Documentation
¶
Overview ¶
Package config loads and validates platformd's configuration from the environment.
Configuration is deliberately tiny and comes from REDOUBT_* environment variables only (the compose bundle written by install.sh sets them, D-004). Every value is validated before use so that a misconfiguration fails at startup with a clear error instead of weakening a golden rule at runtime — in particular the Docker endpoint must be the socket-proxy (golden rule 2).
Index ¶
Constants ¶
const ( EnvDev = "REDOUBT_DEV" EnvDataDir = "REDOUBT_DATA_DIR" EnvDockerHost = "REDOUBT_DOCKER_HOST" EnvListen = "REDOUBT_LISTEN" EnvTraefikContainer = "REDOUBT_TRAEFIK_CONTAINER" EnvTraefikDynamicDir = "REDOUBT_TRAEFIK_DYNAMIC_DIR" EnvACMEResolver = "REDOUBT_ACME_RESOLVER" EnvDomain = "REDOUBT_DOMAIN" EnvAppArmorProfile = "REDOUBT_APPARMOR_PROFILE" // EnvBuildkitAddr is the rootless buildkitd endpoint on the private network (D-018). EnvBuildkitAddr = "REDOUBT_BUILDKIT_ADDR" // EnvBuildCacheBytes caps the BuildKit cache; the pipeline prunes to it after every build. EnvBuildCacheBytes = "REDOUBT_BUILD_CACHE_BYTES" // EnvBootstrapToken overrides the on-disk bootstrap token. Dev mode only (tests/demos); // in production the token lives in <DataDir>/bootstrap-token (D-011). EnvBootstrapToken = "REDOUBT_BOOTSTRAP_TOKEN" // #nosec G101 -- variable NAME, not a credential // EnvHostDataDir is the host path of DataDir as the Docker daemon sees it (bind-mount // sources for job containers). Defaults to DataDir; the compose bundle sets it. EnvHostDataDir = "REDOUBT_HOST_DATA_DIR" // Object store for addon backups and the Litestream sidecar (E2.3, D-008). All four of // endpoint/bucket/access key/secret key must be set together; unset means "local only". EnvS3Endpoint = "REDOUBT_S3_ENDPOINT" EnvS3Region = "REDOUBT_S3_REGION" EnvS3Bucket = "REDOUBT_S3_BUCKET" EnvS3AccessKey = "REDOUBT_S3_ACCESS_KEY" EnvS3SecretKey = "REDOUBT_S3_SECRET_KEY" // #nosec G101 -- variable NAME, not a credential EnvS3PathStyle = "REDOUBT_S3_PATH_STYLE" EnvS3Prefix = "REDOUBT_S3_PREFIX" // EnvBackupInterval is how often every running addon is backed up ("0" disables the // scheduler; manual backups still work). EnvBackupInterval = "REDOUBT_BACKUP_INTERVAL" )
Environment variable names.
const ( DefaultDataDir = "/var/lib/redoubt" DefaultDockerHost = "tcp://socket-proxy:2375" DefaultListenProd = ":8443" DefaultListenDev = "127.0.0.1:8443" DefaultTraefikContainer = "redoubt-traefik" DefaultACMEResolver = "le" DefaultAppArmorProfile = "docker-default" // D-005 DefaultBuildkitAddr = "tcp://buildkitd:1234" DefaultBuildCacheBytes = int64(2) << 30 // 2 GiB — small-VPS friendly (plan §2, §9) DefaultS3Region = "us-east-1" DefaultS3Prefix = "redoubt" DefaultBackupInterval = 24 * time.Hour )
Defaults.
const ( PermKeys = 0o700 PermDir = 0o750 )
Directory permissions used by EnsureDirs.
Variables ¶
var ErrInvalid = errors.New("invalid configuration")
ErrInvalid wraps every validation failure.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// DevMode relaxes production-only checks (local Docker socket, Pebble ACME). Never on by
// default; the compose bundle does not set it.
DevMode bool
// DataDir is the single host directory holding all state (D-012).
DataDir string
// HostDataDir is DataDir's path on the Docker host (bind sources are resolved there).
HostDataDir string
// DockerHost is the Docker Engine API endpoint: the socket-proxy in production.
DockerHost string
// ListenAddr is the host:port the control API/dashboard binds to.
ListenAddr string
// TraefikContainer is the name of the Traefik container platformd attaches to app networks.
TraefikContainer string
// TraefikDynamicDir is the directory Traefik's file provider watches (D-009).
TraefikDynamicDir string
// ACMEResolver is the Traefik certificate resolver name referenced by generated routers.
ACMEResolver string
// BaseDomain is the optional wildcard base for app hostnames (<app>.<BaseDomain>).
BaseDomain string
// AppArmorProfile is applied to every app container (D-005).
AppArmorProfile string
// BootstrapToken, when non-empty, replaces the on-disk token. Only honoured in DevMode.
BootstrapToken string
// BuildkitAddr is the buildkitd gRPC endpoint (tcp://host:port or unix:///path).
BuildkitAddr string
// BuildCacheBytes is the BuildKit cache cap enforced after each build.
BuildCacheBytes int64
// S3* configure the object store for addon backups (empty endpoint = local only).
S3Endpoint string
S3Region string
S3Bucket string
S3AccessKey string
S3SecretKey string
S3PathStyle bool
S3Prefix string
// BackupInterval is the scheduled backup period for every running addon (0 = off).
BackupInterval time.Duration
}
Config is platformd's runtime configuration.
func FromEnv ¶
FromEnv builds a Config from environment variables (via getenv; nil means os.Getenv), applies defaults, and validates it. It never panics; every problem is reported as a wrapped ErrInvalid.
func (Config) EnsureDirs ¶
EnsureDirs creates DataDir and its subdirectories: keys/ with 0700, everything else 0750. Directories that already exist are never chmod'ed (an operator's deliberate permissions are not silently changed) but they are verified: keys/ must have no group/other bits and be owned by the running user, and no directory may be world-writable. Existing non-directories and symlinks in those positions are reported as errors.
In DevMode the permission/ownership checks on pre-existing directories are downgraded to warnings (demos and CI bind-mount a throwaway tree the host user cannot chown to uid 65532); structural problems (symlinks, non-directories) are still errors.
func (Config) EnsureDirsWarn ¶
EnsureDirsWarn is EnsureDirs returning the dev-mode warnings so callers can log them.
func (Config) S3Configured ¶
S3Configured reports whether an object store is configured.
type Paths ¶
type Paths struct {
DB string // SQLite database
Keys string // 0700 directory holding the age key
AgeKey string // age identity used to encrypt secrets at rest (0600)
BootstrapToken string // first-start API token (D-011, 0600)
Traefik string // Traefik state directory
TraefikDynamic string // file-provider directory (== Config.TraefikDynamicDir)
TraefikACME string // Traefik's acme.json
Workspace string // git checkouts / build contexts
Backups string // addon backups
}
Paths are the well-known files and directories derived from DataDir (D-012).
Source Files