6a59d34bb1
Update configuration files, templates, and internal documentation for the provisioning repository system. Configuration Updates: - KMS configuration modernization - Plugin system settings - Service port mappings - Test cluster topologies - Installation configuration examples - VM configuration defaults - Cedar authorization policies Documentation Updates: - Library module documentation - Extension API guides - AI system documentation - Service management guides - Test environment setup - Plugin usage guides - Validator configuration documentation All changes are backward compatible.
206 lines
5.8 KiB
TOML
206 lines
5.8 KiB
TOML
# Provisioning Platform - Plugin Configuration
|
|
#
|
|
# This file configures the three critical Nushell plugins that provide
|
|
# high-performance operations for the provisioning platform.
|
|
#
|
|
# Performance gains:
|
|
# - Auth operations: ~10x faster (local JWT verification)
|
|
# - KMS operations: ~10x faster (no HTTP encryption)
|
|
# - Orchestrator queries: ~30x faster (direct file I/O)
|
|
|
|
[plugins]
|
|
# Enable plugin system (set to false to use HTTP fallback only)
|
|
enabled = true
|
|
|
|
# Plugin version (matches provisioning platform version)
|
|
version = "0.1.0"
|
|
|
|
# Auto-load plugins on startup
|
|
auto_load = true
|
|
|
|
# Graceful fallback to HTTP API if plugins unavailable
|
|
fallback_enabled = true
|
|
|
|
# =============================================================================
|
|
# Authentication Plugin (nu_plugin_auth)
|
|
# =============================================================================
|
|
[plugins.auth]
|
|
name = "nu_plugin_auth"
|
|
enabled = true
|
|
description = "JWT authentication with system keyring integration"
|
|
priority = 1
|
|
|
|
# Commands provided by this plugin
|
|
commands = [
|
|
"auth login",
|
|
"auth logout",
|
|
"auth verify",
|
|
"auth sessions",
|
|
"auth mfa enroll",
|
|
"auth mfa verify"
|
|
]
|
|
|
|
# Features
|
|
features = [
|
|
"jwt_rs256", # RS256 token signing
|
|
"system_keyring", # OS-native secure storage
|
|
"mfa_totp", # Time-based OTP
|
|
"mfa_webauthn", # FIDO2/WebAuthn
|
|
"session_management" # Multiple session support
|
|
]
|
|
|
|
# Fallback HTTP endpoint when plugin unavailable
|
|
fallback_endpoint = "http://localhost:8081/api/auth"
|
|
|
|
# Performance characteristics
|
|
[plugins.auth.performance]
|
|
typical_latency_ms = 10
|
|
http_fallback_latency_ms = 50
|
|
improvement_factor = 5
|
|
|
|
# =============================================================================
|
|
# KMS Plugin (nu_plugin_kms)
|
|
# =============================================================================
|
|
[plugins.kms]
|
|
name = "nu_plugin_kms"
|
|
enabled = true
|
|
description = "Multi-backend Key Management System encryption"
|
|
priority = 2
|
|
|
|
# Commands provided by this plugin
|
|
commands = [
|
|
"kms encrypt",
|
|
"kms decrypt",
|
|
"kms generate-key",
|
|
"kms status",
|
|
"kms list-backends"
|
|
]
|
|
|
|
# Supported KMS backends
|
|
backends = [
|
|
"rustyvault", # Primary - local Vault-compatible
|
|
"age", # File-based encryption
|
|
"cosmian", # Privacy-preserving
|
|
"aws", # AWS KMS
|
|
"vault" # HashiCorp Vault
|
|
]
|
|
|
|
# Default backend selection priority
|
|
backend_priority = ["rustyvault", "age", "vault", "aws", "cosmian"]
|
|
|
|
# Fallback HTTP endpoint when plugin unavailable
|
|
fallback_endpoint = "http://localhost:8082/api/kms"
|
|
|
|
# Environment variables for backend configuration
|
|
[plugins.kms.env_vars]
|
|
rustyvault = ["RUSTYVAULT_ADDR", "RUSTYVAULT_TOKEN"]
|
|
age = ["AGE_RECIPIENT", "AGE_IDENTITY"]
|
|
aws = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_REGION"]
|
|
vault = ["VAULT_ADDR", "VAULT_TOKEN"]
|
|
cosmian = ["KMS_HTTP_URL"]
|
|
|
|
# Performance characteristics
|
|
[plugins.kms.performance]
|
|
typical_latency_ms = 5
|
|
http_fallback_latency_ms = 50
|
|
improvement_factor = 10
|
|
|
|
# =============================================================================
|
|
# Orchestrator Plugin (nu_plugin_orchestrator)
|
|
# =============================================================================
|
|
[plugins.orchestrator]
|
|
name = "nu_plugin_orchestrator"
|
|
enabled = true
|
|
description = "Local orchestrator operations with direct file I/O"
|
|
priority = 3
|
|
|
|
# Commands provided by this plugin
|
|
commands = [
|
|
"orch status",
|
|
"orch tasks",
|
|
"orch validate",
|
|
"orch submit",
|
|
"orch monitor"
|
|
]
|
|
|
|
# Features
|
|
features = [
|
|
"local_state", # Direct file-based state access
|
|
"kcl_validation", # KCL workflow validation
|
|
"task_queue", # Local task queue operations
|
|
"progress_monitor" # Real-time task monitoring
|
|
]
|
|
|
|
# Default data directory
|
|
data_dir = "${PROVISIONING_ORCHESTRATOR_DATA:-./data/orchestrator}"
|
|
|
|
# Fallback HTTP endpoint when plugin unavailable
|
|
fallback_endpoint = "http://localhost:9090/api"
|
|
|
|
# Performance characteristics
|
|
[plugins.orchestrator.performance]
|
|
typical_latency_ms = 1
|
|
http_fallback_latency_ms = 30
|
|
improvement_factor = 30
|
|
|
|
# =============================================================================
|
|
# Plugin Installation Paths
|
|
# =============================================================================
|
|
[plugins.paths]
|
|
# Base directory for plugin binaries
|
|
base = "${PROVISIONING_PLUGINS_PATH:-${HOME}/.local/share/nushell/plugins}"
|
|
|
|
# Platform-specific binary extensions
|
|
[plugins.paths.extensions]
|
|
linux = ""
|
|
darwin = ""
|
|
windows = ".exe"
|
|
|
|
# =============================================================================
|
|
# Fallback Configuration
|
|
# =============================================================================
|
|
[plugins.fallback]
|
|
# Enable graceful degradation to HTTP API
|
|
enabled = true
|
|
|
|
# HTTP API endpoints for fallback
|
|
auth_api = "http://localhost:8081/api/auth"
|
|
kms_api = "http://localhost:8082/api/kms"
|
|
orch_api = "http://localhost:9090/api"
|
|
|
|
# Timeout for HTTP fallback requests (ms)
|
|
timeout_ms = 5000
|
|
|
|
# Retry configuration for HTTP fallback
|
|
max_retries = 3
|
|
retry_delay_ms = 100
|
|
|
|
# =============================================================================
|
|
# Logging and Diagnostics
|
|
# =============================================================================
|
|
[plugins.logging]
|
|
# Log plugin operations
|
|
enabled = false
|
|
|
|
# Log level: debug, info, warn, error
|
|
level = "warn"
|
|
|
|
# Log plugin performance metrics
|
|
metrics_enabled = false
|
|
|
|
# =============================================================================
|
|
# Security Settings
|
|
# =============================================================================
|
|
[plugins.security]
|
|
# Verify plugin signatures (future feature)
|
|
verify_signatures = false
|
|
|
|
# Allowed plugin sources
|
|
allowed_sources = [
|
|
"local",
|
|
"https://repo.jesusperez.pro"
|
|
]
|
|
|
|
# Sandbox plugin execution (future feature)
|
|
sandbox_enabled = false
|