Skip to main content

Console

The Synapse console is the nginx frontend image. Users sign in via an OIDC provider (unless disabled) and manage datasources, schemas, pipelines, and executions.

Runtime​

  • HTTP port 80
  • Probes: GET /healthz
  • Env at container start: VITE_API_BASE_URL (required); VITE_OIDC_AUTHORITY and VITE_OIDC_CLIENT_ID (required unless OIDC is off); VITE_OIDC_REDIRECT_URI (optional); VITE_OIDC_COGNITO_DOMAIN (required for AWS Cognito only); VITE_OIDC_AUTH_ENABLED (optional, default true); VITE_KAFKA_UI_URL (optional — hides Kafka UI button when unset); VITE_LISTEN_NAMESPACE (optional — Helm sets the release namespace; empty hides computed listen addresses); VITE_CSP (optional full Content-Security-Policy); VITE_CSP_CONNECT_SRC (optional extra connect-src origins, space-separated)

Point VITE_API_BASE_URL at the public API URL you expose. CORS on the API must allow the console origin.

nginx writes Content-Security-Policy at container start. Set VITE_CSP to the full policy to skip auto assembly. Otherwise connect-src includes 'self', VITE_API_BASE_URL, VITE_KAFKA_UI_URL when set, plus any origins in VITE_CSP_CONNECT_SRC. When VITE_OIDC_AUTH_ENABLED is true, the OIDC authority's origin (and, for AWS Cognito, VITE_OIDC_COGNITO_DOMAIN) is added to connect-src and frame-src — the provider's discovery/token endpoints and its silent-renew iframe need it. Sign-in itself is a full-page redirect to the provider's own hosted page, so no script-src/img-src additions are needed. Images do not ship tenant CSP hosts.

Auth in the browser​

When VITE_OIDC_AUTH_ENABLED is true (default): OIDC ID token, kept fresh by the OIDC client's automatic silent renew, sent as Authorization: Bearer.

When false: no OIDC client is loaded; paste an API key in the sidebar. It is stored in the browser (localStorage) so it survives reloads.

What it calls​

CRUD for datasources, schemas, pipelines, custom transformers, executions, plus GET /api/v1/worker/stats. It does not call worker register/claim/finish.

Routes​

/, /datasources, /schemas, /pipelines, /custom-transformers, /executions, /workers, /playground, /login.