nordisk/holger

deploy/k8s/configmap.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: holger-config
  namespace: holger
data:
  holger.ron: |
    (
        repositories: [
            // Writable OCI registry: `helm push oci://host/charts/<name>`.
            (
                ron_name: "charts",
                ron_repo_type: "oci",
                ron_upstreams: [],
                ron_in: None,
                ron_out: Some((
                    ron_storage_endpoint: "storage",
                    ron_exposed_endpoint: "default",
                )),
                ron_data_dir: Some("/var/lib/holger/charts"),
            ),
        ],
        exposed_endpoints: [
            (
                ron_name: "default",
                ron_url: "0.0.0.0:50051",
                ron_http_url: Some("0.0.0.0:8443"),
                // TLS for both the gRPC and HTTP/OCI ports. Certs come from the
                // holger-tls Secret mounted at /etc/holger/tls.
                ron_tls: Some((
                    cert: "/etc/holger/tls/tls.crt",
                    key: "/etc/holger/tls/tls.key",
                    // Uncomment to require mTLS client certs (writers):
                    // client_ca: "/etc/holger/tls/ca.crt",
                )),
            ),
        ],
        storage_endpoints: [
            (
                ron_name: "storage",
                ron_storage_type: "znippy",
                ron_path: "/var/lib/holger",
            ),
        ],
        // HOL-NCSC: a listener off loopback authenticates. The operator's token is the
        // `holger-auth` Secret (secret.yaml), mounted at
        // /etc/holger/auth; reads stay open, every write and admin act needs it.
        auth: Some((
            methods: [ StaticToken(subject: "operator", token_file: Some("/etc/holger/auth/token")) ],
            roles: { "operator": Admin },
            require_auth_for_reads: false,
        )),
    )