1- // Copyright 2025 Stacklok, Inc.
2- //
3- // Licensed under the Apache License, Version 2.0 (the "License");
4- // you may not use this file except in compliance with the License.
5- // You may obtain a copy of the License at
6- //
7- // http://www.apache.org/licenses/LICENSE-2.0
8- //
9- // Unless required by applicable law or agreed to in writing, software
10- // distributed under the License is distributed on an "AS IS" BASIS,
11- // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12- // See the License for the specific language governing permissions and
13- // limitations under the License.
1+ // SPDX-FileCopyrightText: Copyright 2025 Stacklok, Inc.
2+ // SPDX-License-Identifier: Apache-2.0
143
154package storage
165
@@ -23,6 +12,9 @@ const (
2312 // TypeMemory uses in-memory storage (default).
2413 TypeMemory Type = "memory"
2514
15+ // TypeRedis uses Redis Sentinel-backed storage for distributed deployments.
16+ TypeRedis Type = "redis"
17+
2618 // DefaultCleanupInterval is how often the background cleanup runs.
2719 DefaultCleanupInterval = 5 * time .Minute
2820
@@ -40,6 +32,10 @@ const (
4032
4133 // DefaultPKCETTL is the default TTL for PKCE requests (same as auth codes).
4234 DefaultPKCETTL = 10 * time .Minute
35+
36+ // DefaultPublicClientTTL is the TTL for dynamically registered public clients.
37+ // This prevents unbounded growth from DCR. Confidential clients don't expire.
38+ DefaultPublicClientTTL = 30 * 24 * time .Hour // 30 days
4339)
4440
4541// Config configures the storage backend.
@@ -61,4 +57,54 @@ func DefaultConfig() *Config {
6157type RunConfig struct {
6258 // Type specifies the storage backend type. Defaults to "memory".
6359 Type string `json:"type,omitempty" yaml:"type,omitempty"`
60+
61+ // RedisConfig is the Redis-specific configuration when Type is "redis".
62+ RedisConfig * RedisRunConfig `json:"redisConfig,omitempty" yaml:"redisConfig,omitempty"`
63+ }
64+
65+ // RedisRunConfig is the serializable Redis configuration for RunConfig.
66+ // This is designed for Sentinel-only deployments with ACL user authentication.
67+ type RedisRunConfig struct {
68+ // SentinelConfig contains Sentinel-specific configuration.
69+ SentinelConfig * SentinelRunConfig `json:"sentinelConfig,omitempty" yaml:"sentinelConfig,omitempty"`
70+
71+ // AuthType must be "aclUser" - only ACL user authentication is supported.
72+ AuthType string `json:"authType" yaml:"authType"`
73+
74+ // ACLUserConfig contains ACL user authentication configuration.
75+ ACLUserConfig * ACLUserRunConfig `json:"aclUserConfig,omitempty" yaml:"aclUserConfig,omitempty"`
76+
77+ // KeyPrefix for multi-tenancy, typically "thv:auth:{ns}:{name}:".
78+ KeyPrefix string `json:"keyPrefix" yaml:"keyPrefix"`
79+
80+ // DialTimeout is the timeout for establishing connections (e.g., "5s").
81+ DialTimeout string `json:"dialTimeout,omitempty" yaml:"dialTimeout,omitempty"`
82+
83+ // ReadTimeout is the timeout for read operations (e.g., "3s").
84+ ReadTimeout string `json:"readTimeout,omitempty" yaml:"readTimeout,omitempty"`
85+
86+ // WriteTimeout is the timeout for write operations (e.g., "3s").
87+ WriteTimeout string `json:"writeTimeout,omitempty" yaml:"writeTimeout,omitempty"`
88+ }
89+
90+ // SentinelRunConfig contains Redis Sentinel configuration.
91+ type SentinelRunConfig struct {
92+ // MasterName is the name of the Redis Sentinel master.
93+ MasterName string `json:"masterName" yaml:"masterName"`
94+
95+ // SentinelAddrs is the list of Sentinel addresses (host:port).
96+ SentinelAddrs []string `json:"sentinelAddrs" yaml:"sentinelAddrs"`
97+
98+ // DB is the Redis database number (default: 0).
99+ DB int `json:"db,omitempty" yaml:"db,omitempty"`
100+ }
101+
102+ // ACLUserRunConfig contains Redis ACL user authentication configuration.
103+ // Credentials are read from environment variables for security.
104+ type ACLUserRunConfig struct {
105+ // UsernameEnvVar is the environment variable containing the Redis username.
106+ UsernameEnvVar string `json:"usernameEnvVar" yaml:"usernameEnvVar"`
107+
108+ // PasswordEnvVar is the environment variable containing the Redis password.
109+ PasswordEnvVar string `json:"passwordEnvVar" yaml:"passwordEnvVar"`
64110}
0 commit comments