#1179 Santa: configurable sync interval (push is not available to third-party servers) Issue created by javuto Part of Santa/Workshop parity, building on the Santa sync server from #1142 (

pkg/santa

,

osctrl-tls

sync endpoint, Santa page in the UI). Problem Rule changes reach clients on Santa's background sync (minutes). Workshop pushes in seconds. Findings • Push: v1 has

push_token

/

push_issuer_token

, but the Santa client only accepts a token chain signed by North Pole Security keys, and the NATS push settings are v2-only. Push is not available to osctrl. • Workshop-only features gated on v2 in the client (

isSyncV2Enabled

is true only for Workshop domains or an NPS-signed token): network flow rules and the network extension, file access rule delivery, NATS push, telemetry signal rules, Santa-side mode transitions, package rules. Out of scope. • v1 does have

full_sync_interval_seconds

. Scope • Per-environment

full_sync_interval_seconds

(with a sane minimum) sent at preflight; Settings tab control. • Document the latency/load trade-off and the out-of-scope list above in

pkg/santa/README.md

. Acceptance • Clients pick up the interval at preflight; tests cover default, custom and minimum. • Depends on: #1184 Protocol Third-party sync servers must use the stable v1 protos (

buf.build/gen/go/northpolesec/protos/protocolbuffers/go/sync

).

syncv2

is internal to North Pole Security and is being removed from the published protos (northpolesec/santa#1270). jmpsec/osctrl