The Notifications plugin validates incoming tokens with the JWT public key mechanism. It does not initiate service-to-service calls, so it has no service-account client registration:
Environment Variable
Description
Default Value
SECURITY_TYPE
Token validation mechanism (JWT public key validation)
URL of the organization-manager service, used by the security library
http://organization-manager:80
Upgrading from 5.1.x? Remove the legacy opaque-token env vars: SECURITY_OAUTH2_REALM, SECURITY_OAUTH2_CLIENT_CLIENTID, and SECURITY_OAUTH2_CLIENT_CLIENTSECRET. These belong to the removed introspection model and prevent the service from starting on 5.9.x. See the authentication and IAM migration guide for the full list.
Notification Plugin uses Redis for caching. Configure Redis connection using the standard Redis environment variables.Quick reference:
Environment Variable
Description
Example Value
Status
SPRING_DATA_REDIS_HOST
Redis server hostname
localhost
Recommended
SPRING_DATA_REDIS_PORT
Redis server port
6379
Recommended
SPRING_DATA_REDIS_PASSWORD
Redis authentication password
-
Recommended
REDIS_TTL
Cache TTL in milliseconds
5000000
Optional
Both SPRING_DATA_REDIS_* and SPRING_REDIS_* variable prefixes are supported. The SPRING_DATA_REDIS_* prefix is the modern Spring Boot standard and is recommended for new deployments.
For advanced Redis deployment modes (Sentinel, Cluster) and SSL/TLS setup, see the Redis Configuration guide. Note that Sentinel and Cluster modes are only supported by the Events Gateway service.
When using the kafka-auth profile, the security protocol will automatically be set to SASL_PLAINTEXT and the SASL mechanism will be set to OAUTHBEARER.
Based on use case you can use directly a file system or an S3 compatible cloud storage solution (for example min.io).The file storage solution can be configured using the following environment variables:
Environment Variable
Description
Default Value
APPLICATION_FILESTORAGE_TYPE
Storage type to use (s3 or fileSystem)
s3
APPLICATION_FILESTORAGE_DISKDIRECTORY
Directory for file storage when using filesystem
MS_SVC_NOTIFICATION
APPLICATION_FILESTORAGE_S3_ENABLED
Enable S3-compatible storage
true
APPLICATION_FILESTORAGE_S3_SERVERURL
URL of MinIO or S3-compatible server
http://minio-service:9000
APPLICATION_FILESTORAGE_S3_ENCRYPTIONENABLED
Enable server-side encryption
false
APPLICATION_FILESTORAGE_S3_ACCESSKEY
Access key for S3
minio
APPLICATION_FILESTORAGE_S3_SECRETKEY
Secret key for S3
secret
APPLICATION_FILESTORAGE_S3_BUCKETPREFIX
Prefix for bucket names
qdevlocal-preview-paperflow
When using S3-compatible storage for notifications with attachments, the S3 user configured through APPLICATION_FILESTORAGE_S3_ACCESSKEY and APPLICATION_FILESTORAGE_S3_SECRETKEY must have read access to multiple buckets beyond its own:Required bucket access:
Own bucket - defined by APPLICATION_FILESTORAGE_S3_BUCKETPREFIX
Documents Plugin bucket - defined in the Documents Plugin configuration via APPLICATION_FILESTORAGE_S3_BUCKETPREFIX
CMS Core public bucket - defined in the CMS Core configuration via APPLICATION_FILESTORAGE_S3_BUCKETNAME
Integration Designer bucket - defined in the Integration Designer configuration via APPLICATION_FILESTORAGE_S3_BUCKETPREFIX
Ensure your S3 user has appropriate read permissions to all releva dnt buckets to avoid attachment failures.
The notification plugin sends email through the simple-java-mail library, which auto-binds every simplejavamail.* property — set them as environment variables the same way as the values above. The options below come up most often when connecting to corporate SMTP relays:
Environment Variable
Description
Default Value
SIMPLEJAVAMAIL_DEFAULTS_VERIFYSERVERIDENTITY
Verify that the hostname in the server’s TLS certificate matches the configured SMTP host. Set to false for relays whose certificate doesn’t match the configured hostname; the connection stays encrypted
true
SIMPLEJAVAMAIL_DEFAULTS_TRUSTEDHOSTS
Semicolon-delimited list of hosts whose TLS certificates are trusted without chain validation
–
SIMPLEJAVAMAIL_DEFAULTS_TRUSTALLHOSTS
Accept any TLS certificate without chain validation. Prefer SIMPLEJAVAMAIL_DEFAULTS_TRUSTEDHOSTS
false
SIMPLEJAVAMAIL_DEFAULTS_SESSIONTIMEOUTMILLIS
Socket timeout (in milliseconds) for the SMTP session. Raise for slow relays
60000
These defaults load into the library’s global configuration, so they apply to all mailers the plugin creates — including the ones built dynamically for Email Sender systems configured in the Integration Designer, whose settings override only the connection fields (host, port, username, password, transport strategy). Changing SIMPLEJAVAMAIL_DEFAULTS_VERIFYSERVERIDENTITY or SIMPLEJAVAMAIL_DEFAULTS_TRUSTALLHOSTS therefore affects every configured email system.
When KAFKA_CONSUMER_ERRORHANDLING_ENABLED is set to true:
The application will retry processing failed messages according to KAFKA_CONSUMER_ERRORHANDLING_RETRIES
Between retries, the application will wait for the duration specified by KAFKA_CONSUMER_ERRORHANDLING_RETRYINTERVAL
For example, if KAFKA_CONSUMER_ERRORHANDLING_RETRYINTERVAL is set to 5000 (5 seconds) and KAFKA_CONSUMER_ERROR_HANDLING_RETRIES is set to 5, the consumer application will make up to 5 attempts, waiting 5 seconds between each attempt.
When using the ‘kafka-auth’ profile, the security protocol changes to ‘SASL_PLAINTEXT’ and requires OAuth configuration via the KAFKA_OAUTH_* variables.
The Notification plugin is exposed externally on the admin host. Routing is configured through the FlowX Helm chart, which renders either a Kubernetes Ingress (default) or a Gateway API HTTPRoute per service. CORS handling lives in the service code; only the allowed-origins list is deployment-specific.
Comma-separated list of origins allowed to call this service from the browser. Supports wildcard subdomains. Must include every Designer and integration domain that issues browser requests against Notification.
-
Allowed methods, allowed headers (including Authorization, Content-Type, Fx-Workspace-Id), and credential handling are baked into the service’s application.yaml with safe defaults. Override these only if you have a non-standard requirement.For the complete route reference, Gateway API HTTPRoute configuration, and route customization, see the ingress configuration guide.
