toki
4c8441e6c9
사용자별 credential 저장, lease, projection, runtime 전달과 OpenAI-compatible 계약 및 검증 근거를 함께 반영한다.
49 lines
1.3 KiB
YAML
49 lines
1.3 KiB
YAML
server:
|
|
listen: "0.0.0.0:18000"
|
|
wire_listen: "0.0.0.0:19080"
|
|
edge_wire_listen: "0.0.0.0:19081"
|
|
edge_wire_tls:
|
|
enabled: false
|
|
cert: "/run/secrets/iop/control-plane.crt"
|
|
key: "/run/secrets/iop/control-plane.key"
|
|
ca: "/run/secrets/iop/credential-plane-ca.crt"
|
|
peer_role: "edge"
|
|
|
|
database:
|
|
url: ""
|
|
|
|
# Provider secret at-rest encryption. Leave all three fields empty/zero to run
|
|
# with encryption disabled (provider-secret mutations fail closed). To enable,
|
|
# a deployment secret manager mounts the key manifest as a 0600 file at
|
|
# key_file; only the id/version placeholders below are tracked, never key bytes.
|
|
credential_encryption:
|
|
key_file: ""
|
|
active_key_id: ""
|
|
active_key_version: 0
|
|
|
|
# Enable only with the complete HTTPS, mTLS, issuer, database, and at-rest
|
|
# encryption composition. Tracked files contain paths and key ids, never keys.
|
|
credential_plane:
|
|
enabled: false
|
|
https:
|
|
enabled: false
|
|
cert: "/run/secrets/iop/control-plane-https.crt"
|
|
key: "/run/secrets/iop/control-plane-https.key"
|
|
issuer_key_id: "credential-issuer-v1"
|
|
issuer_private_key: "/run/secrets/iop/credential-issuer.ed25519"
|
|
lease_ttl_seconds: 30
|
|
lease_cache_size: 256
|
|
|
|
redis:
|
|
url: ""
|
|
key_prefix: "iop:control-plane:"
|
|
|
|
tls:
|
|
enabled: false
|
|
|
|
logging:
|
|
level: "info"
|
|
pretty: true
|
|
|
|
metrics:
|
|
port: 9093
|