OPA Config

opa-config is not an application service — it's the image that runs the OPA (Open Policy Agent) server itself along with the Rego policy that acts as RAGA's authorization decision engine. Every time OPA Auth asks "is this request allowed?", the answer is computed by the policy running here.

opa-config is one of three components in RAGA's OPA subsystem:

Component	Role
OPA Config	Runs the OPA server & holds the Rego policy (decision engine)
OPA Data	Syncs role & grant data from User Service into OPA
OPA Auth	The gate in front of Traefik — calls OPA on every request

Tech Stack

Layer	Technology
Base Image	Alpine 3.20
Policy Engine	OPA binary (v1.5.1)
Policy Language	Rego
Secret Management	Infisical CLI (infisical run --watch)

Full policy structure, decision flow, and environment variable details are on the Technical page.

Flow at a Glance

1. OPA Data writes the latest role/grant data to a data.json file on a shared volume.
2. The OPA server (run from this image) loads data.json and policy.rego as the basis for decisions.
3. OPA Auth calls POST /v1/data/verify_access on every incoming request; OPA evaluates the Rego policy against data.json and returns an allow/deny decision along with the user's role & grant details.

Summary

opa-config is the "brain" of the OPA subsystem — it doesn't receive traffic from Traefik (that's opa-auth's job) or populate data (that's opa-data's job), but it's what actually decides access based on Rego rules and the latest synced data.