1 line
3.6 KiB
JSON
1 line
3.6 KiB
JSON
{"repo": "canyonroad/agentsh-render", "files": {"config.yaml": {"f9a2b4e264075c3732a1c1a41fb50616f0075569": {"t": 1785674470.0086136, "n": 3249, "h": "6842e24681f008a5", "c": "# agentsh Server Configuration for Render\n# Landlock (kernel path restrictions) + seccomp file_monitor (policy enforcement)\n# Optimized via agentsh detect config on Render (kernel 6.8.0-1046-aws)\n\nserver:\n http:\n addr: \"127.0.0.1:18080\"\n read_timeout: \"30s\"\n write_timeout: \"120s\"\n max_request_size: \"10MB\"\n grpc:\n enabled: true\n addr: \"127.0.0.1:9090\"\n\nauth:\n type: \"none\"\n\nlogging:\n level: \"info\"\n format: \"text\"\n output: \"stderr\"\n\nsessions:\n base_dir: \"/var/lib/agentsh/sessions\"\n max_sessions: 50\n default_timeout: \"1h\"\n default_idle_timeout: \"15m\"\n cleanup_interval: \"5m\"\n\naudit:\n enabled: true\n storage:\n sqlite_path: \"/var/lib/agentsh/events.db\"\n\nsandbox:\n enabled: true\n allow_degraded: true\n\n limits:\n max_memory_mb: 2048\n max_cpu_percent: 100\n max_processes: 100\n\n fuse:\n enabled: false\n\n network:\n enabled: true\n intercept_mode: \"all\"\n proxy_listen_addr: \"127.0.0.1:0\"\n\n cgroups:\n enabled: false\n\n unix_sockets:\n enabled: false\n\n seccomp:\n enabled: true\n mode: \"enforce\"\n execve:\n enabled: false\n file_monitor:\n enabled: true\n enforce_without_fuse: true\n\n # Landlock kernel enforcement (ABI v5 on Render)\n # allow_execute lets the shell shim at /bin/bash run\n landlock:\n enabled: true\n allow_execute:\n - /usr/bin\n - /bin\n - /usr/local/bin\n - /usr/sbin\n - /sbin\n - /usr/lib\n - /lib\n network:\n allow_connect_tcp: true\n allow_bind_tcp: false\n\n # BASH_ENV disables dangerous builtins (kill, enable, ulimit, etc.)\n env_inject:\n AGENTSH_SERVER: \"http://127.0.0.1:18080\"\n BASH_ENV: \"/usr/lib/agentsh/bash_startup.sh\"\n\n # ptrace not available on Render (no SYS_PTRACE) but fail_open\n # enables graceful degradation to seccomp file_monitor for policy enforcement\n ptrace:\n enabled: true\n attach_mode: \"children\"\n on_attach_failure: \"fail_open\"\n mask_tracer_pid: \"off\"\n trace:\n execve: true\n file: true\n network: true\n signal: true\n performance:\n seccomp_prefilter: true\n max_tracees: 100\n max_hold_ms: 5000\n\npolicies:\n dir: \"/etc/agentsh/policies\"\n default_policy: \"default\"\n\napprovals:\n enabled: false\n\ndlp:\n mode: \"redact\"\n patterns:\n email: true\n phone: true\n credit_card: true\n ssn: true\n api_keys: true\n custom_patterns:\n - name: openai_key\n display: \"[OPENAI_KEY]\"\n regex: \"sk-[a-zA-Z0-9]{48,}\"\n - name: anthropic_key\n display: \"[ANTHROPIC_KEY]\"\n regex: \"sk-ant-[a-zA-Z0-9-]{95,}\"\n - name: aws_access_key\n display: \"[AWS_KEY]\"\n regex: \"AKIA[0-9A-Z]{16}\"\n - name: github_pat\n display: \"[GITHUB_TOKEN]\"\n regex: \"ghp_[a-zA-Z0-9]{36}\"\n - name: github_oauth\n display: \"[GITHUB_OAUTH]\"\n regex: \"gho_[a-zA-Z0-9]{36}\"\n - name: jwt_token\n display: \"[JWT]\"\n regex: \"eyJ[a-zA-Z0-9_-]*\\\\.eyJ[a-zA-Z0-9_-]*\\\\.[a-zA-Z0-9_-]*\"\n - name: private_key\n display: \"[PRIVATE_KEY]\"\n regex: \"-----BEGIN [A-Z]+ PRIVATE KEY-----\"\n - name: slack_token\n display: \"[SLACK_TOKEN]\"\n regex: \"xox[baprs]-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24}\"\n\nhealth:\n path: \"/health\"\n\ndevelopment:\n disable_auth: true\n verbose_errors: true\n"}}}} |