Kong config

Source of truth: splick-backend/infra/kong/kong.yml (and kong.prod.yml where production differs). Kong DB mode stores the running config in schema kong. A file change does nothing until bootstrap or restart applies it. The manage scripts do that. There is a GitHub workflow kong-validate.yml in the backend repo.

When you add a public route:

1. Add the upstream and route, including rate limit and timeout plugins if the route is credential-related or a WebSocket.
2. Keep the /api strip plugin in front.
3. Document the prefix on the service's API page and in API gateway.
4. Do not add the outbox relay to Kong.

Admin API stays on localhost. A security group that exposes 8001 is a misconfiguration.

Health for a future Kubernetes move is /status, recorded in ADR 0001. Kubernetes is not the current runtime. See Kubernetes target.