boot-service/config.example.yaml at main · OpenCHAMI/boot-service · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
#
# SPDX-License-Identifier: MIT

# OpenCHAMI Boot Service Configuration Example
#
# This file documents the configuration keys currently read by cmd/server/main.go.
# Older nested sections such as auth:, logging:, tokensmith:, development:, and
# bss: are intentionally omitted because the current server runtime does not
# unmarshal them.
#
# Configuration precedence (highest to lowest):
#   1. Command-line flags
#   2. Environment variables
#   3. Configuration file (config.yaml)
#   4. Default values

# =============================================================================
# SERVER
# =============================================================================

# Main HTTP listen port for the API server.
port: 8080
# Interface to bind for the main HTTP listener.
host: "0.0.0.0"
# Read deadline in seconds for inbound HTTP requests.
read_timeout: 30
# Write deadline in seconds for outbound HTTP responses.
write_timeout: 30
# Keep-alive timeout in seconds for idle connections.
idle_timeout: 120

# =============================================================================
# STORAGE
# =============================================================================

# Directory used by the file-backed storage implementation.
data_dir: "./data"
# Storage backend type. The current server supports "file".
storage_type: "file"

# =============================================================================
# FEATURE FLAGS
# =============================================================================

# Enables TokenSmith-dependent startup validation and HSM token exchange.
enable_auth: false
# Enables runtime exposure of Prometheus metrics endpoints. Fabrica generation
# of metrics instrumentation is controlled separately by .fabrica.yaml.
enable_metrics: false
# Controls legacy BSS-compatible endpoints at /boot/v1/*.
# When false, only modern endpoints at root paths are available.
# When true, both modern and legacy endpoints are available.
enable_legacy_api: true
# Metrics listener port used when enable_metrics is true.
metrics_port: 9090

# =============================================================================
# TOKENSMITH / HSM
# =============================================================================

# Top-level TokenSmith URL used by current auth-related startup checks and HSM
# service-token exchange.
tokensmith_url: ""

# Optional bootstrap token for HSM service-token exchange.
# Prefer environment variable TOKENSMITH_BOOTSTRAP_TOKEN for real deployments.
# tokensmith_bootstrap_token: "<bootstrap-jwt>"

# Target service name requested during TokenSmith service-token exchange.
tokensmith_target_service: "hsm"

# Optional comma-separated scope hint used for diagnostics when exchanging HSM
# service tokens.
tokensmith_bootstrap_policy_scopes_hint: ""

# Refresh skew in seconds applied before service tokens are considered stale.
tokensmith_refresh_skew_sec: 120

# HSM-backed node resolution is enabled when this URL is provided.
hsm_url: ""
# Enables background synchronization against the HSM provider.
hsm_sync_enabled: true
# Interval in minutes between HSM background sync runs.
hsm_sync_interval: 5

# =============================================================================
# NOTES
# =============================================================================

# Reserved flag present in the current config struct but not documented as an
# active runtime auth path in the server entrypoint.
# jwks_endpoint: "https://auth.example.com/.well-known/jwks.json"

# - Boot endpoints are always available at root paths (e.g. /bootscript).
# - enable_legacy_api controls legacy BSS-compatible endpoints at /boot/v1/*
# - enable_auth currently affects startup validation and HSM token exchange.
# - The standalone server does not currently attach pkg/auth request middleware
#   to its route tree in cmd/server/main.go.

# =============================================================================
# EXAMPLE OVERRIDES
# =============================================================================

# Minimal metrics-enabled setup:
# enable_metrics: true
# metrics_port: 9090

# HSM integration without auth-backed token exchange:
# hsm_url: "http://localhost:27779"

# HSM integration with TokenSmith-backed service tokens:
# enable_auth: true
# tokensmith_url: "http://localhost:8080"
# hsm_url: "http://localhost:27779"
# tokensmith_target_service: "hsm"
# tokensmith_bootstrap_policy_scopes_hint: "hsm:read"