config

Documentation

Index

• func IsNonLocalhost(addr string) bool
• func IsPrivateOrLocalURL(rawURL string) bool
• type AuthConfig
• type CacheConfig
• type Config
  • func LoadConfig(path string) (*Config, error)
  • func (c *Config) ListenAddr() string
• type CorrelationConfig
• type DeepTriageConfig
• type EvaluationMode
  • func (m EvaluationMode) IsValid() bool
• type RulesConfig
• type ServerConfig
• type SessionConfig
• type StoreConfig
• type TelemetryConfig
• type TestContextConfig
• type TriageAgentConfig
• type TriageConfig

Functions

func IsNonLocalhost

func IsNonLocalhost(addr string) bool

IsNonLocalhost reports whether addr is NOT a localhost address. It returns true for addresses like "0.0.0.0", "192.168.1.1", or any address that is not "127.0.0.1", "localhost", or "::1".

func IsPrivateOrLocalURL

func IsPrivateOrLocalURL(rawURL string) bool

IsPrivateOrLocalURL checks whether a URL targets a private/local network. It parses the URL properly and resolves the hostname to check against RFC 1918, loopback, link-local, and other non-routable ranges. Uses net/netip for stricter IP parsing that rejects ambiguous forms (octal notation, IPv4-mapped IPv6 bypass vectors).

Types

type AuthConfig

type AuthConfig struct {
	Token string `yaml:"token" json:"-"`
}

AuthConfig holds authentication configuration

type CacheConfig

type CacheConfig struct {
	Enabled bool `yaml:"enabled" json:"enabled"`   // default true
	MaxSize int  `yaml:"max_size" json:"max_size"` // default 10000
	TTLSec  int  `yaml:"ttl_sec" json:"ttl_sec"`   // default 300 (5 minutes)
}

CacheConfig controls the verdict caching layer.

type Config

type Config struct {
	Server         ServerConfig      `yaml:"server" json:"server"`
	Auth           AuthConfig        `yaml:"auth" json:"auth"`
	Rules          RulesConfig       `yaml:"rules" json:"rules"`
	Store          StoreConfig       `yaml:"store" json:"store"`
	Cache          CacheConfig       `yaml:"cache" json:"cache"`
	Triage         TriageConfig      `yaml:"triage" json:"triage"`
	DeepTriage     DeepTriageConfig  `yaml:"deep_triage" json:"deep_triage"`
	TestContext    TestContextConfig `yaml:"test_context" json:"test_context"`
	Telemetry      TelemetryConfig   `yaml:"telemetry" json:"telemetry"`
	Session        SessionConfig     `yaml:"session" json:"session"`
	EvaluationMode EvaluationMode    `yaml:"evaluation_mode" json:"evaluation_mode"`
	LogLevel       string            `yaml:"log_level" json:"log_level"`
}

func LoadConfig

func LoadConfig(path string) (*Config, error)

LoadConfig loads configuration from file with environment variable overrides

func (*Config) ListenAddr

func (c *Config) ListenAddr() string

ListenAddr returns the full listen address

type CorrelationConfig

type CorrelationConfig struct {
	Enabled              bool    `yaml:"enabled"`
	WindowSec            int     `yaml:"window_sec"`
	MaxAlerts            int     `yaml:"max_alerts"`
	RequireSameSession   bool    `yaml:"require_same_session"`
	RequireSameTool      bool    `yaml:"require_same_tool"`
	WeightCritical       float64 `yaml:"weight_critical"`
	WeightHigh           float64 `yaml:"weight_high"`
	WeightChainBonus     float64 `yaml:"weight_chain_bonus"`
	WeightRepeatBonus    float64 `yaml:"weight_repeat_bonus"`
	TimeDecayHalfLifeSec int     `yaml:"time_decay_half_life_sec"`
	EscalateThreshold    float64 `yaml:"escalate_threshold"`
}

CorrelationConfig controls deterministic, short-window alert correlation used by triage.

type DeepTriageConfig

type DeepTriageConfig struct {
	Enabled      bool              `yaml:"enabled"`
	GatewayURL   string            `yaml:"gateway_url"`            // default: http://127.0.0.1:18789
	GatewayToken string            `yaml:"gateway_token" json:"-"` // env: OPENCLAW_GATEWAY_TOKEN
	Agent        TriageAgentConfig `yaml:"agent"`                  // Agent personality, model, tools
	MinSeverity  string            `yaml:"min_severity"`           // Minimum severity to trigger deep triage (default: critical)
	Webhook      string            `yaml:"webhook"`                // Optional webhook URL for deep triage results
}

DeepTriageConfig holds deep triage configuration (async, OpenClaw sub-agent with tools)

type EvaluationMode

type EvaluationMode string

EvaluationMode defines how the engine evaluates events

const (
	ModeEnforce EvaluationMode = "enforce"
	ModeAudit   EvaluationMode = "audit"
	ModeShadow  EvaluationMode = "shadow"
)

func (EvaluationMode) IsValid

func (m EvaluationMode) IsValid() bool

IsValid checks if the evaluation mode is valid

type RulesConfig

type RulesConfig struct {
	Dir       string `yaml:"dir" json:"dir"`
	HotReload bool   `yaml:"hot_reload" json:"hot_reload"`
}

RulesConfig holds rules configuration

type ServerConfig

type ServerConfig struct {
	Addr string `yaml:"addr" json:"addr"`
	Port int    `yaml:"port" json:"port"`
}

ServerConfig holds server configuration

type SessionConfig

type SessionConfig struct {
	Enabled   bool `yaml:"enabled" json:"enabled"`
	WindowSec int  `yaml:"window_sec" json:"window_sec"`
	MaxEvents int  `yaml:"max_events" json:"max_events"`
}

SessionConfig configures per-session behavioural sequencing.

type StoreConfig

type StoreConfig struct {
	SQLitePath           string `yaml:"sqlite_path" json:"sqlite_path"`
	RetentionDays        int    `yaml:"retention_days" json:"retention_days"`                 // 0 = disabled
	CleanupIntervalHours int    `yaml:"cleanup_interval_hours" json:"cleanup_interval_hours"` // how often retention runs
}

StoreConfig holds store configuration

type TelemetryConfig

type TelemetryConfig struct {
	Enabled         bool    `yaml:"enabled"`
	Endpoint        string  `yaml:"endpoint"`
	ServiceName     string  `yaml:"service_name"`
	SampleRate      float64 `yaml:"sample_rate"`
	ExportAllEvents bool    `yaml:"export_all_events"`
	Insecure        bool    `yaml:"insecure"`
}

TelemetryConfig configures OpenTelemetry export.

type TestContextConfig

type TestContextConfig struct {
	Enabled bool   `yaml:"enabled" json:"enabled"`
	Token   string `yaml:"token" json:"-"`
}

Config holds the complete application configuration

type TriageAgentConfig

type TriageAgentConfig struct {
	SystemPrompt string   `yaml:"system_prompt"` // Custom agent personality (default: SOC analyst)
	Model        string   `yaml:"model"`         // Override model for triage agent
	AgentID      string   `yaml:"agent_id"`      // OpenClaw agent ID (optional)
	Thinking     string   `yaml:"thinking"`      // Thinking mode: "off", "low", "high"
	Tools        []string `yaml:"tools"`         // Tools the agent can use: web_search, web_fetch, memory_search, read
	TimeoutSec   int      `yaml:"timeout_sec"`   // Agent session timeout (default: 60)
}

TriageAgentConfig configures the OpenClaw triage agent's personality and capabilities. Users can customise this to create a specialised security analyst agent.

type TriageConfig

type TriageConfig struct {
	Enabled         bool              `yaml:"enabled"`
	Provider        string            `yaml:"provider"`         // "openai", "anthropic", or "openclaw"
	Model           string            `yaml:"model"`            // e.g. "gpt-4o-mini", "claude-sonnet-4-20250514"
	APIKey          string            `yaml:"api_key" json:"-"` // env: AGENTSHIELD_TRIAGE_API_KEY
	BaseURL         string            `yaml:"base_url"`         // custom base URL (e.g. https://openrouter.ai/api/v1)
	MaxTokens       int               `yaml:"max_tokens"`
	TimeoutSec      int               `yaml:"timeout_sec"`
	HealthCheckMode string            `yaml:"health_check_mode"` // "full" (default) or "connectivity"
	Correlation     CorrelationConfig `yaml:"correlation"`
}

TriageConfig holds triage configuration (fast triage — synchronous, in request path)