Configuration

Configuration

Config is YAML. A filesystem file passed via -f/--config (default ./config/.supervisor.yaml) fully replaces the embedded default — it is not merged.

Top-level keys

Key	Default	Meaning
instance	—	Node/service identifier (logged as service_id). Falls back to sid.
datacenter	—	Datacenter identifier.
cluster	—	Cluster identifier.
log.loglevel	info	Log level (debug/info/warn/error).
loglinenumbers	false	Include source line numbers in logs (top-level).
watchduration	15s	How often the daemon reconciles services.
deploypath	—	Root deploy dir; native services resolve their paths from it.
configpath	<deploypath>/config	Where service config files live.
piddir	<deploypath>/run, else temp	Where per-service PID files are written.
enabled_services	—	Allow-list of registry services to manage.
services	—	Per-service overrides and non-registry services.

How services are resolved

supervisor merges a native registry (service name → binary/config/log) with your config:

1. With deploypath set and enabled_services listed — only those registry services are managed. iam resolves to:
   • binary <deploypath>/iam.svc
   • args -f <configpath>/.iam.yaml and logs to <deploypath>/iam.log
   • desired state up
2. With deploypath set and no enabled_services — every registry service is managed (see full-stack profile).
3. Without deploypath — only the services you spell out under services: are managed (you must provide binarypath etc. yourself).

The services: block overlays the resolved set: a listed registry name merges its overrides; a new name is added as-is.

services entry fields

Field	Default	Meaning
state	up	Desired state: up or down.
type	generic	Processor type: generic, kong, openvpn, podman.
binarypath	from registry	Absolute path to the service binary.
args	from registry	Argument list. A trailing &>>/>/>> + path becomes the log file.
logfile	—	Explicit stdout/stderr log file (else /dev/null).
username	current user	User to run as.
sudo	false	Run via sudo (and stop via sudo kill).
initenv	true	Launch through a login shell to populate the environment.
statuscommand	—	Custom status check; its exit code is authoritative.
stoptimeout	15s	How long stop waits before giving up (escalates to SIGKILL at half).

Native registry services

baas:  bff config notify authz vault content iam gateway morph meta
       rtc integrate jobs data status telemetry workflow
ops:   collector querier backup automate
ai:    ai-flow ai-bot ai-gateway datapipe scraper search rules
dev:   test one

Example

instance: supervisor01
datacenter: dc-01
cluster: cluster-01

log:
  loglevel: info

watchduration: 15s
deploypath: /opt/kisai/deploy
configpath: /opt/kisai/deploy/config

enabled_services:
  - config
  - vault
  - iam
  - authz
  - data
  - content

services:
  # override a resolved service
  data:
    args: ["-f", "/opt/kisai/deploy/config/.data.cluster.yaml"]
  # run a service as another user under sudo
  gateway:
    sudo: true
    username: kisai
  # a special processor type (not from the registry)
  edge:
    type: kong
    state: up
  # keep a managed service stopped
  scraper:
    state: down

Config profiles

Profiles are config templates embedded in the binary. One (single-node) is also the fallback used when no config file exists.

supervisor.svc config list                       # list profiles + descriptions
supervisor.svc config generate single-node         # print to stdout
supervisor.svc config generate single-node > config/.supervisor.yaml
supervisor.svc config generate single-node -d ./config   # write ./config/single-node.yaml
supervisor.svc config generate all -d ./config           # write every profile

Profile	Description
minimal	A few core services to start from.
single-node	Full kis.ai core platform stack on a single node (the default).
full-stack	Every service in the registry (no allow-list).

To use a profile as the active config, write it to config/.supervisor.yaml.

Commands

The service name is a positional argument: supervisor.svc <operation> <service>. Omit it (or pass all) to operate on every service.

Persistent flags (available on most commands):

Flag	Default	Meaning
-f, --config	./config/.supervisor.yaml	Config file (falls back to embedded).
-u, --username	—	Run/inspect as this user.
--force	false	Force (e.g. stop/restart go straight to SIGKILL).
--home	—	Root deploy directory (overrides deploypath).

status / start / stop / restart

Operate on one service (status iam) or all of them (status).

supervisor.svc status            # pretty overview of every service, with PIDs
supervisor.svc status iam        # one service
supervisor.svc start iam         # start iam (no-op if already running)
supervisor.svc stop  data        # stop and wait for real exit
supervisor.svc restart gateway --force

status prints an aligned overview — a header (instance · datacenter / cluster), one row per service (● up / ○ down, name, state, PIDs), and a N up · M down summary. It exits 0 only if every targeted service is up. Batch operations attempt every service and report the first error (they do not abort midway).

daemon

Runs the reconcile loop: every watchduration, each service is synced to its desired state (down-but-should-be-up services are restarted). The config is reloaded each tick, so edits are picked up without a restart.

supervisor.svc daemon -f config/.supervisor.yaml

install-daemon / uninstall-daemon

Install supervisor itself as an OS service so the reconcile loop starts on boot — a systemd unit (Linux) or launchd agent (macOS). Generates a starter config if none exists.

supervisor.svc install-daemon --home /opt/kisai/deploy [--user kisai]
supervisor.svc uninstall-daemon [--user kisai]

The systemd unit uses KillMode=process, so restarting supervisor does not kill the services it launched.

install-service / uninstall-service

Install a single kis.ai service as its own OS-supervised unit (independent of the supervisor daemon), resolved from the config + registry.

supervisor.svc install-service iam --home /opt/kisai/deploy [--user kisai]
supervisor.svc uninstall-service iam

server

A small HTTP(S) health server exposing /health and /ready. Serves HTTPS only when both --svccert and --svckey are provided.

supervisor.svc server --addr :8080
supervisor.svc server --svccert cert.pem --svckey key.pem --addr :8443

config

See Config profiles.