App Deployments (4a+): config-file mounts via files:

[v0l]

Follow-up to the shared compose parser (#218). Adds config-file mounts to the app compose grammar so file-driven apps (e.g. strfry's strfry.conf, nginx, haven) are deployable — env vars alone aren't enough for them.

Grammar

A files: list per service — read-only config files injected into the container:

services:
  strfry:
    image: ghcr.io/hoytech/strfry:latest
    files:
      - path: /etc/strfry.conf
        content: |                       # templated, ${…} from config:/secrets:
          relay { info { name = "${relay_name}"; } }
      - path: /etc/custom.conf
        content_from: custom_conf         # customer-supplied whole file
      - path: /etc/api.key
        content: "${API_KEY}"
        sensitive: true                   # -> Secret, not ConfigMap
config:
  - { name: relay_name, type: string, default: "My Relay" }
  - { name: custom_conf, type: file }     # new field type for whole-file input

• Content source is exactly one of inline content (templated) or content_from a config field (new type: file).
• sensitive: true → rendered into a Secret; otherwise a ConfigMap. The operator mounts each at path via subPath (single file, doesn't shadow the directory).
• Kept distinct from volumes: (persistent read-write PVCs) — files: are injected read-only config.

Validation (shared parser → admin API)

Absolute, non-.. path; single content source; ≤256 KiB inline; content_from must reference a declared config field; a file may not overlap a data-volume mount.

API

• resolve_files(vars) → per-service [ResolvedFile { path, content, sensitive }] for the operator.
• referenced_vars() now also scans file-content templates.

Tests

4 new (strfry.conf multi-file example incl. sensitive + content_from, and every rejection path); 11 total in the crate.

Next

4b) operator reconcile — will render files: into ConfigMaps/Secrets and subPath-mount them alongside Deployment/Service/Ingress/PVC.