Module server 

Optional kopia web-UI server surface for Repository / ClusterRepository.

When spec.server is present, the operator runs kopia server start in a Deployment and exposes it via a Service so users can browse the repository through kopia’s built-in HTML UI. Networking (Ingress/HTTPRoute) is left to the user — only the Service is created.

Security reality (read before changing defaults)

By default the server holds a read-write repository connection: kopia’s UI is full read-write-delete, and the server process holds the repository decryption key, so exposing it exposes full mutation of all backups. Consequences encoded here:

• ServerAuth defaults (when auth is omitted) to ServerAuth::Generate — never to no-auth.
• the no-auth variant (ServerAuth::Insecure) carries a mandatory acknowledgeInsecure: true, webhook-rejected otherwise (see api::validate).

Read-only (readOnly)

ServerSpec::read_only (and a Repository with spec.mode: ReadOnly) connects the server’s kopia process read-only (kopia repository connect --readonly), so creating/deleting/altering backups through the UI is rejected by the repository. kopia 0.23 has no server-level read-only flag; the guarantee comes from the read-only connection, which every later operation on that connection inherits. Two caveats it does not remove: the server still holds the decryption key (anyone reaching the UI can still read and restore every backup — read-only is not confidentiality), and kopia’s UI does not hide the now-non-functional write/delete buttons. The effective read-only state is mode: ReadOnly OR readOnly: true, and is pinned to status.server.readOnly.

Encoding

ServerAuth is an externally-tagged enum (the same representation as crate::backend::Backend), so a value is always exactly one variant and reconcilers match it exhaustively. Every variant wraps a struct (never a unit variant — which would serialize as a bare string — and never a bare bool).

Structs

ClusterServerSpec

ClusterRepository-only server config; the target namespace is required.

GenerateAuth

Payload for ServerAuth::Generate.

InsecureAuth

Payload for ServerAuth::Insecure.

ServerSecretRef

User-supplied UI credentials.

ServerService

How the kopia server is exposed as a Kubernetes Service.

ServerSpec

Namespace-agnostic kopia web-UI server configuration; presence of spec.server means enabled.

ServerStatus

Status block for the kopia server, pinned by the reconciler; never carries a password.

Enums

ServerAuth

UI authentication mode; exactly one variant by construction.

ServiceType

Kubernetes Service.spec.type.

Constants

DEFAULT_SERVER_PORT

kopia’s default server listen port; the resolved value is pinned to status.