agent/config.example.yml at main · flatrun/agent · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
deployments_path: /home/nfebe/flatrun/deployments
system_files_root: /
docker_socket: unix:///var/run/docker.sock
default_timeout: 2m0s
api:
    host: 0.0.0.0
    port: 8090
    enable_cors: true
    allowed_origins:
        - http://localhost:5173
        - http://localhost:3000
        - http://127.0.0.1:5173
auth:
    enabled: true
    api_keys:
        - your-api-key-here
    jwt_secret: generate-a-secure-random-string-here
domain:
    default_domain: ""
    auto_subdomain: false
    auto_ssl: false
    subdomain_style: words
nginx:
    enabled: true
    image: nginx:alpine
    container_name: nginx
    config_path: ""
    reload_command: nginx -s reload
    external: false
    container_webroot_path: ""
    reject_unknown_domains: false
certbot:
    enabled: true
    image: certbot/certbot
    email: engineering@whilesmart.com
    staging: true
    certs_path: ""
    webroot_path: ""
    container_webroot_path: ""
    dns_provider: ""
    auto_renewal_enabled: true
    renewal_threshold_days: 30
    renewal_check_interval: 12h0m0s
logging:
    level: info
    format: json
health:
    check_interval: 30s
    metrics_retention: 24h0m0s
infrastructure:
    default_proxy_network: proxy
    default_database_network: database
    database:
        enabled: true
        type: mysql
        container: ""
        host: ""
        port: 3306
        root_user: root
        root_password: ""
    redis:
        enabled: false
        container: ""
        host: ""
        port: 6379
        password: ""
    powerdns:
        enabled: false
        container: powerdns
        image: powerdns/pdns-auth-48:latest
        api_port: 8081
        dns_port: 53
        api_key: your-powerdns-api-key-here
        data_path: ""
        default_soa: ""
        nameservers: ""
security:
    enabled: true
    realtime_capture: false
    scan_interval: 30s
    retention_days: 30
    rate_threshold: 100
    auto_block_enabled: true
    auto_block_threshold: 50
    auto_block_duration: 24h0m0s
    detection_window: 2m0s
    not_found_threshold: 10
    auth_failure_threshold: 5
    unique_paths_threshold: 20
    repeated_hits_threshold: 30
    internal_api_token: generate-a-secure-random-string-here
    trusted_proxies: []
    trust_cf_header: false
audit:
    enabled: false
    retention_days: 30
    capture_request_body: false
    excluded_paths:
        - /api/health
    sensitive_fields:
        - password
        - token
        - secret
        - api_key
        - authorization
    cleanup_interval: 24h0m0s
cluster:
    enabled: false
    server_name: nfebe-zenbk-duo
    advertise_url: ""
    health_interval: 30s
    request_timeout: 10s
system_terminal:
    protected_mode:
        enabled: false
cleanup:
    timeout: 2m0s
files:
    show_hidden: true
plans:
    ttl: 24h0m0s
    retention_days: 30
ai:
    enabled: true
    base_url: https://generativelanguage.googleapis.com/v1beta/openai/
    api_key: your-gemini-api-key-here
    model: gemini-2.5-flash
    timeout: 1m0s
    # Ceiling on log incidents the assistant may be asked to explain in a day.
    # Unattended work is the only kind that can run up a bill unwatched.
    triage_daily_cap: 25
mcp:
    # Exposes the assistant's tool set to external MCP clients at /api/mcp. Every
    # call is authenticated and permission-gated exactly as the assistant is.
    # Off unless enabled.
    enabled: false
backup:
    # Remote destinations that backups are mirrored to after the local copy is
    # written. The local copy under <deployments_path>/.flatrun/backups always
    # remains the primary. Secrets live in the credential manager, never here:
    # credential_id references an s3 credential managed via the API.
    destinations: []
    #   - name: s3-prod
    #     type: s3
    #     kind: external   # external (connect only) or managed (FlatRun runs it)
    #     endpoint: https://s3.us-east-1.amazonaws.com
    #     region: us-east-1
    #     bucket: flatrun-backups
    #     prefix: agent-01
    #     credential_id: <s3-credential-id>
    #     use_path_style: false
    #     enabled: true
templates:
    # Background resync period in seconds; 0 disables the resync loop.
    sync_interval: 3600
    github:
        enabled: true
        repo: flatrun/templates
        ref: main
    marketplace:
        # Enable once the marketplace API is ready; it then takes priority over GitHub.
        enabled: false
        url: ""