0009: One configuration file, read at startup¶
- Status:
Accepted
- Date:
2026-10-19
Context¶
Sources, the approval policy and RBAC change rarely,
and the first release has no admin UI.
The legacy service used ADR_VIEWER_ environment variables for a
single source.
Decision¶
catalog.yaml (path in ADRIANO_CONFIG_FILE) holds sources,
approval_policy and rbac; changes need a restart.
Everything else is an ADRIANO_-prefixed environment variable.
Secrets are referenced by environment variable name
(token_env, push_tokens_env), resolved at startup,
held as secret strings and never logged or stored.
Validation degrades per entry instead of stopping startup:
an invalid registration is disabled with a readable error,
a missing or invalid policy yields policy_missing everywhere,
and a missing rbac section grants nothing.
Consequences¶
adriano check-configvalidates a file before deployment.A broken registration never takes the rest of the catalog down; problems show in
/healthz, the startup log and the Sources page.Registrations removed from the file are disabled, never deleted, so their history stays.
A missing policy is never mistaken for “approval not required”.