Documentation
¶
Overview ¶
Package daemonconfig is a strict, versioned, operator-selected daemon configuration file loaded ONLY when `mecated serve --config PATH` is explicitly supplied. No conventional auto-load, no project discovery, no app.Config widening.
Schema v1 is a small API-edge subset: gRPC listen address, HTTP/SSE listen address, metrics/admin address, TLS cert/key/CA paths, and rate-limit/burst. Authentication TOKEN VALUE is NOT accepted in YAML; server auth remains MECATL_AUTH_TOKEN / existing CLI behaviour. OTLP is deferred.
Precedence: built-in defaults < config file < explicitly supplied CLI.
Security note on logging: the daemon config file's RAW content and any future secret-bearing fields are NEVER logged. Effective security-POSTURE values (listen addresses, TLS presence, rate-limit/burst, auth on/off) ARE logged by the cmd main's logSecurityPosture, because an operator must be able to confirm what is actually bound — that is the posture, not the raw file. Do not conflate the two: "raw content/secrets not logged" is the rule; "effective posture values may be logged" is the deliberate exception.
Index ¶
Constants ¶
const DaemonConfigRelPath = "mecatl/daemon.yaml"
DaemonConfigRelPath is the conventional daemon.yaml location relative to the XDG config base (`mecatl/daemon.yaml`), re-exported so the WRITE paths (`mecated config daemon init` / `config daemon validate`) and the docs agree on a single relative path. It is NEVER used for auto-load — the daemon config is loaded ONLY when --config is supplied explicitly (issue #338, ADR 0088). Re-exporting it here keeps the conventional path in the SAME package that owns the schema, mirroring the configgen/permconfig SettingsRelPath pattern.
const SchemaVersionV1 = "v1"
SchemaVersionV1 is the only supported config version.
Variables ¶
This section is empty.
Functions ¶
func Skeleton ¶
func Skeleton() string
Skeleton returns the committed commented daemon.yaml skeleton that `mecated config daemon init` writes (or prints with --print). It is the embedded artifact, NOT a fresh render.
func Validate ¶
Validate runs the EFFECTIVE semantic validation possible WITHOUT starting or binding the server: rate_limit/rate_burst sanity bounds. The schema (unknown keys, version, types) is already enforced by Load/parse; Validate adds the cross-field bounds that mirror the runtime validateEffectiveConfig rate checks so a `mecated config daemon validate` catches the same misconfiguration before serve. 0 values are meaningful (disable / derive); only negative and non-finite (NaN/Inf) values are rejected. It does NOT validate listener binding (loopback/perf-mcp guards) — those depend on the full effective config + CLI flags, not the file alone.
Types ¶
type Config ¶
type Config struct {
// Version is required; it must be exactly "v1". Any other value or a missing
// key is a parse error.
Version string `yaml:"version"`
// GRPCAddr is the gRPC listen address (host:port). nil = not in file.
GRPCAddr *string `yaml:"grpc_addr,omitempty"`
// HTTPAddr is the HTTP/SSE listen address (host:port). nil = not in file.
HTTPAddr *string `yaml:"http_addr,omitempty"`
// MetricsAddr is the metrics/admin listen address (host:port). nil = not in
// file. An explicitly supplied empty string means "disable metrics".
MetricsAddr *string `yaml:"metrics_addr,omitempty"`
// TLSCert is the path to the PEM server certificate. nil = not in file.
TLSCert *string `yaml:"tls_cert,omitempty"`
// TLSKey is the path to the PEM server private key. nil = not in file.
TLSKey *string `yaml:"tls_key,omitempty"`
// ClientCA is the path to the PEM client CA bundle for mutual TLS. nil =
// not in file.
ClientCA *string `yaml:"client_ca,omitempty"`
// RateLimit is the sustained per-client request rate (req/s). nil = not in
// file. An explicitly supplied 0 means "no rate limiting".
RateLimit *float64 `yaml:"rate_limit,omitempty"`
// RateBurst is the token-bucket burst size. nil = not in file. An explicitly
// supplied 0 means "derive from rate limit".
RateBurst *int `yaml:"rate_burst,omitempty"`
}
Config is the parsed daemon configuration. It carries only the API-edge slice for v1. Every pointer field distinguishes absent (nil) from an explicitly supplied zero/empty value (non-nil pointer to zero/empty). Version is a plain string because the schema requires a non-empty value (absent and explicit "" are both rejected identically), so a pointer would add no information.
func Load ¶
Load reads and validates the daemon config at path. It returns the parsed Config and a line-aware error on any problem: unknown top-level keys, unsupported or missing version, a multi-document file, trailing content after the single document, or an unreadable file. It does NOT parse any nested key (the schema has none today, but the strict parser rejects unknown top-level keys).
Source Files