Configuration

The bare-metal install writes a fully commented /etc/orbitron/config.yml. In containers the same keys map 1:1 to ORBITRON_-prefixed environment variables.

CONFIG/etc/orbitron/config.ymlyaml

listen_addr: "127.0.0.1:8080"
storage_path: "/var/lib/orbitron/storage"
log_path: "/var/log/orbitron/orbitron.log"
tokens_file: "/etc/orbitron/tokens.json"

# Require Bearer Token / Basic Auth for client pulls
require_auth_pull: false

# Concurrent download/clone workers during syncs
max_concurrency: 4

# Default lifetime of newly generated tokens in days (0 = never expire)
token_ttl_days: 0

# Optional forward proxy for upstream Galaxy + git traffic
http_proxy: ""
https_proxy: ""
no_proxy: ""

# Outbound TLS policy (Galaxy API, downloads, git remotes, OIDC)
tls:
  ca_file: ""                     # PEM bundle for private-CA-signed services
  insecure_skip_tls_verify: false

# SSO for the /ui dashboard
oidc:
  enabled: false
  issuer: ""
  client_id: ""
  client_secret: ""
  session_ttl_hours: 8

Forward proxy (Squid & co.)

When the mirror host has no direct internet route — or you want outbound Galaxy and git traffic to pass a single choke point — point the proxy keys at your forward proxy:

CONFIG/etc/orbitron/config.ymlyaml

http_proxy: "http://squid.example.com:3128"
https_proxy: "http://squid.example.com:3128"
no_proxy: "localhost,127.0.0.1,.example.com"

When left empty, Orbitron falls back to the standard HTTP_PROXY /HTTPS_PROXY / NO_PROXY environment variables. Exactly one proxy is used per request: https_proxy proxies https:// requests and falls back to http_proxy when unset (and vice versa). no_proxy takes exact hostnames, .domain / *.domain suffixes, a bare *, or CIDR ranges.

TLS & private CAs

Outbound calls — Galaxy API, collection downloads, git HTTPS remotes and OIDC discovery — can talk to services signed by an internal CA. Point tls.ca_file at a PEM bundle with those CA(s), and your trust anchors are used for all of them. For labs,insecure_skip_tls_verify is the blunt curl -k equivalent.

SSO / OIDC (Keycloak)

Optional OpenID Connect for the web dashboard: the /ui login page gains a"Sign in with SSO" button alongside the access-token login. An SSO session opens the dashboard exactly like a valid admin token would.

Set oidc.issuer to the full realm URL (e.g.https://keycloak.example.org/realms/orbitron), register the redirect URI<host>/ui/oidc/callback in Keycloak, restart — and verify withsystemctl reload orbitron. Keycloak-side configuration steps and requirement-notes for running Keycloak behind the same reverse proxy are in the README.