sigma/conf/config-compose.yaml

# this file used as default config in the container.

log:
  level: debug
  proxyLevel: info

database:
  # The database type to use. Supported types are: sqlite3, turso, mysql, postgresql
  type: postgresql
  sqlite3:
    path: /var/lib/sigma/sigma.db
  turso:
    dsn: /var/lib/sigma/sigma-turso.db
  mysql:
    host: localhost
    port: 3306
    username: sigma
    password: sigma
    database: sigma
  postgresql:
    host: postgresql
    port: 5432
    username: sigma
    password: sigma
    database: sigma
    sslMode: disable

redis:
  # redis type available: none, external
  # none: means never use redis
  # external: means use the specific redis instance
  type: external
  url: redis://:sigma@redis:6379/0

cache:
  # the cache type available is: redis, inmemory, database
  type: redis
  # please attention in multi
  ttl: 72h
  inmemory:
    size: 10240
  redis:
    ttl: 72h
  database:
    size: 10240
    threshold: 0.2

workqueue:
  # the workqueue type available: redis, kafka, database
  type: redis
  redis:
    concurrency: 10
    # reject new messages when redis queue backlog reaches this value; 0 means unlimited
    maxBacklog: 0
  kafka: {}
  database: {}

locker:
  # the locker type available: redis, inmemory
  type: redis
  redis: {}

namespace:
  # push image to registry, if namespace not exist, it will be created automatically
  autoCreate: false
  # the automatic created namespace visibility, available: public, private
  visibility: public
  # namespaces created at startup; each entry is created when missing,
  # and each entry may set its own visibility (public or private)
  initialize:
    - name: library
      visibility: public

http:
  # endpoint can be a domain or domain with port, eg: http://sigma.test.io, https://sigma.test.io:30080, http://127.0.0.1:3000
  # this endpoint will be used to generate the token service url in auth middleware,
  # you can leave it blank and it will use http://127.0.0.1:3000 as internal domain by default,
  # because the front page need show this endpoint.
  endpoint: https://sigma.test.io
  # in some cases, daemon may pull image and scan it, but we don't want to pull image from public registry domain,
  # so use this internal domain to pull image from registry.
  # you can leave it blank and it will use http://127.0.0.1:3000 as internal domain by default.
  # in k8s cluster, it will be set to the distribution service which is used to pull image from registry, eg: http://registry.default.svc.cluster.local:3000
  # in docker-compose, it will be set to the registry service which is used to pull image from registry, eg: http://registry:3000
  # if http.tls.enabled is true, internalEndpoint should start with https://
  # eg: http://sigma.test.io, http://sigma.test.io:3000, https://sigma.test.io:30080
  internalEndpoint: https://sigma.test.io
  # eg: http://sigma-distribution:3000
  internalDistributionEndpoint:
  timeout:
    readHeader: 30s
    # read and write cover full push/pull transfers; increase them for very large images or slow links
    read: 1h
    write: 1h
    idle: 2m
  bodyLimit:
    # request body size limits in bytes; 0 disables the limit for that route class
    enabled: true
    # default applies to regular API requests
    default: 10485760
    # manifest applies to PUT /v2/<name>/manifests/<reference>
    manifest: 104857600
    # blob applies to /v2/<name>/blobs/uploads requests; increase for large image pushes
    blob: 10737418240
  tls:
    enabled: false
    certificate: /etc/sigma/sigma.test.io.crt
    key: /etc/sigma/sigma.test.io.key

storage:
  rootDirectory: ./storage
  type: s3
  filesystem:
    path: /var/lib/sigma/oci/
  s3:
    ak: sigma
    sk: sigma-sigma
    endpoint: http://rs3:9000
    region: cn-north-1
    bucket: sigma
    forcePathStyle: true
  cos:
    ak: xxxx
    sk: xxxx
    endpoint: https://xxxxxxx

# Notice: the tag never update after the first pulled from remote registry, unless you delete the image and pull again.
proxy:
  enabled: false
  endpoint: https://registry-1.docker.io
  tlsVerify: true
  username: ""
  password: ""

# daemon task config
daemon:
  gc:
    # if blob not associate with artifact
    retention: 72h
    # At 02:00 on Saturday
    cron: 0 2 * * 6
  builder:
    image: sigma-builder:latest
    type: docker
    tlsVerify: true
    docker:
      sock:
      network: sigma
    kubernetes:
      kubeconfig:
      namespace:
  vulnerability:
    staleTimeout: 6h
    grype:
      dbCacheDir: ""

auth:
  admin:
    username: sigma
    password: Admin@123
    email: sigma@sigma.io
  token:
    realm: ""
    service: ""
  jwt:
    ttl: 1h
    refreshTTL: 24h
    # generate the key with: openssl genpkey -algorithm ED25519 | base64
    privateKey: "LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1DNENBUUF3QlFZREsyVndCQ0lFSUFZY0NvYldvT2V2dnNjOWRlcStab1JFS2lyWW52MW1MRUFpZzlySDNmOHMKLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLQo="
  oauth2:
    github:
      clientId: "e5f9fa9e372dfac66aed"
      clientSecret: "49ab83f4d0665f8579516f7a3f2f753a6a57189b"
  loginRateLimit:
    enabled: true
    maxFailures: 5
    window: 5m
    delay: 1s

audit:
  enabled: true
  cleanup:
    softDeleteAfterMonths: 3
    hardDeleteAfterMonths: 6
    interval: 168h
    batchSize: 1000
  recordListGet: false