History

Sipke Schoorstra f9055a1041 feat(apps): enable BPMN interchange in the Elsa.Server.Web sample host (#8068 ) * feat(apps): enable BPMN interchange in the Elsa.Server.Web sample host Turns on .UseBpmnInterchange() unconditionally alongside the host's other showcase features so the analyze endpoint (and BPMN execution) can be exercised end-to-end against a live server, per #8055 (part of #7909). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(bpmn): fix sample host method names to UseBpmn/UseBpmnInterchange The enabling-BPMN sample referenced AddBpmn()/AddBpmnInterchange(), which do not exist; the real extension methods are UseBpmn() and UseBpmnInterchange(). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(bpmn): note dev-certs trust prerequisite for analyze example The login curl in the "Trying it" walkthrough fails TLS verification when the local ASP.NET Core development certificate isn't trusted, leaving TOKEN empty. Document the one-time dotnet dev-certs --trust step instead of suggesting curl -k. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>		2026-09-12 00:39:29 -07:00
..
Activities	Merge remote-tracking branch 'origin/develop/3.5.0' into develop/3.6.0	2025-08-01 22:09:48 +02:00
ActivityHosts	Adds activity host registration support (#7172 )	2025-12-27 20:52:52 +01:00
Filters
Properties
Workflows	Added logic to search for workflow-as-activities based on DefinitionId (not only versionId) (#7149 )	2025-12-17 23:23:49 +01:00
appsettings.Development.json	[codex] Remove production-usable default admin credentials (#7500 )	2026-05-20 20:58:03 +02:00
appsettings.json	Add ingress rate limiting hooks (#7512 )	2026-05-22 00:13:11 +02:00
ClassicServerHost.cs	fix(external-auth)!: wildcard-aware permission grant boundary, and startup smoke tests for both hosts (#7985 )	2026-08-25 05:25:29 +02:00
Elsa.Server.Web.csproj	feat(apps): enable BPMN interchange in the Elsa.Server.Web sample host (#8068 )	2026-09-12 00:39:29 -07:00
Elsa.Server.Web.csproj.DotSettings
Program.cs	feat(apps): enable BPMN interchange in the Elsa.Server.Web sample host (#8068 )	2026-09-12 00:39:29 -07:00
README.md	Add ingress rate limiting hooks (#7512 )	2026-05-22 00:13:11 +02:00

README.md

Server

This project represents an Elsa application that hosts workflows and exposes API endpoints to manage & execute workflows.

Secrets

appsettings.json does not include production-usable default admin credentials or API keys. Configure initial users and applications through environment-specific configuration or a secret manager.

Ingress Rate Limiting

The reference server includes opt-in ASP.NET Core rate limiting for Elsa management API requests and public HTTP workflow trigger routes. Enable it by setting IngressRateLimiting:Enabled to true.

Default policies are intentionally conservative and queue-free:

"IngressRateLimiting": {
  "Enabled": true,
  "ApiPermitLimit": 120,
  "ApiWindowSeconds": 60,
  "ApiQueueLimit": 0,
  "HttpWorkflowPermitLimit": 60,
  "HttpWorkflowWindowSeconds": 60,
  "HttpWorkflowQueueLimit": 0
}

Tune these values for production traffic and deployment topology. To disable the reference rate limiting behavior, leave Enabled as false and do not configure external policy names. Custom hosts can register their own named ASP.NET Core rate limiter policies with services.AddRateLimiter(...), pass the policy names through ApiEndpointOptions.RateLimitingPolicyName and HttpActivityOptions.RateLimitingPolicyName, map Elsa API endpoints with MapWorkflowsApi(...), call UseWorkflowsApiRateLimiting(...) and UseWorkflowsRateLimiting(...) after endpoint routing has selected endpoints, then call app.UseRateLimiter() once for the host pipeline. The Elsa hooks only attach endpoint metadata; ASP.NET Core validates configured policy names when the rate limiter middleware handles matching requests.

In the reference server, IngressRateLimiting:RegisterReferencePolicies controls whether the built-in fixed-window policies are registered; when it is unset, it defaults to the value of Enabled. Enabled controls default policy-name assignment and the reference-server middleware toggle. Externally configured policy names are preserved. Set a policy option to an empty string to explicitly disable rate limiting for that surface even when reference policies are registered.

OpenTelemetry (MacOS)

COR_ENABLE_PROFILING=1 COR_PROFILER={918728DD-259F-4A6A-AC2B-B85E1B658318} CORECLR_PROFILER_PATH=$INSTALL_DIR/osx-x64/OpenTelemetry.AutoInstrumentation.Native.dylib DOTNET_ADDITIONAL_DEPS=$INSTALL_DIR/AdditionalDeps DOTNET_EnableDiagnostics=1 DOTNET_SHARED_STORE=$INSTALL_DIR/store DOTNET_STARTUP_HOOKS=OpenTelemetry.AutoInstrumentation.StartupHook OTEL_DOTNET_AUTO_HOME=$INSTALL_DIR OTEL_DOTNET_AUTO_LOGS_CONSOLE_EXPORTER_ENABLED=true OTEL_DOTNET_AUTO_METRICS_CONSOLE_EXPORTER_ENABLED=true OTEL_DOTNET_AUTO_TRACES_ADDITIONAL_SOURCES=Proto.Actor,Elsa.Workflows OTEL_DOTNET_AUTO_TRACES_CONSOLE_EXPORTER_ENABLED=true OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317 OTEL_EXPORTER_OTLP_PROTOCOL=grpc OTEL_RESOURCE_ATTRIBUTES=service.name=Elsa Server,service.version=3.3.0,service.instance.id=instance-123,deployment.environment=development