Module config 

Local configuration files (RON).

Two distinct files, split by audience:

• project.cfg — one per project folder, read by the client commands (sync, build, bundle, validate): where/how to publish, the optional build/bundle steps, and the deploy-scoped routing config that is folded into the immutable deployment manifest. See ProjectConfig.
• boatramp.cfg — the server daemon config, read by serve: serve / handlers / cluster. See ServerConfig.

Both are RON; a missing file yields the default config.

Structs

BindingsConfig

handlers.bindings — per-binding backend configuration. kv/blob reuse the server’s own KV/Storage backends (per-site prefixed); sql is the single libsql backend, whose single-node-vs-cluster split is the only choice.

BlobBackendConfig

[serve.blob_backends.<project>] — a per-project blob object-store backend (PLAN-per-project-blob-backend). Same backend-descriptor shape as the [serve] primary’s S3 fields plus its OWN sealed base S3 credential (#505 path), so project ACME can point its wasi:blobstore at its own bucket/endpoint/account. Key-prefix confinement (container_access) still runs on top — a separate bucket adds PHYSICAL isolation, it does not replace the confinement (invariant 2).

BlobFallbackConfig

[serve.blob_fallback] — a read-only SECONDARY blob backend for a zero-downtime backend switch (blob-backend migration Part 2). Same backend-descriptor shape as the PRIMARY ([serve]’s blobs/s3_*/gcs_*/azure_* fields) so a source/dest is fully described by config, plus its OWN optional s3_credential (the secondary can source its base S3 credential from the sealed [secrets] store via its own boatramp:/env: ref, #505). Constructed exactly like the primary but with NO watcher provisioning (a read-only drain source never watches). Serving wraps FallbackStorage::new(primary, secondary, …) so a primary miss on a boatramp-owned key falls through to this secondary; writes/deletes are primary-only.

BuildConfig

build section.

BundleConfig

bundle section — the in-process Rust bundler (bundler feature).

ClusterConfig

cluster section — self-hosted cluster mode. Parsed in every build so config files stay portable; only consumed when the cluster feature is compiled in (boatramp serve --mode cluster).

ComputeConfig

compute section — opt-in compute backends. Present ⇒ serve registers the backends this node can offer and advertises them to the scheduler; backends are capability-detected (container on Linux, remote docker when a daemon is reachable, VMM when /dev/kvm exists).

ConsoleConfig

[serve.console] — the embedded web console (a Wasm SPA baked into the binary with the console build feature). Opt-in: the static shell holds no secrets and the /api it drives is token-gated, so it is served unauthenticated at a deliberately obscure path (a bearer token can’t gate a top-level browser navigation anyway — the path is the obscurity, the token is the real gate).

ExternalDatabaseConfig

One external SQL database for the handler sql binding. Its source is one of two mutually-exclusive forms:

HandlersConfig

handlers section — server-side handler runtime config (read by serve). Parsed in every build (so config files stay portable), but only consumed when the handlers feature is compiled in.

KvConfig

[serve.kv] — control-plane KV configuration. The backend itself is selected by --kv / BOATRAMP_KV (slatedb default, sql, memory, cloudflare); this block holds the backend-specific settings, nested so a knob can never silently mislead under the wrong backend (UX-C3): the SlateDB durability knobs live under slatedb, and the SQL connection under sql. Absent block ⇒ the SlateDB defaults apply.

ListenerConfig

[serve.listeners.<name>] — a host-owned inbound-TCP listener (PLAN-handler-tcp-inbound). The node binds + listens + accepts on bind and dispatches each accepted connection to the guest component’s tcp-connection-handler export, with tenancy OPERATOR-PINNED here (a raw socket carries no Host/path/principal, so there is nothing per-connection to resolve). The guest is handed only the connection’s wasi:io byte streams — it holds NO wasi:sockets authority (bind stays host-side). Modeled on boatramp_core::function::FunctionConfig / the session route config.

ListenerTlsConfig

DEFERRED (Phase 1): per-listener host-TLS material. Present in the schema for forward parity, but a declared tls block is REFUSED at config load in Phase 1 (plaintext-only) — see ListenerConfig.

MeshConfig

[cluster.mesh] — mesh identity + TLS knobs.

ProjectConfig

Project configuration, loaded from project.cfg (RON) in the project folder.

PublishConfig

publish section — where and what to deploy (the sync target).

S3CredentialConfig

[serve.s3_credential] — a node-level base S3 credential source (#505) sourcing the base AWS credential from boatramp’s [secrets] sealed store rather than the ambient env chain. Consumed by BOTH the S3 blob object backend and the AWS blob-upload cloud minter (one shared source, since it is the same bucket key). Additive/non-breaking: absent ⇒ the ambient AWS env chain (unchanged).

S3IngressCloud

[serve.s3_ingress_cloud] — the cloud-brokering knobs for the M4 blob-upload minter (which native credential the mint brokers when the node’s blob backend is a cloud object store). Only the fields for the active blob backend are consulted; a None here ⇒ the local S3 face mints.

SecretsConfig

secrets section — envelope encryption for private keys at rest.

ServeConfig

serve section — server defaults, overridden by flags/env.

ServerConfig

Server daemon configuration, loaded from boatramp.cfg (RON). Read by boatramp serve; flags/env override the serve values.

SlatedbKvConfig

[serve.kv.slatedb] — control-plane SlateDB KV durability knobs (v0.9.0 KV-recovery). Both are backstops/tuning: the crown-jewel per-write frontier-sync (C2) is unconditional and independent of these. Absent ⇒ both defaults apply (checkpoint cadence ON, generous close budget). (v0.12.0 UX-C3: MOVED here from the [serve.kv] top level so they do not appear to apply under a non-SlateDB backend; with deny_unknown_fields a pre-v0.12.0 top-level knob now fails loud rather than silently misleading.)

SqlBindingConfig

libsql settings for the handler sql binding — the single SQL backend. Each site gets a real database boundary (an embedded file per site, or a sqld namespace per site), never schema separation (which arbitrary guest SQL escapes). Setting url switches from single-node to a shared sqld cluster; everything else stays identical.

SqlKvConfig

[serve.kv.sql] — the SQL control-plane KV backend connection (--kv sql). The connection URL is NEVER written in the config (UX-C2): a bring-your-own / remote engine names the env var holding it via url_env (mirroring ExternalDatabaseConfig), while an embedded single-node SQLite database names an on-disk file via path. Every field is also settable by BOATRAMP_KV_SQL_* env (resolved at serve wiring). This workstream (build-order step 1) wires sqlite (libsql-local) only; postgres/mysql are later workstreams.

VaultSecretsConfig

Vault Transit settings for envelope = "vault". The token is read from the environment (token_env), never stored in the config file.

Enums

AuthSignerConfig

External token signer selector (serve.signer). Maps to boatramp_server::signer::SignerConfig; secrets (tokens/PINs) are resolved from the named env vars at startup, never stored in config. Written as a RON enum — signer: Vault(...), signer: AwsKms(...), signer: Pkcs11(...), ….

ConfigError

A failure loading or parsing a local config file (project.cfg / boatramp.cfg).

ConfigFormat

The wire format an operator-authored config file is decoded as (v0.6.5).

ManagedDbPrivilege

How a managed database (PLAN-managed-compute-sql) runs its stock image on a shared-kernel backend, whose entrypoint would otherwise fail under the dropped-ALL hardening. rootless (the default) needs no capabilities and works under any posture; caps is the fallback for an image that won’t run rootless.

SignerAlg

The signing algorithm for a signer that can choose one (Local, Vault, Pkcs11). ES256 is the portable default; the cloud KMS backends are ES256-only and ignore this. Written as a RON enum: alg: Es256 / alg: Ed25519.

TenantIsolation

How a managed compute-backed database is physically isolated per tenant (2×2 axis 1). Single = a dedicated server (container) per tenant (isolation by separate process); Shared = one server with a per-tenant database + login role (isolation by grants — Postgres REVOKE CONNECT FROM PUBLIC + owner grant; MySQL per-schema grant), so a tenant’s role cannot connect to another tenant’s database.

TenantScope

The grain of a tenant for a managed compute-backed database (2×2 axis 2) — Project (default) or Site. The two grains are parallel; the isolation mechanism is TenantIsolation.

Constants

BOATRAMP_KERNEL_SIGNING_PUBKEY

The built-in boatramp kernel-signing public key (es256:…), whose private half lives as the KERNEL_SIGNING_KEY Actions secret in BoatRamp/boatramp-vmlinux. Shipped as a default trust anchor so the first-party signed boatramp-vmlinux verifies out of the box under the strict posture. An operator can replace kernel_signing_pubkeys to trust only their own keys.

DEFAULT_BLOB_FALLBACK_TIMEOUT_SECS

Default bound (seconds) on a [serve.blob_fallback] secondary read when secondary_timeout_secs is unset: 5s — long enough for a cloud round-trip, short enough that a wedged secondary degrades a primary miss to NotFound promptly rather than hanging serving.

DEFAULT_KV_CHECKPOINT_INTERVAL_SECS

Default control-plane KV periodic checkpoint cadence (seconds) when [serve.kv] checkpoint_interval is unset (v0.9.0 KV-recovery, C1). The cadence advances the durable frontier (WAL→L0 MemTable freeze) so the self-heal-on-open trailing-tail loss window is bounded to at most this interval for anything NOT already frontier-synced by a crown-jewel write. 10s balances a tiny loss window against manifest-PUT churn; an idle store’s checkpoint is a dirty-gated no-op regardless.

DEFAULT_KV_CLOSE_DEADLINE_SECS

Default graceful-close budget (seconds) when [serve.kv] close_deadline is unset (v0.9.0 KV-recovery, C12). The shutdown drain+close is abandoned only after this budget — GENEROUS (not the old hardcoded 3s, which self-exited BEFORE fly’s SIGKILL grace and left the frontier un-advanced = the exact torn tail we prevent). With continuous checkpointing (C1/C2) the close is cheap, so this budget rarely bites; operators should still raise fly kill_timeout to ≥ their measured drain+close.

DEFAULT_KV_GC_INTERVAL_SECS

Default control-plane SlateDB online maintenance-GC cadence (seconds) when [serve.kv.slatedb] gc_interval is unset (kv-data-observability durable fix). The supervised writer task reclaims the stale manifest/compactions/WAL/compacted objects the embedded GC would — SURVIVING the transient tick error that kills the unsupervised embedded GC permanently (the 16.5 GB manifest-retention leak). 900s (15 min) matches the cadence of the embedded GC’s own protective-checkpoint window, so freshly-superseded SSTs age out of their checkpoint before the next reclaim; a 0 DISABLES the task.

DEFAULT_KV_GC_MIN_AGE_SECS

Default minimum object age (seconds) before the online maintenance GC will reclaim an object, when [serve.kv.slatedb] gc_min_age is unset. 3600s (1h) is deliberately CONSERVATIVE: the online GC only deletes objects the latest manifest no longer references, but a read replica polling the shared store could still be mid-scan over a manifest generation that just became stale — a min_age this large guarantees such a needed-but-unreferenced object is never a deletion candidate while any plausible replica scan is in flight. A 0 (or unset) falls back to this default — it is never zero (a zero min_age would reintroduce exactly the mid-scan deletion hazard this bound closes).

DEFAULT_LISTENER_IDLE_TIMEOUT_MS

Default per-listener idle timeout (ms) when idle_timeout_ms is unset — 60s. A connection with no bytes in either direction for this long is torn down (so a connection that opens and sends nothing can’t hold a store + instance + conn-lane permit forever).

DEFAULT_LISTENER_MAX_CONNS

Default per-listener live-connection cap when [serve.listeners.<name>] max_conns is unset (PLAN-handler-tcp-inbound). 256 — a generous but bounded ceiling on top of the engine conn lane.

DEFAULT_LISTENER_MAX_CONN_DURATION_MS

Default per-listener absolute max-connection-duration (ms) when max_conn_duration_ms is unset — 1h. Bounds a single connection’s lifetime regardless of activity (CPU is wall-clock-bounded here, since the conn lane disables the per-invocation CPU-fuel budget).

DEFAULT_S3_INGRESS_MINT_MAX_TTL_SECS

The default operator ceiling on a minted S3 upload credential’s TTL when [serve].s3_ingress_mint_max_ttl_secs is unset: 1 hour — long enough for a browser UGC upload or a bulk-agent burst, short enough to bound a leaked short-lived credential.

Functions

resolve_format

Resolve the ConfigFormat for a config path.

ron_options

RON parse options shared by both loaders: implicit_some lets optional fields be written as bare values (server: "...", not Some("...")). pub so the binary (which re-exports this module) can parse a manifest with the same options after the module moved into this crate.