Module config 

Local configuration files (RON).

Two distinct files, split by audience:

• project.cfg — one per project folder, read by the client commands (sync, build, bundle, validate): where/how to publish, the optional build/bundle steps, and the deploy-scoped routing config that is folded into the immutable deployment manifest. See ProjectConfig.
• boatramp.cfg — the server daemon config, read by serve: serve / handlers / cluster. See ServerConfig.

Both are RON; a missing file yields the default config.

Structs

BindingsConfig

handlers.bindings — per-binding backend configuration. kv/blob reuse the server’s own KV/Storage backends (per-site prefixed); sql is the single libsql backend, whose single-node-vs-cluster split is the only choice.

BlobFallbackConfig

[serve.blob_fallback] — a read-only SECONDARY blob backend for a zero-downtime backend switch (blob-backend migration Part 2). Same backend-descriptor shape as the PRIMARY ([serve]’s blobs/s3_*/gcs_*/azure_* fields) so a source/dest is fully described by config, plus its OWN optional s3_credential (the secondary can source its base S3 credential from the sealed [secrets] store via its own boatramp:/env: ref, #505). Constructed exactly like the primary but with NO watcher provisioning (a read-only drain source never watches). Serving wraps FallbackStorage::new(primary, secondary, …) so a primary miss on a boatramp-owned key falls through to this secondary; writes/deletes are primary-only.

BuildConfig

build section.

BundleConfig

bundle section — the in-process Rust bundler (bundler feature).

ClusterConfig

cluster section — self-hosted cluster mode. Parsed in every build so config files stay portable; only consumed when the cluster feature is compiled in (boatramp serve --mode cluster).

ComputeConfig

compute section — opt-in compute backends. Present ⇒ serve registers the backends this node can offer and advertises them to the scheduler; backends are capability-detected (container on Linux, remote docker when a daemon is reachable, VMM when /dev/kvm exists).

ConsoleConfig

[serve.console] — the embedded web console (a Wasm SPA baked into the binary with the console build feature). Opt-in: the static shell holds no secrets and the /api it drives is token-gated, so it is served unauthenticated at a deliberately obscure path (a bearer token can’t gate a top-level browser navigation anyway — the path is the obscurity, the token is the real gate).

ExternalDatabaseConfig

One external SQL database for the handler sql binding. Its source is one of two mutually-exclusive forms:

HandlersConfig

handlers section — server-side handler runtime config (read by serve). Parsed in every build (so config files stay portable), but only consumed when the handlers feature is compiled in.

MeshConfig

[cluster.mesh] — mesh identity + TLS knobs.

ProjectConfig

Project configuration, loaded from project.cfg (RON) in the project folder.

PublishConfig

publish section — where and what to deploy (the sync target).

S3CredentialConfig

[serve.s3_credential] — a node-level base S3 credential source (#505) sourcing the base AWS credential from boatramp’s [secrets] sealed store rather than the ambient env chain. Consumed by BOTH the S3 blob object backend and the AWS blob-upload cloud minter (one shared source, since it is the same bucket key). Additive/non-breaking: absent ⇒ the ambient AWS env chain (unchanged).

S3IngressCloud

[serve.s3_ingress_cloud] — the cloud-brokering knobs for the M4 blob-upload minter (which native credential the mint brokers when the node’s blob backend is a cloud object store). Only the fields for the active blob backend are consulted; a None here ⇒ the local S3 face mints.

SecretsConfig

secrets section — envelope encryption for private keys at rest.

ServeConfig

serve section — server defaults, overridden by flags/env.

ServerConfig

Server daemon configuration, loaded from boatramp.cfg (RON). Read by boatramp serve; flags/env override the serve values.

SqlBindingConfig

libsql settings for the handler sql binding — the single SQL backend. Each site gets a real database boundary (an embedded file per site, or a sqld namespace per site), never schema separation (which arbitrary guest SQL escapes). Setting url switches from single-node to a shared sqld cluster; everything else stays identical.

VaultSecretsConfig

Vault Transit settings for envelope = "vault". The token is read from the environment (token_env), never stored in the config file.

Enums

AuthSignerConfig

External token signer selector (serve.signer). Maps to boatramp_server::signer::SignerConfig; secrets (tokens/PINs) are resolved from the named env vars at startup, never stored in config. Written as a RON enum — signer: Vault(...), signer: AwsKms(...), signer: Pkcs11(...), ….

ConfigError

A failure loading or parsing a local config file (project.cfg / boatramp.cfg).

ConfigFormat

The wire format an operator-authored config file is decoded as (v0.6.5).

ManagedDbPrivilege

How a managed database (PLAN-managed-compute-sql) runs its stock image on a shared-kernel backend, whose entrypoint would otherwise fail under the dropped-ALL hardening. rootless (the default) needs no capabilities and works under any posture; caps is the fallback for an image that won’t run rootless.

SignerAlg

The signing algorithm for a signer that can choose one (Local, Vault, Pkcs11). ES256 is the portable default; the cloud KMS backends are ES256-only and ignore this. Written as a RON enum: alg: Es256 / alg: Ed25519.

TenantIsolation

How a managed compute-backed database is physically isolated per tenant (2×2 axis 1). Single = a dedicated server (container) per tenant (isolation by separate process); Shared = one server with a per-tenant database + login role (isolation by grants — Postgres REVOKE CONNECT FROM PUBLIC + owner grant; MySQL per-schema grant), so a tenant’s role cannot connect to another tenant’s database.

TenantScope

The grain of a tenant for a managed compute-backed database (2×2 axis 2) — Project (default) or Site. The two grains are parallel; the isolation mechanism is TenantIsolation.

Constants

BOATRAMP_KERNEL_SIGNING_PUBKEY

The built-in boatramp kernel-signing public key (es256:…), whose private half lives as the KERNEL_SIGNING_KEY Actions secret in BoatRamp/boatramp-vmlinux. Shipped as a default trust anchor so the first-party signed boatramp-vmlinux verifies out of the box under the strict posture. An operator can replace kernel_signing_pubkeys to trust only their own keys.

DEFAULT_BLOB_FALLBACK_TIMEOUT_SECS

Default bound (seconds) on a [serve.blob_fallback] secondary read when secondary_timeout_secs is unset: 5s — long enough for a cloud round-trip, short enough that a wedged secondary degrades a primary miss to NotFound promptly rather than hanging serving.

DEFAULT_S3_INGRESS_MINT_MAX_TTL_SECS

The default operator ceiling on a minted S3 upload credential’s TTL when [serve].s3_ingress_mint_max_ttl_secs is unset: 1 hour — long enough for a browser UGC upload or a bulk-agent burst, short enough to bound a leaked short-lived credential.

Functions

resolve_format

Resolve the ConfigFormat for a config path.

ron_options

RON parse options shared by both loaders: implicit_some lets optional fields be written as bare values (server: "...", not Some("...")). pub so the binary (which re-exports this module) can parse a manifest with the same options after the module moved into this crate.