Nomploy Nomad Packs

← All packs

openfga v0.1.0

Identity

OpenFGA — a high-performance, flexible authorization engine inspired by Google Zanzibar. Model relationships and permissions ("can user X view document Y?") and check them at scale over gRPC/HTTP, with a built-in playground. Deployed as a host-networked Nomad service using an embedded SQLite datastore with a persistent volume.

nomad-pack run openfga --registry nomploy
…or one line (add registry + run)
curl -fsSL https://packs.nomploy.com/install.sh | sh -s -- openfga

Needs nomad-pack on PATH. The script only adds the nomploy registry and runs this pack.

Source ↗ Project ↗ ★ 5.8k ⚑ Report an issue

2 tasks http 8080grpc 8081playground 3000 1 volume image openfga/openfga:latest tracks :latest image bumped today
Pairs with authentikkeycloak
Variables 10
values.hcl

Save as values.hcl, edit, then run:

nomad-pack run openfga -f values.hcl --registry nomploy
# The name of the Nomad job.
job_name = "openfga"

# The Nomad namespace to deploy into.
namespace = "default"

# The datacenters to deploy to.
datacenters = ["*"]

# The OpenFGA container image. Pin a tag in production.
image = "openfga/openfga:latest"

# Host port for the HTTP API (OPENFGA_HTTP_ADDR).
http_port = 8080

# Host port for the gRPC API (OPENFGA_GRPC_ADDR).
grpc_port = 8081

# Host port for the web playground (OPENFGA_PLAYGROUND_PORT).
playground_port = 3000

# Named volume for the SQLite datastore (/data, holds openfga.db).
data_volume = "openfga_data"

# Placement constraints. Pin to the node holding the volume. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
constraints = []

# Resources for the OpenFGA task.
resources = {
    cpu    = 500
    memory = 256
  }
NameTypeDefaultDescription
job_name string 
"openfga"
 The name of the Nomad job.
namespace string 
"default"
 The Nomad namespace to deploy into.
datacenters list 
["*"]
 The datacenters to deploy to.
image string 
"openfga/openfga:latest"
 The OpenFGA container image. Pin a tag in production.
http_port number 
8080
 Host port for the HTTP API (OPENFGA_HTTP_ADDR).
grpc_port number 
8081
 Host port for the gRPC API (OPENFGA_GRPC_ADDR).
playground_port number 
3000
 Host port for the web playground (OPENFGA_PLAYGROUND_PORT).
data_volume string 
"openfga_data"
 Named volume for the SQLite datastore (/data, holds openfga.db).
constraints list 
[]
 Placement constraints. Pin to the node holding the volume. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
resources object 
{
    cpu    = 500
    memory = 256
  }
 Resources for the OpenFGA task.
Back up this pack

This pack stores data in one Docker named volume: openfga_data

restic

# Run on the node hosting this pack. Point restic at your repo first:
#   export RESTIC_REPOSITORY="s3:https://<account>.r2.cloudflarestorage.com/<bucket>"
#   export RESTIC_PASSWORD="<repo-password>"
#   export AWS_ACCESS_KEY_ID=<key>  AWS_SECRET_ACCESS_KEY=<secret>
restic backup \
  /var/lib/docker/volumes/openfga_data/_data

rclone (sync to S3/R2)

rclone sync /var/lib/docker/volumes/openfga_data/_data backup:<bucket>/openfga_data

Paths assume the default Docker volume location (/var/lib/docker/volumes). Restore by stopping the job, restoring files into the same volume, and re-running the pack.

Readme

openfga

OpenFGA — a high-performance, flexible authorization engine inspired by Google Zanzibar. Define relationship-based permissions ("can user X view document Y?") in an authorization model and check them at scale over gRPC/HTTP. Ships a web playground for designing and testing models.

Single host-networked Nomad service using an embedded SQLite datastore with a persistent volume. A prestart task runs the schema migration before the server starts.

Deploy

nomad-pack registry add nomploy https://github.com/Nomploy/nomad-packs
nomad-pack run openfga --registry=nomploy

Configure

Variable Default Description
http_port 8080 HTTP API port (OPENFGA_HTTP_ADDR).
grpc_port 8081 gRPC API port (OPENFGA_GRPC_ADDR).
playground_port 3000 Web playground port (OPENFGA_PLAYGROUND_PORT).
data_volume openfga_data /data — the SQLite datastore (openfga.db).
image openfga/openfga:latest Container image. Pin a tag in production.
resources { cpu = 500, memory = 256 } Task resources.

Create a store and authorization model, then call check/write from your app's OpenFGA SDK. Uses the embedded SQLite datastore (switch to PostgreSQL/MySQL via OPENFGA_DATASTORE_* for larger workloads). Runs without authentication by default — keep it on an internal network, or set OPENFGA_AUTHN_* (preshared key or OIDC) for production. Pin the job to the node holding the volume with constraints.