config

Documentation

Overview

package: config / composition type: struct job: decrypt/parse the launch config and either check it (Verify) or assemble the adapter stack (Run) limits: the only component that sees the whole config; adapters get scope.Section slices (-> Verify, Run)

Two entry points mirror the CLI verbs: Verify checks without assembling, Run assembles the live stack. Each adapter is handed its own scope.Section and nothing else, its env()/vault() delegations resolved lazily at use.

config is the one component that sees the whole config; the narrowing below it is by containment, not visibility.

package: config / composition type: func job: expand a single env(KEY)/vault(ref) delegation to its plaintext value limits: whole-value match only; no embedded interpolation (-> scopeOf)

A value is a literal or one whole env(KEY)/vault(ref) placeholder — no interpolation, so no secret hides inside a larger string. vaultBox builds the store lazily.

package: config / composition type: func job: decrypt an age-encrypted config with a caller-supplied passphrase source limits: passphrase (scrypt) only; the source is built by the frontend (-> cmd/ranke-db)

A reference-only config is plaintext; one carrying an inline secret is age-encrypted. decrypt sniffs the header and passes plaintext through, so Verify and Run can route every config through it and ask for a passphrase only when there is something to open.

package: config / composition type: struct job: the concrete scope.Section handed to each adapter — a lazily-resolved slice of the parsed config limits: one parsed object, leaves resolved on demand, no path to the rest (-> config)

This file is the handout itself: the concrete type that fulfils the scope contract. cfgSection wraps one parsed JSON object plus the vault box its leaves may reference; it navigates into nested sections and resolves leaves via Get, and holds no back-reference to the enclosing config — the containment that keeps one adapter from reading another's slice. A leaf is resolved lazily on Get: a literal passes through, an env()/vault() delegation is expanded only then, so a rotating secret is fetched at use and the source stays opaque to the adapter.

Index

• func Verify(ctx context.Context, cfg io.Reader, pass PassphraseSource, level Level) error
• type App
  • func Run(ctx context.Context, cfg io.Reader, pass PassphraseSource, dev bool) (*App, error)
• type Config
• type Level
• type PassphraseSource

Functions

func Verify

func Verify(ctx context.Context, cfg io.Reader, pass PassphraseSource, level Level) error

Verify checks an (optionally age-encrypted) config to the given level, decrypting with pass when the bytes are encrypted. See Level for what each depth reaches.

Types

type App

type App struct {
	Storage   storage.Storage
	Signer    signer.Signer
	Sequencer sequencer.Sequencer
	Endpoints []endpoints.Endpoints
	// Layers names the configured storage layers, name and type only.
	Layers []storage.Layer
	// DevClock is the launch's steerable clock, non-nil only when Run was called with
	// dev true — the handle POST /dev/clock advances (-> core.WithDevClock).
	DevClock *sequencer.SteerableClock
}

App is the assembled stack Run produces: the shared driven ports and the endpoints, each holding its own core over them.

func Run

func Run(ctx context.Context, cfg io.Reader, pass PassphraseSource, dev bool) (*App, error)

Run decrypts with pass when needed, parses, and assembles the stack. dev mounts the launch's steerable clock — see App.DevClock — and requires sequencer.type "dev"; pass false for every real deployment.

type Config

type Config struct {
	Signer    section                  `json:"signer"`
	Vault     section                  `json:"vault"`
	Storage   section                  `json:"storage"`
	Sequencer section                  `json:"sequencer"`
	Accounts  map[string]accountConfig `json:"accounts"`
	Endpoints []endpointConfig         `json:"endpoints"`
	// contains filtered or unexported fields
}

Config is the parsed launch artifact: driven ports and accounts shared by the instance, authentication and admission per endpoint, each section an open map.

type Level

type Level int

Level is the depth of a Verify check.

const (
	// LevelSyntax parses and shape-checks offline — no environment, vault or assembly.
	LevelSyntax Level = iota
	// LevelResolve also resolves every env()/vault() reference, assembling nothing.
	LevelResolve
	// LevelConnect also assembles the adapters and discards them, so a bad backend
	// surfaces before Run does.
	LevelConnect
)

type PassphraseSource

type PassphraseSource func() (string, error)

PassphraseSource yields the passphrase for an age-encrypted config, called at most once. The frontend supplies it — the CLI from --age-key, a TUI from a modal.