apollo-router

Apollo Router Config Generator

Apollo Router is a high-performance graph router written in Rust for running Apollo Federation 2 supergraphs. It sits in front of your subgraphs and handles query planning, execution, and response composition.

This skill generates version-correct configuration. Router v1 and v2 have incompatible config schemas in several critical sections (CORS, JWT auth, connectors). Always determine the target version before generating any config.

Step 1: Version Selection

Ask the user before generating any config:

Which Apollo Router version are you targeting?

  [1] Router v2.x (recommended — current LTS, required for Connectors)
  [2] Router v1.x (legacy — end-of-support announced, security patches only)
  [3] Not sure — help me decide

If the user picks [3], display:

Quick guide:

  • Pick v2 if: you're starting fresh, using Apollo Connectors for REST APIs,
    or want backpressure-based overload protection.
  • Pick v1 if: you have an existing deployment and haven't migrated yet.
    Note: Apollo ended active support for v1.x. The v2.10 LTS (Dec 2025)
    is the current baseline. Migration is strongly recommended.

  Tip: If you have an existing router.yaml, you can auto-migrate it:
    router config upgrade router.yaml

Store the selection as ROUTER_VERSION=v1|v2 to gate all subsequent template generation.

Step 2: Environment Selection

Ask: Production or Development?

• Production: security-hardened defaults (introspection off, sandbox off, homepage off, subgraph errors hidden, auth required, health check on)
• Development: open defaults (introspection on, sandbox on, errors exposed, text logging)

Load the appropriate base template from:

• templates/{version}/production.yaml
• templates/{version}/development.yaml

Step 3: Feature Selection

Ask which features to include:

• JWT Authentication
• Declarative Authorization (field-level @authenticated / @requiresScopes / @policy directives — requires GraphOS + request claims)
• CORS (almost always yes for browser clients)
• Operation Limits
• Traffic Shaping / Rate Limiting
• Telemetry (Prometheus, OTLP tracing, JSON logging)
• APQ (Automatic Persisted Queries — performance/bandwidth only, NOT a security control)
• Persisted Query Safelisting (GraphOS PQL operation allowlist — a security control; distinct from APQ)
• Connectors (REST API integration — Router v2 only; GA key is connectors, early v2 preview key was preview_connectors)
• Subscriptions
• Header Propagation
• Response Caching (entity + root field caching with Redis — Router v2 only, v2.6.0+)