Reference / component / v1.6.1
Every example below is validated against the schema on this page in CI, so an example that does not validate fails the build rather than shipping.
specVersion: v1
kind: COMPONENT
metadata:
revision: 1
description: Dashboard that signs viewers in by verifying the signed assertion the platform forwards.
spec:
type: SERVICE
workload:
source:
image: example/dashboard:12.1.0
endpoints:
web:
targetPort: 3000
protocol: HTTP
health:
readiness:
http:
endpoint: web
path: /api/health
contract:
inputs:
assertionHeader:
description: Request header carrying the signed viewer assertion.
schema:
type: string
target:
envVarKey: DASHBOARD_JWT_HEADER_NAME
keysURL:
description: Key set the dashboard verifies the assertion against.
schema:
type: string
target:
envVarKey: DASHBOARD_JWT_JWK_SET_URL
expectedClaims:
description: Issuer and audience the dashboard requires, as a JSON object.
schema:
type: string
target:
envVarKey: DASHBOARD_JWT_EXPECT_CLAIMS
# A verified assertion needs no peer check, so there are no trusted proxies
# to read: the signature, issuer and audience say the platform sent it.
outputs:
assertionHeader:
description: Header carrying the signed viewer assertion.
schema:
type: string
from:
endpoint: web
property: viewerAssertionHeader
keysURL:
description: URL of the key set that verifies the assertion.
schema:
type: string
from:
endpoint: web
property: viewerAssertionKeysURL
expectedClaims:
description: The assertion's issuer and audience, as a JSON object.
schema:
type: string
from:
template: >-
{"iss": "${{ self.endpoints.web.viewerAssertionIssuer }}", "aud": "${{ self.endpoints.web.viewerAssertionAudience }}"}
specVersion: v1
kind: COMPONENT
metadata:
revision: 1
description: Web application built from its Git repository with a Dockerfile.
spec:
type: SERVICE
workload:
source:
git:
repositoryURL: https://github.com/musher-dev/examples
ref:
branch: main
build:
dockerfile: Dockerfile
arguments:
NODE_ENV: production
command:
- node
- server.js
endpoints:
web:
targetPort: 8080
protocol: HTTP
health:
readiness:
http:
endpoint: web
path: /healthz
periodSeconds: 10
failureThreshold: 3
specVersion: v1
kind: COMPONENT
metadata:
revision: 1
description: Managed PostgreSQL database run by a provider outside this platform and addressed by its host.
spec:
type: EXTERNAL
contract:
inputs:
host:
description: Hostname of the managed database server.
schema:
type: string
presentationHint: HOSTNAME
port:
description: Port the managed database server listens on.
schema:
type: integer
minimum: 1
maximum: 65535
default: 5432
database:
description: Name of the database the application uses.
schema:
type: string
username:
description: Role the application connects as.
schema:
type: string
password:
description: Password of the application role.
schema:
type: string
sensitive: true
outputs:
host:
description: Hostname of the managed database server, for a client to connect to.
schema:
type: string
presentationHint: HOSTNAME
from:
input: host
port:
description: Port the managed database server listens on.
schema:
type: integer
from:
input: port
database:
description: Name of the database the application uses.
schema:
type: string
from:
input: database
username:
description: Role the application connects as.
schema:
type: string
from:
input: username
password:
description: Password of the application role.
schema:
type: string
sensitive: true
from:
input: password
sslMode:
description: TLS mode a client uses; the provider accepts only verified connections.
schema:
type: string
from:
value: verify-full
specVersion: v1
kind: COMPONENT
metadata:
revision: 1
description: Browser desktop served over HTTPS with a certificate generated at startup, behind a password.
spec:
type: SERVICE
workload:
source:
image: kasmweb/doom:1.18.0
endpoints:
web:
targetPort: 6901
protocol: HTTPS
# The image generates its certificate when it starts, so nothing can
# verify it in advance. NONE is the explicit exception for that.
tls:
verify: NONE
health:
readiness:
http:
endpoint: web
path: /
auth:
basic:
username:
value: kasm_user
password:
input: vncPassword
contract:
inputs:
vncPassword:
description: Password for the kasm_user login, used by people and by the readiness probe.
schema:
type: string
minLength: 8
sensitive: true
target:
envVarKey: VNC_PW
specVersion: v1
kind: COMPONENT
metadata:
revision: 1
description: Background worker that answers queued requests with a language model it reaches through three ordinary inputs.
spec:
type: WORKER
workload:
source:
image: ghcr.io/musher-dev/assistant-worker:2.3.0
contract:
inputs:
llmBaseURL:
description: Base URL of the language-model API.
schema:
type: string
presentationHint: ENDPOINT_URL
target:
envVarKey: OPENAI_BASE_URL
llmAPIKey:
description: Credential presented to the language-model API.
schema:
type: string
sensitive: true
target:
envVarKey: OPENAI_API_KEY
llmModel:
description: Model the language-model API answers with.
schema:
type: string
target:
envVarKey: OPENAI_MODEL
outputs: {}
specVersion: v1
kind: COMPONENT
metadata:
revision: 1
description: Static web server with one HTTP endpoint.
spec:
type: SERVICE
workload:
source:
image: nginx:1.29.4-alpine
endpoints:
web:
targetPort: 8080
protocol: HTTP
specVersion: v1
kind: COMPONENT
metadata:
revision: 1
description: RabbitMQ message broker with an AMQP listener, a management console and HTTP API, and a Prometheus metrics endpoint.
spec:
type: SERVICE
workload:
source:
image: rabbitmq:4.1.4-management-alpine
endpoints:
amqp:
targetPort: 5672
protocol: TCP
console:
targetPort: 15672
protocol: HTTP
metrics:
targetPort: 15692
protocol: HTTP
health:
readiness:
http:
endpoint: metrics
path: /metrics
volumes:
data:
mountPath: /var/lib/rabbitmq
minSizeGiB: 5
contract:
inputs:
username:
description: Name of the user the broker creates on first start.
schema:
type: string
minLength: 1
default: app
target:
envVarKey: RABBITMQ_DEFAULT_USER
password:
description: Password of the user the broker creates on first start.
schema:
type: string
minLength: 12
sensitive: true
target:
envVarKey: RABBITMQ_DEFAULT_PASS
outputs:
consoleURL:
description: Public URL of the management console, for an operator to sign in at.
schema:
type: string
presentationHint: ENDPOINT_URL
from:
endpoint: console
property: publicURL
apiURL:
description: Base URL of the management HTTP API, for sibling nodes that declare queues.
schema:
type: string
presentationHint: ENDPOINT_URL
from:
template: "http://${{ self.endpoints.console.privateAddress }}/api"
wireAddress:
description: Internal host and port of the AMQP listener, for sibling nodes that publish or consume.
schema:
type: string
from:
endpoint: amqp
property: privateAddress
username:
description: Name of the broker user a client authenticates as.
schema:
type: string
minLength: 1
from:
input: username
password:
description: Password of the broker user a client authenticates as.
schema:
type: string
minLength: 12
sensitive: true
from:
input: password
specVersion: v1
kind: COMPONENT
metadata:
revision: 1
description: Chat workspace that signs viewers in as an OpenID Connect client of the platform.
spec:
type: SERVICE
workload:
source:
image: example/workspace:0.11.4
endpoints:
web:
targetPort: 8080
protocol: HTTP
# The route the workspace receives the authorization response on. The
# platform registers publicURL followed by it as the redirect URI.
oidc:
redirectPaths: [/oauth/oidc/callback]
health:
readiness:
http:
endpoint: web
path: /health
contract:
inputs:
issuerURL:
description: OpenID Connect provider the workspace signs viewers in with.
schema:
type: string
target:
envVarKey: OPENID_PROVIDER_URL
clientID:
description: Client identifier registered for the workspace.
schema:
type: string
target:
envVarKey: OAUTH_CLIENT_ID
clientSecret:
description: Client secret registered for the workspace.
schema:
type: string
sensitive: true
target:
envVarKey: OAUTH_CLIENT_SECRET
redirectURI:
description: Redirect URI the workspace sends with its authorization request.
schema:
type: string
target:
envVarKey: OPENID_REDIRECT_URI
# The platform issues the client. Reading it through outputs means every
# blueprint deploying this component must select viewerIdentity OIDC on `web`.
outputs:
issuerURL:
description: Issuer of the platform's OpenID Connect provider.
schema:
type: string
from:
endpoint: web
property: oidcIssuerURL
clientID:
description: Client identifier registered for this endpoint.
schema:
type: string
from:
endpoint: web
property: oidcClientID
clientSecret:
description: Client secret registered for this endpoint.
schema:
type: string
sensitive: true
from:
endpoint: web
property: oidcClientSecret
redirectURI:
description: Redirect URI the platform registered for this endpoint.
schema:
type: string
from:
template: "${{ self.endpoints.web.publicURL }}/oauth/oidc/callback"
specVersion: v1
kind: COMPONENT
metadata:
revision: 1
description: Language-model API reached through an organization connection, handing its endpoint, credential and model to the nodes that call it.
spec:
type: EXTERNAL
contract:
inputs:
llm:
description: Language-model connection this node stands for.
connection:
protocol: OPENAI_CHAT_COMPLETIONS
capabilities:
- STREAMING
- TOOL_CALLS
outputs:
baseURL:
description: Base URL of the language-model API.
schema:
type: string
presentationHint: ENDPOINT_URL
from:
input: llm
member: baseURL
apiKey:
description: Credential the language-model API accepts.
schema:
type: string
sensitive: true
from:
input: llm
member: apiKey
model:
description: Model the language-model API answers with.
schema:
type: string
from:
input: llm
member: model
specVersion: v1
kind: COMPONENT
metadata:
revision: 1
description: Queue consumer with a private health endpoint the platform probes; it serves no traffic of its own.
spec:
type: WORKER
workload:
source:
image: ghcr.io/musher-dev/worker:1.4.0
command:
- /bin/consume
- --queue
- default
endpoints:
health:
targetPort: 8081
protocol: HTTP
health:
readiness:
http:
endpoint: health
path: /readyz
liveness:
http:
endpoint: health
path: /healthz
failureThreshold: 5
contract:
inputs:
queueURL:
description: Address of the queue the worker consumes.
schema:
type: string
presentationHint: CONNECTION_STRING
sensitive: true
target:
envVarKey: QUEUE_URL
outputs: {}
specVersion: v1
kind: COMPONENT
metadata:
revision: 1
description: Nightly database backup that runs at 03:00 UTC and writes to a persistent volume.
spec:
type: JOB
workload:
source:
image: ghcr.io/musher-dev/backup:1.0.2
command:
- /bin/backup
- --verify
schedule:
cron: "0 3 * * *"
volumes:
archive:
mountPath: /var/backups
minSizeGiB: 20
contract:
inputs:
databaseURL:
description: Connection URL of the database to back up.
schema:
type: string
presentationHint: CONNECTION_STRING
sensitive: true
target:
envVarKey: DATABASE_URL
outputs: {}
specVersion: v1
kind: COMPONENT
metadata:
revision: 1
description: PostgreSQL database with a single persistent data volume.
spec:
type: SERVICE
workload:
source:
image: postgres:17.10-alpine
endpoints:
primary:
targetPort: 5432
protocol: TCP
volumes:
data:
mountPath: /var/lib/postgresql/data
minSizeGiB: 10
contract:
inputs:
postgresPassword:
description: Password the database superuser is created with.
schema:
type: string
required: true
target:
envVarKey: POSTGRES_PASSWORD
sensitive: true
databaseName:
description: Name of the database created on first start.
schema:
type: string
default: app
target:
envVarKey: POSTGRES_DB
dataDirectory:
description: Directory inside the data volume PostgreSQL keeps its files in.
schema:
type: string
default: /var/lib/postgresql/data/pgdata
target:
envVarKey: PGDATA
outputs:
address:
description: Internal host and port clients reach the database at.
schema:
type: string
from:
endpoint: primary
property: privateAddress
specVersion: v1
kind: COMPONENT
metadata:
revision: 1
description: Web gateway that signs viewers in by trusting the identity header the platform forwards.
spec:
type: SERVICE
workload:
source:
image: example/gateway:2026.9.6
endpoints:
web:
targetPort: 18789
protocol: HTTP
health:
readiness:
http:
endpoint: web
path: /healthz
contract:
inputs:
identityHeader:
description: Request header the gateway reads the signed-in viewer from.
schema:
type: string
target:
envVarKey: GATEWAY_IDENTITY_HEADER
trustedProxies:
description: Proxy addresses the gateway accepts that header from, as a JSON array of CIDRs.
schema:
type: array
items:
type: string
target:
envVarKey: GATEWAY_TRUSTED_PROXIES
publicOrigin:
description: Origin the gateway's browser clients connect from.
schema:
type: string
target:
envVarKey: GATEWAY_PUBLIC_ORIGIN
# The platform owns these facts. Reading them through outputs, rather than
# defaulting the inputs above, means every blueprint deploying this
# component must forward viewer identity on `web`.
outputs:
identityHeader:
description: Header carrying the signed-in viewer's identity.
schema:
type: string
from:
endpoint: web
property: viewerIdentityHeader
trustedProxies:
description: Addresses the forwarded traffic arrives from.
schema:
type: array
items:
type: string
from:
endpoint: web
property: trustedProxyCIDRs
publicURL:
description: Public URL of the gateway.
schema:
type: string
from:
endpoint: web
property: publicURL
specVersion: v1
kind: COMPONENT
metadata:
revision: 1
description: Workflow editor whose webhooks and API serve machines on the same port as its UI.
spec:
type: SERVICE
workload:
source:
image: example/workflows:2.40.7
endpoints:
web:
targetPort: 5678
protocol: HTTP
# Routes third-party services call. A blueprint may let them through
# sign-in; every other route keeps it.
accessExemptions:
paths: [/webhook, /webhook-test]
health:
readiness:
http:
endpoint: web
path: /healthz
contract:
inputs:
ownerEmail:
description: Email address of the owner account created on first start.
schema:
type: string
presentationHint: EMAIL
target:
envVarKey: WORKFLOWS_OWNER_EMAIL
ownerPasswordHash:
description: bcrypt hash of the owner account's password.
schema:
type: string
pattern: "^\\$2[aby]\\$"
minLength: 60
maxLength: 60
sensitive: true
target:
envVarKey: WORKFLOWS_OWNER_PASSWORD_HASH
outputs: {}