mirror of
https://github.com/block/buzz.git
synced 2026-10-28 13:01:10 +00:00
781d39510c
The relay can use a configurable HTTP(S) gateway delivery URL and signs the same URL it sends. The gateway verifies NIP-98 against the received request URL, including authority, port, path and query. App Attest, scoped grants, replay checks and delivery quotas are unchanged. Forwarding proxies must preserve Host and supply the original request scheme through X-Forwarded-Proto. The NIP relay-delivery wording now defines the configured HTTP(S) URL as the signed URL and labels the public URL as an example. <!-- buzz-review-completed --> --------- Signed-off-by: Tom Brow <tomb@block.xyz>
362 lines
7.4 KiB
JSON
362 lines
7.4 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"type": "object",
|
|
"additionalProperties": true,
|
|
"properties": {
|
|
"replicaCount": {
|
|
"type": "integer",
|
|
"minimum": 2
|
|
},
|
|
"existingSecret": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"gatewayOrigin": {
|
|
"type": "string",
|
|
"description": "Routing origin for the optional HTTPRoute; not passed to the gateway binary.",
|
|
"pattern": "^(https://[^/?#@:]+/?)?$"
|
|
},
|
|
"maxGrantLifetimeSeconds": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 31536000
|
|
},
|
|
"profiles": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"dogfood"
|
|
],
|
|
"properties": {
|
|
"dogfood": {
|
|
"$ref": "#/$defs/enabledProfile"
|
|
}
|
|
}
|
|
},
|
|
"apnsKey": false,
|
|
"podAnnotations": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"httpRoute": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"enabled",
|
|
"parentRefs"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"parentRefs": {
|
|
"type": "array"
|
|
}
|
|
},
|
|
"allOf": [
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
},
|
|
"required": [
|
|
"enabled"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"parentRefs": {
|
|
"minItems": 1
|
|
}
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"networkPolicy": {
|
|
"type": "object",
|
|
"required": [
|
|
"enabled",
|
|
"apnsEgressCidrs",
|
|
"postgresEgressCidrs",
|
|
"dns"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
},
|
|
"apnsEgressCidrs": {
|
|
"type": "array",
|
|
"minItems": 1
|
|
},
|
|
"postgresEgressCidrs": {
|
|
"type": "array",
|
|
"minItems": 1
|
|
},
|
|
"dns": {
|
|
"type": "object",
|
|
"required": [
|
|
"namespaceSelector",
|
|
"podSelector"
|
|
]
|
|
},
|
|
"monitoring": {
|
|
"type": "object",
|
|
"required": [
|
|
"enabled",
|
|
"namespaceSelector",
|
|
"podSelector"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"namespaceSelector": {
|
|
"type": "object"
|
|
},
|
|
"podSelector": {
|
|
"type": "object"
|
|
}
|
|
},
|
|
"allOf": [
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
},
|
|
"required": [
|
|
"enabled"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"namespaceSelector": {
|
|
"minProperties": 1
|
|
},
|
|
"podSelector": {
|
|
"minProperties": 1
|
|
}
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"podMonitor": {
|
|
"type": "object",
|
|
"required": [
|
|
"enabled"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
}
|
|
}
|
|
},
|
|
"prometheusRule": {
|
|
"type": "object",
|
|
"required": [
|
|
"enabled"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"apnsRetryRatioThreshold": {
|
|
"type": "number",
|
|
"exclusiveMinimum": 0,
|
|
"maximum": 1
|
|
},
|
|
"apnsRetryMinSamples": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
}
|
|
}
|
|
},
|
|
"image": {
|
|
"type": "object",
|
|
"required": [
|
|
"repository"
|
|
],
|
|
"properties": {
|
|
"repository": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"tag": {
|
|
"type": "string"
|
|
},
|
|
"digest": {
|
|
"type": "string",
|
|
"pattern": "^$|^sha256:[0-9a-f]{64}$"
|
|
}
|
|
},
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"tag": {
|
|
"minLength": 1
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"properties": {
|
|
"digest": {
|
|
"pattern": "^sha256:[0-9a-f]{64}$"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"migration": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"existingSecret",
|
|
"databaseUrlKey",
|
|
"runtimeDatabaseRole",
|
|
"resources"
|
|
],
|
|
"properties": {
|
|
"existingSecret": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"databaseUrlKey": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"runtimeDatabaseRole": {
|
|
"type": "string",
|
|
"pattern": "^[a-zA-Z_][a-zA-Z0-9_]{0,62}$"
|
|
},
|
|
"resources": {
|
|
"type": "object"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"$defs": {
|
|
"profileBase": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"appAttestAppId",
|
|
"apnsTopic",
|
|
"apnsEnvironment"
|
|
],
|
|
"properties": {
|
|
"appAttestAppId": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"apnsTopic": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"apnsEnvironment": {
|
|
"enum": [
|
|
"production",
|
|
"sandbox"
|
|
]
|
|
},
|
|
"apnsCert": {
|
|
"$ref": "#/$defs/apnsCert"
|
|
}
|
|
}
|
|
},
|
|
"enabledProfile": {
|
|
"allOf": [
|
|
{
|
|
"$ref": "#/$defs/profileBase"
|
|
},
|
|
{
|
|
"required": [
|
|
"apnsCert"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"apnsCert": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"secretName",
|
|
"secretKey"
|
|
],
|
|
"properties": {
|
|
"secretName": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"secretKey": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"required": [
|
|
"replicaCount",
|
|
"existingSecret",
|
|
"maxGrantLifetimeSeconds",
|
|
"profiles",
|
|
"httpRoute",
|
|
"image",
|
|
"migration"
|
|
],
|
|
"allOf": [
|
|
{
|
|
"$comment": "A PodMonitor requires scoped 8081 ingress. External scrapers such as Datadog may enable that ingress without rendering a PodMonitor.",
|
|
"if": {
|
|
"properties": {
|
|
"podMonitor": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
},
|
|
"required": [
|
|
"enabled"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"podMonitor"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"networkPolicy": {
|
|
"properties": {
|
|
"monitoring": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
},
|
|
"required": [
|
|
"enabled"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"monitoring"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"networkPolicy"
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|