Files
nadir-agent/config.example.yaml
urania a356207ee8
build-and-release / release (push) Has been cancelled
fix: minor fixes
2026-06-22 17:10:09 +02:00

98 lines
4.9 KiB
YAML

# ──────────────────────────────────────────────────────────────────────
# Nadir configuration - config.yaml
#
# This is the single source of truth for runtime settings: server/TLS,
# roles, role assignments, and log-file allowlists. The only env var
# nadir reads is CONFIG_PATH, the bootstrap pointer to this file.
# By default, nadir uses ~/.config/config.yaml. You can override this
# with the -f / --config flag or by setting the CONFIG_PATH env var.
# ──────────────────────────────────────────────────────────────────────
server:
# Secure attribute on the session cookie.
# Keep true when the browser reaches nadir over HTTPS (direct or via proxy).
# Set false only for local plain-HTTP development.
secure_tls: true
# TLS mode, in priority order:
#
# 1. trust_proxy: true
# A reverse proxy (e.g. Traefik) terminates TLS and forwards plaintext
# to nadir. Bind hostname to a private/overlay address so only the proxy
# can reach nadir. X-Forwarded-For is trusted in this mode.
#
# 2. tls_cert + tls_key (uncomment below)
# Nadir terminates TLS itself with your PEM certificate and key.
#
# 3. Neither (default)
# Nadir generates a fresh in-memory self-signed certificate on every
# start. Browsers will warn - this is for development only.
#
# Keep secure_tls: true in modes 1 and 2.
# trust_proxy: false
# tls_cert: /etc/nadir/tls/cert.pem
# tls_key: /etc/nadir/tls/key.pem
# Address and port to bind.
# Use 127.0.0.1 for local-only, or an overlay/VPN address (e.g. a Netbird
# or Tailscale IP) to expose nadir only on that interface.
hostname: localhost
port: 9999
release_repo: https://tea.urania.dev/urania/nadir-agent
# ──────────────────────────────────────────────────────────────────────
# Roles
#
# Maps a role name to { module → [permissions] }.
# - Module key "*" means "all modules (including future ones)".
# - Permission "*" means "all permissions the module exports".
# - IMPORTANT: quote "*" - bare * is YAML alias syntax and fails to parse.
#
# Each module exports its own permission vocabulary via Permissions().
# Valid tiers are: read, write, root. Unknown modules or permissions
# cause a startup error, not a silent denial.
# ──────────────────────────────────────────────────────────────────────
roles:
# Full access - every permission on every module.
admin:
"*": ["*"]
# Read-only on all modules - good for monitoring dashboards.
# auditor:
# "*": ["read"]
# Scoped operator - can read and write the system module only.
# system_ops:
# system: ["read", "write"]
# ──────────────────────────────────────────────────────────────────────
# Assignments
#
# Maps a local username to one or more roles. Effective grants are the
# union of all assigned roles' permissions. The username must match a
# real system account (PAM authenticates against /etc/shadow).
#
# A machine credential (Bearer token) is assigned a role the same way, by its
# token name rather than a system username. Mint with `nadir token add
# central-dashboard`, then grant it scoped access below. Until it is listed
# here the token authenticates but can do nothing.
# ──────────────────────────────────────────────────────────────────────
assignments:
# Replace with your admin username.
ubuntu: [admin]
# central-dashboard: [auditor]
# ──────────────────────────────────────────────────────────────────────
# Log files (optional)
#
# Per-unit allowlist of log files the Services module may serve via the
# source=file log endpoints. Only paths listed here are readable - the
# caller can never request an arbitrary file.
# ──────────────────────────────────────────────────────────────────────
# log_files:
# nginx:
# - /var/log/nginx/access.log
# - /var/log/nginx/error.log
# files:
# - /var/log/auth.log