sre-config

Files (1)

• SKILL.md

SKILL.md (first lines)

# sentinel.yaml + .sentinel/config.json

## Two-File Split

| File | Location | In Git | Purpose |
|------|----------|--------|---------|
| `sentinel.yaml` | SRE root | Yes | Behavior config — shared with team |
| `.sentinel/config.json` | SRE root (gitignored) | No | Infrastructure — per-machine |

**Rule**: Never put `api.port`, logging, or security in `sentinel.yaml`.

Backups are a harness-managed subsystem. Backup plans and run history live in the state database and are operated through the Backups dashboard/API/CLI surface, not through new project-level keys in `sentinel.yaml`.

---

## sentinel.yaml (in git, shared)

```yaml
name: "My SRE Project"
description: "What this SRE does"
version: "0.1.0"              # project semver (written by sentinel sre init)
sre_init_version: "1.0.0"     # sre-init template set when kits/bundles installed (optional on minimal init)

editor_exts:
  - ".lua"
  - ".yaml"
  - ".md"

git:
  sync: true              # enable git sync
  push: false             # auto-push on sync
  interval: "5m"          # sync interval (duration string)
  on_conflict: "ours"     # "ours"|"theirs"|"abort"
  include_backups: false  # include .sentinel/ backups in git

hotreload:
  yaml: "full"            # "full"|"safe" — reload strategy on YAML change

flows:
  defaults:
    timeout: 30           # default flow execution timeout (seconds)

triggers:
  cron: {}
  event: {}
```

---

## .sentinel/config.json (gitignored, per-machine)

```json
{
  "data_dir": ".sentinel",
  "log": {
    "level": "info",
    "format": "text"
  },
  "api": {
    "port": 8080,
    "debug_mode": true,
    "tokens": [],
    "ip_whitelist": []
  },
  "tls": {
    "enabled": false,
    "port": 8443,
    "cert_dir": "",
    "hosts": ["localhost"],
    "ips": ["127.0.0.1"]
  },
  "state": {
    "busy_timeout": 5000,
    "encrypt_db": false
  },
  "lua": {
    "pool_size": 10,
    "registry_size": 256,
    "execution_timeout": 30
  },
  "logging": {
    "connectors": {
      "enabled": true,
      "level": "smart",
      "slow_threshold_ms": 1000
    },
    "triggers": {
      "enabled": true
    },
    "rotation": {
      "max_db_size_mb": 100,
      "max_log_age_days": 30,
      "archive_path": ".sentinel/archive/"
    }
  }
}
```

---

## Environment Variables (highest priority)

| Variable | Config key | Notes |
|----------|-----------|-------|
| `SENTINEL_DATA_DIR` | `data_dir` | Override data directory |
| `SENTINEL_PORT` | `api.port` | Override API port |
| `SENTINEL_DEBUG` | `api.debug_mode` | Set debug mode |
| `SENTINEL_VAULT_PASSPHRASE` | `vault_passphrase` | **Never** in config.json |
| `SENTINEL_STATE_PASSPHRASE` | `state.state_passphrase` | Falls back to vault passphrase |
| `SENTINEL_LOG_LEVEL` | `log.level` | debug/info/warn/error |
| `SENTINEL_LOG_FORMAT` | `log.format` | json/text |

**Load order**: hardcoded defaults → config.json → env vars (env wins)

---

## Config Field Reference

From ndx-au/sre-init, MIT.

More from ndx-au/sre-init