Skip to content

Service options

Set inside a service block:

service NotesApi {
  option (spec.service_c2s) = {auth_entitled_users: true};
}

spec.event_label

Set on service · Type string · Number 70012

event_label is the routing label for gateway-exposed event services.
Set by tacplus on generated state services that have spec.service_event.
The gateway uses this as the service_id for backend resolution.

spec.service_s2s

Set on service · Type ServiceS2SAnnotation · Number 70013

service_s2s declares a service-to-service gRPC service.
Only authenticated service identities can call these RPCs; which ones is
declared per-RPC on spec.rpc.

Example: option (spec.service_s2s) = {};

Example: option (spec.service_s2s) = {label: "recordstore"};

spec.service_c2s

Set on service · Type ServiceC2SAnnotation · Number 70014

service_c2s declares a client-to-service gRPC service.
Exposed through the gateway to end users.

Example: option (spec.service_c2s) = {auth_entitled_users: true};

spec.service_c2d

Set on service · Type ServiceC2DAnnotation · Number 70015

service_c2d declares a client-to-daemon gRPC service.
Served over local IPC between CLI processes and a daemon.
No auth — filesystem permissions are the security boundary.

Example: option (spec.service_c2d) = {socket_path: "/run/mydaemon.sock"};

spec.token_minter

Set on service · Type TokenMinterAnnotation · Number 70016

token_minter explicitly marks the cluster's token mint service so the
bootstrap exchanger codegen targets it by fully-qualified name instead of
scanning for mint RPC signatures.

Example: option (spec.token_minter) = {}; // authoritative S2S minter

option (spec.token_minter) = {proxy: true}; // gateway C2S front

spec.smb

Set on service · Type SmbAnnotation · Number 70020

smb (Service Mesh Blackbox) marks a service whose OWN INSTANCES communicate
over a black-box peer protocol within a
single cluster (SPIFFE plan D7). Each instance obtains a per-SMB CA + its
own member cert from the SMB CA authority (the consumer service designated
by spec.smb_authority). By default that per-SMB CA is isolated from the
cluster root; bootstrap-constrained members may request a cluster-rooted
per-SMB intermediate with root: SMB_ROOT_CLUSTER.

Example: option (spec.smb) = {};

option (spec.smb) = {root: SMB_ROOT_CLUSTER};

spec.smb_authority

Set on service · Type SmbAuthorityAnnotation · Number 70021

smb_authority marks the consumer service that issues isolated per-SMB CAs and
member certs for spec.smb services — declared EXPLICITLY (like token_minter),
not inferred. tacplus targets the service carrying this annotation as the SMB
cert authority and fails generation if spec.smb services exist with no
authority declared. tacplus does not implement the authority; the designated
consumer service does. Exactly one authority should be annotated.

Example: option (spec.smb_authority) = {};

spec.volume_group

Set on service · Type repeated VolumeGroupAnnotation · Number 70022

volume_group declares a named blob-store volume group owned by this service
— its accepted content types, per-blob size ceiling and per-tenant quota,
fixed at build time. Repeatable: a service may declare more than one group.
tacplus refuses duplicate group names fleet-wide and emits every group into
registry.json for the operator to render into the blob store's config.

Example: option (spec.volume_group) = {name: "documents",

max_blob_bytes: 52428800,
content_types: ["application/pdf", "image/jpeg"],
tenant_quota_bytes: 53687091200};