initial-commit

config.toml.example

@@ -0,0 +1,267 @@
+# Charybdis Configuration File
+# =============================
+# This file uses TOML format and supports environment variable substitution
+# using ${VAR_NAME} syntax to avoid storing secrets in the config file.
+#
+# Copy this file to 'config.toml' and customize for your environment.
+
+# Server Configuration
+# ====================
+[server]
+# gRPC server bind address
+# Default: "[::1]" (IPv6 localhost)
+# Use "0.0.0.0" to listen on all interfaces
+grpc_host = "[::1]"
+
+# gRPC server port
+# Default: 50051
+grpc_port = 50051
+
+# YAML Adapter for Backstage Integration
+[server.yaml_adapter]
+# Enable YAML adapter (for Backstage catalog integration)
+enabled = true
+
+# YAML adapter bind address
+host = "0.0.0.0"
+
+# YAML adapter port
+port = 8080
+
+
+# Database Configuration
+# ======================
+[database]
+# PostgreSQL connection URL
+# Use environment variable substitution to avoid storing credentials
+# Example: postgresql://user:password@localhost:5432/dbname
+url = "${DATABASE_URL}"
+
+# Maximum number of connections in the pool
+# Default: 10
+max_connections = 10
+
+# Connection timeout in seconds
+# Default: 30
+connection_timeout_secs = 30
+
+
+# Security Configuration
+# ======================
+[security.mtls]
+# Enable mutual TLS authentication
+# When enabled, all clients must present valid certificates
+# Default: false
+enabled = false
+
+# Server certificate (PEM format)
+# Example: "./certs/server-cert.pem"
+server_cert = "./certs/server-cert.pem"
+
+# Server private key (PEM format)
+# Example: "./certs/server-key.pem"
+server_key = "./certs/server-key.pem"
+
+# Client CA certificate for verification (PEM format)
+# Example: "./certs/ca.pem"
+client_ca_cert = "./certs/ca.pem"
+
+# Require client certificate (recommended: true)
+# Default: true
+require_client_cert = true
+
+# Optional: Certificate Revocation List (CRL) file
+# crl_file = "./certs/crl.pem"
+
+[security.rbac]
+# Enable role-based access control
+# Default: false
+enabled = false
+
+# Audit logging configuration
+[security.rbac.audit]
+# Enable audit logging for security events
+# Default: true
+enabled = true
+
+# Log all requests (including successful ones)
+# Default: true
+log_all_requests = true
+
+# Log denied requests
+# Default: true
+log_denied_requests = true
+
+# Role mappings: Certificate attributes -> RBAC roles
+# Note: Default roles are configured in code if this section is empty
+# Uncomment to customize role mappings
+#
+# [[security.rbac.role_mappings]]
+# role = "admin"
+# [[security.rbac.role_mappings.rules]]
+# [security.rbac.role_mappings.rules.subject]
+# ou = "administrators"
+#
+# [[security.rbac.role_mappings]]
+# role = "developer"
+# [[security.rbac.role_mappings.rules]]
+# [security.rbac.role_mappings.rules.subject]
+# ou = "engineering"
+
+# Role permissions: role -> list of permissions
+# Uncomment to customize permissions
+#
+# [security.rbac.permissions]
+# admin = ["entity:create", "entity:read", "entity:update", "entity:delete", "entity:list"]
+# developer = ["entity:create", "entity:read", "entity:update", "entity:list"]
+# viewer = ["entity:read", "entity:list"]
+
+
+# OpenTelemetry Configuration
+# ============================
+[telemetry]
+# Service name for telemetry
+# Default: "charybdis"
+service_name = "charybdis"
+
+# Service version
+# Default: "0.1.0"
+service_version = "0.1.0"
+
+# Environment name (development, staging, production)
+# Default: "development"
+environment = "development"
+
+# Console output for traces/metrics (useful for development)
+# Default: true
+# Set to false in production
+enable_console = true
+
+# OTLP exporter configuration (for production)
+[telemetry.otlp]
+# Enable OTLP exporter (sends telemetry to collector)
+# Default: false
+enabled = false
+
+# OTLP endpoint (without protocol prefix)
+# Example: "localhost:4317"
+# endpoint = "localhost:4317"
+
+# Traces configuration
+[telemetry.traces]
+# Sampling ratio (0.0 to 1.0)
+# 1.0 = sample all traces (development)
+# 0.1 = sample 10% of traces (production)
+# Default: 1.0
+sampler_ratio = 1.0
+
+# Metrics configuration
+[telemetry.metrics]
+# Export interval in seconds
+# Default: 60
+export_interval_secs = 60
+
+# Logs configuration
+[telemetry.logs]
+# Log level filter
+# Options: trace, debug, info, warn, error
+# Default: "info"
+level = "info"
+
+# Enable JSON formatting
+# Default: false
+json_format = false
+
+
+# Plugin Configuration
+# ====================
+# Plugins extend Charybdis functionality by reacting to entity lifecycle events
+
+# DefectDojo Integration Plugin
+[plugins.defectdojo]
+# Enable DefectDojo plugin
+enabled = false
+
+# DefectDojo API URL
+# api_url = "https://defectdojo.company.com"
+
+# DefectDojo API key (use environment variable)
+# api_key = "${DEFECTDOJO_API_KEY}"
+
+# Request timeout in seconds
+# timeout_secs = 30
+
+# Event handlers
+# [[plugins.defectdojo.on_entity_created]]
+# kind = "Service"
+# action = "create_product"
+# auto_create_engagement = true
+#
+# [[plugins.defectdojo.on_entity_updated]]
+# kind = "Service"
+# action = "update_product"
+# sync_metadata = true
+
+# Dependency-Track Integration Plugin
+[plugins.dependencytrack]
+# Enable Dependency-Track plugin
+enabled = false
+
+# Dependency-Track API URL
+# base_url = "https://dependencytrack.company.com"
+
+# Dependency-Track API key (use environment variable)
+# api_key = "${DEPENDENCYTRACK_API_KEY}"
+
+# Request timeout in seconds
+# timeout_secs = 30
+
+# Auto-create projects for new Component entities
+# auto_create_project = true
+
+# Default team UUID to assign to new projects (optional)
+# default_team_uuid = ""
+
+# Keycloak Identity Provider Sync Plugin
+[plugins.keycloak]
+# Enable Keycloak plugin
+enabled = false
+
+# Keycloak server URL
+# base_url = "https://keycloak.company.com"
+
+# Keycloak realm to sync users and groups from
+# realm = "master"
+
+# Service account client credentials (use environment variables)
+# client_id = "charybdis-sync"
+# client_secret = "${KEYCLOAK_CLIENT_SECRET}"
+
+# Sync options
+# [plugins.keycloak.sync]
+# Cron schedule (e.g., every 5 minutes)
+# schedule = "0 */5 * * * *"
+
+# Run sync on Charybdis startup
+# on_startup = true
+
+# Allow manual trigger via API
+# manual_trigger = true
+
+# Sync users from Keycloak
+# sync_users = true
+
+# Sync groups from Keycloak
+# sync_groups = true
+
+# Namespace to assign to synced entities
+# namespace = "keycloak"
+
+# Max results per API page
+# page_size = 100
+
+# Custom Plugin Example
+# [plugins.custom_plugin]
+# enabled = false
+# setting1 = "value1"
+# setting2 = "${CUSTOM_PLUGIN_API_KEY}"