sigma/conf/config.yaml

# this file used as default config in the container.

log:
  level: debug
  proxyLevel: info

database:
  # The database type to use. Supported types are: sqlite3, turso, mysql, postgresql
  type: sqlite3
  # Connection pool settings for mysql and postgresql. sqlite3 and turso use built-in sqlite-like limits.
  maxOpenConns: 50
  maxIdleConns: 10
  connMaxLifetime: 1h
  connMaxIdleTime: 10m
  sqlite3:
    path: /var/lib/sigma/sigma.db
  turso:
    dsn: /var/lib/sigma/sigma-turso.db
  mysql:
    host: localhost
    port: 3306
    username: sigma
    password: sigma
    database: sigma
  postgresql:
    host: localhost
    port: 5432
    username: sigma
    password: sigma
    database: sigma
    sslMode: disable

redis:
  # Redis is enabled when any of url / addrs / masterName is non-empty.
  # Leave all empty to disable redis (inmemory cache/locker/workqueue must be used instead).
  # The default standalone config uses inmemory cache/locker/workqueue, so redis stays disabled here.
  # Enable it by setting url (or addrs/masterName) and switching cache/locker/workqueue to redis.
  url:
  addrs: []
  username: ""
  password: ""
  db: 0
  masterName: ""
  poolSize: 0
  minIdleConns: 0
  maxRetries: 0

cache:
  # the cache type available is: redis, inmemory
  # please attention in multi-node mode, you should use redis
  type: inmemory
  # cache key prefix
  prefix: sigma-cache
  # default positive cache TTL
  ttl: 72h
  # TTL for cached not-found results
  negativeTtl: 5m
  inmemory:
    size: 10240
  redis:
    # kept for compatibility; ttl is used when this value is empty
    ttl: 72h
  prewarm:
    # prewarm namespace/repository metadata cache during server and distribution startup
    enabled: true
    # maximum namespaces and repositories to prewarm per process
    limit: 1000
    timeout: 10s

workqueue:
  # the workqueue type available: redis, database, inmemory
  type: inmemory
  redis:
    concurrency: 10
    # reject new messages when redis queue backlog reaches this value; 0 means unlimited
    maxBacklog: 0
  database: {}
  inmemory:
    concurrency: 1024
    maxBacklog: 1000

locker:
  # the locker type available: redis, inmemory
  type: inmemory
  prefix: sigma-locker
  inmemory: {}
  redis: {}

namespace:
  # push image to registry, if namespace not exist, it will be created automatically
  autoCreate: false
  # the automatic created namespace visibility, available: public, private
  visibility: public
  # namespaces created at startup; each entry is created when missing,
  # and each entry may set its own visibility (public or private)
  initialize:
    - name: library
      visibility: public

http:
  # endpoint can be a domain or domain with port, eg: http://sigma.test.io, https://sigma.test.io:30080, http://127.0.0.1:3000
  # this endpoint will be used to generate the token service url in auth middleware,
  # you can leave it blank and it will use http://127.0.0.1:3000 as internal domain by default,
  # because the front page need show this endpoint.
  endpoint:
  # in some cases, daemon may pull image and scan it, but we don't want to pull image from public registry domain,
  # so use this internal domain to pull image from registry.
  # you can leave it blank and it will use http://127.0.0.1:3000 as internal domain by default.
  # in k8s cluster, it will be set to the distribution service which is used to pull image from registry, eg: http://registry.default.svc.cluster.local:3000
  # in docker-compose, it will be set to the registry service which is used to pull image from registry, eg: http://registry:3000
  # if http.tls.enabled is true, internalEndpoint should start with https://
  # eg: http://sigma.test.io, http://sigma.test.io:3000, https://sigma.test.io:30080
  internalEndpoint:
  # eg: http://sigma-distribution:3000
  internalDistributionEndpoint:
  timeout:
    readHeader: 30s
    # read and write cover full push/pull transfers; increase them for very large images or slow links
    read: 1h
    write: 1h
    idle: 2m
  bodyLimit:
    # request body size limits in bytes; 0 disables the limit for that route class
    enabled: true
    # default applies to regular API requests
    default: 10485760
    # manifest applies to PUT /v2/<name>/manifests/<reference>
    manifest: 104857600
    # blob applies to /v2/<name>/blobs/uploads requests; increase for large image pushes
    blob: 10737418240
  tls:
    enabled: false
    certificate: ./conf/sigma.test.io.crt
    key: ./conf/sigma.test.io.key

storage:
  rootdirectory: ./storage
  redirect: false
  type: filesystem
  filesystem:
    path: /var/lib/sigma/
  s3:
    ak: sigma
    sk: sigma-sigma
    endpoint: http://127.0.0.1:9000
    region: cn-north-1
    bucket: sigma
    forcePathStyle: true
  cos:
    ak: sigma
    sk: sigma-sigma
    endpoint: https://hack-1251887554.cos.na-toronto.myqcloud.com
  oss:
    ak: sigma
    sk: sigma-sigma
    endpoint: http://127.0.0.1:9000
    forcePathStyle: true

# Notice: the tag never update after the first pulled from remote registry, unless you delete the image and pull again.
proxy:
  enabled: false
  endpoint: https://registry-1.docker.io
  tlsVerify: true
  username: ""
  password: ""

# daemon task config
daemon:
  gc:
    batchSize: 100
    workerCount: 2
    recordBatchSize: 100
    lockExpire: 30s
    lockWaitTimeout: 5s
  builder:
    enabled: false
    image: sigma-builder:latest
    type: docker
    tlsVerify: true
    docker:
      sock:
      network: sigma
    kubernetes:
      kubeconfig:
      namespace: sigma-builder
    podman:
      uri: unix:///run/podman/podman.sock
  vulnerability:
    # retry Doing tasks after this crash-recovery grace period
    staleTimeout: 6h
    grype:
      dbCacheDir: ""

auth:
  anonymous:
    # anonymous will disabled if auth.anonymous.enabled set false
    enabled: true
  admin:
    username: sigma
    password: Admin@123
    email: sigma@sigma.io
  token:
    realm: ""
    service: ""
  jwt:
    ttl: 6h
    refreshTTL: 72h
    # generate the key with: openssl genpkey -algorithm ED25519 | base64
    privateKey: "LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1DNENBUUF3QlFZREsyVndCQ0lFSUFZY0NvYldvT2V2dnNjOWRlcStab1JFS2lyWW52MW1MRUFpZzlySDNmOHMKLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLQo="
  oauth2:
    github:
      # github login will disable if auth.oauth.github.enabled set false
      enabled: false
      clientId: "e5f9fa9e372dfac66aed"
      clientSecret: "49ab83f4d0665f8579516f7a3f2f753a6a57189b"
  # limit the number of failed login attempts before rejecting further requests
  loginRateLimit:
    enabled: false
    maxFailures: 5
    lockDuration: 60s
    # inmemory | redis
    backend: inmemory
  # master key used to encrypt source code credentials at rest.
  # when empty, sigma generates one on first start and stores it in the settings table.
  # generate the key with: openssl rand -base64 32
  credentialKey: ""

scm:
  # source code management providers available for code repository sync and image builds.
  # this section is independent of auth.oauth2, which only decides whether a provider can be
  # used to sign in. when empty, the providers are derived from the enabled oauth2 providers.
  providers: []
  # providers:
  #   - provider: github
  #     baseUrl: https://github.com
  #   - provider: gitlab
  #     baseUrl: https://gitlab.com
  #   - provider: gitea
  #     baseUrl: https://gitea.example.com

audit:
  # record completed authenticated business HTTP requests
  enabled: true
  # record list-style GET requests, such as namespace, tag, and catalog lists
  recordListGet: false
  cleanup:
    # soft delete audit records older than this many months
    softDeleteAfterMonths: 3
    # hard delete audit records older than this many months
    hardDeleteAfterMonths: 6
    # run audit cleanup once per week by default
    interval: 168h
    # maximum audit records changed per cleanup iteration
    batchSize: 1000

analytics:
  enabled: true
  backend: database
  counterBackend: inmemory
  retentionDays: 400
  flushInterval: 1m
  reconcileCron: "0 10 0 * * *"

trace:
  # enable OpenTelemetry tracing; disabled by default
  enabled: false
  # OTLP collector endpoint (e.g. "localhost:4317" for gRPC, "localhost:4318" for HTTP)
  endpoint: ""
  # otlp transport: "grpc" or "http"
  protocol: grpc
  # disable TLS when the collector is reached over plaintext
  insecure: true
  # sample ratio in [0, 1]; root spans are sampled at this ratio
  sampleRatio: 1.0
  # service name reported to the tracer
  serviceName: sigma