Scott KarpandClaude Fable 5.1
79eb34840f
/courtyard/* and /chatzer/* admitted any `Authorization: Bearer <x>`. Every test sent `Bearer test-token`; none sent a wrong one. Every admitted request spends the day's manna. VavPipeline.BigdeiKodesh.Gate: keys are a file (Construction §4.6 — never env, never config, never git), one `tier key` per line, tiers courtyard < chatzer (the inner ring opens the outer). Constant-time compare against every line; no file / empty / unreadable → nobody passes, GATE_NO_KEYS in the log, the caller told only "missing or invalid". 403 FORBIDDEN for an outer key at an inner gate. Read on every request so a rotated key is live in ~1 min without a rollout. Deploy: Secret shorashim-api-keys projected at /etc/shorashim/secrets/api_keys (vav-pipeline only, 0440), API_KEYS_FILE in the configmap, template + issue/rotate recipe in secrets.yaml and KOHEN.md "Issuing a key". Spec: tamid §1.1 (gate, 403), vayakhel §4.6. Doorpost 91d09d8d… → 42b38626…. Tests: tablet45_gate_test (parse, tiers, wrong/near/empty/no key, no file) — Elixir 527/0. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
45 lines
1.6 KiB
YAML
45 lines
1.6 KiB
YAML
# Shorashim ConfigMap — non-secret configuration
|
|
# Construction spec §4.4: Tuning constants
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: shorashim-config
|
|
namespace: shorashim
|
|
data:
|
|
# L1 mount point — read-only Torah filesystem
|
|
L1_MOUNT_POINT: "/mnt/torah"
|
|
|
|
# Manna provision file location
|
|
MANNA_PROVISION_FILE: "/var/lib/shorashim/manna/today.json"
|
|
|
|
# Talmudic Engine socket
|
|
TALMUDIC_SOCKET_PATH: "/tmp/shorashim/talmudic.sock"
|
|
|
|
# Korban Processor socket — the bedikah (Construction §3.9). Opened by
|
|
# the korban-processor container, read by vav-pipeline, both over the
|
|
# shared tmp-shorashim volume. Pod-internal; never on the network.
|
|
KORBAN_SOCKET_PATH: "/tmp/shorashim/korban.sock"
|
|
|
|
# Courtyard / chatzer keys — a FILE (Construction §4.6), projected from
|
|
# the shorashim-api-keys Secret (secrets.yaml). The path is config; the
|
|
# keys never are.
|
|
API_KEYS_FILE: "/etc/shorashim/secrets/api_keys"
|
|
|
|
# Shoresh Engine binary — staged onto the shared shoresh-bin volume
|
|
# by the shoresh-engine-install init container (see deployment.yaml).
|
|
# vav_pipeline spawns it as an Erlang Port, i.e. as a child process of
|
|
# the vav-pipeline container, so it must be a path on THIS
|
|
# container's filesystem.
|
|
SHORESH_ENGINE_BINARY: "/opt/shoresh/shoresh-engine"
|
|
|
|
# Shabbat location — Zurich (Construction spec §4.4)
|
|
SHABBAT_LATITUDE: "47.3769"
|
|
SHABBAT_LONGITUDE: "8.5417"
|
|
SHABBAT_TIMEZONE_OFFSET: "1"
|
|
|
|
# Cycle boundary check interval (ms)
|
|
CYCLE_BOUNDARY_CHECK_INTERVAL_MS: "60000"
|
|
|
|
# Pipeline latency budget (ms) — Construction spec §2.5
|
|
PIPELINE_LATENCY_BUDGET_MS: "5000"
|