Scott KarpandClaude Fable 5.1
e17436c4ca
Three NLBs became one (185.19.28.170, ingress-nginx). Shorashim: `shorashim-external` (NLB 185.19.29.180, NodePort 30923) is replaced by an Ingress — a host-less catch-all (works by IP, no DNS) plus a `shorashim.ch` rule ready for the A record; TLS deliberately not requested until the name resolves. Sanhedrin-length proxy timeouts. The watch behind the ingress (completes tablet 46): the TCP peer is now the ingress controller, so Mishmar.peer/1 takes the caller from X-Real-IP — only when the peer is inside TRUSTED_PROXIES (the pod network, configmap); from anyone else the header is the caller's own claim and is ignored. The ingress Service was already externalTrafficPolicy: Local with its health-check port open, so the caller's address arrives without the security-group change the direct route needed. Verified live: the 11th knock is 429, a forged X-Real-IP is still 429, and in the same minute the old route (pod sees the node) was a different subject. Gitea: no name of its resolves, so it rides the controller's TCP passthrough on the same NLB — :3000 → gitea:80, :22 → gitea:22 (ingress-tcp-services.yaml), on the two NodePorts the security group already allowed. gitea-mcp now reaches Gitea over the cluster network instead of out through an NLB and back. Tamid §1.1 note, KOHEN.md, AGENTS.md. Doorpost e4e3d56d… → a2ec3842…. Elixir 539/0 (L3 on and off). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
46 lines
1.7 KiB
Elixir
46 lines
1.7 KiB
Elixir
import Config
|
|
|
|
# L1 mount point — relative path for dev, absolute for production
|
|
# Construction spec §4.4: l1_mount_point: "/mnt/torah"
|
|
config :vav_pipeline,
|
|
# Dev: relative to project root (run from shorashim/)
|
|
l1_mount_point: "l1",
|
|
# Manna provision file
|
|
manna_provision_file: "var/manna/today.json",
|
|
# Shabbat check interval (1 minute)
|
|
cycle_boundary_check_interval_ms: 60_000,
|
|
# ShemaContext: no caching — always read fresh
|
|
shema_context_cache_ttl_ms: 0,
|
|
# Step 14 — Component connection config
|
|
# Shoresh Engine (Haskell) — binary path for Erlang Port
|
|
shoresh_engine_binary: "shoresh-engine",
|
|
shoresh_engine_cwd: nil,
|
|
# Talmudic Engine (Prolog) — Unix domain socket path
|
|
talmudic_socket_path: "/tmp/shorashim/talmudic.sock",
|
|
korban_socket_path: "/tmp/shorashim/korban.sock",
|
|
# Courtyard / chatzer keys (BigdeiKodesh.Gate). nil → the gate is shut.
|
|
# Construction §4.6: a file, never an environment variable.
|
|
api_keys_file: nil,
|
|
# The watch (BigdeiKodesh.Mishmar). pe'ah is Tamid §1.1 verbatim; the
|
|
# other two derive from Construction §2.3 and may be tuned here.
|
|
rate_limits: [
|
|
peah: [minute: 10, hour: 100],
|
|
courtyard: [minute: 20, hour: 200],
|
|
chatzer: [minute: 5, hour: 60]
|
|
],
|
|
# Peers whose X-Real-IP is believed (the ingress controller). CIDRs.
|
|
# Empty → the TCP peer is the caller.
|
|
trusted_proxies: []
|
|
|
|
# L3 — Oral Tradition (PostgreSQL)
|
|
# Architecture §3.7: Append-only. INSERT allowed. Never UPDATE. Never DELETE.
|
|
config :vav_pipeline, ecto_repos: [VavPipeline.Repo]
|
|
|
|
config :vav_pipeline, VavPipeline.Repo,
|
|
database: "shorashim_dev",
|
|
hostname: "localhost",
|
|
pool_size: 10
|
|
|
|
# Import environment specific config
|
|
import_config "#{config_env()}.exs"
|