dtoro
1bfc18ea3a
- SSE stream: GET /events/stream using io.Pipe to bridge the SSE goroutine to the response body. Replay from Last-Event-ID via in-memory broker with DB fallback. LISTEN/NOTIFY fan-out to all subscribers. Heartbeat every 15s. Bounded channels. - OIDC JWT auth: validates Bearer tokens against Authentik/OIDC issuer via JWKS discovery + key caching. Extracts sub/email into context actor. Falls back to static bearer tokens. Dev mode (no OIDC + no tokens) = open. - Config: OIDCIssuer, OIDCClientID env vars - SSE + OIDC infrastructure complete, build passes, all tests pass Remaining: MCP server, conformance tests, wire audit middleware
120 lines
3.3 KiB
Go
120 lines
3.3 KiB
Go
package config
|
|
|
|
import (
|
|
"fmt"
|
|
"log/slog"
|
|
"os"
|
|
"strings"
|
|
)
|
|
|
|
// Config holds all runtime configuration for an Oikos role.
|
|
// Hierarchy: compiled defaults → config file → env vars → Infisical (secrets only).
|
|
type Config struct {
|
|
// Database
|
|
DatabaseURL string // postgres://user:pass@host:5432/oikos?sslmode=disable
|
|
|
|
// API
|
|
APIListen string // :8090
|
|
APIEnv string // dev, prod
|
|
|
|
// Auth (Phase 2: static bearer tokens + OIDC JWT)
|
|
APIToken string // operator/CI bearer token for the REST API
|
|
MCPBearerToken string // shared secret for Hermes→API MCP calls
|
|
OIDCIssuer string // OIDC issuer URL for JWT validation (e.g. https://authentik.example.com/application/o/oikos/)
|
|
OIDCClientID string // OIDC client ID (aud claim expected in JWT)
|
|
|
|
// Observability
|
|
Debug bool // verbose logging, probe payloads, SQL
|
|
|
|
// Seeds directory (for ingest/export)
|
|
SeedsDir string
|
|
|
|
// Migrations directory (embedded at build time, but path for fallback)
|
|
MigrationsDir string
|
|
}
|
|
|
|
// Default returns a Config with compiled defaults.
|
|
func Default() Config {
|
|
return Config{
|
|
DatabaseURL: "postgres://oikos:oikos@localhost:5432/oikos?sslmode=disable",
|
|
APIListen: ":8090",
|
|
APIEnv: "dev",
|
|
SeedsDir: "seeds",
|
|
MigrationsDir: "migrations",
|
|
}
|
|
}
|
|
|
|
// FromEnv loads config from environment variables, overlaying defaults.
|
|
func FromEnv() Config {
|
|
c := Default()
|
|
|
|
if v := os.Getenv("OIKOS_DATABASE_URL"); v != "" {
|
|
c.DatabaseURL = v
|
|
}
|
|
if v := os.Getenv("OIKOS_API_LISTEN"); v != "" {
|
|
c.APIListen = v
|
|
}
|
|
if v := os.Getenv("OIKOS_ENV"); v != "" {
|
|
c.APIEnv = v
|
|
}
|
|
if v := os.Getenv("OIKOS_OIDC_ISSUER"); v != "" {
|
|
c.OIDCIssuer = v
|
|
}
|
|
if v := os.Getenv("OIKOS_OIDC_CLIENT_ID"); v != "" {
|
|
c.OIDCClientID = v
|
|
}
|
|
if v := os.Getenv("OIKOS_API_TOKEN"); v != "" {
|
|
c.APIToken = v
|
|
}
|
|
if v := os.Getenv("OIKOS_MCP_BEARER_TOKEN"); v != "" {
|
|
c.MCPBearerToken = v
|
|
}
|
|
if v := os.Getenv("OIKOS_SEEDS_DIR"); v != "" {
|
|
c.SeedsDir = v
|
|
}
|
|
c.Debug = os.Getenv("OIKOS_DEBUG") == "true" || os.Getenv("OIKOS_DEBUG") == "1"
|
|
|
|
return c
|
|
}
|
|
|
|
// redactedDBURL masks credentials in a postgres:// URL.
|
|
func (c Config) redactedDBURL() string {
|
|
dbURL := c.DatabaseURL
|
|
if i := strings.Index(dbURL, "@"); i >= 0 {
|
|
if j := strings.Index(dbURL, "://"); j >= 0 && j < i {
|
|
dbURL = dbURL[:j+3] + "***" + dbURL[i:]
|
|
}
|
|
}
|
|
return dbURL
|
|
}
|
|
|
|
// String returns a human-safe representation (secrets redacted).
|
|
func (c Config) String() string {
|
|
token := ""
|
|
if c.MCPBearerToken != "" {
|
|
token = "***"
|
|
}
|
|
return fmt.Sprintf("Config{DB=%s Listen=%s Env=%s Debug=%v MCPToken=%s SeedsDir=%s OIDCIssuer=%s OIDCClientID=%s}",
|
|
c.redactedDBURL(), c.APIListen, c.APIEnv, c.Debug, token, c.SeedsDir, c.OIDCIssuer, c.OIDCClientID)
|
|
}
|
|
|
|
// LogValue implements slog.LogValuer so structured handlers (JSON) never
|
|
// serialize raw secrets — without this, slog marshals struct fields
|
|
// directly and String() is bypassed.
|
|
func (c Config) LogValue() slog.Value {
|
|
token := ""
|
|
if c.MCPBearerToken != "" {
|
|
token = "***"
|
|
}
|
|
return slog.GroupValue(
|
|
slog.String("db", c.redactedDBURL()),
|
|
slog.String("listen", c.APIListen),
|
|
slog.String("env", c.APIEnv),
|
|
slog.Bool("debug", c.Debug),
|
|
slog.String("mcp_token", token),
|
|
slog.String("seeds_dir", c.SeedsDir),
|
|
slog.String("oidc_issuer", c.OIDCIssuer),
|
|
slog.String("oidc_client_id", c.OIDCClientID),
|
|
)
|
|
}
|