Configuration

The bare-metal install writes a fully commented /etc/orbitron/config.yml. In containers the same keys map 1:1 to ORBITRON_-prefixed environment variables.

CONFIG/etc/orbitron/config.ymlyaml

listen_addr: "127.0.0.1:8080"
storage_path: "/var/lib/orbitron/storage"
log_path: "/var/log/orbitron/orbitron.log"
tokens_file: "/etc/orbitron/tokens.json"

# Require Bearer Token / Basic Auth for client pulls
require_auth_pull: false

# Concurrent download/clone workers during syncs
max_concurrency: 4

# Default lifetime of newly generated tokens in days (0 = never expire)
token_ttl_days: 0

# Optional forward proxy for upstream Galaxy + git traffic
http_proxy: ""
https_proxy: ""
no_proxy: ""

# Outbound TLS policy (Galaxy API, downloads, git remotes, OIDC)
tls:
  ca_file: ""                     # PEM bundle for private-CA-signed services
  insecure_skip_tls_verify: false

# SSO for the /ui dashboard
oidc:
  enabled: false
  issuer: ""
  client_id: ""
  client_secret: ""
  session_ttl_hours: 8

Forward proxy (Squid & co.)

When the mirror host has no direct internet route — or you want outbound Galaxy and git traffic to pass a single choke point — point the proxy keys at your forward proxy:

CONFIG/etc/orbitron/config.ymlyaml

http_proxy: "http://squid.example.com:3128"
https_proxy: "http://squid.example.com:3128"
no_proxy: "localhost,127.0.0.1,.example.com"

When left empty, Orbitron falls back to the standard HTTP_PROXY /HTTPS_PROXY / NO_PROXY environment variables. Exactly one proxy is used per request: https_proxy proxies https:// requests and falls back to http_proxy when unset (and vice versa). no_proxy takes exact hostnames, .domain / *.domain suffixes, a bare *, or CIDR ranges.

TLS & private CAs

Outbound calls — Galaxy API, collection downloads, git HTTPS remotes and OIDC discovery — can talk to services signed by an internal CA. Point tls.ca_file at a PEM bundle with those CA(s), and your trust anchors are used for all of them. For labs,insecure_skip_tls_verify is the blunt curl -k equivalent.

Reverse proxy

Run the daemon bound to 127.0.0.1 and terminate TLS in front of it. Orbitron honors X-Forwarded-Proto / X-Forwarded-For, so download URLs and client IPs stay correct behind a proxy. Point your load balancer health check at the unauthenticated GET /healthz.

APACHE/etc/httpd/conf.d/orbitron.confconf

# Requires: mod_proxy, mod_proxy_http, mod_ssl, mod_headers
<VirtualHost *:443>
    ServerName orbitron.example.com

    SSLEngine on
    SSLCertificateFile    /etc/letsencrypt/live/orbitron.example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/orbitron.example.com/privkey.pem

    ProxyPreserveHost On
    ProxyRequests Off
    ProxyTimeout 300

    ProxyPass        / http://127.0.0.1:8080/ retry=0
    ProxyPassReverse / http://127.0.0.1:8080/

    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-For  "%{REMOTE_ADDR}s"
</VirtualHost>

CADDYCaddyfileconf

orbitron.example.com {
    # Caddy sets X-Forwarded-Proto / X-Forwarded-For automatically
    reverse_proxy 127.0.0.1:8080
}

HAPROXY/etc/haproxy/haproxy.cfgconf

frontend orbitron
    bind :443 ssl crt /etc/haproxy/certs/orbitron.pem
    default_backend orbitron_backend

backend orbitron_backend
    option forwardfor
    option httpchk GET /healthz
    http-request set-header X-Forwarded-Proto https if { ssl_fc }
    timeout server 5m
    server orbitron 127.0.0.1:8080 check inter 10s

NGINX/etc/nginx/sites-available/orbitronconf

server {
    listen 443 ssl;
    http2 on;
    server_name orbitron.example.com;

    ssl_certificate     /etc/letsencrypt/live/orbitron.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/orbitron.example.com/privkey.pem;

    proxy_read_timeout 300s;
    proxy_send_timeout 300s;

    location / {
        proxy_pass         http://127.0.0.1:8080;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
    }

    location = /healthz {
        proxy_pass http://127.0.0.1:8080/healthz;
    }
}

TRAEFIKtraefik.ymlconf

http:
  routers:
    orbitron:
      rule: "Host(`orbitron.example.com`)"
      service: orbitron
      tls:
        certResolver: letsencrypt
  services:
    orbitron:
      loadBalancer:
        servers:
          - url: http://127.0.0.1:8080
        # Traefik sets X-Forwarded-* automatically
        healthCheck:
          path: /healthz
          interval: 10s

SSO / OIDC (Keycloak)

Optional OpenID Connect for the web dashboard: the /ui login page gains a"Sign in with SSO" button alongside the access-token login. An SSO session opens the dashboard exactly like a valid admin token would.

Set oidc.issuer to the full realm URL (e.g.https://keycloak.example.org/realms/orbitron), register the redirect URI<host>/ui/oidc/callback in Keycloak, restart — and verify withsystemctl reload orbitron. Keycloak-side configuration steps and requirement-notes for running Keycloak behind the same reverse proxy are in the README.