Configuration

Settings live in canton-deploy.config.js at the project root or a parent directory. Select a named network with --network.

Run:

dpm canton-deploy init

or copy canton-deploy.config.example.js.

If the nearest package.json contains "type": "module", use canton-deploy.config.cjs instead.

Example Configuration

module.exports = {
  defaultNetwork: 'localnet',

  networks: {
    localnet: {
      host: 'localhost',
      adminPort: 5002,
      ledgerPort: 5001,
      httpPort: 7575,
      vetOnUpload: true,
      excludePackages: ['./tests', 'my-app-tests'],
      additionalDars: [],
      parties: ['Alice', 'Bob'],
      users: [{
        userId: 'ledger-api-user',
        parties: ['Alice', 'Bob'],
        rights: ['CanActAs', 'CanReadAs'],
      }],
    },

    devnet: {
      host: 'validator.example.com',
      adminPort: 5002,
      ledgerPort: 5011,
      httpPort: 8080,
      token: process.env.DEVNET_JWT_TOKEN,
      vetOnUpload: true,
      parties: ['Operator'],
      users: [{
        userId: 'app-operator',
        parties: ['Operator'],
        rights: ['CanActAs', 'CanReadAs'],
      }],
    },
  },
};

Configuration Keys

Key	What it controls
host	Validator host or IP
adminPort	Admin gRPC port (default 5002)
ledgerPort	Ledger gRPC port (default 5001)
httpPort	HTTP JSON API port (default 7575)
grpcAuthority	gRPC :authority for the Ledger API when a proxy routes on name
adminGrpcAuthority	Same for the Admin API
httpHost	HTTP Host header for the JSON API
httpUseTls	Use https for JSON API calls
token / tokenFile / tokenCommand	JWT source (see Authentication)
tls / tlsCertFile	TLS for gRPC; optional CA file
synchronizerId	Logical synchronizer ID (namespace::fingerprint). Required when the participant has more than one synchronizer.
vetOnUpload	Vet during upload. Defaults on for localnet, off otherwise. Override with --vet / --no-vet.
additionalDars	Extra DAR paths uploaded before project DARs
includePackages / excludePackages	Filter packages from daml.yaml / multi-package.yaml
parties	Display names allocated on deploy (skipped if they already exist)
users	Users created on deploy with CanActAs / CanReadAs for their parties
scriptUserId	--user-id passed to dpm script (otherwise JWT sub)

Vendored DARs go in additionalDars or --dar. Data dependencies are not uploaded on their own.

DAR upload uses the Admin API, so adminPort must be reachable.

Configuration Precedence

CLI flags override environment variables, which override the config file.

Authentication

The JWT is resolved in this order:

1. --token
2. CANTON_DEPLOY_TOKEN
3. config token
4. config tokenCommand (a shell command whose stdout is the token)
5. config tokenFile
6. LocalNet development HMAC (network name localnet only)

Synchronizer ID

When a participant has more than one synchronizer, synchronizerId is required.

Use the logical ID from status in the form:

namespace::fingerprint

Do not use a trailing ::NN-N suffix.