Overview

Nextflow Tower Enterprise is now Seqera Platform Enterprise. Existing configuration parameters, configuration files, and API endpoints that include Tower currently remain unchanged.

Set Seqera configuration values using environment variables, a tower.yml configuration file, or individual values stored in AWS Parameter Store. Sensitive values such as database passwords should be stored securely (e.g., as SecureString type parameters in AWS Parameter Store).

Environment variablesYML configurationAWS Parameter Store

Declare environment variables in a tower.env file. For example:

TOWER_CONTACT_EMAIL=hello@foo.com
TOWER_SMTP_HOST=your.smtphost.com

See the Environment variables option in each section below.

Declare YML configuration values in a tower.yml file. For example:

...
mail:
  from: "hello@foo.com"
  smtp:
    host: "your.smtphost.com"
...

See the tower.yml option in each section below. YML configuration keys on this page are listed in "dot" notation, i.e., the SMTP host value in the snippet above is represented as mail.smtp.host in the tables that follow.

Don't declare duplicate keys in your tower.yml configuration file. Seqera will only enforce the last instance of configuration keys that are defined more than once, for example:

# This block will not be enforced due to the duplicate `tower` key below
tower:
    trustedEmails:
        - user@example.com

# This block will be enforced because it's defined last
tower:
    auth:
        oidc:
            - "*@foo.com"

Create parameters in the AWS Parameter Store individually, using the format /config/<application_name>/<cfg_path> : <cfg_value>. For example:

/config/tower-app/mail.smtp.user : <your_username>
/config/tower-app/mail.smtp.password : <your_password>

Sensitive values (such as database passwords) should be SecureString type parameters. See AWS Parameter Store for detailed instructions.

Configuration values not supported in tower.yml or AWS Parameter Store#

Due to the order of operations when deploying Seqera Enterprise, some configuration values can only be retrieved from environment variables (tower.env). The following configuration values are not supported for tower.yml or AWS Parameter Store configuration and must be set as environment variables:

Environment variable	Description	Value
`TOWER_DB_USER`	The user account to access your database. If you are using an external database, you must create this user manually. For installation in a new environment, this value must be set as an environment variable.	Default: `tower`
`TOWER_DB_PASSWORD`	The user password to access your database. If you are using an external database, you must create this password manually. For installation in a new environment, this value must be set as an environment variable.	Default: `tower`
`TOWER_DB_URL`	The URL to access your database. For installation in a new environment, this value must be set as an environment variable.	Example: `jdbc:mysql://db:3306/tower`
`TOWER_APP_NAME`	Application name. To run multiple instances of the same Seqera account, each instance must have a unique name, e.g., `tower-dev` and `tower-prod`. Can also be set in `tower.yml` with `tower.appName`.	Default: `tower`
`TOWER_ENABLE_AWS_SES`	Set `true` to enable AWS Simple Email Service for sending Seqera emails instead of SMTP.	Default: `false`
`TOWER_ENABLE_PLATFORMS`	A comma-separated list of execution backends to enable. At least one is required.	`altair-platform,awsbatch-platform,azbatch-platform,eks-platform,googlebatch-platform,gke-platform,k8s-platform,local-platform,lsf-platform,moab-platform,slurm-platform`
`TOWER_ENABLE_UNSAFE_MODE`	Set to `true` to allow HTTP connections to Seqera. HTTP must not be used in production deployments. HTTPS is used by default from version 22.1.x.	Default: `false`

Basic configuration#

Basic configuration options such as the Seqera instance server URL, application name, and license key.

Basic configuration options

Environment variablestower.ymlAWS Parameter Store

Environment variable	Description	Value
`TOWER_SERVER_URL`	Your Seqera instance hostname, IP address, DNS name, or full reverse proxy path where the application is exposed. The `https://` protocol is required for instances that use an SSL certificate. As of version 22.1, HTTPS is used by default. To use HTTP, set `TOWER_ENABLE_UNSAFE_MODE=true`.	Default: `http://localhost:8000`
`TOWER_LICENSE`	Your Seqera Enterprise license key (required). Contact us to obtain your license key. The key is base64-encoded by Seqera — paste this value exactly as received.	`DT8G5F3...BBV90OW`
`TOWER_APP_NAME`	Application name. To run multiple instances of the same Seqera account, each instance must have a unique name, e.g., `tower-dev` and `tower-prod`.	Default: `tower`
`TOWER_CONFIG_FILE`	Custom path for the `tower.yml` file.	`path/to/tower/config`
`TOWER_LANDING_URL`	Custom landing page for the application (requires version 21.10.1 or later). This value doesn't change the `TOWER_SERVER_URL` used for inbound Seqera connections.	`https://your.custom.landing.net`
`TOWER_CRON_SERVER_PORT`	Define the HTTP port used by the Seqera cron service (requires version 21.06.1 or later).	`8080`
`TOWER_ROOT_USERS`	Grant users access to the application admin panel.	`user1@your-company.com,user2@your-company.com`
`TOWER_CONTACT_EMAIL`	Your Seqera system administrator contact email.	`seqera@your-company.com`
`TOWER_USER_WORKSPACE_ENABLED`	Enable or disable user private workspaces (requires version 22.1.0 or later).	Default: `true`

YML configuration keys in this table are listed in "dot" notation, i.e., a nested value:

...
mail:
  smtp:
    host: "your.smtphost.com"
...

is represented as mail.smtp.host.

tower.yml	Description	Value
`tower.serverUrl`	Your Seqera instance hostname, IP address, DNS name, or full reverse proxy path where the application is exposed. The `https://` protocol is required for instances that use an SSL certificate. As of version 22.1, HTTPS is used by default. To use HTTP, set `TOWER_ENABLE_UNSAFE_MODE=true`.	Default: `http://localhost:8000`
`tower.license`	Your Seqera Enterprise license key (required). Contact us to obtain your license key. The key is base64-encoded by Seqera — paste this value exactly as received.	`DT8G5F3...BBV90OW`
`tower.appName`	Application name. To run multiple instances of the same Seqera account, each instance must have a unique name, e.g., `tower-dev` and `tower-prod`.	Default: `tower`
Use Environment variable	Custom path for the `tower.yml` file.	Use Environment variable
`tower.landingUrl`	Custom landing page for the application (requires version 21.10.1 or later). This value doesn't change the `TOWER_SERVER_URL` used for inbound Seqera connections.	`https://your.custom.landing.net`
`micronaut.server.port`	Define the HTTP port used by the Seqera cron service (requires version 21.06.1 or later).	`8080`
`tower.admin.root-users`	Grant users access to the application admin panel.	`user1@your-company.com,user2@your-company.com`
`tower.contactEmail`	Your Seqera system administrator contact email.	`tower@your-company.com`
`tower.admin.user-workspace-enabled`	Enable or disable user private workspaces (requires version 22.1.0 or later).	Default: `true`

Prefix each configuration path with /config/<application_name>, where application_name is tower or your custom application name. See AWS Parameter Store.

AWS Parameter Store	Description	Value
`/tower/serverUrl`	Your Seqera instance hostname, IP address, DNS name, or full reverse proxy path where the application is exposed. The `https://` protocol is required for instances that use an SSL certificate. As of version 22.1, HTTPS is used by default. To use HTTP, set `TOWER_ENABLE_UNSAFE_MODE=true`.	Default: `http://localhost:8000`
`/tower/license`	Your Seqera Enterprise license key (required). Contact us to obtain your license key. The key is base64-encoded by Seqera — paste this value exactly as received.	`DT8G5F3...BBV90OW`
Use environment variable	Application name. To run multiple instances of the same Seqera account, each instance must have a unique name, e.g., `tower-dev` and `tower-prod`.	Use environment variable
Use Environment variable	Custom path for the `tower.yml` file.	Use Environment variable
`/tower/landingUrl`	Custom landing page for the application (requires version 21.10.1 or later). This value doesn't change the `TOWER_SERVER_URL` used for inbound Seqera connections.	`https://your.custom.landing.net`
`/micronaut/server/port`	Define the HTTP port used by the Seqera cron service (requires version 21.06.1 or later).	`8080`
`/tower/admin/root-users`	Grant users access to the application admin panel.	`user1@your-company.com,user2@your-company.com`
`/tower/contactEmail`	Your Seqera system administrator contact email.	`tower@your-company.com`
`/tower/admin/user-workspace-enabled`	Enable or disable user private workspaces (requires version 22.1.0 or later).	Default: `true`

Seqera and Redis databases#

Configuration values that control Seqera's interaction with databases and Redis instances. TOWER_DB_USER, TOWER_DB_PASSWORD, and TOWER_DB_URL must be specified using environment variables during initial Seqera Enterprise deployment in a new environment. A new installation will fail if DB values are only defined in tower.yml or the AWS Parameter Store. Once the database has been created, these values can be added to tower.yml or AWS Parameter Store entries and removed from your environment variables.

From Seqera Enterprise version 23.2, we officially support Redis version 6, and compatibility has been tested with the following specific Redis versions:

7.0.4, 7.0.2, 7.0
6.2.12, 6.2.10, 6.2.8
6.0.18, 6.0.16

Follow your cloud provider specifications to upgrade your instance.

If you use a database other than the provided db container, you must create a MySQL user and database schema manually.

MySQLMariaDB

CREATE DATABASE tower;
ALTER DATABASE tower CHARACTER SET utf8 COLLATE utf8_bin;

CREATE USER 'tower' IDENTIFIED BY <password>;
GRANT ALL PRIVILEGES ON tower.* TO tower@'%' ;

GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, EVENT, TRIGGER on tower.* TO tower@'%';

Managed Redis services

Seqera supports managed Redis services such as Amazon ElastiCache, Azure Cache for Redis, or Google Memorystore.

AWS ElastiCache requirementsAzure Cache for Redis requirementsGoogle Memorystore requirements

Use a single-node cluster, as multi-node clusters are not supported
Use an instance with at least 6GB capacity (cache.m4.large or greater)
Specify your private ElastiCache instance in the Seqera environment variables:
1
TOWER_REDIS_URL=redis://<redis private IP>:6379

Use a single-node cluster, as multi-node clusters are not supported
Use an instance with at least 6GB capacity (C3 or greater)
Specify your private Azure Cache for Redis instance in the Seqera environment variables:
1
TOWER_REDIS_URL=redis://<redis private IP>:6379

Use a single-node cluster, as multi-node clusters are not supported
Use an instance with at least 6GB capacity (M2 or greater)
Specify your private Memorystore instance in the Seqera environment variables:
1
TOWER_REDIS_URL=redis://<redis private IP>:6379

Database and Redis manual configuration options

If the DB username and password variables are left empty when using Docker Compose, default tower database values are applied automatically. With Kubernetes and custom DB deployments, tower values are not pre-filled.

Environment variablestower.ymlAWS Parameter Store

Environment variable	Description	Value
`TOWER_DB_USER`	The user account to access your database. If you are using an external database, you must create this user manually.	Default: `tower`
`TOWER_DB_PASSWORD`	The user password to access your database. If you are using an external database, you must create this password manually.	Default: `tower`
`TOWER_DB_URL`	The URL to access your database.	Example: `jdbc:mysql://db:3306/tower`
`TOWER_DB_MIN_POOL_SIZE`	Minimum database connection pool size.	Default: `5`
`TOWER_DB_MAX_POOL_SIZE`	Maximum database connection pool size.	Default: `10`
`TOWER_DB_MAX_LIFETIME`	Maximum lifespan of database connections, in milliseconds.	Default: `1800000`
`TOWER_REDIS_URL`	The URL to access your Seqera Redis instance.	Example: `redis://redis:6379`
`TOWER_REDIS_PASSWORD`	The password of your Seqera Redis instance.

YML configuration keys in this table are listed in "dot" notation, i.e., a nested value:

...
mail:
  smtp:
    host: "your.smtphost.com"
...

is represented as mail.smtp.host.

TOWER_DB_USER, TOWER_DB_PASSWORD, and TOWER_DB_URL must be specified using environment variables during initial Seqera Enterprise deployment in a new environment.

tower.yml	Description	Value
`datasources.default.username`	The user account to access your database. If you are using an external database, you must create this user manually. For installation in a new environment, this value must be set as an environment variable.	Default: `tower`
`datasources.default.password`	The user password to access your database. If you are using an external database, you must create this password manually. For installation in a new environment, this value must be set as an environment variable.	Default: `tower`
`datasources.default.url`	The URL to access your database. For installation in a new environment, this value must be set as an environment variable.	Example: `jdbc:mysql://db:3306/tower`
`datasources.default.minPoolSize`	Minimum database connection pool size.	Default: `5`
`datasources.default.maxPoolSize`	Maximum database connection pool size.	Default: `10`
`datasources.default.maxLifetime`	Maximum lifespan of database connections, in milliseconds.	Default: `1800000`
`redisson.uri`	The URL to access your Seqera Redis instance.	Example: `redis://redis:6379`
`redisson.password`	The password of your Seqera Redis instance.

Prefix each configuration path with /config/<application_name>, where application_name is tower or your custom application name. See AWS Parameter Store.

TOWER_DB_USER, TOWER_DB_PASSWORD, and TOWER_DB_URL must be specified using environment variables during initial Seqera Enterprise deployment in a new environment.

AWS Parameter Store	Description	Value
`/datasources/default/username`	The user account to access your database. If you are using an external database, you must create this user manually. For installation in a new environment, this value must be set as an environment variable.	Default: `tower`
`/datasources/default/password`	The user password to access your database. If you are using an external database, you must create this password manually. For installation in a new environment, this value must be set as an environment variable.	Default: `tower`
`/datasources/default/url`	The URL to access your database. For installation in a new environment, this value must be set as an environment variable.	`jdbc:mysql://db:3306/tower`
`/datasources/default/minPoolSize`	Minimum database connection pool size.	Default: `5`
`/datasources/default/maxPoolSize`	Maximum database connection pool size.	Default: `10`
`/datasources/default/maxLifetime`	Maximum lifespan of database connections, in milliseconds.	Default: `1800000`
`/redisson/uri`	The URL to access your Seqera Redis instance.	Example: `redis://redis:6379`
`/redisson/password`	The password of your Seqera Redis instance.

Opt-in Seqera features#

Configuration values that enable opt-in Seqera features per instance or workspace.

Seqera feature configuration options

Environment variables

Environment variable	Description	Value
`TOWER_ENABLE_AWS_SSM`	Enable Seqera configuration value retrieval from AWS Parameter Store.	Default: `false`
`TOWER_ENABLE_AWS_SES`	Use AWS Simple Email Service (SES) to send Seqera emails instead of SMTP.	Default: `false`

Cryptographic options#

Configuration values that control the way Seqera secures your data.

Do not modify your crypto secret key between starts. Changing this value will prevent the decryption of existing data.

Cryptographic configuration options

Environment variablestower.ymlAWS Parameter Store

Environment variable	Description	Value
`TOWER_CRYPTO_SECRETKEY`	The secret key used to encrypt user credentials (required).	Random string of alphanumeric characters.
`TOWER_JWT_SECRET`	The secret used to generate the login JWT token (required).	Random string of 35 characters or more.

YML configuration keys in this table are listed in "dot" notation, i.e., a nested value:

...
mail:
  smtp:
    host: "your.smtphost.com"
...

is represented as mail.smtp.host.

tower.yml	Description	Value
`tower.crypto.secretKey`	The secret key used to encrypt user credentials (required).	Random string of alphanumeric characters.
`micronaut.security.token.jwt.signatures.secret.generator.secret`	The secret used to generate the login JWT token (required).	Random string of 35 characters or more.
`micronaut.security.token.jwt.generator.refresh-token.secret`	The secret used to generate the login refresh token (required).	Random string of 35 characters or more.

Prefix each configuration path with /config/<application_name>, where application_name is tower or your custom application name. See AWS Parameter Store.

AWS Parameter Store	Description	Value
`/tower/crypto/secretKey`	The secret key used to encrypt user credentials (required).	Random string of alphanumeric characters.
`/micronaut/security/token/jwt/signatures/secret/generator/secret`	The secret used to generate the login JWT token (required).	Random string of 35 characters or more.
`/micronaut/security/token/jwt/generator/refresh-token/secret`	The secret used to generate the login refresh token (required).	Random string of 35 characters or more.

Compute environments#

Configuration values that control the way Seqera presents resources created by Tower Forge.

Compute environment configuration options

Environment variables

Environment variable	Description	Value
`TOWER_ENABLE_PLATFORMS`	Comma-separated list of the execution backends to enable. At least one is required.	`altair-platform,awsbatch-platform,azbatch-platform,eks-platform,googlebatch-platform,gke-platform,k8s-platform,local-platform,lsf-platform,moab-platform,slurm-platform`
`MICRONAUT_ENVIRONMENTS`	Configuration values to control the behavior of the Seqera `cron` and `backend` containers.	Backend configuration: `prod`, `redis`, `ha` Cron configuration: `prod`, `redis`, `cron`
`TOWER_FORGE_PREFIX`	Override the default `TowerForge` prefix, appended to AWS resources created by Tower Forge, with a custom value.	Default: `TowerForge`

Git integration#

Seqera Platform has built-in support for public and private Git repositories. Create Git provider credentials to allow Seqera to interact with the following services:

Credentials configured in your SCM providers list override Git credentials in your (organization or personal) workspace.

Public Git repositories can be accessed without authentication, but are often subject to throttling. We recommend always adding Git credentials to your Seqera workspace, regardless of the repository type you use.

Git configuration options

Environment variablestower.ymlAWS Parameter Store

Environment variable	Description
`TOWER_SCM_PROVIDERS_GITHUB_USER`	Your GitHub username.
`TOWER_SCM_PROVIDERS_GITHUB_PASSWORD`	Your GitHub (classic or fine-grained) access token.
`TOWER_SCM_PROVIDERS_GITLAB_USER`	Your GitLab username.
`TOWER_SCM_PROVIDERS_GITLAB_PASSWORD`	Your GitLab (Personal, Group, or Project) access token.
`TOWER_SCM_PROVIDERS_GITLAB_TOKEN`	Your GitLab (Personal, Group, or Project) access token.
`TOWER_SCM_PROVIDERS_BITBUCKET_USER`	Your BitBucket username.
`TOWER_SCM_PROVIDERS_BITBUCKET_PASSWORD`	Your BitBucket App password.
`TOWER_SCM_PROVIDERS_GITEA_USER`	Your Gitea username.
`TOWER_SCM_PROVIDERS_GITEA_PASSWORD`	Your Gitea token.
`TOWER_SCM_PROVIDERS_AZUREREPOS_USER`	Your Azure DevOps repository username.
`TOWER_SCM_PROVIDERS_AZUREREPOS_TOKEN`	Your Azure DevOps repository personal access token.

YML configuration keys in this table are listed in "dot" notation, i.e., a nested value:

...
mail:
  smtp:
    host: "your.smtphost.com"
...

is represented as mail.smtp.host.

tower.yml	Description
`tower.scm.provider.github.user`	Your GitHub username.
`tower.scm.provider.github.password`	Your GitHub (classic or fine-grained) access token.
`tower.scm.provider.gitlab.user`	Your GitLab username.
`tower.scm.provider.gitlab.password`	Your GitLab (Personal, Group, or Project) access token.
`tower.scm.provider.gitlab.token`	Your GitLab (Personal, Group, or Project) access token.
`tower.scm.provider.bitbucket.user`	Your BitBucket username.
`tower.scm.provider.bitbucket.password`	Your BitBucket App password.
`tower.scm.provider.gitea.user`	Your Gitea username.
`tower.scm.provider.gitea.password`	Your Gitea token.
`tower.scm.provider.azurerepos.user`	Your Azure DevOps repository username.
`tower.scm.provider.azurerepos.token`	Your Azure DevOps repository personal access token.

Prefix each configuration path with /config/<application_name>, where application_name is tower or your custom application name. See AWS Parameter Store.

AWS Parameter Store	Description
`/tower/scm/provider/github/user`	Your GitHub username.
`/tower/scm/provider/github/password`	Your GitHub (classic or fine-grained) access token.
`/tower/scm/provider/gitlab/user`	Your GitLab username.
`/tower/scm/provider/gitlab/password`	Your GitLab (Personal, Group, or Project) access token.
`/tower/scm/provider/gitlab/token`	Your GitLab (Personal, Group, or Project) access token.
`/tower/scm/provider/bitbucket/user`	Your BitBucket username.
`/tower/scm/provider/bitbucket/password`	Your BitBucket App password.
`/tower/scm/provider/gitea/user`	Your Gitea username.
`/tower/scm/provider/gitea/password`	Your Gitea token.
`/tower/scm/provider/azurerepos/user`	Your Azure DevOps repository username.
`/tower/scm/provider/azurerepos/token`	Your Azure DevOps repository personal access token.

Local repositories#

Seqera Enterprise can connect to workflows stored in local Git repositories. To do so, volume mount your local repository folder in your Seqera backend container. Then, update your tower.yml:

tower:
    pipeline:
        allow-local-repos:
            - /path/to/repo

Mail server#

Configure values for Seqera email service integration.

SMTP service integration#

Production SMTP hosts must use a TLS-protected connection. See SSL/TLS.

Your organization's email security policy may prevent the TOWER_CONTACT_EMAIL address from receiving Seqera emails. If this occurs after successful SMTP configuration, you may need to configure spf, dkim, and dmarc records for your domain. Contact your IT support staff for further assistance.

SMTP mail service configuration

To use an SMTP gateway for mail service, set SMTP user and password values to null.

Environment variablestower.ymlAWS Parameter Store

Environment variable	Description	Value
`TOWER_SMTP_USER`	Your email service user.	Example: `user`
`TOWER_SMTP_PASSWORD`	Your email service password.
`TOWER_SMTP_HOST`	Your email service endpoint URL, excluding protocol.	Example: `email-smtp.eu-west-1.amazonaws.com`
`TOWER_SMTP_PORT`	Your email service port. Note that most cloud services block port 25 by default.	Default: `587`
`TOWER_CONTACT_EMAIL`	The email address used to send Seqera emails.	Example: `seqera@your-company.com`
`TOWER_SMTP_AUTH`	Use SMTP authentication when calling your email service endpoint.	Default: `true`
`TOWER_SMTP_STARTTLS_ENABLED`	Switch the connection to a TLS-protected connection before issuing login commands. Must be `true` for production SMTP hosts.	Recommended: `true`
`TOWER_SMTP_STARTTLS_REQUIRED`	Require the use of the STARTTLS command. Must be `true` for production SMTP hosts.	Recommended: `true`

YML configuration keys in this table are listed in "dot" notation, i.e., a nested value:

...
mail:
  smtp:
    host: "your.smtphost.com"
...

is represented as mail.smtp.host.

tower.yml	Description	Value
`mail.smtp.user`	Your email service user.	Example: `user`
`mail.smtp.password`	Your email service password.
`mail.smtp.host`	Your email service endpoint URL, excluding protocol.	Example: `email-smtp.eu-west-1.amazonaws.com`
`mail.smtp.port`	Your email service port. Note that most cloud services block port 25 by default.	Default: `587`
`mail.from`	The email address used to send Seqera emails.	Example: `Seqera@your-company.com`
`mail.smtp.auth`	Use SMTP authentication when calling your email service endpoint.	Default: `true`
`mail.smtp.starttls.enable`	Switch the connection to a TLS-protected connection before issuing login commands. Must be `true` for production SMTP hosts.	Recommended: `true`
`mail.smtp.starttls.required`	Require the use of the STARTTLS command. Must be `true` for production SMTP hosts.	Recommended: `true`

Prefix each configuration path with /config/<application_name>, where application_name is tower or your custom application name. See AWS Parameter Store.

AWS Parameter Store	Description	Value
`/mail/smtp/user`	Your email service user.	Example: `user`
`/mail/smtp/password`	Your email service password.
`/mail/smtp/host`	Your email service endpoint URL, excluding protocol.	Example: `email-smtp.eu-west-1.amazonaws.com`
`/mail/smtp/port`	Your email service port. Note that most cloud services block port 25 by default.	Default: `587`
`/mail/from`	The email address used to send Seqera emails.	Example: `seqera@your-company.com`
`/mail/smtp/auth`	Use SMTP authentication when calling your email service endpoint.	Default: `true`
`/mail/smtp/starttls/enable`	Switch the connection to a TLS-protected connection before issuing login commands. Must be `true` for production SMTP hosts.	Recommended: `true`
`/mail/smtp/starttls/required`	Require the use of the STARTTLS command. Must be `true` for production SMTP hosts.	Recommended: `true`

AWS SES integration#

From version 23.2, you can use AWS SES (Simple Email Service) instead of traditional SMTP for sending Seqera platform emails.

AWS Simple Email Service (SES) configuration

To configure AWS SES as your Seqera email service:

Set TOWER_ENABLE_AWS_SES=true in your environment variables.
Specify the email address used to send Seqera emails with one of the following:
- the TOWER_CONTACT_EMAIL environment variable
- a mail.from entry in tower.yml
- a /config/<application_name>/mail/from AWS Parameter Store entry
The AWS SES service must be running in the same region as your Seqera instance.
The Seqera IAM role must include the ses:SendRawEmail permission.

(Optional) Mail proxy server#

Mail proxy server configuration details must be set either in tower.yml or AWS Parameter Store.

Proxy server configuration options

tower.ymlAWS Parameter Store

YML configuration keys in this table are listed in "dot" notation, i.e., a nested value:

...
mail:
  smtp:
    host: "your.smtphost.com"
...

is represented as mail.smtp.host.

tower.yml	Description	Value
`mail.smtp.proxy.host`	Specify the host name of an HTTP web proxy server that will be used for connections to the mail server.	Example: `http://my.proxy.int`
`mail.smtp.proxy.port`	Specify the port number for the HTTP web proxy server. Defaults to 80 if not set.	Example: `80`
`mail.smtp.proxy.user`	Specify the username to authenticate with the HTTP web proxy server. No authentication is performed if not set.	Example: `proxy_user_1`
`mail.smtp.proxy.password`	Specify the password to authenticate with the HTTP web proxy server. No authentication is performed if not set.

Prefix each configuration path with /config/<application_name>, where application_name is tower or your custom application name. See AWS Parameter Store.

AWS Parameter Store	Description	Value
`/mail/smtp/proxy/host`	Specify the host name of an HTTP web proxy server that will be used for connections to the mail server.	Example: `http://my.proxy.int`
`/mail/smtp/proxy/port`	Specify the port number for the HTTP web proxy server. Defaults to 80 if not set.	Example: `80`
`/mail/smtp/proxy/user`	Specify the username to authenticate with the HTTP web proxy server. No authentication is performed if not set.	Example: `proxy_user_1`
`/mail/smtp/proxy/password`	Specify the password to authenticate with the HTTP web proxy server. No authentication is performed if not set.

Nextflow launch container#

Do not replace the Seqera-provided default image unless absolutely necessary.

Nextflow launch container configuration options

Environment variables

Environment variable	Description	Value
`TOWER_LAUNCH_CONTAINER`	The container image to run the Nextflow execution (requires version 20.10.2 or later). This setting overrides the launch container selection for all organizations and workspaces in your account.	Example: `nf-launcher:j17-23.04.1`

Seqera API#

Enable the API endpoints to host the Seqera Enterprise OpenAPI specification and use the tw CLI.

Seqera API configuration options

Environment variables

Environment variable	Description	Value
`TOWER_ENABLE_OPENAPI`	Enable the OpenAPI documentation endpoint, e.g., tower.nf/openapi/index.html.	Default: `true`

Modify your Seqera instance's navigation menu options.

Seqera custom navigation menu configuration options

tower.yml

tower:
  navbar:
    menus:
      - label: "My Community"
        url: "https://host.com/foo"
      - label: "My Pipelines"
        url: "https://other.com/bar"

Logging#

Customize the format of emitted log messages.

Seqera logging configuration options

Environment variables

Environment variable	Description	Value
`TOWER_LOG_APPENDER_TYPE`	The output format of Seqera logs.	Options: `STDOUT`, `JSON`
`TOWER_LOG_LEVEL`	Seqera application event logging detail level.	Options: `TRACE`, `DEBUG`, `INFO`, `WARN`, `ERROR`
`TOWER_SECURITY_LOGLEVEL`	Seqera login event logging detail level.	Options: `TRACE`, `DEBUG`, `INFO`, `WARN`, `ERROR`
`TOWER_LOG_DIR`	Base directory to store Seqera logs.
`TOWER_LOG_PATTERN`	The logging format emitted to STDOUT. See here for a reference of the full logback pattern syntax.	`%d{MMM-dd HH:mm:ss.SSS} [%t] %X{ip:--} %-5level %logger{36} - %msg%n} # Default logging pattern shown`

Overview

Configuration values not supported in tower.yml or AWS Parameter Store#

Basic configuration#

Seqera and Redis databases#

Opt-in Seqera features#

Cryptographic options#

Compute environments#

Git integration#

Local repositories#

Mail server#

SMTP service integration#

AWS SES integration#

(Optional) Mail proxy server#

Nextflow launch container#

Seqera API#

Custom navigation menu#

Logging#