Infrastructure configuration

The operator-critical spring.* / environment-variable knobs every deployment sets: the datastores, the secret backend, schema migrations, and the three deploy-time values the Helm chart refuses to render without. This is deliberately a curated subset -- the platform's own behaviour is configured through the oauthy.* namespace documented on the other pages of this reference, not through raw Spring internals.

PostgreSQL (R2DBC runtime + JDBC for Flyway)

Every stateful service runs on PostgreSQL over R2DBC at runtime and needs a JDBC datasource for Flyway migrations at startup. The hub reads the standard SPRING_DATASOURCE_* / SPRING_R2DBC_* names; product-api uses service-prefixed names. Point both the R2DBC and JDBC URLs at the same database.

Setting	Type	Default	Description	Service(s)
SPRING_DATASOURCE_URL	string	jdbc:postgresql://localhost:5432/oauthy	JDBC URL Flyway uses to apply migrations at startup (hub / identity).	authorization-hub, identity-service
SPRING_R2DBC_URL	string	r2dbc:postgresql://localhost:5432/oauthy	R2DBC URL the service uses at runtime (hub / identity).	authorization-hub, identity-service
SPRING_DATASOURCE_USERNAME / SPRING_DATASOURCE_PASSWORD	string	admin / admin	Database credentials (override in every non-local environment).	authorization-hub, identity-service
PRODUCT_API_R2DBC_URL	string	r2dbc:postgresql://localhost:5432/product_api	R2DBC URL for product-api at runtime.	product-api
PRODUCT_API_JDBC_URL	string	jdbc:postgresql://localhost:5432/product_api	JDBC URL product-api uses for Flyway.	product-api
PRODUCT_API_DB_USER / PRODUCT_API_DB_PASSWORD	string	product_api / product_api	product-api database credentials.	product-api

Redis (rate limits, sessions, caches)

Redis holds the multi-node-safe state (rate limits, nonces, session tokens, idempotency keys). Non-default consumers authenticate with a per-service ACL user whose password is delivered as a Kubernetes Secret, never in application.yml.

Setting	Type	Default	Description	Service(s)
SPRING_DATA_REDIS_HOST	string	localhost	Redis host.	authorization-hub, product-api, identity-service, api-gateway
SPRING_DATA_REDIS_PORT	int	6379	Redis port.	authorization-hub, product-api, identity-service, api-gateway
SPRING_DATA_REDIS_USERNAME	string	(empty = default user)	Per-service Redis ACL user (e.g. thoryn-hub); empty selects the default user.	authorization-hub, product-api, identity-service, api-gateway
SPRING_DATA_REDIS_PASSWORD	string	(empty)	Per-service Redis ACL password; supplied from a Kubernetes Secret.	authorization-hub, product-api, identity-service, api-gateway

Flyway (schema migrations)

Flyway runs on startup against the JDBC datasource above. The URL/user/password are bridged from spring.datasource.*. Seed flags gate optional reference data and must stay false in production.

Setting	Type	Default	Description	Service(s)
SPRING_FLYWAY_OUT_OF_ORDER	boolean	true (staging via the Helm macro)	Allow out-of-order migration application; set by the staging-env Helm macro.	all stateful services
OAUTHY_FLYWAY_SEED_DEMO	boolean	false	Seed demo reference data (dev / staging only -- never production).	authorization-hub, product-api
OAUTHY_FLYWAY_SEED_MONITOR	boolean	false	Seed the synthetic-monitor OAuth client (staging only).	authorization-hub

Vault / OpenBao (signing keys, transit, secrets)

The hub signs tokens with a Vault Transit key and reads secrets from the KV engine. Local dev uses a dev-mode token; staging / production authenticate with the Kubernetes auth method (no static token). The URL is an in-cluster Service address, never the public ingress.

Setting	Type	Default	Description	Service(s)
SPRING_CLOUD_VAULT_URI / VAULT_URI	string	http://localhost:8200 (dev); http://thoryn-vault:8200 (staging)	Vault / OpenBao address; in-cluster Service host in the cluster.	authorization-hub, product-api, identity-service
spring.cloud.vault.authentication	enum	TOKEN (dev) / KUBERNETES (staging)	Auth method. Local dev uses a root token; deployed uses the Kubernetes role.	authorization-hub, product-api, identity-service
spring.cloud.vault.token	string	root (dev only)	Dev-mode Vault token. Unused under Kubernetes auth.	authorization-hub, product-api, identity-service
spring.cloud.vault.kubernetes.role	string	thoryn-hub (per service)	The Vault Kubernetes-auth role the pod's ServiceAccount token is exchanged for.	authorization-hub, product-api, identity-service

Required deploy-time values (Helm required helpers)

These three values have no safe default: the chart's required helper fails helm rendering if they are unset, because an empty value lets a Host-header attacker poison outbound email / OAuth-redirect URLs (CVE-2017-6056 class). Set each per environment. They bind to the oauthy.* properties shown.

Setting	Type	Default	Description	Service(s)
hub.publicBaseUrl -> OAUTHY_HUB_PUBLIC_BASE_URL	string (required)	http://localhost:9000 (local only)	Public origin of the hub; used for DCR registration_client_uri, federation redirect_uri, and device-flow verification_uri (SSO-1135).	authorization-hub
identity.publicBaseUrl -> OAUTHY_IDENTITY_PUBLIC_BASE_URL	string (required)	(empty)	Public origin of identity-service; used to build password-reset and 'wasn't me' email URLs (SSO-1134).	identity-service
apple.publicBaseUrl -> OAUTHY_FEDERATION_APPLE_PUBLIC_BASE_URL	string (required)	(empty)	Public origin of the Apple federation member; used to build Apple's redirect_uri (SSO-832).	federation-members/apple