config.yaml.example

# ZTAP Configuration File (TEMPLATE)
# 
# Copy to config.yaml: cp config.yaml.example config.yaml
# Customize values as needed. The CLI reads config.yaml by default or the path
# specified via the ZTAP_CONFIG environment variable.

# Service discovery
discovery:
  backend: inmemory # inmemory, dns, or k8s (cache can wrap the selected backend)
  dns:
    domain: example.com
  k8s:
    namespace: "" # Optional: restrict to a specific namespace. If empty, uses ZTAP_NAMESPACE or "default".
  cache:
    ttl: "" # Optional cache TTL applied to the selected backend (e.g., 30s). Leave empty to disable caching.

# Logging settings
logging:
  level: info # debug, info, warn, error
  file: ~/.ztap/ztap.log # newline-delimited logs (json or text)
  format: json # json or text

# Alerting settings
alerting:
  enabled: false
  queue_size: 128
  workers: 2
  timeout: 5s
  dedupe_ttl: 5m
  slack:
    webhook_url: ""
  pagerduty:
    routing_key: ""
    source: ztap

# Metrics settings
metrics:
  enabled: true
  port: 9090
  path: /metrics

# REST API server
api:
  listen: 127.0.0.1:8080
  auth:
    enabled: true
  tls:
    enabled: false
    cert_file: ""
    key_file: ""
    client_auth: false
    client_ca_file: ""
  rate_limit:
    enabled: false
    trust_proxy_headers: false
    unauthenticated:
      rps: 5
      burst: 10
    per_ip:
      rps: 20
      burst: 40
    per_token:
      rps: 10
      burst: 20
    exempt_paths:
      - /healthz
      - /readyz
      - /metrics

# gRPC API server
grpc:
  listen: 127.0.0.1:9092
  auth:
    enabled: true
  tls:
    enabled: false
    cert_file: ""
    key_file: ""
    client_auth: false
    client_ca_file: ""
  rate_limit:
    enabled: false
    unauthenticated:
      rps: 5
      burst: 10
    per_ip:
      rps: 20
      burst: 40
    per_token:
      rps: 10
      burst: 20
    exempt_methods:
      - /grpc.health.v1.Health/*
      - /ztap.api.v1.AuthService/Login

# Cluster coordination (policy sync + leader election)
cluster:
  # backend: memory (default) or etcd
  backend: memory
  # Optional overrides; defaults to hostname and server listen address
  node_id: ""
  node_address: ""
  election:
    # heartbeat_interval: 200ms
    # election_timeout: 1s
    heartbeat_interval: ""
    election_timeout: ""
  etcd:
    # endpoints: ["localhost:2379"]
    endpoints: []
    dial_timeout: ""
    username: ""
    password: ""
    key_prefix: ""
    leader_election_key: ""
    session_ttl: ""

# Authentication
auth:
  sessions:
    backend: sqlite # sqlite or memory
    ttl: 24h # Session lifetime (Go duration; e.g., 30m, 24h)
    sqlite:
      path: ~/.ztap/sessions.db

# AWS Cloud Integration
aws:
  enabled: false
  region: us-east-1
  profile: default # AWS CLI profile to use
  # security_group_id: sg-12345  # Optional: specific SG to manage

# Azure Cloud Integration
azure:
  enabled: false
  subscription_id: ""
  resource_group: ""
  nsg: ""
  rule_prefix: ztap-
  priority_base: 2000

# GCP Cloud Integration
gcp:
  enabled: false
  project_id: ""
  network: ""
  rule_prefix: ztap-
  priority_base: 2000

# Anomaly Detection
anomaly:
  enabled: false
  # Host-local default. Container deployments should set
  # ZTAP_ANOMALY_ENDPOINT=http://anomaly-detector:5000.
  endpoint: http://localhost:5000
  threshold: 50.0 # Anomaly score threshold (0-100)
  alert_email: security@example.com
  batch_size: 50 # Flows per batch sent to the detection service
  flush_interval: 10s # Max time to wait before flushing a partial batch
  auth_token: "" # Bearer token presented to the detection service
  fail_open: true # If true, enforcement continues when the service is unreachable

# Enforcement settings
enforcement:
  dry_run: false # If true, log actions but don't enforce
  default_action: block # block or allow (default for `ztap enforce --default-action`; pf backend)

# Audit logging settings
audit:
  # Path to audit log file (default: ~/.ztap/audit.log)
  log_path: ""

  # Integrity mode: "none", "hmac-sha256", or "ed25519" (default: "none")
  # "none" = hash chaining only (legacy behavior)
  # "hmac-sha256" = HMAC-SHA256 per-entry signing
  # "ed25519" = Ed25519 per-entry signing (recommended)
  integrity_mode: "none"

  # Key identifier (used in audit entries)
  key_id: ""

  # For HMAC mode: path to file containing shared secret
  hmac_key_file: ""

  # For Ed25519 mode: path to private key file
  ed25519_private_key_file: ""

  # Checkpoint settings
  checkpoint_path: ""
  checkpoint_interval: "5m" # Write checkpoint every N duration or 100 entries


# Policy validation
policy:
  strict: true # Fail on validation errors
  allow_empty_egress: false # Allow policies with no egress rules
  resolve_labels: false # Attempt to resolve label selectors to IPs