---
module: technical.config
title: hiveops-config — Spring Cloud Config Server (centralized configuration)
tab: Overview
order: 10
audience: dev
---

> **DRAFT · internal.** Written 2026-07-01 from hiveops-config source. Verify against code before relying on specifics.

## Responsibility

`hiveops-config` is the Spring Cloud Config Server (`@EnableConfigServer`) that serves centralized, git-backed configuration to all other HiveOps microservices. It owns no business domain of its own — it exposes profile/label-resolved config files (`hiveops-<service>[-<profile>].yml`) over HTTP Basic auth. Clients bootstrap against it and can hot-reload via `@RefreshScope` + their own `/actuator/refresh`. Cross-link [platform.service-ownership].

## Data

- **No database.** This service has no `@Entity` classes, no datasource, and no Flyway migrations.
- Backing store is a **git repository** of YAML config files (`config-repo/`). Dev uses a local repo (`file://${user.dir}/config-repo`, `default-label: main`); prod pulls a remote repo via `GIT_REPO_URL` / `GIT_USERNAME` / `GIT_PASSWORD` (`application-prod.yml`).
- Config files present in-repo: `application.yml` (shared defaults) plus `hiveops-{auth,mgmt,incident}[-dev|-prod].yml`.

Cross-link [platform.data-stores].

## Kafka

No Kafka. No producers, `@KafkaListener`s, or topics in this service.

## API surface

No custom `@RestController`s. The endpoints below are provided by Spring Cloud Config Server and Actuator (auth + exposure verified in `SecurityConfig.java` / `application.yml`). Base URL is the service root on port **8083** (NGINX path `/api/config/`).

| METHOD path | Purpose |
|---|---|
| GET `/{application}/{profile}` | Resolved config as JSON (e.g. `/hiveops-mgmt/prod`) |
| GET `/{application}/{profile}/{label}` | Config for a specific git label/branch |
| GET `/{application}-{profile}.yml` | Resolved config as YAML |
| GET `/{application}-{profile}.properties` | Resolved config as properties |
| GET `/{label}/{application}-{profile}.yml` | YAML from a specific git label |
| GET `/actuator/health` | Health incl. `configServer` component (public, no auth) |
| GET `/actuator/info` | Build/info (public, no auth) |
| GET `/actuator/env` | Environment (auth required) |
| POST `/actuator/refresh` | Refresh server's own config (auth required) |

All paths except `/actuator/health` and `/actuator/info` require HTTP Basic auth.

## Gotchas

- **No default credentials.** `CONFIG_USERNAME` and `CONFIG_PASSWORD` are required env vars with no fallback (`application.yml`); the app fails to start if unset. Single in-memory user with role `CONFIG_CLIENT` (`SecurityConfig.java`), not the usual `MSP_ADMIN`/`BCOS_ADMIN` role model.
- **Auth is HTTP Basic, not JWT.** This service does not use the shared JWT model of other HiveOps services.
- **CSRF disabled**; only `/actuator/health` and `/actuator/info` are `permitAll` — everything else is `authenticated()`.
- **Git `force-pull: true` + `clone-on-start: true`** — server force-pulls the config repo; local edits to the working copy are discarded on refresh/restart.
- **Prod vs dev git source differs by profile:** dev serves from a local `config-repo` dir; prod requires `GIT_REPO_URL`/`GIT_USERNAME`/`GIT_PASSWORD` (activate with `SPRING_PROFILES_ACTIVE=prod`).
- **Actuator exposure is limited** to `health,info,env,refresh` — other actuator endpoints are not exposed.
- **Client-side refresh is separate:** hitting this server's `/actuator/refresh` reloads the server; consuming services reload via their own `/actuator/refresh` (and must have `@RefreshScope`).
