Module config 

Process configuration, read from the environment.

The two DSNs are deliberately not interchangeable. GWK_ADMIN_DATABASE_URL owns the schema and exists only for the one-shot admin init; GWK_DATABASE_URL is the least-privilege runtime credential the daemon receives. A daemon that can reach the admin DSN can re-DDL its own store, so KernelConfig::from_env REFUSES to start when the admin variable is present rather than trusting itself to ignore it. Putting both in one unit file is the mistake this catches.

Structs

AdminConfig

The one-shot initializer’s configuration.

BlobConfig

The blob spine’s configuration.

KernelConfig

The daemon’s configuration.

Constants

ADMIN_DATABASE_URL_ENV

The schema-owner connection string. One-shot initialization only.

BLOB_KEK_ENV

The key-encryption key, base64 over exactly DEK_BYTES bytes.

BLOB_KEK_ID_ENV

The nonsecret label recorded beside every blob this KEK wraps.

BLOB_ROOT_ENV

Where blob containers are written. Required, absolute, no default.

DATABASE_URL_ENV

The runtime (least-privilege) connection string.

DEFAULT_SOCKET_PATH

The default socket path (ADR 0002: UDS only, no network listener).

MAX_IDENTIFIER_BYTES

Longest legal PostgreSQL identifier — NAMEDATALEN - 1.

MAX_KEK_ID_BYTES

Longest legal KEK label. It is copied into every container header, so it is kept short on purpose — this is a name, not a place to stash material.

RUNTIME_ROLE_ENV

The already-created role the runtime credential authenticates as.

SOCKET_PATH_ENV

Where the daemon binds its Unix domain socket.

Functions

validate_kek_id

The label is written into every container header and is what a rotation matches on, so it stays a plain short name: no separators to confuse a parser, nothing that could carry material, nothing that changes meaning under a different locale.

validate_role

PostgreSQL cannot bind an identifier as a parameter, so the role name is interpolated into the GRANT script. This allowlist is what keeps that safe: a bare lowercase identifier needs no quoting and cannot carry a statement separator, a quote, or a comment.