Skip to main content

Configuration

This page is the short canonical map for repo-owned runtime and contract inputs.

Primary Sources​

  • compose.yaml
  • .env.example
  • config/runtime/port-policy.json
  • config/runtime/runtime-materialization-policy.yaml
  • config/keycloak/realms/helpifyr-template.json
  • config/clients/*.yaml
  • config/identity/*.yaml

Runtime Ports and Host Binds​

  • HEADDLE_HTTP_PORT
  • HEADDLE_MANAGEMENT_PORT
  • PLANE_OIDC_HOST_BIND_IP
  • PLANE_OIDC_HOST_PORT
  • LOOM_OIDC_HOST_BIND_IP
  • LOOM_OIDC_HOST_PORT
  • AGENT_RECONCILE_API_PORT
  • AGENT_RECONCILE_WORKER_PORT

Keycloak and Database Runtime​

  • KC_BOOTSTRAP_ADMIN_USERNAME
  • KC_BOOTSTRAP_ADMIN_PASSWORD
  • KC_DB_*
  • POSTGRES_*

Fabric / Projection Consumption​

  • FABRIC_BASE_URL-style validator arguments
  • AGENT_RECONCILE_FABRIC_*
  • AGENT_RECONCILE_FABRIC_AUTH_TOKEN is a protected runtime-only read token for the private Fabric agent-federation readiness, projection, and drift endpoints; it must never be committed, returned by status APIs, or replaced by an unauthenticated host-port fallback.
  • PLANE_OIDC_FABRIC_AUTH_TOKEN when Plane bridge readiness consumes a guarded Fabric projection/readiness surface
  • Fabric consumer contracts under config/fabric/*.yaml

Bridge and Runtime Verification Inputs​

  • PLANE_OIDC_*
  • LOOM_OIDC_*
  • KEYCLOAK_*
  • AGENT_RECONCILE_MODE
  • AGENT_RECONCILE_RESTORE_SWEEP_VERIFIED
  • AGENT_RECONCILE_APPLY

Employee-JML technical receipt inputs:

  • HEDDLE_EMPLOYEE_JML_READBACK_TOKEN and HEDDLE_EMPLOYEE_JML_READBACK_SIGNING_KEY are runtime-only secrets.
  • HEDDLE_EMPLOYEE_JML_REPLAY_DB_PATH and HEDDLE_EMPLOYEE_JML_SESSION_EVIDENCE_DB_PATH point both private services at the shared repo-owned durable volume.
  • The Lantern OIDC bridge writes session evidence only after verifying provider signature, issuer, audience and login nonce. The Agent Reconcile API combines that evidence with current Keycloak Admin session existence; neither accepts caller-supplied AMR, ACR or auth_time.

Fail-closed secret requirement:

  • PLANE_OIDC_SESSION_SECRET and LOOM_OIDC_SESSION_SECRET must be explicitly set for bridge startup
  • placeholder fallback secrets are not accepted

Verify Path​

python scripts/validate-admitted-surface-client-contracts.py --admitted-surfaces config/clients/admitted-surfaces.v1.yaml
python scripts/validate-identity-claim-vocabulary.py --contract config/identity/claim-vocabulary.v2.yaml
python scripts/verify-runtime-materialization-drift.py
python scripts/verify-runtime-materialization-drift.py --live-host <live-host> --ssh-user <ssh-user> --remote-repo-path <remote-repo-path>

License: AGPLv3 Project: https://helpifyr.com

Bootstrap JML live verification

scripts/validate-bootstrap-access-projection-jml-seam.py reads Fabric's protected identity-contract endpoint when --fabric-base-url is supplied. Provide its runtime-only read token through --fabric-auth-token-env (default FABRIC_AUTH_TOKEN) or --fabric-auth-token-file; do not commit or print the token. A denied protected read fails the verifier rather than bypassing Fabric.