Configuration

Settings live in canton-deploy.config.js at the project root or a parent directory. Select a named network with --network.

Run:

dpm canton-deploy init

or copy canton-deploy.config.example.js.

If the nearest package.json contains "type": "module", use canton-deploy.config.cjs instead.

Example Configuration

module.exports = {
  defaultNetwork: 'localnet',

  networks: {
    localnet: {
      host: 'localhost',
      adminPort: 5002,
      ledgerPort: 5001,
      httpPort: 7575,
      uploadVia: 'ledger',
      vetOnUpload: true,
      excludePackages: ['./tests', 'my-app-tests'],
      additionalDars: [],
      parties: ['Alice', 'Bob'],
      users: [{
        userId: 'ledger-api-user',
        parties: ['Alice', 'Bob'],
        rights: ['CanActAs', 'CanReadAs'],
      }],
    },

    devnet: {
      host: 'validator.example.com',
      adminPort: 5002,
      ledgerPort: 5011,
      httpPort: 8080,
      token: process.env.DEVNET_JWT_TOKEN,
      vetOnUpload: true,
      parties: ['Operator'],
      users: [{
        userId: 'app-operator',
        parties: ['Operator'],
        rights: ['CanActAs', 'CanReadAs'],
      }],
    },
  },
};

Configuration Keys

Key	What it controls
host	Validator host or IP
adminPort	Admin gRPC port (default 5002)
ledgerPort	Ledger gRPC port (default 5001)
httpPort	HTTP JSON API port (default 7575)
grpcAuthority	gRPC :authority for the Ledger API when a proxy routes on name
adminGrpcAuthority	Same for the Admin API
httpHost	HTTP Host header for the JSON API
httpUseTls	Use https for JSON API calls
token / oauth2 / tokenFile / tokenCommand	JWT source (see Authentication)
tunnel.ssh	Optional SSH -L forwards opened before network commands (see Remote Validators)
uploadVia	"admin" or "ledger": DAR upload path (default ledger). Ledger uses gRPC UploadDarFile, with a JSON POST /v2/dars fallback if Ledger gRPC is unreachable.
synchronizerId	Logical synchronizer ID (namespace::fingerprint). Required when the participant has more than one synchronizer.
vetOnUpload	Vet during upload. Defaults on for localnet, off otherwise (TestNet/MainNet upload-only by default). Override with --vet / --no-vet.
additionalDars	Extra DAR paths uploaded before project DARs
includePackages / excludePackages	Filter packages from daml.yaml / multi-package.yaml
parties	Display names allocated on deploy (skipped if they already exist)
users	Users created on deploy with CanActAs / CanReadAs for their parties
scriptUserId	--user-id passed to dpm script (otherwise JWT sub)

Vendored DARs go in additionalDars or --dar. Data dependencies are not uploaded on their own.

Upload Paths

ledger (default) works on managed validators where only the Ledger and JSON APIs are exposed. admin uses Canton Admin UploadDar (operator tooling; needs adminPort). The dars, vet, and vet-dar commands always use the Admin API. On validators without Admin, vet during upload with deploy --vet on the ledger path.

Upload path precedence:

--upload-via → CANTON_DEPLOY_UPLOAD_VIA → config uploadVia → ledger

Configuration Precedence

CLI flags override environment variables, which override the config file.

Authentication

Token sources, resolution order, and OAuth2 client credentials are covered in Authentication.

Synchronizer ID

When a participant has more than one synchronizer, synchronizerId is required.

Use the logical ID from status in the form:

namespace::fingerprint

Do not use a trailing ::NN-N suffix.