Registry Render configuration reference

Scope

This grammar is not frozen.

manifest.yaml declares the bundle’s document types: each one’s template, data schema, label locales, version, and PDF standard. Each labels/<locale>.yaml holds one label table, and every table must carry the same keys. runtime.yaml is what registry-render serve reads: listener, package, secret providers, API key, limits, and audit.

The JSON Schema a document type names for its data is yours to write; Render applies it to every request and has no schema of its own for it. A schema-valid file still needs registry-render check, because rules across files, such as a label key the template reads, are not in these tables. Configuration files describes the YAML rules and environment substitution that apply when serve reads runtime.yaml.

Two rules are written as exclusions the tables do not show: each document’s entryFile and schemaFile is relative to the bundle root and contains no .., and package.root has no . or .. segment.

Read the tables

documents[] means an array item; labels.* means a map entry whose name you choose. Required fields inside an optional object apply when that object is present. Conditional fields depend on another value, such as audit.path on audit.destination. audit.rotateBytes defaults to 100 MiB and audit.retentionDays to 90.

• manifest.yaml Source preview, pre-1.0, 12 key paths
• labels/*.yaml Source preview, pre-1.0, 4 key paths
• runtime.yaml Source preview, pre-1.0, 24 key paths

manifest.yaml

Source preview, pre-1.0

Generated from products/render/schemas/bundle.schema.json. 12 key paths. Explained in docs/site/src/content/docs/reference/render-configuration.mdx.

Key path	Type	Required	Accepted values	Constraints
apiVersion	string	Yes	id.registrystack.org/formats/render/bundle/v1alpha1	None specified
bundleVersionAuthor-defined bundle version, monotonic per bundle.	integer	Yes	Not specified	format: uint32 maximum: 4294967295 minimum: 1
documentsThe document types, each with an id unique in the bundle.	array	No	Not specified	None specified
documents[]Array itemOne document type as manifest.yaml writes it.	object	No	Not specified	None specified
documents[].entryFileEntry point relative to the bundle root: a .typ file inside the bundle.	string	Yes	Not specified	pattern: \.typ$
documents[].idStable document identifier used in requests and routes.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
documents[].labelsLabel tables the template receives, by locale: each names labels/<locale>.yaml.	array	No	Not specifiedSchema default, where declared: []	uniqueItems: true
documents[].labels[]Array itemA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	No	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
documents[].pdfStandardPDF standard for this document; plain PDF when absent.	string	No	1.4 1.5 1.6 1.7 2.0 a-1a a-1b a-2a a-2b a-2u a-3a a-3b a-3u a-4 a-4e a-4f ua-1	None specified
documents[].schemaFileJSON Schema (draft 2020-12) for the request data, relative to the bundle root: a .json file inside the bundle.	string	No	Not specified	pattern: \.json$
documents[].versionThe document's own version; printed on paper by templates that wish to.	integer	Yes	Not specified	format: uint32 maximum: 4294967295 minimum: 1
kind	string	Yes	RenderBundle	None specified

labels/*.yaml

Source preview, pre-1.0

Generated from products/render/schemas/labels.schema.json. 4 key paths. Explained in docs/site/src/content/docs/reference/render-configuration.mdx.

Key path	Type	Required	Accepted values	Constraints
apiVersion	string	Yes	id.registrystack.org/formats/render/labels/v1alpha1	None specified
kind	string	Yes	RenderLabels	None specified
labelsThe text of each label, by key. Every locale of a document defines the same keys.	object	Yes	Not specified	None specified
labels.*Map valueHuman-readable display text. Bidirectional embedding, override, and isolate controls, byte-order marks, line and paragraph separators, and Unicode noncharacters are refused; multilingual joiners and direction marks remain valid.	string	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$

runtime.yaml

Source preview, pre-1.0

Generated from products/render/schemas/runtime.schema.json. 24 key paths. Explained in docs/site/src/content/docs/reference/render-configuration.mdx.

Key path	Type	Required	Accepted values	Constraints
apiVersion	string	Yes	id.registrystack.org/formats/render/runtime/v1alpha1	None specified
auditThe audit block every Registry Stack product shares: a file (the default) or stdout destination, with rotation and retention for a file.	object	Yes	Not specified	None specified
audit.destinationWhere audit lines go: file or stdout.	string	No	file stdout Schema default, where declared: "file"	None specified
audit.pathThe absolute path of the active audit file, for a file destination.	string	Conditional	Not specified	pattern: ^/+(?:(?:[^/.][^/]*|\.(?:[^/.][^/]*|\.[^/]+)?)/+)*(?:[^/.][^/]*|\.(?:[^/.][^/]*|\.[^/]+))$
audit.retentionDaysDays a rotated file is kept, for a file destination. Default: 90.	integer	No	Not specified	format: uint32 maximum: 36500 minimum: 1
audit.rotateBytesSize at which the active file rotates, in bytes, for a file destination. Default: 100 MiB.	integer	No	Not specified	format: uint64 maximum: 4294967295 minimum: 1048576
auth	object	Yes	Not specified	None specified
auth.apiKeyRefSecret reference to the caller API key, under a declared provider.	string	Yes	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
kind	string	Yes	RenderRuntimeConfig	None specified
limits	object	No	Not specified	None specified
limits.maximumConcurrentRendersMost renders in flight at once. Default: the CPU count, at most 8.	integer	No	Not specified	format: uint64 maximum: 64 minimum: 1
limits.maximumOutputBytesLargest PDF a render may produce, in bytes.	integer	No	Not specifiedSchema default, where declared: 8388608	format: uint64 maximum: 8388608 minimum: 1
limits.maximumRequestBytesLargest request body (data and base64 assets), in bytes. The httpsec default is 1 MiB; renders with photos need a conscious, bounded raise.	integer	No	Not specifiedSchema default, where declared: 8388608	format: uint64 maximum: 67108864 minimum: 1
limits.renderTimeoutSecondsWall-clock budget per render, in seconds; the worker is killed at this bound.	integer	No	Not specifiedSchema default, where declared: 20	format: uint64 maximum: 3600 minimum: 1
listener	object	Yes	Not specified	None specified
listener.bindLoopback, private, or link-local address to listen on. A public or all-interfaces bind is refused when the file is read. TLS is the proxy's job, not Render's.	string	Yes	Not specified	maxLength: 128 minLength: 1 pattern: :0*(?:[0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$ pattern: ^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]?|0)\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]?|0):[0-9]+$ or maxLength: 128 minLength: 1 pattern: :0*(?:[0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$ pattern: ^\[(?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|:(?:(?::[0-9A-Fa-f]{1,4}){1,7}|:))\]:[0-9]+$ or maxLength: 128 minLength: 1 pattern: :0*(?:[0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$ pattern: ^\[(?:(?:[0-9A-Fa-f]{1,4}:){6}|::(?:[0-9A-Fa-f]{1,4}:){5}|(?:[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){4}|(?:(?:[0-9A-Fa-f]{1,4}:){0,1}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){3}|(?:(?:[0-9A-Fa-f]{1,4}:){0,2}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){2}|(?:(?:[0-9A-Fa-f]{1,4}:){0,3}[0-9A-Fa-f]{1,4})?::[0-9A-Fa-f]{1,4}:|(?:(?:[0-9A-Fa-f]{1,4}:){0,4}[0-9A-Fa-f]{1,4})?::)(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]?|0)\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]?|0)\]:[0-9]+$
listener.shutdownGraceMillisecondsTime allowed for renders in flight to finish at shutdown, in milliseconds. Open connections get the same again.	integer	No	Not specifiedSchema default, where declared: 30000	format: uint64 maximum: 3600000 minimum: 1000
packageThe verified bundle package Render serves.	object	Yes	Not specified	None specified
package.expectedDigestsha256: label of the package digest, the digest of the package's SHA256SUMS file. When set, the runtime refuses to start on any other package.	string	No	Not specified	pattern: ^sha256:[0-9a-f]{64}$
package.rootAbsolute path of the package directory.	string	Yes	Not specified	pattern: ^/
secretProvidersThe secret providers a runtime enables. A reference is resolved only by a provider declared here: secret:file/name under file.root, and secret:env/NAME only when environment: {} is present.	object	Yes	Not specified	None specified
secretProviders.environmentEnables secret:env/NAME references, read from the process environment. Declared as an empty mapping: environment: {}.	object	Conditional	Not specified	None specified
secretProviders.fileEnables secret:file/name references, read from files under root.	object	Conditional	Not specified	None specified
secretProviders.file.rootAbsolute directory holding one file per secret. Each file must be a regular file owned by the runtime user, mode 0400 or 0600, with exactly one hard link.	string	Conditional	Not specified	pattern: ^/

Check commands

Format and files	Check command
Render bundle manifest manifest.yaml	registry-render check --bundle <project>
Render label catalogue labels/*.yaml	registry-render check --bundle <project>
Render runtime configuration runtime.yaml	registry-render check --runtime-config <file>
Render document data schema schemas/*.schema.json	None

Next

• Render your first document
• Deploy Registry Render