HubConfig class

Configuration for an OmnyShellHub.

Constructors

HubConfig({required Authenticator authenticator, SecurityContext? securityContext, String? tlsDirectory, Duration tlsReloadInterval = const Duration(hours: 12), Authorizer? authorizer, Uint8List? identityCertificate, Object host = '0.0.0.0', int port = 8443, Duration heartbeatTimeout = const Duration(seconds: 30), PortRange? tunnelPortRange, String tunnelPublicHost = '', SecurityContext? tunnelSecurityContext, String? tunnelTlsDirectory, Duration tunnelTlsReloadInterval = const Duration(hours: 12), Clock clock = const SystemClock(), void logger(String message)?, AiConfig? aiConfig})

Creates a hub configuration.

Properties

aiConfig → AiConfig?

The Hub's default AI configuration (e.g. from AiConfigIo.load()), used to proxy AI requests on behalf of browser clients with the key injected Hub-side, and to advertise a default provider/model. When null the Hub still proxies requests that carry the client's own key, but cannot inject credentials or advertise a default.

final

authenticator → Authenticator

Authenticates node and client credentials.

final

authorizer → Authorizer

Authorizes session opens. Defaults to a fail-closed RoleBasedAuthorizer.

final

clock → Clock

The clock (overridable in tests).

final

hashCode → int

The hash code for this object.

no setter, inherited

heartbeatTimeout → Duration

How long a node may go silent before being declared offline.

final

host → Object

The bind address (a String host or an InternetAddress).

final

identityCertificate → Uint8List?

The leaf TLS certificate (PEM or DER bytes) used to derive this hub's deterministic UID from its public key (SPKI). When omitted the hub runs without a computed UID.

final

logger → void Function(String message)?

Optional diagnostic logger.

final

port → int

The TCP port to listen on (0 binds an ephemeral port).

final

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

securityContext → SecurityContext?

The TLS security context (server certificate + key) for the main wss listener. Exactly one of securityContext or tlsDirectory must be set; when tlsDirectory drives the listener this is null.

final

tlsDirectory → String?

A directory holding fullchain.pem + privkey.pem (LetsEncrypt layout) for the main wss listener. When set, the Hub loads the certificate at start and re-checks the files every tlsReloadInterval; on renewal it re-binds the listener with the fresh context so the new certificate is served without a restart (briefly running both listeners on the same port while existing connections drain). Mutually exclusive with securityContext.

final

tlsReloadInterval → Duration

How often the Hub re-checks tlsDirectory for a renewed certificate. Kept below a day so a renewal is always picked up within 24h.

final

tunnelPortRange → PortRange?

The public TCP port range tunnels may bind (e.g. PortRange(20000, 20100)), or null to disable tunneling (fail closed). Align this with the firewall rules permitting inbound connections on those ports.

final

tunnelPublicHost → String

The host advertised to clients for tunnel public ports. When empty the client substitutes the Hub's own hostname (sensible when host is a wildcard bind address).

final

tunnelSecurityContext → SecurityContext?

The TLS security context (certificate chain + key) used to terminate TLS on tunnel public ports requested with secure: true. The certificate should match tunnelPublicHost. When null, secure tunnels are unavailable and such requests are rejected.

final

tunnelTlsDirectory → String?

A directory holding fullchain.pem + privkey.pem (LetsEncrypt layout) used to terminate TLS on secure tunnel public ports. When set, the Hub loads the certificate at start and re-checks the files every tunnelTlsReloadInterval, reloading automatically when they change so renewals are picked up without a restart. Takes precedence over tunnelSecurityContext.

final

tunnelTlsReloadInterval → Duration

How often the Hub re-checks tunnelTlsDirectory for a renewed certificate. Kept below a day so a renewal is always picked up within 24h.

final

Methods

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited