corebundle

Overview ¶

controlplane.go: 内部控制平面端点 HMAC 密钥环构造（/internal/v1/* service token）。

Code in this file is intentionally minimal: it carries the //go:generate directive that drives `go generate ./cmd/corebundle/`, kept in its own file so the directive is discoverable and not buried inside any of the per-concern bundle_*.go composition root files.

jwt_deps.go: JWT 签名/验证依赖构建（Registry + issuer + verifier）。

Code generated by gocell generate assembly. DO NOT EDIT.

metrics.go: Prometheus 指标栈构建与 /metrics handler 守卫。

Code generated by gocell generate assembly. DO NOT EDIT. Source: assemblies/corebundle/assembly.yaml

per_cell_adapter.go: per-cell env-loading helpers for adapter configuration.

ref: Kratos config/env prefix-strip convention — each module reads its own namespace. ref: uber-go/fx fx.Module + fx.Private — module-private dependencies.

per_cell_broker.go: per-cell broker-URL env-loading helper.

ref: Kratos config/env prefix-strip convention — each module reads its own namespace. ref: cellmodules/percellpg + per_cell_adapter.go (LoadPGConfig) — the per-cell DSN twin.

Package main is the entry point for the corebundle assembly. It bootstraps configcore, accesscore, and auditcore with in-memory repositories by default, suitable for development and integration testing.

DurabilityDemo is used with memory storage so Cells auto-fill explicit no-op dependencies. Set GOCELL_CELL_ADAPTER_MODE=postgres to switch the assembly to DurabilityDurable and require real writer/tx dependencies; set GOCELL_ADAPTER_MODE=real to enable production control-plane secret checks.

Required env vars (all adapter modes) ¶

• GOCELL_JWT_ISSUER: JWT iss claim written into tokens and verified on inbound requests via VerifyIntent. Must be set before startup.

• GOCELL_JWT_AUDIENCE: JWT aud claim written into tokens and verified on inbound requests via VerifyIntent. Must be set before startup.

• GOCELL_SERVICE_SECRET: HMAC-SHA256 secret (>=32 bytes) protecting /internal/v1/* paths via ServiceTokenMiddleware. Must be set in all adapter modes; missing in any mode aborts startup with ERR_CONTROLPLANE_SERVICE_SECRET_MISSING (SEC-FAIL-CLOSED, PR-MODE-1).

See also: docs/ops/env-vars.md for the full env var reference.