Serve HTTPS yourself, or sit behind your gateway.
In the default mode the server serves HTTPS itself and accepts customer connections. Use it when clients reach the server directly, or through a load balancer or ingress that passes the connection through unchanged. In gateway mode an HTTPS gateway receives requests, requires the caller's credentials, and passes the request to the server. The server makes the same access decisions in both modes.
| Variable | Default | Effect |
|---|---|---|
AIDC_HUB_BIND_ADDRESS | 0.0.0.0 | Address the API listens on |
AIDC_HUB_PORT | 8443 (the image sets 8080) | API port. Set it explicitly for a container |
AIDC_HUB_CERT_BUNDLE | /etc/aidc/hub/tls/tls.crt | HTTPS bundle file. The server does not start without it outside gateway mode |
AIDC_HUB_GATEWAY_MODE | false | true serves the API to a gateway in front of the server |
AIDC_HUB_PATH_PREFIX | none | Serves every route, including health, under this prefix |
In gateway mode, configure the gateway as supplied with your on-premise setup, make the server's HTTP port reachable only from the gateway and verify that after every network change, and never expose the HTTP port or the monitoring port outside the cluster. With the Kubernetes chart, gateway mode is several separate values, not one switch: set the service port to 8080, turn off config.tls.enabled, supply the complete env list, use HTTP probes, disable the TCP route and enable ingressRoute.https. Inspect the helm template output before installing. When you set a path prefix, add it to the probe paths and to ingressRoute.https.pathPrefix, and keep it identical in the gateway route and the address customers use, or every path returns 404.
Where data lives and how long uploads and old keys last.
All settings are environment variables, read when the server starts; restart after a change. Each variable also works without the AIDC_ prefix, and the prefixed form wins. With the Kubernetes chart you set them through the chart's env list.
| Variable | Default | Effect |
|---|---|---|
AIDC_HUB_STORAGE_PATH | /var/lib/aidc/hub/packages | Directory for archives and manifests |
AIDC_HUB_DATABASE_URL | a file on the data volume | Location of the server's catalogue, which also holds signing keys and activity records. Leave the default and keep it on the same volume |
AIDC_HUB_UPLOAD_EXPIRY_HOURS | 1 | Lifetime of a chunked upload session from its creation. Activity does not extend it |
AIDC_HUB_UPLOAD_CLEANUP_INTERVAL_MINUTES | 30 | How often expired sessions and their partial data are removed |
AIDC_HUB_AUTO_RESIGN_ENABLED | true | Re-signs packages carrying a former key's signature after a rotation |
AIDC_HUB_RESIGN_INTERVAL | 86400 | Seconds between re-signing cycles |
AIDC_HUB_AUTO_RESIGN_BATCH_SIZE | 100 | Packages handled per batch |
AIDC_HUB_AUTO_RESIGN_PARALLEL | 1 | Parallel re-signing workers |
AIDC_HUB_AUTO_DEPRECATE_AFTER_RESIGN | true | Retires a former key once no package uses it |
AIDC_HUB_AUTO_REMOVE_AFTER_DAYS | 2 | Days after retirement before an unused former key is deleted |
Storage and database must be on a persistent volume writable by user ID 1000. A single request body is limited to 500 MiB, and that limit is not configurable. AIDC_HUB_UPLOAD_CHUNK_SIZE and AIDC_HUB_UPLOAD_MAX_RETRIES are accepted but change nothing; the publishing client chooses its chunk size. With re-signing off, former keys stay trusted and served until you turn it back on.
Intervals for refresh, integrity checks and activity.
Turning a job back on resumes it at its next interval; missed cycles are not replayed.
| Variable | Default | Effect |
|---|---|---|
AIDC_HUB_VERSION_REFRESH_ENABLED | true | Scheduled upstream version refresh. When off, versions still refresh on request |
AIDC_HUB_VERSION_REFRESH_INTERVAL | 10800 | Seconds between scheduled refreshes |
AIDC_GITHUB_TOKEN | none | Optional token for GitHub-released tools; avoids rate limits |
AIDC_HUB_VENDOR_KEY_REFRESH_ENABLED | true | Daily refresh of vendor verification keys |
AIDC_HUB_VENDOR_KEY_REFRESH_INTERVAL | 86400 | Seconds between vendor-key refreshes |
AIDC_HUB_CONSISTENCY_CHECK_ENABLED | true | Scheduled package integrity check |
AIDC_HUB_CONSISTENCY_CHECK_INTERVAL | 43200 | Seconds between integrity checks |
AIDC_HUB_CONSISTENCY_AUTO_CLEANUP | true | Removes missing or altered packages the scheduled check finds |
AIDC_HUB_TELEMETRY_ENABLED | true | Records requests and downloads for statistics |
AIDC_HUB_SUGGESTION_THRESHOLD, AIDC_HUB_SUGGESTION_LIMIT | 10, 20 | Default minimum request count and number of suggestions; callers can override per request |
AIDC_HUB_RETENTION_DAYS | 90 (minimum 3) | Days detailed activity records are kept before being summarized into daily totals |
AIDC_HUB_METRICS_ENABLED, AIDC_HUB_METRICS_PORT | true, 9090 | Internal monitoring listener; the port must differ from the API port |
The access-check setting has no default outside the chart. It comes with your on-premise setup (chart value liveAccess.url); without a reachable access check, every protected request is refused with 503 while health stays green.
What the Helm chart exposes.
| Value | Default | Effect |
|---|---|---|
image.tag | the chart's pinned version | Server version to run. Set it explicitly |
replicaCount | 1 | Must stay 1; the chart refuses other values |
strategy.type | Recreate | Keep it; a rolling update cannot attach the volume the old pod holds |
persistence.size, persistence.storageClass | 1Gi, cluster default | Data volume size and class. The default size is not a capacity recommendation |
persistence.existingClaim | none | A volume claim you manage, which uninstalling the chart never deletes |
secrets.tls, config.tls.enabled | aidc-server-tls, true | Secret holding the HTTPS bundle under tls.crt; false in gateway mode |
liveAccess.url | a placeholder that does not work on-premise | Always set it to the access-check address from your on-premise setup |
env | the chart's defaults | The complete environment list. Overriding it replaces every default entry |
channel | stable | Label added to every monitoring metric; only stable, edge or beta are accepted |
resources | requests 250m CPU and 256 MiB, limits 2 CPU and 1 GiB | Container resources |
retentionPurgeCronJob.enabled, .suspend, .schedule | true, false, 0 3 * * * | Daily job that asks the server to remove expired activity records |
ingressRoute.tcp.enabled | true | TCP pass-through route for direct HTTPS |
ingressRoute.https.enabled, .host, .pathPrefix | false, empty, / | HTTPS route used in gateway mode |
serversTransport.enabled | false | Gateway backend timeouts for long uploads and downloads (gateway mode only) |
middleware.rateLimit.enabled | false | Creates a rate-limit middleware (30 requests per minute on average, bursts of 60) to add to the HTTPS route |
Each request carries its own coordinates.
Customers do not configure the server. On each request they choose the server address, including any path prefix, their credential files, and the package coordinates.
| Choice | Default | Effect |
|---|---|---|
platform | linux when omitted in metadata and download requests | Send the package's explicit platform |
architecture | amd64 when omitted | Use the exact catalogue string; x64 and amd64 are different variants |
distribution | empty | A named distribution is a separate variant, not an alias of the empty one |
Omitted values are defaults, not wildcards. Unpublishing requires an explicit platform and architecture.