config.example.yaml

# gitdr config. Secrets are NOT set here, supply them via env:
#   GITDR_GITHUB_APP_PRIVATE_KEY    PEM contents (or source.github.privateKeyPath)
#   GITDR_MANIFEST_SIGNING_KEY      PEM contents (or manifest.signingKeyPath)
#   AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY   S3-compatible static keys (opt-in)
# Prefer the env vars to the *Path options: git runs as gitdr's user and can read any file that
# user can, and a secret in gitdr's environment never reaches git (SPEC §6).
# Any field can be overridden via GITDR_<PATH>, e.g. GITDR_DESTINATION_S3_BUCKET=foo.

source:
  type: github                 # github | gitlab
  baseURL: ""                  # github: GHES /api/v3; gitlab: self-managed https://gitlab.example.com
  repo: "octo-org/octo-repo"   # single repo selector; empty = all accessible (filtered)
  include: []
  exclude: []
  github:                      # the App (appID, installationID and its key) or tokenPath, never both
    appID: 0
    installationID: 0
    privateKeyPath: ""         # or set GITDR_GITHUB_APP_PRIVATE_KEY
    tokenPath: ""              # or a file holding an installation token, re-read on every use (SPEC §3)
    maxRateLimitWait: 1h       # most one run waits for GitHub rate limits, all told (SPEC §6)
  gitlab: {}                   # token is a secret: set GITDR_GITLAB_TOKEN (read_api, read_repository)

destination:
  type: s3                     # s3 (AWS + S3-compatible) | gcs | azure
  s3:
    bucket: "my-worm-bucket"
    region: "us-east-1"
    endpoint: ""               # empty = AWS; MinIO: http://localhost:9000
    usePathStyle: false        # true for MinIO and most S3-compatible stores
    multipartThreshold: 0      # bytes; 0 = 4 GiB. Larger objects are written in parts
    partSize: 0                # bytes; 0 = 64 MiB, the smallest part
  gcs:
    bucket: ""                 # GCS bucket with a LOCKED retention policy (Bucket Lock)
    endpoint: ""               # empty = real GCS; set for an emulator
  azure:
    account: ""                # storage account name, 3 to 24 lowercase letters and digits (real Azure; uses DefaultAzureCredential)
    container: ""              # blob container with a LOCKED time-based retention policy
    endpoint: ""               # optional service URL override
    # connection string is a secret: set GITDR_DESTINATION_AZURE_CONNECTIONSTRING (e.g. Azurite)
    # Where the account lives in Azure Resource Manager, the only API that says whether the
    # policy is locked. Without both, gitdr reports the container as unknown. Needs an Entra ID
    # identity with Microsoft.Storage/storageAccounts/blobServices/containers/read (in Storage
    # Blob Data Reader and Contributor); an account key or SAS cannot read it.
    subscriptionID: ""
    resourceGroup: ""
  retention:
    mode: COMPLIANCE           # COMPLIANCE (true WORM) or GOVERNANCE, S3 only; GCS uses bucket retention
    days: 30                   # S3 locks each object this long; an unchanged copy is relied on for a third of this or of the bucket's own lock, whichever is shorter

backup:
  concurrency: 4               # repositories backed up in parallel, and artifacts `gitdr verify` reads at once
  resume: true                 # skip repos a manifest records as copied on the run date
  lfs: true                    # fetch Git LFS objects (stored as a separate .lfs.tar artifact)
  recopy: []                   # repos every run copies even when unchanged, named as the manifest names them; for one run pass --recopy (SPEC §11)

manifest:
  signingKeyPath: ""           # ed25519 private key, PEM (or GITDR_MANIFEST_SIGNING_KEY)
  publicKeyPath: ""            # ed25519 public key, PEM (for `gitdr verify`)

metrics:
  textfilePath: ""             # Prometheus .prom file for node_exporter's textfile collector; empty = off

encryption:
  enabled: false               # optional client-side envelope encryption of artifacts before upload
  # key is a secret: set GITDR_ENCRYPTION_KEY (32-byte AES-256 key as 64-char hex, base64, or raw)

worm:
  require: false               # false = warn on non-WORM and proceed; true = fail closed (--require-worm)

log:
  level: info                  # debug|info|warn|error
  format: json                 # json|text