Production feeds the config through INVIDIOUS_CONFIG, so a config.yml
written at runtime is thrown away on the next restart. The fork's own
settings therefore need a home the admin can write to: a key/value table
arik_settings, one row per setting.
- The environment config is parsed and validated first and seeds every
value; a stored row then overrides the value of its own key. A key
without a row keeps the environment value.
- Applied at boot right after the table integrity check, so Config.check
still fails closed on a bad environment config while a bad database
row only loses its own override: decoding reports the reason and the
environment value stands.
- Validation lives in ArikSettings and is pure, so the admin UI can
refuse an entry before it is stored. It refuses what hurts later: a
CIDR range in trusted_proxies (Config.check exits on it at the next
boot), header auth enabled with no trusted proxy at all, and callback
origins that are not a bare scheme+host+port.
- Two new trusted_header_auth fields are declared here and wired up in
the commits that follow: password_self_service and
auto_approve_token_callbacks.
The table is created both by a migration and by check_integrity, so
instances on either path get it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
