*/config: add PLC URL config option

The knotserver can now use alternative PLCs for DID resolution
by setting the env var KNOT_SERVER_PLC_URL. The default identity
directory was copied out of the at proto lib and updated to take
in a target url for the PLC being used to do this.

Same goes for appview with TANGLED_PLC_URL and spindle with
SPINDLE_SERVER_PLC_URL

This allows tangled to run on fully sandboxed atmosphere infra

Co-authored-by: Shail Patel <[e-mail]>
Co-authored-by: Seongmin Lee <[e-mail]>
Signed-off-by: Seongmin Lee <[e-mail]>

appview/config/config.go

···
 	Jwks string `env:"JWKS"`
 }
 
+type PlcConfig struct {
+	PLCURL string `env:"URL, default=https://plc.directory"`
+}
+
 type JetstreamConfig struct {
 	Endpoint string `env:"ENDPOINT, default=wss://jetstream1.us-east.bsky.network/subscribe"`
 }
···
 	Avatar        AvatarConfig    `env:",prefix=TANGLED_AVATAR_"`
 	OAuth         OAuthConfig     `env:",prefix=TANGLED_OAUTH_"`
 	Redis         RedisConfig     `env:",prefix=TANGLED_REDIS_"`
+	Plc           PlcConfig       `env:",prefix=TANGLED_PLC_"`
 	Pds           PdsConfig       `env:",prefix=TANGLED_PDS_"`
 	Cloudflare    Cloudflare      `env:",prefix=TANGLED_CLOUDFLARE_"`
 }

appview/state/state.go

···
 		return nil, fmt.Errorf("failed to create enforcer: %w", err)
 	}
 
-	res, err := idresolver.RedisResolver(config.Redis.ToURL())
+	res, err := idresolver.RedisResolver(config.Redis.ToURL(), config.Plc.PLCURL)
 	if err != nil {
 		logger.Error("failed to create redis resolver", "err", err)
-		res = idresolver.DefaultResolver()
+		res = idresolver.DefaultResolver(config.Plc.PLCURL)
 	}
 
 	posthog, err := posthog.NewWithConfig(config.Posthog.ApiKey, posthog.Config{Endpoint: config.Posthog.Endpoint})

guard/guard.go

···
 	"github.com/urfave/cli/v3"
 	"tangled.org/core/idresolver"
 	"tangled.org/core/log"
+	"tangled.org/core/knotserver/config"
 )
 
 func Command() *cli.Command {
···
 
 func Run(ctx context.Context, cmd *cli.Command) error {
 	l := log.FromContext(ctx)
+
+	c, err := config.Load(ctx)
+	if err != nil {
+		return fmt.Errorf("failed to load config: %w", err)
+	}
 
 	incomingUser := cmd.String("user")
 	gitDir := cmd.String("git-dir")
···
 	}
 
 	didOrHandle := components[0]
-	identity := resolveIdentity(ctx, l, didOrHandle)
+	identity := resolveIdentity(ctx, c, l, didOrHandle)
 	did := identity.DID.String()
 	repoName := components[1]
 	qualifiedRepoName, _ := securejoin.SecureJoin(did, repoName)
···
 	return nil
 }
 
-func resolveIdentity(ctx context.Context, l *slog.Logger, didOrHandle string) *identity.Identity {
-	resolver := idresolver.DefaultResolver()
+func resolveIdentity(ctx context.Context, c *config.Config, l *slog.Logger, didOrHandle string) *identity.Identity {
+	resolver := idresolver.DefaultResolver(c.Server.PlcUrl)
 	ident, err := resolver.ResolveIdent(ctx, didOrHandle)
 	if err != nil {
 		l.Error("Error resolving handle", "error", err, "handle", didOrHandle)

idresolver/resolver.go

···
 	directory identity.Directory
 }
 
-func BaseDirectory() identity.Directory {
+func BaseDirectory(plcUrl string) identity.Directory {
 	base := identity.BaseDirectory{
-		PLCURL: identity.DefaultPLCURL,
+		PLCURL: plcUrl,
 		HTTPClient: http.Client{
 			Timeout: time.Second * 10,
 			Transport: &http.Transport{
···
 	return &base
 }
 
-func RedisDirectory(url string) (identity.Directory, error) {
+func RedisDirectory(url, plcUrl string) (identity.Directory, error) {
 	hitTTL := time.Hour * 24
 	errTTL := time.Second * 30
 	invalidHandleTTL := time.Minute * 5
-	return redisdir.NewRedisDirectory(BaseDirectory(), url, hitTTL, errTTL, invalidHandleTTL, 10000)
+	return redisdir.NewRedisDirectory(
+		BaseDirectory(plcUrl),
+		url,
+		hitTTL,
+		errTTL,
+		invalidHandleTTL,
+		10000,
+	)
 }
 
-func DefaultResolver() *Resolver {
+func DefaultResolver(plcUrl string) *Resolver {
+	base := BaseDirectory(plcUrl)
+	cached := identity.NewCacheDirectory(base, 250_000, time.Hour*24, time.Minute*2, time.Minute*5)
 	return &Resolver{
-		directory: identity.DefaultDirectory(),
+		directory: &cached,
 	}
 }
 
-func RedisResolver(redisUrl string) (*Resolver, error) {
-	directory, err := RedisDirectory(redisUrl)
+func RedisResolver(redisUrl, plcUrl string) (*Resolver, error) {
+	directory, err := RedisDirectory(redisUrl, plcUrl)
 	if err != nil {
 		return nil, err
 	}

knotserver/config/config.go

···
 	InternalListenAddr string `env:"INTERNAL_LISTEN_ADDR, default=127.0.0.1:5444"`
 	DBPath             string `env:"DB_PATH, default=knotserver.db"`
 	Hostname           string `env:"HOSTNAME, required"`
+	PlcUrl             string `env:"PLC_URL, default=plc.directory"`
 	JetstreamEndpoint  string `env:"JETSTREAM_ENDPOINT, default=wss://jetstream1.us-west.bsky.network/subscribe"`
 	Owner              string `env:"OWNER, required"`
 	LogDids            bool   `env:"LOG_DIDS, default=true"`

knotserver/ingester.go

···
 	"github.com/bluesky-social/jetstream/pkg/models"
 	securejoin "github.com/cyphar/filepath-securejoin"
 	"tangled.org/core/api/tangled"
-	"tangled.org/core/idresolver"
 	"tangled.org/core/knotserver/db"
 	"tangled.org/core/knotserver/git"
 	"tangled.org/core/log"
···
 	}
 
 	// resolve this aturi to extract the repo record
-	resolver := idresolver.DefaultResolver()
-	ident, err := resolver.ResolveIdent(ctx, repoAt.Authority().String())
+	ident, err := h.resolver.ResolveIdent(ctx, repoAt.Authority().String())
 	if err != nil || ident.Handle.IsInvalidHandle() {
 		return fmt.Errorf("failed to resolve handle: %w", err)
 	}
···
 		return err
 	}
 
-	resolver := idresolver.DefaultResolver()
-
-	subjectId, err := resolver.ResolveIdent(ctx, record.Subject)
+	subjectId, err := h.resolver.ResolveIdent(ctx, record.Subject)
 	if err != nil || subjectId.Handle.IsInvalidHandle() {
 		return err
 	}
 
 	// TODO: fix this for good, we need to fetch the record here unfortunately
 	// resolve this aturi to extract the repo record
-	owner, err := resolver.ResolveIdent(ctx, repoAt.Authority().String())
+	owner, err := h.resolver.ResolveIdent(ctx, repoAt.Authority().String())
 	if err != nil || owner.Handle.IsInvalidHandle() {
 		return fmt.Errorf("failed to resolve handle: %w", err)
 	}

knotserver/internal.go

···
 
 func (h *InternalHandle) replyCompare(line git.PostReceiveLine, repoOwner string, gitRelativeDir string, repoName string, ctx context.Context) ([]string, error) {
 	l := h.l.With("handler", "replyCompare")
-	userIdent, err := idresolver.DefaultResolver().ResolveIdent(ctx, repoOwner)
+	userIdent, err := idresolver.DefaultResolver(h.c.Server.PlcUrl).ResolveIdent(ctx, repoOwner)
 	user := repoOwner
 	if err != nil {
 		l.Error("Failed to fetch user identity", "err", err)

knotserver/router.go

···
 		l:        log.FromContext(ctx),
 		jc:       jc,
 		n:        n,
-		resolver: idresolver.DefaultResolver(),
+		resolver: idresolver.DefaultResolver(c.Server.PlcUrl),
 	}
 
 	err := e.AddKnot(rbac.ThisServer)

spindle/config/config.go

···
 	DBPath            string  `env:"DB_PATH, default=spindle.db"`
 	Hostname          string  `env:"HOSTNAME, required"`
 	JetstreamEndpoint string  `env:"JETSTREAM_ENDPOINT, default=wss://jetstream1.us-west.bsky.network/subscribe"`
+	PlcUrl            string `env:"PLC_URL, default=plc.directory"`
 	Dev               bool    `env:"DEV, default=false"`
 	Owner             string  `env:"OWNER, required"`
 	Secrets           Secrets `env:",prefix=SECRETS_"`

spindle/ingester.go

···
 
 	"tangled.org/core/api/tangled"
 	"tangled.org/core/eventconsumer"
-	"tangled.org/core/idresolver"
 	"tangled.org/core/rbac"
 	"tangled.org/core/spindle/db"
 
···
 func (s *Spindle) ingestRepo(ctx context.Context, e *models.Event) error {
 	var err error
 	did := e.Did
-	resolver := idresolver.DefaultResolver()
 
 	l := s.l.With("component", "ingester", "record", tangled.RepoNSID)
 
···
 		}
 
 		// add collaborators to rbac
-		owner, err := resolver.ResolveIdent(ctx, did)
+		owner, err := s.res.ResolveIdent(ctx, did)
 		if err != nil || owner.Handle.IsInvalidHandle() {
 			return err
 		}
···
 			return err
 		}
 
-		resolver := idresolver.DefaultResolver()
-
-		subjectId, err := resolver.ResolveIdent(ctx, record.Subject)
+		subjectId, err := s.res.ResolveIdent(ctx, record.Subject)
 		if err != nil || subjectId.Handle.IsInvalidHandle() {
 			return err
 		}
···
 
 		// TODO: get rid of this entirely
 		// resolve this aturi to extract the repo record
-		owner, err := resolver.ResolveIdent(ctx, repoAt.Authority().String())
+		owner, err := s.res.ResolveIdent(ctx, repoAt.Authority().String())
 		if err != nil || owner.Handle.IsInvalidHandle() {
 			return fmt.Errorf("failed to resolve handle: %w", err)
 		}

spindle/server.go

···
 		jc.AddDid(d)
 	}
 
-	resolver := idresolver.DefaultResolver()
+	resolver := idresolver.DefaultResolver(cfg.Server.PlcUrl)
 
 	spindle := Spindle{
 		jc:    jc,