config

package
v0.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 15, 2026 License: Apache-2.0 Imports: 16 Imported by: 0

Documentation

Overview

Package config defines Backyard's configuration schema, loading (YAML with ${ENV} expansion), defaults and validation. It contains no runtime logic for the subsystems themselves; every other package reads its section from here.

Index

Constants

View Source 
const DefaultMCPMaxPublishBytes = 4 << 20

DefaultMCPMaxPublishBytes is the default of mcp.max_publish_bytes.

Variables

View Source 
var (
	// DefaultMCPClients are Claude's client metadata documents (claude.ai,
	// Desktop, mobile and Cowork; Claude Code).
	DefaultMCPClients = []string{
		"https://claude.ai/oauth/mcp-oauth-client-metadata",
		"https://claude.ai/oauth/claude-code-client-metadata",
	}
	// DefaultMCPRedirectURIs are Claude's OAuth callbacks.
	DefaultMCPRedirectURIs = []string{
		"https://claude.ai/api/mcp/auth_callback",
		"https://claude.com/api/mcp/auth_callback",
	}
)

Defaults of the mcp section.

View Source 
var DefaultReserved = []string{"www", "api", "admin", "hub", "auth", "static", "assets", "cdn", "docs", "mail", "backyard", "s"}

DefaultReserved are site names that can never be deployed.

View Source 
var Example string

Example is the annotated example configuration printed by `backyard config example`.

Functions

func CookieDomainCapable 

func CookieDomainCapable(host string) bool

CookieDomainCapable reports whether browsers accept ".<host>" as a cookie Domain attribute, which host-mode sessions need to reach site hosts. They refuse localhost, *.localhost, IP literals and single-label names. (Public suffixes such as co.uk are refused too but are not detected here.)

func ExpandEnv 

func ExpandEnv(s string) string

ExpandEnv replaces ${VAR} and ${VAR:-default} with environment values. A literal "$${" escapes to "${".

func LoopbackHost added in v0.2.0 

func LoopbackHost(h string) bool

LoopbackHost reports whether h (a hostname without port) is localhost, a *.localhost name, a 127.0.0.0/8 literal or ::1.

func ParseCIDROrIP 

func ParseCIDROrIP(s string) (*net.IPNet, error)

ParseCIDROrIP parses "10.0.0.0/8" or a bare IP into a *net.IPNet.

Types

type AIConfig 

type AIConfig struct {
	// Enabled defaults to true when at least one model is configured.
	Enabled *bool `yaml:"enabled"`
	// DefaultModel is the alias used when the client does not specify one.
	DefaultModel string `yaml:"default_model"`
	// DefaultImageModel / DefaultEmbeddingModel aliases.
	DefaultImageModel     string                    `yaml:"default_image_model"`
	DefaultEmbeddingModel string                    `yaml:"default_embedding_model"`
	Providers             map[string]ProviderConfig `yaml:"providers"`
	Models                map[string]ModelConfig    `yaml:"models"`
	// AllowRawModels lets clients pass "provider/model-id" directly.
	AllowRawModels bool `yaml:"allow_raw_models"`
	// ExposeModelIDs includes provider model ids in GET /ai/models.
	ExposeModelIDs bool `yaml:"expose_model_ids"`
	// MaxTokens caps max_tokens per request (default 8192).
	MaxTokens int `yaml:"max_tokens"`
	// RequestTimeout per upstream call (default 120s; streaming: 10m).
	RequestTimeout Duration `yaml:"request_timeout"`
	// SystemPrompt is prepended to every request's system prompt (optional).
	SystemPrompt string `yaml:"system_prompt"`
}

AIConfig configures providers and model aliases.

type ALBConfig 

type ALBConfig struct {
	Region string `yaml:"region"`
	// SignerARN is the load balancer ARN expected in the JWT "signer" header.
	SignerARN string `yaml:"signer_arn"`
	// KeyURL override (default https://public-keys.auth.elb.<region>.amazonaws.com).
	KeyURL string `yaml:"key_url"`
}

ALBConfig configures AWS Application Load Balancer OIDC verification.

type AuthConfig 

type AuthConfig struct {
	// Mode: none | oidc | iap | alb | header. "okta", "entra", "azuread",
	// "google", "auth0" and "keycloak" are accepted aliases for "oidc".
	Mode string `yaml:"mode"`
	// Admins are user ids/emails with admin rights.
	Admins []string `yaml:"admins"`
	// AdminGroups grant admin rights to members.
	AdminGroups []string `yaml:"admin_groups"`
	// AllowedDomains restricts access to these email domains (empty = any).
	AllowedDomains []string `yaml:"allowed_domains"`
	// AllowedEmails admits these exact addresses too. With AllowedDomains a
	// person passes when either matches; alone, only the listed addresses
	// pass (empty = no per-address list).
	AllowedEmails []string `yaml:"allowed_emails"`
	// AllowedGroups restricts access to members of these groups (empty = any).
	AllowedGroups []string `yaml:"allowed_groups"`
	// TokenTTL is the lifetime of minted Backyard API tokens (default 720h).
	TokenTTL Duration `yaml:"token_ttl"`
	// Tokens are static bearer tokens (e.g. for CI), stored as sha256 hex.
	Tokens []StaticToken `yaml:"tokens"`

	OIDC   OIDCConfig       `yaml:"oidc"`
	IAP    IAPConfig        `yaml:"iap"`
	ALB    ALBConfig        `yaml:"alb"`
	Header HeaderAuthConfig `yaml:"header"`
}

AuthConfig selects and configures the authenticator.

func (AuthConfig) IsAdmin 

func (a AuthConfig) IsAdmin(id, email string, groups []string) bool

IsAdmin reports whether a user id/email or any group grants admin rights.

type AzureConfig 

type AzureConfig struct {
	Account   string `yaml:"account"`
	Container string `yaml:"container"`
	Prefix    string `yaml:"prefix"`
	// ConnectionString optional (Azurite / shared key); default DefaultAzureCredential.
	ConnectionString string `yaml:"connection_string"`
	// AccountKey optional shared key (enables service SAS without user delegation).
	AccountKey string `yaml:"account_key"`
	// Endpoint override, default https://<account>.blob.core.windows.net/.
	Endpoint string `yaml:"endpoint"`
}

AzureConfig for Azure Blob Storage.

type ClaimsMapping 

type ClaimsMapping struct {
	Email  string `yaml:"email"`  // default "email"
	Name   string `yaml:"name"`   // default "name"
	Title  string `yaml:"title"`  // default "title"
	Team   string `yaml:"team"`   // default "department"
	Slack  string `yaml:"slack"`  // default "slack"
	Avatar string `yaml:"avatar"` // default "picture"
	Groups string `yaml:"groups"` // default "groups"
}

ClaimsMapping names the claim used for each profile field.

type Config 

type Config struct {
	Server    ServerConfig    `yaml:"server"`
	Auth      AuthConfig      `yaml:"auth"`
	Identity  IdentityConfig  `yaml:"identity"`
	Storage   StorageConfig   `yaml:"storage"`
	Database  DatabaseConfig  `yaml:"database"`
	PubSub    PubSubConfig    `yaml:"pubsub"`
	AI        AIConfig        `yaml:"ai"`
	Warehouse WarehouseConfig `yaml:"warehouse"`
	Sites     SitesConfig     `yaml:"sites"`
	Files     FilesConfig     `yaml:"files"`
	Deploy    DeployConfig    `yaml:"deploy"`
	MCP       MCPConfig       `yaml:"mcp"`
	RateLimit RateLimitConfig `yaml:"ratelimit"`
	Realtime  RealtimeConfig  `yaml:"realtime"`
	Telemetry TelemetryConfig `yaml:"telemetry"`
}

Config is the root configuration document (backyard.yaml).

func Load 

func Load(path string, dev bool) (*Config, error)

Load reads configuration from (in order of precedence): the file at path (if non-empty), the BACKYARD_CONFIG_YAML environment variable, the file named by BACKYARD_CONFIG, or ./backyard.yaml if it exists. Missing everything yields an empty config (valid only with dev=true). Defaults are applied and the result is validated.

func Parse 

func Parse(raw []byte) (*Config, error)

Parse expands ${ENV} references and decodes YAML strictly (unknown keys are errors). It does not apply defaults or validate.

func (*Config) ApplyDefaults 

func (c *Config) ApplyDefaults()

ApplyDefaults fills zero values with production defaults.

func (*Config) ApplyDevDefaults 

func (c *Config) ApplyDevDefaults()

ApplyDevDefaults fills in a zero-dependency local setup.

func (*Config) ApplyEnvOverrides 

func (c *Config) ApplyEnvOverrides()

ApplyEnvOverrides applies a small set of well-known environment variables that are convenient on PaaS platforms.

func (*Config) HubHost 

func (c *Config) HubHost() string

HubHost returns the host (with port, if any) of the public URL.

func (*Config) Secure 

func (c *Config) Secure() bool

Secure reports whether cookies should carry the Secure attribute.

func (*Config) SiteURL 

func (c *Config) SiteURL(site string) string

SiteURL returns the public URL of a site (with trailing slash). In host mode that is <scheme>://<site>.<base_domain>[:<port>]/ with the scheme and port of server.public_url: sites are routed by base_domain, whose name may differ from the public URL's host (public_url https://hub.acme.com with base_domain apps.acme.com puts site foo at https://foo.apps.acme.com/). In path mode it is <public_url>/s/<site>/.

func (*Config) Validate 

func (c *Config) Validate() error

Validate reports configuration errors (all of them, joined).

type DatabaseConfig 

type DatabaseConfig struct {
	// Type: sqlite | postgres | dynamodb | memory.
	Type     string         `yaml:"type"`
	SQLite   SQLiteConfig   `yaml:"sqlite"`
	Postgres PostgresConfig `yaml:"postgres"`
	DynamoDB DynamoDBConfig `yaml:"dynamodb"`
	// MaxDocBytes caps the JSON size of one document (default 262144).
	MaxDocBytes int `yaml:"max_doc_bytes"`
	// MaxList caps query limit (default 1000).
	MaxList int `yaml:"max_list"`
	// MaxDocsPerSite caps documents per site (default 100000; 0 selects the
	// default, a negative value = unlimited).
	MaxDocsPerSite int `yaml:"max_docs_per_site"`
}

DatabaseConfig selects the document store behind backyard.db.

type DeployConfig 

type DeployConfig struct {
	// Methods advertised to CLIs, in preference order. Default: ["api"] plus
	// the storage-native method (s3|gcs|azure|rsync for fs).
	Methods []string `yaml:"methods"`
	// RsyncTarget e.g. deploy@backyard.acme.com:/var/lib/backyard/sites
	RsyncTarget string `yaml:"rsync_target"`
	// GatewayURL advertises an external gateway (Lambda / Cloud Run) to CLIs.
	GatewayURL string `yaml:"gateway_url"`
	// AllowAnonymous allows deploys without any token in auth.mode=none.
	AllowAnonymous bool `yaml:"allow_anonymous"`
	// Presign uses presigned storage URLs for uploads when supported (default true).
	Presign *bool `yaml:"presign"`
	// ExposeStorage includes bucket details in /info (default true).
	ExposeStorage *bool `yaml:"expose_storage"`
	// EmbeddedGateway mounts the gateway at /__backyard/api/deploy (default true).
	EmbeddedGateway *bool `yaml:"embedded_gateway"`
}

DeployConfig controls deploy methods advertised to CLIs and the gateway.

type DirectoryConfig 

type DirectoryConfig struct {
	// Type: "" (none) | csv | json.
	Type string `yaml:"type"`
	// Path to the file. CSV header must include "email"; other recognised
	// columns: name,title,team,slack,avatar_url,groups (groups ';'-separated).
	Path string `yaml:"path"`
	// Reload interval (0 = load once).
	Reload Duration `yaml:"reload"`
}

DirectoryConfig is an optional static people directory.

type Duration 

type Duration time.Duration

Duration is a time.Duration that unmarshals from strings like "12h" or integers (seconds).

func (Duration) D 

func (d Duration) D() time.Duration

D returns the underlying time.Duration.

func (Duration) MarshalYAML 

func (d Duration) MarshalYAML() (any, error)

MarshalYAML implements yaml.Marshaler.

func (*Duration) UnmarshalYAML 

func (d *Duration) UnmarshalYAML(n *yaml.Node) error

UnmarshalYAML implements yaml.Unmarshaler.

type DynamoDBConfig 

type DynamoDBConfig struct {
	Table    string `yaml:"table"` // default "backyard"
	Region   string `yaml:"region"`
	Endpoint string `yaml:"endpoint"` // DynamoDB Local / LocalStack
	// CreateTable creates the table (on-demand billing) if missing.
	CreateTable bool `yaml:"create_table"`
	// MaxScan caps items read per query before in-memory filtering/sorting (default 10000).
	MaxScan int `yaml:"max_scan"`
}

DynamoDBConfig for Amazon DynamoDB.

type FSConfig 

type FSConfig struct {
	Root string `yaml:"root"` // default /var/lib/backyard (dev: ./.backyard-data)
}

FSConfig stores everything on the local filesystem (or a mounted bucket via gcsfuse / mountpoint-s3 / blobfuse2). This is the "no bucket" option and the target of `backyard deploy --method rsync`.

type FilesConfig 

type FilesConfig struct {
	MaxUploadBytes int64 `yaml:"max_upload_bytes"` // default 100 MiB
}

FilesConfig controls backyard.files uploads.

type GCSConfig 

type GCSConfig struct {
	Bucket string `yaml:"bucket"`
	Prefix string `yaml:"prefix"`
	// CredentialsFile optional; default Application Default Credentials.
	CredentialsFile string `yaml:"credentials_file"`
	// SignerEmail is the service account used for V4 signed URLs when ADC has
	// no private key (Cloud Run / GCE); default: auto-detected.
	SignerEmail string `yaml:"signer_email"`
	// Endpoint override (testing / emulators).
	Endpoint string `yaml:"endpoint"`
}

GCSConfig for Google Cloud Storage.

type HeaderAuthConfig 

type HeaderAuthConfig struct {
	EmailHeader  string `yaml:"email_header"`  // e.g. X-Forwarded-Email, X-MS-CLIENT-PRINCIPAL-NAME
	NameHeader   string `yaml:"name_header"`   // optional
	GroupsHeader string `yaml:"groups_header"` // optional, comma separated
	// Optional JWT verification (Cloudflare Access, Pomerium, …).
	JWTHeader string   `yaml:"jwt_header"`
	JWKSURL   string   `yaml:"jwks_url"`
	Issuer    string   `yaml:"issuer"`
	Audiences []string `yaml:"audiences"`
}

HeaderAuthConfig configures trusted-proxy header authentication.

type IAPConfig 

type IAPConfig struct {
	// Audience: /projects/<number>/global/backendServices/<id> (load balancer)
	// or /projects/<number>/locations/<region>/services/<name> (Cloud Run).
	Audience string `yaml:"audience"`
	// AdditionalAudiences are also accepted (e.g. the deploy backend service).
	AdditionalAudiences []string `yaml:"additional_audiences"`
	// JWKSURL override (default https://www.gstatic.com/iap/verify/public_key-jwk).
	JWKSURL string `yaml:"jwks_url"`
}

IAPConfig configures Google Cloud Identity-Aware Proxy verification.

type IdentityConfig 

type IdentityConfig struct {
	Claims    ClaimsMapping   `yaml:"claims"`
	Directory DirectoryConfig `yaml:"directory"`
	// ExtraClaims are additional claim names copied into User.Extra.
	ExtraClaims []string `yaml:"extra_claims"`
}

IdentityConfig maps IdP claims to user profile fields and configures an optional directory for enrichment.

type MCPConfig added in v0.2.0 

type MCPConfig struct {
	// Enabled serves the connector endpoint and Backyard's OAuth endpoints
	// (default false: every connector path answers 404).
	Enabled bool `yaml:"enabled"`
	// Clients are the Client ID Metadata Document URLs that may connect
	// (only these are fetched). Unset: DefaultMCPClients; [] turns CIMD off,
	// so clients register automatically (stateless DCR).
	Clients []string `yaml:"clients"`
	// RedirectURIs are the exact https addresses that may receive sign-in
	// codes (unset: DefaultMCPRedirectURIs). http loopback addresses are
	// always allowed and are not listed.
	RedirectURIs []string `yaml:"redirect_uris"`
	// MaxPublishBytes caps the decoded file bytes of one backyard_publish
	// call (default 4194304). The MCP request body limit is 2× this + 1 MiB.
	MaxPublishBytes int64 `yaml:"max_publish_bytes"`
}

MCPConfig configures the remote MCP connector (SPEC §8.4, §14.1): Claude and other MCP clients reach <public_url>/__backyard/mcp with OAuth tokens Backyard issues itself after the browser signed in through auth.mode.

type ModelConfig 

type ModelConfig struct {
	Provider    string `yaml:"provider"` // key in ai.providers
	Model       string `yaml:"model"`    // provider model id
	Kind        string `yaml:"kind"`     // chat (default) | image | embedding
	Description string `yaml:"description"`
	MaxTokens   int    `yaml:"max_tokens"` // per-alias cap
	Effort      string `yaml:"effort"`     // anthropic effort override
}

ModelConfig maps an alias to a provider model.

type NamedQuery 

type NamedQuery struct {
	Source      string   `yaml:"source"`
	SQL         string   `yaml:"sql"`
	Description string   `yaml:"description"`
	Params      []string `yaml:"params"` // names used as @name in SQL
}

NamedQuery is a pre-approved parameterised query.

type OIDCConfig 

type OIDCConfig struct {
	Issuer       string   `yaml:"issuer"`
	ClientID     string   `yaml:"client_id"`
	ClientSecret string   `yaml:"client_secret"`
	Scopes       []string `yaml:"scopes"` // default: openid profile email (+ groups if GroupsClaim set)
	// RedirectURL defaults to <public_url>/__backyard/auth/callback.
	RedirectURL string `yaml:"redirect_url"`
	// SessionTTL is the browser session lifetime (default 12h).
	SessionTTL Duration `yaml:"session_ttl"`
	// UseUserInfo calls the userinfo endpoint to enrich claims.
	UseUserInfo bool `yaml:"use_userinfo"`
	// DeviceClientID enables the CLI device-authorization flow with this
	// (public/native) client id.
	DeviceClientID string `yaml:"device_client_id"`
	// DeviceScopes default: openid profile email offline_access.
	DeviceScopes []string `yaml:"device_scopes"`
	// APIAudiences are additional accepted audiences for IdP-issued bearer
	// JWTs presented to the API/gateway.
	APIAudiences []string `yaml:"api_audiences"`
	// InsecureSkipIssuerCheck is for IdPs with non-standard issuer URLs (avoid).
	InsecureSkipIssuerCheck bool `yaml:"insecure_skip_issuer_check"`
}

OIDCConfig configures the built-in OpenID Connect login (Okta, Entra ID, …).

type PostgresConfig 

type PostgresConfig struct {
	DSN      string `yaml:"dsn"` // postgres://user:pass@host:5432/db?sslmode=require
	MaxConns int    `yaml:"max_conns"`
	// Schema to create tables in (default "public").
	Schema string `yaml:"schema"`
	// AutoMigrate creates/updates tables on start (default true).
	AutoMigrate *bool `yaml:"auto_migrate"`
}

PostgresConfig for PostgreSQL (Cloud SQL, RDS, Azure Flexible Server, …).

type PostgresPubSub 

type PostgresPubSub struct {
	DSN     string `yaml:"dsn"`     // default database.postgres.dsn
	Channel string `yaml:"channel"` // default "backyard_events"
}

PostgresPubSub uses LISTEN/NOTIFY.

type ProviderConfig 

type ProviderConfig struct {
	// Type: anthropic | openai | azure-openai | bedrock | gemini | ollama.
	// ("ollama" is openai-compatible with base_url default http://localhost:11434/v1.)
	Type    string            `yaml:"type"`
	APIKey  string            `yaml:"api_key"`
	BaseURL string            `yaml:"base_url"`
	Headers map[string]string `yaml:"headers"`

	// anthropic: platform "anthropic" (default) | "vertex" | "bedrock".
	Platform string `yaml:"platform"`
	// anthropic: enable server-side refusal fallbacks on the first-party API (default true).
	RefusalFallback *bool `yaml:"refusal_fallback"`
	// anthropic: default effort for models that support it (low|medium|high|xhigh|max).
	Effort string `yaml:"effort"`

	// openai: OpenAI-Organization / OpenAI-Project headers.
	Organization  string `yaml:"organization"`
	OpenAIProject string `yaml:"openai_project"`

	// azure-openai
	Endpoint   string `yaml:"endpoint"`    // https://<resource>.openai.azure.com
	APIVersion string `yaml:"api_version"` // default 2024-10-21
	// azure-openai: use Entra ID (DefaultAzureCredential) instead of api_key.
	UseAzureAD bool `yaml:"use_azure_ad"`

	// bedrock / anthropic(platform=bedrock)
	Region string `yaml:"region"`

	// gemini: AI Studio (api_key) or Vertex AI (project+location, ADC).
	// anthropic(platform=vertex) also uses project+location.
	ProjectID string `yaml:"project_id"`
	Location  string `yaml:"location"`
}

ProviderConfig configures one upstream provider instance.

type PubSubConfig 

type PubSubConfig struct {
	// Type: memory (single instance) | postgres | redis. Default memory.
	Type     string         `yaml:"type"`
	Redis    RedisConfig    `yaml:"redis"`
	Postgres PostgresPubSub `yaml:"postgres"`
}

PubSubConfig selects the cross-instance message bus for realtime.

type RateLimitConfig 

type RateLimitConfig struct {
	Disabled          bool `yaml:"disabled"`
	APIPerMinute      int  `yaml:"api_per_minute"`       // default 600
	DBWritesPerMinute int  `yaml:"db_writes_per_minute"` // default 300
	AIPerMinute       int  `yaml:"ai_per_minute"`        // default 20
	// AITokensPerDay caps input+output AI tokens per user per UTC day
	// (default 2000000; negative = unlimited).
	AITokensPerDay     int64 `yaml:"ai_tokens_per_day"`
	DeploysPerHour     int   `yaml:"deploys_per_hour"`     // default 60
	UploadsPerMinute   int   `yaml:"uploads_per_minute"`   // default 60
	WarehousePerMinute int   `yaml:"warehouse_per_minute"` // default 30
}

RateLimitConfig sets per-user limits (per instance). For every limit, 0 selects the default and a negative value = unlimited (that limit is disabled); Disabled turns all of them off.

type RealtimeConfig 

type RealtimeConfig struct {
	Disabled          bool `yaml:"disabled"`
	MaxRoomsPerConn   int  `yaml:"max_rooms_per_conn"`  // default 50
	MaxSubsPerConn    int  `yaml:"max_subs_per_conn"`   // default 100
	MessagesPerSecond int  `yaml:"messages_per_second"` // default 60
	MessageBurst      int  `yaml:"message_burst"`       // default 120
	MaxMessageBytes   int  `yaml:"max_message_bytes"`   // default 65536
	MaxConnsPerUser   int  `yaml:"max_conns_per_user"`  // default 50
	MaxPresenceBytes  int  `yaml:"max_presence_bytes"`  // default 8192
	// AllowCrossSiteWS lets pages on other Backyard sites open this site's websocket (default false).
	AllowCrossSiteWS bool `yaml:"allow_cross_site_ws"`
}

RealtimeConfig controls websockets.

type RedisConfig 

type RedisConfig struct {
	URL string `yaml:"url"` // redis://[:password@]host:6379/0 or rediss://
}

RedisConfig for Redis / Valkey / ElastiCache / Memorystore.

type S3Config 

type S3Config struct {
	Bucket         string `yaml:"bucket"`
	Region         string `yaml:"region"`
	Prefix         string `yaml:"prefix"`
	Endpoint       string `yaml:"endpoint"` // custom endpoint for S3-compatible stores
	ForcePathStyle bool   `yaml:"force_path_style"`
	// Static credentials (optional; default AWS credential chain).
	AccessKeyID     string `yaml:"access_key_id"`
	SecretAccessKey string `yaml:"secret_access_key"`
	// SSEKMSKeyID enables SSE-KMS with this key for writes (optional).
	SSEKMSKeyID string `yaml:"sse_kms_key_id"`
}

S3Config for AWS S3 or S3-compatible stores (MinIO, R2, Ceph…).

type SQLiteConfig 

type SQLiteConfig struct {
	Path string `yaml:"path"` // default <fs root>/backyard.db
}

SQLiteConfig for the embedded single-node database.

type ServerConfig 

type ServerConfig struct {
	// Listen address, e.g. ":8080". Empty → ":$PORT" if PORT is set, else ":8080".
	Listen string `yaml:"listen"`
	// BaseDomain is the hub host; sites live at <site>.<base_domain> (host mode).
	BaseDomain string `yaml:"base_domain"`
	// PublicURL is the externally visible hub URL, e.g. https://backyard.acme.com.
	// Defaults to https://<base_domain> (http:// for localhost).
	PublicURL string `yaml:"public_url"`
	// URLMode is "host" (default; wildcard subdomains) or "path" (/s/<site>/).
	URLMode string `yaml:"url_mode"`
	// Secret signs/encrypts sessions, API tokens, deploy ids and upload URLs.
	// Must be at least 32 characters. Generated (ephemeral) in dev mode.
	Secret string `yaml:"secret"`
	// TrustedProxies are CIDRs (or IPs) whose X-Forwarded-* headers are trusted
	// and who may supply identity headers in auth.mode=header.
	TrustedProxies []string `yaml:"trusted_proxies"`
	// Dev enables developer defaults (see ApplyDevDefaults).
	Dev bool `yaml:"dev"`
	// Name shown in the hub UI.
	Name string `yaml:"name"`
	// ReadTimeout/WriteTimeout/IdleTimeout for the HTTP server. Websockets and
	// streaming responses are exempt from WriteTimeout.
	ReadTimeout  Duration `yaml:"read_timeout"`
	WriteTimeout Duration `yaml:"write_timeout"`
	IdleTimeout  Duration `yaml:"idle_timeout"`
	// ShutdownTimeout bounds graceful shutdown.
	ShutdownTimeout Duration `yaml:"shutdown_timeout"`
}

ServerConfig controls the HTTP server and URL scheme.

type SitesConfig 

type SitesConfig struct {
	// Ownership: none (default, anyone can overwrite — the Quick philosophy) |
	// owner (first deployer owns the site; owners/admins may overwrite/delete).
	Ownership string   `yaml:"ownership"`
	Reserved  []string `yaml:"reserved"`
	// MaxSiteBytes total (default 500 MiB), MaxFiles (default 10000),
	// MaxFileBytes per file (default 100 MiB).
	MaxSiteBytes int64 `yaml:"max_site_bytes"`
	MaxFiles     int   `yaml:"max_files"`
	MaxFileBytes int64 `yaml:"max_file_bytes"`
}

SitesConfig controls site naming and ownership.

type StaticToken 

type StaticToken struct {
	Name   string `yaml:"name"`
	SHA256 string `yaml:"sha256"`
	Admin  bool   `yaml:"admin"`
}

StaticToken is a pre-shared bearer token.

type StorageConfig 

type StorageConfig struct {
	// Type: fs | s3 | gcs | azure.
	Type  string      `yaml:"type"`
	FS    FSConfig    `yaml:"fs"`
	S3    S3Config    `yaml:"s3"`
	GCS   GCSConfig   `yaml:"gcs"`
	Azure AzureConfig `yaml:"azure"`
	// CacheBytes is the in-memory cache size for small static files
	// (default 64 MiB; -1 disables the cache).
	CacheBytes int64 `yaml:"cache_bytes"`
	// CacheTTL is how long cached objects are trusted (default 5s).
	CacheTTL Duration `yaml:"cache_ttl"`
}

StorageConfig selects the blob store holding site files and uploads.

type TelemetryConfig 

type TelemetryConfig struct {
	LogLevel  string `yaml:"log_level"`  // debug | info (default) | warn | error
	LogFormat string `yaml:"log_format"` // json (default) | text
	Metrics   bool   `yaml:"metrics"`    // expose Prometheus metrics
	// MetricsListen serves /metrics on a separate address (recommended in prod).
	MetricsListen string `yaml:"metrics_listen"`
	// AccessLog logs every request (default false).
	AccessLog bool `yaml:"access_log"`
}

TelemetryConfig controls logs and metrics.

type WarehouseConfig 

type WarehouseConfig struct {
	Sources map[string]WarehouseSource `yaml:"sources"`
	// DefaultSource name (default "default", or the only source).
	DefaultSource string `yaml:"default_source"`
	// AllowRawSQL permits ad-hoc SQL from sites (default false).
	AllowRawSQL bool `yaml:"allow_raw_sql"`
	// AllowAnyStatement disables the SELECT/WITH-only guard (default false).
	AllowAnyStatement bool                  `yaml:"allow_any_statement"`
	Queries           map[string]NamedQuery `yaml:"queries"`
	MaxRows           int                   `yaml:"max_rows"` // default 10000
	Timeout           Duration              `yaml:"timeout"`  // default 60s
}

WarehouseConfig configures read-only analytics sources.

type WarehouseSource 

type WarehouseSource struct {
	// Type: bigquery | postgres | athena.
	Type        string `yaml:"type"`
	Description string `yaml:"description"`
	// bigquery
	ProjectID       string `yaml:"project_id"`
	Location        string `yaml:"location"`
	MaxBytesBilled  int64  `yaml:"max_bytes_billed"`
	CredentialsFile string `yaml:"credentials_file"`
	// postgres (also Redshift, AlloyDB, Aurora, …)
	DSN string `yaml:"dsn"`
	// athena
	Region         string `yaml:"region"`
	Workgroup      string `yaml:"workgroup"`
	Database       string `yaml:"database"`
	Catalog        string `yaml:"catalog"`
	OutputLocation string `yaml:"output_location"`
}

WarehouseSource is one analytics backend.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.