31 lines
1 KiB
Text
31 lines
1 KiB
Text
# registry-access domain contract v0.1.0
|
|
#
|
|
# OCI registry endpoint and per-namespace access policy.
|
|
# Credentials (username, password, token) arrive via secret-delivery.
|
|
|
|
let _AccessMode = [| 'read_only, 'read_write, 'append_only |] in
|
|
|
|
let _NamespaceAccess = {
|
|
name | String
|
|
| doc "Registry namespace path (e.g. 'images', 'cache', 'crates')",
|
|
access | _AccessMode,
|
|
} in
|
|
|
|
let _RegistryAccessContext = {
|
|
schema_version | String | default = "0.1.0",
|
|
workspace | String,
|
|
mode_id | String,
|
|
endpoint | String
|
|
| doc "Base HTTPS URL of the OCI registry (e.g. 'https://reg.librecloud.online')",
|
|
namespaces | Array _NamespaceAccess | optional
|
|
| doc "Per-namespace access policy; absent means no namespace restrictions",
|
|
insecure | Bool
|
|
| doc "Allow plain HTTP (only for local/test registries)"
|
|
| default = false,
|
|
} in
|
|
|
|
{
|
|
AccessMode = _AccessMode,
|
|
NamespaceAccess = _NamespaceAccess,
|
|
RegistryAccessContext = _RegistryAccessContext,
|
|
}
|