solver web-service runtime settings

104 lines of INI Raw file Open on GitHub

# solver web-service runtime settings
# ===================================
#
# The web services are configured by their **environment**, not by `values.conf`: each
# runs as its own uid, from `/opt/euler`, with a scoped `EnvironmentFile=` under
# `/etc/euler` and — for three of them — no working tree at all. This file is the map
# from a service's settings to the variables that carry them.
#
# One entry per line:
#
#     <field> = <ENV_VAR> | <default>
#
# `<field>` is the config class's attribute, which also decides the type it is read as.
# An empty default means the empty string. `!required` means the service refuses to
# start without it, naming the variable — a secret or a public URL that has no sane
# default is better as a startup failure than as a quiet wrong answer.
#
# Everything a *person* would tune lives in `values.conf` instead. These are deployment
# facts: which socket, which group, which state directory. Change one by editing the
# unit's env file, not this table — this only says which variable to set.
#
# `[common]` is not a service. Its entries are settings several services share, so the
# default is stated once: `euler-web` used to be written into five separate files, and
# a group name that disagrees with the Caddy config is a socket nobody can connect to.


[common]
# Group given connect() on a public socket — Caddy and the app tier are in it.
socket_group      = EULER_WEB_GROUP        | euler-web
# Group for an admin socket. Empty means **private** (0600, the service uid only): the
# admin planes are wheel-gated, and root connects through sudo.
admin_socket_group = EULER_ADM_GROUP       |
# Where the per-user instance sockets live (`user-<slug>.sock`). A push — a teardown, a
# message delivery — targets the one socket for the user affected. Empty disables it.
user_socket_dir   = EULER_USER_SOCKET_DIR  | /run/euler
# The auth service's public socket, as seen by everything that mints a shell ticket.
auth_socket       = EULER_AUTH_SOCKET      | /run/euler/auth.sock
# The static content root (assets + vendored JS; Caddy serves them in production).
static_dir        = EULER_CONTENT_STATIC_DIR |
# Serve /assets and /vendor from the app itself. Dev only.
serve_static      = EULER_CONTENT_SERVE_STATIC |
# The repo on GitHub, for the problem page's "source" link.
github_url        = EULER_GITHUB_URL       | https://github.com/vikasmunshi/euler
github_branch     = EULER_GITHUB_BRANCH    | master
# Seconds a web shell may sit with zero attached sockets before the reaper closes it
# (hygiene, not security; 0 disables).
detached_ttl      = EULER_WS_DETACHED_TTL  | 86400


[auth]
# euler-auth: SRP registration and login, the forward_auth every request passes through,
# and the admin plane the `users` command drives under sudo.
state_dir         = EULER_AUTH_STATE_DIR      | /var/lib/euler-auth
socket_path       = EULER_AUTH_SOCKET         | /run/euler/auth.sock
admin_socket_path = EULER_AUTH_ADMIN_SOCKET   | /run/euler-adm/auth-admin.sock
# The admin API's shared secret — the second factor beside the socket's group gate.
admin_token       = EULER_ADMIN_TOKEN         | !required
# The public https://<FQDN>, used in the invite and reset links people click. A wrong
# one mails out links that go nowhere, so it is required rather than guessed.
base_url          = EULER_BASE_URL            | !required
smtp_relay        = EULER_SMTP_RELAY          | 127.0.0.1:8025
terms_version     = TERMS_VERSION             | 1
# Where invite-request notices go. Empty disables the notice — `requests.json` is the
# system of record, so a missing address costs a nudge, not a request.
owner_email       = EULER_OWNER_EMAIL         |


[msg]
# euler-msg: the user <-> staff message spool, on its own uid.
state_dir         = EULER_MSG_STATE_DIR       | /var/lib/euler-msg
socket_path       = EULER_MSG_SOCKET          | /run/euler/msg.sock
admin_socket_path = EULER_MSG_ADMIN_SOCKET    | /run/euler-msg/admin.sock
admin_token       = EULER_MSG_ADMIN_TOKEN     | !required


[site]
# The content tier: server-rendered pages and htmx fragments.
socket_path       = EULER_CONTENT_SOCKET      | /run/euler/content.sock
tcp_bind          = EULER_CONTENT_TCP         |
# The profile this instance is born as. A request whose X-Profile differs is refused —
# the code-side backstop to Caddy's per-profile routing. Empty (dev) accepts any.
profile           = EULER_PROFILE             |
# Serve the public site: the packaged content (euler-content), read routes only, no identity.
public            = EULER_SITE_PUBLIC         |


[user]
# euler-user@<slug>: one collaborator's own content and their web shell, running as
# their uid, out of their own ~/euler clone.
tcp_bind          = EULER_USER_TCP            |
# **This instance's own user** — the collaborator's system_slug, which is also its uid,
# its home, its socket and its branch. The identity guard refuses any request whose
# X-User maps elsewhere. Empty (dev) accepts any authenticated user.
slug              = EULER_USER_SLUG           |
# Left without a default on purpose: it is `/run/euler/user-<slug>.sock`, and the slug
# is only known at startup, so the class computes it.
socket_path       = EULER_USER_SOCKET         |


[ws]
# The web-shell service: the solver PTY terminal over a WebSocket.
socket_path       = EULER_WS_SOCKET           | /run/euler/ws.sock
tcp_bind          = EULER_WS_TCP              |
profile           = EULER_PROFILE             |