUTH_CLIENTSECRET mcsd.auth.clientsecret (Optional) OAuth2 client secret for authenticating requests to the local mCSD Query Directory.
KNPT_MCSD_AUTH_SCOPES mcsd.auth.scopes (Optional) OAuth2 scopes for authenticating requests to the local mCSD Query Directory. Multiple values can be specified as a comma-separated list.
KNPT_MCSD_ADMINEXCLUDE mcsd.adminexclude (Optional) List of FHIR base URLs to exclude from being registered as administration directories. Useful to prevent self-referencing loops when the query directory is discovered as an Endpoint. Multiple values can be specified as a comma-separated list.
KNPT_MCSD_DIRECTORYRESOURCETYPES mcsd.directoryresourcetypes (Optional) List of resource types to synchronize from discovered mCSD directories. Defaults to: Organization, Endpoint, Location, HealthcareService, PractitionerRole, Practitioner. Multiple values can be specified as a comma-separated list.
Addressing / LRZA    
KNPT_LRZA_LRZABASEURL lrza.lrzabaseurl Base URL of the trusted national LRZA mCSD directory to synchronize from. The LRZA sync client is only enabled when this is set.
KNPT_LRZA_QUERYBASEURL lrza.querybaseurl FHIR base URL of the local mCSD Query Directory to synchronize into (shared with the mCSD client).
KNPT_LRZA_RESOURCETYPES lrza.resourcetypes (Optional) Resource types to synchronize from the LRZA. Defaults to: Organization, Endpoint, Location, HealthcareService, PractitionerRole, Practitioner. Multiple values can be specified as a comma-separated list.
KNPT_LRZA_AUTH_TOKENENDPOINT lrza.auth.tokenendpoint (Optional) OAuth2 token endpoint URL for authenticating requests to the LRZA.
KNPT_LRZA_AUTH_CLIENTID lrza.auth.clientid (Optional) OAuth2 client ID for authenticating requests to the LRZA.
KNPT_LRZA_AUTH_CLIENTSECRET lrza.auth.clientsecret (Optional) OAuth2 client secret for authenticating requests to the LRZA.
KNPT_LRZA_AUTH_SCOPES lrza.auth.scopes (Optional) OAuth2 scopes for authenticating requests to the LRZA. Multiple values can be specified as a comma-separated list.
KNPT_LRZA_TLSCERTFILE lrza.tlscertfile (Optional) Path to mTLS client certificate (.p12/.pfx or .pem) for the LRZA connection. Required by the national LRZA environment. For PEM, point to the full leaf + intermediates chain.
KNPT_LRZA_TLSKEYFILE lrza.tlskeyfile (Optional) Path to mTLS private key (only for .pem certs).
KNPT_LRZA_TLSKEYPASSWORD lrza.tlskeypassword (Optional) Password for an encrypted private key or .p12/.pfx file.
KNPT_LRZA_TLSCAFILE lrza.tlscafile (Optional) Path to CA certificate used to verify the LRZA server. Replaces the system trust store when set, so only needed when the server uses a private CA.
Localization / NVI    
KNPT_NVI_BASEURL nvi.baseurl Base URL of the NVI service.
KNPT_NVI_AUDIENCE nvi.audience Name of the NVI service, used for creating BSN transport tokens. When using fake pseudonymization, set to nvi. Otherwise, set to the URA number of the NVI (for the test environment, this is 90000901).
Defaults to nvi.
Pseudonymization    
KNPT_PSEUDO_PRSURL pseudo.prsurl Base URL of the pseudonymization service without a trailing slash(!) (for test: https://pseudoniemendienst.proeftuin.gf.irealisatie.nl).
Consent / Mitz    
KNPT_MITZ_MITZBASE mitz.mitzbase Base URL of the MITZ endpoint
KNPT_MITZ_NOTIFYENDPOINT mitz.notifyendpoint Endpoint that will be used in Subscription.channel.endpoint when subscribing to Mitz (unless one is provided in the Subscription request to the knooppunt)
KNPT_MITZ_GATEWAYSYSTEM mitz.gatewaysystem gateway system OID to be used in a MITZ subscription (your gateway system OID)
KNPT_MITZ_SOURCESYSTEM mitz.sourcesystem source system OID to be used in a MITZ subscription (your source system OID)
KNPT_MITZ_TLSCERTFILE mitz.tlscertfile Path to client certificate (.p12/.pfx or .pem)
KNPT_MITZ_TLSKEYFILE mitz.tlskeyfile Path to private key (only for .pem certs)
KNPT_MITZ_TLSKEYPASSWORD mitz.tlskeypassword Password for .p12/.pfx
KNPT_MITZ_TLSCAFILE mitz.tlscafile Path to server certificate
Authentication    
KNPT_AUTHN_MINVWS_TOKENENDPOINT authn.minvws.tokenendpoint Token endpoint for getting access tokens, for interacting with the Ministry of Health’s (MinVWS) services.
KNPT_AUTHN_MINVWS_TLSCERTFILE authn.minvws.tlscertfile Path to client certificate (.p12/.pfx or .pem) for authenticating to the Ministry of Health’s (MinVWS) services.
KNPT_AUTHN_MINVWS_TLSKEYFILE authn.minvws.tlskeyfile Path to private key (only for .pem certs) for authenticating to the Ministry of Health’s (MinVWS) services.
KNPT_AUTHN_MINVWS_TLSKEYPASSWORD authn.minvws.tlskeypassword Password for .p12/.pfx client certificate for authenticating to the Ministry of Health’s (MinVWS) services.
KNPT_AUTHN_MINVWS_TLSCAFILE authn.minvws.tlscafile Path to server certificate for authenticating to the Ministry of Health’s (MinVWS) services (optional).
Authorization    
KNPT_PDP_ENABLED pdp.enabled Enable the Policy Decision Point (PDP).
Defaults to true.
KNPT_PDP_PIP_URL pdp.pip.url Address of the policy information point used for finding patient records and local consents
KNPT_PDP_PIP_RESOURCECONTENTENABLED pdp.pip.resourcecontentenabled When enabled, the PDP fetches the targeted resource content from the PIP and makes it available in the policy input as resource.content.
Defaults to false.
Tracing / OpenTelemetry    
KNPT_TRACING_OTLPENDPOINT tracing.otlpendpoint OTLP collector address as host:port. Tracing is enabled when this is set.
Example: jaeger:4318.
KNPT_TRACING_INSECURE tracing.insecure Use insecure (non-TLS) connection to OTLP endpoint.
Defaults to true.
KNPT_TRACING_SERVICENAME tracing.servicename Service name reported in traces.
Defaults to nuts-knooppunt.
This site is open source. Improve this page.