Module config 

Local configuration files (RON).

Two distinct files, split by audience:

• project.cfg — one per project folder, read by the client commands (sync, build, bundle, validate): where/how to publish, the optional build/bundle steps, and the deploy-scoped routing config that is folded into the immutable deployment manifest. See ProjectConfig.
• boatramp.cfg — the server daemon config, read by serve: serve / handlers / cluster. See ServerConfig.

Both are RON; a missing file yields the default config.

Structs

BindingsConfig

handlers.bindings — per-binding backend configuration. kv/blob reuse the server’s own KV/Storage backends (per-site prefixed); sql is the single libsql backend, whose single-node-vs-cluster split is the only choice.

BuildConfig

build section.

BundleConfig

bundle section — the in-process Rust bundler (bundler feature).

ClusterConfig

cluster section — self-hosted cluster mode. Parsed in every build so config files stay portable; only consumed when the cluster feature is compiled in (boatramp serve --mode cluster).

ComputeConfig

compute section — opt-in compute backends. Present ⇒ serve registers the backends this node can offer and advertises them to the scheduler; backends are capability-detected (container on Linux, remote docker when a daemon is reachable, VMM when /dev/kvm exists).

ConsoleConfig

[serve.console] — the embedded web console (a Wasm SPA baked into the binary with the console build feature). Opt-in: the static shell holds no secrets and the /api it drives is token-gated, so it is served unauthenticated at a deliberately obscure path (a bearer token can’t gate a top-level browser navigation anyway — the path is the obscurity, the token is the real gate).

ExternalDatabaseConfig

One external (bring-your-own) SQL database for the handler sql binding. The connection URL is a secret and is named indirectly (url_env), never written in the config file.

HandlersConfig

handlers section — server-side handler runtime config (read by serve). Parsed in every build (so config files stay portable), but only consumed when the handlers feature is compiled in.

MeshConfig

[cluster.mesh] — mesh identity + TLS knobs.

ProjectConfig

Project configuration, loaded from project.cfg (RON) in the project folder.

PublishConfig

publish section — where and what to deploy (the sync target).

SecretsConfig

secrets section — envelope encryption for private keys at rest.

ServeConfig

serve section — server defaults, overridden by flags/env.

ServerConfig

Server daemon configuration, loaded from boatramp.cfg (RON). Read by boatramp serve; flags/env override the serve values.

SqlBindingConfig

libsql settings for the handler sql binding — the single SQL backend. Each site gets a real database boundary (an embedded file per site, or a sqld namespace per site), never schema separation (which arbitrary guest SQL escapes). Setting url switches from single-node to a shared sqld cluster; everything else stays identical.

VaultSecretsConfig

Vault Transit settings for envelope = "vault". The token is read from the environment (token_env), never stored in the config file.

Enums

AuthSignerConfig

External token signer selector (serve.signer). Maps to boatramp_server::signer::SignerConfig; secrets (tokens/PINs) are resolved from the named env vars at startup, never stored in config. Written as a RON enum — signer: Vault(...), signer: AwsKms(...), signer: Pkcs11(...), ….

ConfigError

A failure loading or parsing a local config file (project.cfg / boatramp.cfg).

SignerAlg

The signing algorithm for a signer that can choose one (Local, Vault, Pkcs11). ES256 is the portable default; the cloud KMS backends are ES256-only and ignore this. Written as a RON enum: alg: Es256 / alg: Ed25519.

Constants

BOATRAMP_KERNEL_SIGNING_PUBKEY

The built-in boatramp kernel-signing public key (es256:…), whose private half lives as the KERNEL_SIGNING_KEY Actions secret in BoatRamp/boatramp-vmlinux. Shipped as a default trust anchor so the first-party signed boatramp-vmlinux verifies out of the box under the strict posture. An operator can replace kernel_signing_pubkeys to trust only their own keys.

Functions

ron_options

RON parse options shared by both loaders: implicit_some lets optional fields be written as bare values (server: "...", not Some("...")). pub so the binary (which re-exports this module) can parse a manifest with the same options after the module moved into this crate.