snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

cmd/serve/root.go

@@ -0,0 +1,58 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package serve
+
+import (
+	"github.com/spf13/cobra"
+
+	"github.com/ory/kratos/cmd/daemon"
+	"github.com/ory/kratos/driver"
+	"github.com/ory/kratos/driver/config"
+	"github.com/ory/x/configx"
+)
+
+// NewServeCmd returns the serve command
+func NewServeCmd(dOpts ...driver.RegistryOption) (serveCmd *cobra.Command) {
+	serveCmd = &cobra.Command{
+		Use:   "serve",
+		Short: "Run the Ory Kratos server",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+			d, err := driver.New(ctx, cmd.ErrOrStderr(), append(dOpts, driver.WithConfigOptions(configx.WithFlags(cmd.Flags())))...)
+			if err != nil {
+				return err
+			}
+
+			if d.Config().IsInsecureDevMode(ctx) {
+				d.Logger().Warn(`
+
+YOU ARE RUNNING Ory KRATOS IN DEV MODE.
+SECURITY IS DISABLED.
+DON'T DO THIS IN PRODUCTION!
+
+`)
+			}
+
+			configVersion := d.Config().ConfigVersion(ctx)
+			if configVersion == config.UnknownVersion {
+				d.Logger().Warn("The config has no version specified. Add the version to improve your development experience.")
+			} else if config.Version != "" &&
+				configVersion != config.Version {
+				d.Logger().Warnf("Config version is '%s' but kratos runs on version '%s'", configVersion, config.Version)
+			}
+
+			return daemon.ServeAll(d)(cmd, args)
+		},
+	}
+	configx.RegisterFlags(serveCmd.PersistentFlags())
+
+	serveCmd.PersistentFlags().Bool("sqa-opt-out", false, "Disable anonymized telemetry reports - for more information please visit https://www.ory.com/docs/ecosystem/sqa")
+	serveCmd.PersistentFlags().Bool("dev", false, "Disables critical security features to make development easier")
+	serveCmd.PersistentFlags().Bool("watch-courier", false, "Run the message courier as a background task, to simplify single-instance setup")
+	return serveCmd
+}
+
+func RegisterCommandRecursive(parent *cobra.Command, dOpts []driver.RegistryOption) {
+	parent.AddCommand(NewServeCmd(dOpts...))
+}

cmd/serve/root_test.go

@@ -0,0 +1,45 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package serve_test
+
+import (
+	"testing"
+
+	"github.com/ory/kratos/pkg/testhelpers"
+)
+
+func TestServe(t *testing.T) {
+	_, _ = testhelpers.StartE2EServer(t, "./stub/kratos.yml", nil)
+}
+
+func TestServeTLSBase64(t *testing.T) {
+	_, _, certBase64, keyBase64 := testhelpers.GenerateTLSCertificateFilesForTests(t)
+	publicPort, adminPort := testhelpers.StartE2EServerOnly(t,
+		"./stub/kratos.yml",
+		true,
+		testhelpers.ConfigOptions{
+			"serve.public.tls.key.base64":  keyBase64,
+			"serve.public.tls.cert.base64": certBase64,
+			"serve.admin.tls.key.base64":   keyBase64,
+			"serve.admin.tls.cert.base64":  certBase64,
+		},
+	)
+	testhelpers.CheckE2EServerOnHTTPS(t, publicPort, adminPort)
+}
+
+func TestServeTLSPaths(t *testing.T) {
+	certPath, keyPath, _, _ := testhelpers.GenerateTLSCertificateFilesForTests(t)
+
+	publicPort, adminPort := testhelpers.StartE2EServerOnly(t,
+		"./stub/kratos.yml",
+		true,
+		testhelpers.ConfigOptions{
+			"serve.public.tls.key.path":  keyPath,
+			"serve.public.tls.cert.path": certPath,
+			"serve.admin.tls.key.path":   keyPath,
+			"serve.admin.tls.cert.path":  certPath,
+		},
+	)
+	testhelpers.CheckE2EServerOnHTTPS(t, publicPort, adminPort)
+}

cmd/serve/stub/identity.schema.json

@@ -0,0 +1,49 @@
+{
+  "$id": "https://schemas.ory.sh/presets/kratos/quickstart/email-password/identity.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Person",
+  "type": "object",
+  "properties": {
+    "traits": {
+      "type": "object",
+      "properties": {
+        "email": {
+          "type": "string",
+          "format": "email",
+          "title": "E-Mail",
+          "minLength": 3,
+          "ory.sh/kratos": {
+            "credentials": {
+              "password": {
+                "identifier": true
+              }
+            },
+            "verification": {
+              "via": "email"
+            },
+            "recovery": {
+              "via": "email"
+            }
+          }
+        },
+        "name": {
+          "type": "object",
+          "properties": {
+            "first": {
+              "title": "First Name",
+              "type": "string"
+            },
+            "last": {
+              "title": "Last Name",
+              "type": "string"
+            }
+          }
+        }
+      },
+      "required": [
+        "email"
+      ],
+      "additionalProperties": false
+    }
+  }
+}

cmd/serve/stub/kratos.yml

@@ -0,0 +1,81 @@
+dsn: memory
+
+serve:
+  public:
+    base_url: http://127.0.0.1:4433/
+    cors:
+      enabled: true
+  admin:
+    base_url: http://kratos:4434/
+
+selfservice:
+  default_browser_return_url: http://127.0.0.1:4455/
+  allowed_return_urls:
+    - http://127.0.0.1:4455
+
+  methods:
+    password:
+      enabled: true
+
+  flows:
+    error:
+      ui_url: http://127.0.0.1:4455/error
+
+    settings:
+      ui_url: http://127.0.0.1:4455/settings
+      privileged_session_max_age: 15m
+
+    recovery:
+      enabled: true
+      ui_url: http://127.0.0.1:4455/recovery
+
+    verification:
+      enabled: true
+      ui_url: http://127.0.0.1:4455/verify
+      after:
+        default_browser_return_url: http://127.0.0.1:4455/
+
+    logout:
+      after:
+        default_browser_return_url: http://127.0.0.1:4455/auth/login
+
+    login:
+      ui_url: http://127.0.0.1:4455/auth/login
+      lifespan: 10m
+
+    registration:
+      lifespan: 10m
+      ui_url: http://127.0.0.1:4455/auth/registration
+      after:
+        password:
+          hooks:
+            -
+              hook: session
+
+log:
+  level: debug
+  format: text
+  leak_sensitive_values: true
+
+secrets:
+  cookie:
+    - PLEASE-CHANGE-ME-I-AM-VERY-INSECURE
+  pagination:
+    - "test pagination secret"
+
+hashers:
+  argon2:
+    parallelism: 1
+    memory: 128MB
+    iterations: 2
+    salt_length: 16
+    key_length: 16
+
+identity:
+  schemas:
+    - id: default
+      url: file://stub/identity.schema.json
+
+courier:
+  smtp:
+    connection_uri: smtps://test:test@mailslurper:1025/?skip_ssl_verify=true&legacy_ssl=true