batlehub/config.s3.toml at main · batleforc/batlehub · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
# batlehub — RustFS + Authentik + Jaeger configuration
# Mounted read-only into the server container by docker-compose.s3.yml.
# Uses compose-internal hostnames (rustfs, authentik-server, jaeger).

[server]
host       = "0.0.0.0"
port       = 8080
static_dir = "/app/ui/dist"

[database]
type            = "postgresql"
url             = "postgresql://batlehub:changeme@postgres:5432/batlehub"
max_connections = 10

# ── Auth providers (evaluated in order; first match wins) ─────────────────────

[[auth]]
type = "token"

[[auth.tokens]]
value   = "change-me-admin-token"
role    = "admin"
user_id = "admin"

[[auth.tokens]]
value   = "change-me-user-token"
role    = "user"
user_id = "user-1"

# Authentik OIDC — JWT validation + browser SSO login.
# Blueprint at deploy/auth/batlehub.yaml provisions client_id / client_secret.
[[auth]]
type         = "oidc"
issuer_url   = "http://authentik-server:9000/application/o/proxy-auth/"
client_id    = "proxy-auth"
client_secret = "proxy-auth-secret"
redirect_uri = "http://localhost:8080/api/v1/auth/oidc/callback"
scopes       = ["openid", "profile", "email", "groups"]
frontend_url = "http://localhost:5173"

user_id_claim = "preferred_username"
role_claim    = "groups"

[auth.role_mappings]
"authentik Admins" = "admin"
"proxy-users"      = "user"

# ── Storage — RustFS (S3-compatible) ─────────────────────────────────────────
# Credentials come from AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY env vars,
# set to the RustFS root credentials in docker-compose.s3.yml.

[storage]
type             = "s3"
bucket           = "artifacts"
region           = "us-east-1"
endpoint_url     = "http://rustfs:9900"
force_path_style = true

# ── OpenTelemetry ─────────────────────────────────────────────────────────────

[otel]
endpoint     = "http://jaeger:4317"
service_name = "batlehub"

# ── Registries ────────────────────────────────────────────────────────────────

[[registries]]
type = "npm"
name = "npm"

[registries.rbac]
anonymous = ["releases:read", "source:read"]
user      = ["releases:read", "source:read"]
admin     = ["*"]

[[registries]]
type = "cargo"
name = "cargo"

[registries.rbac]
anonymous = ["releases:read", "source:read"]
user      = ["releases:read", "source:read"]
admin     = ["*"]

[[registries]]
type = "github"
name = "github"

[registries.rbac]
anonymous = []
user      = ["releases:read", "source:read"]
admin     = ["*"]

[[registries]]
type = "goproxy"
name = "go"

[registries.rbac]
anonymous = ["releases:read", "source:read"]
user      = ["releases:read", "source:read"]
admin     = ["*"]

[[registries]]
type = "openvsx"
name = "openvsx"

[registries.rbac]
anonymous = ["releases:read", "source:read"]
user      = ["releases:read", "source:read"]
admin     = ["*"]