config.toml

# Local sample config for mega2.
# Load order is: --config, MEGA_CONFIG, ./config/config.toml,
# ${mega_base}/etc/config.toml, then generated default config.
# Optional profiles use config.<profile>.toml next to the selected base config
# and are merged before MEGA_* environment overrides.
# Run `mega2 config validate` after editing; warnings identify ignored
# compatibility fields without printing secret values.
#
# The directory where the data files is located, such as logs, database, etc.
# can be overridden by environment variable `MEGA_BASE_DIR`
# When using monobean, this option will be ignored, you should set it in monobean preference GUI.
base_dir = "/tmp/.mono"

# Fill deployment-specific values through MEGA_* environment variables,
# profile files, or your deployment secret mechanism rather than committing
# real credentials to this sample file.
## Logging Configuration
[log]
# log level, can be "trace", "debug", "info", "warn", "error"
level = "info"

# print std log in console, disable it on production for performance
print_std = true

# enable ANSI colors for stdout logs (has no effect on file logs)
with_ansi = true


[database]
# Only PostgreSQL is supported.
db_type = "postgres"

# Database connection URL. This sample intentionally avoids embedding a
# reusable password; inject credentials with MEGA_DATABASE__DB_URL or your
# deployment secret mechanism when PostgreSQL requires auth.
# Example for Docker without inline credentials: "postgres://mono-pg:5432/mono"
db_url = "postgres://localhost:5432/mono"

# Maximum number of database connections in the pool.
# A good rule of thumb is to set this to ~2 × CPU cores.
max_connection = 16

# Minimum number of database connections maintained in the pool.
# Typically set to ~1 × CPU cores to ensure baseline concurrency.
min_connection = 8

# Timeout (in seconds) for acquiring a connection from the pool.
# If exceeded, the request will fail.
acquire_timeout = 3

# Timeout (in seconds) for establishing a new database connection.
# If exceeded, the connection attempt will fail.
connect_timeout = 3

# Whether to enable SQLx logging
sqlx_logging = false

[monorepo]
## Monorepo product rules (authoritative: docs/monorepo.md):
## - Only one public branch: main. Client pushes of other heads become refs/cl/* (not new public branches).
## - Tags must not be created/updated/deleted via Git client; use Web UI /tags API.
## Only import_dir supports multi-branch and Git-client tags (ImportRepo).
## Mega treats files under this directory as import repo and other directories as monorepo
## Shape: a canonical absolute non-root path (no trailing '/', no '//', '.' or '..' segments,
## no '\' or NUL) whose first component is listed in root_dirs. Import first: a path under
## import_dir is always an ImportRepo (created by Git push), even if root_dirs has the same name.
## 形状:规范绝对非根路径(无尾 '/'、无 '//'、'.'、'..' 段,不含 '\' 或 NUL),首组件必须列在
## root_dirs 中;import 优先:该目录下的路径一律按 ImportRepo 处理(由 Git 推送创建),即使
## root_dirs 含同名项.
import_dir = "/third-party"

# Set System Admin(s) in directory init, these users will be added to the admin group
# Supports multiple admins: admin = ["user1", "user2", "user3"]
admin = ["mega2"]

# Set serveral root dirs in directory init
# Shape: each entry is a unique single path component: no '/', '\' or NUL; not '.', '..'
# or empty; no leading/trailing spaces; not a reserved root entry (.cedar, .mega_cedar.json,
# .buckroot, .buckconfig, .git). `config validate` and startup reject anything else. Only the
# first initialization (`service init`, or the first service start on an empty database)
# creates these directories; changing the list later needs a restart and does not add or
# remove top-level directories of an initialized repository.
# 形状:每项为唯一的单组件目录名:不含 '/'、'\' 或 NUL,不能是 '.'、'..' 或空串,无首尾空格,
# 且不能是根树保留项(.cedar、.mega_cedar.json、.buckroot、.buckconfig、.git),否则校验失败.
# 只有首次初始化(`service init` 或空库上的首次服务启动)会创建这些目录;事后修改需重启,且不会
# 增删已初始化库的顶层目录.
# .view and .filter are reserved view URL names; exact-case matches are rejected.
# .view 和 .filter 是视图 URL 保留名，按大小写精确匹配时同样拒绝。
root_dirs = ["third-party", "project", "doc", "artifact", "release", "model", "data", "toolchains"]

# Object-ID format for the initial Monorepo graph and live Git service.
# "sha1" (default) is the stock Git format. "sha256" and "blake3" are
# git-internal / Libra extensions — do not claim interoperability with
# stock Git clients for those values.
# Bootstrap with: mega2 --config config/config.toml service init --yes
object_format = "sha1"

# Push morphology: "trunk" (default, MonoWriteQueue) or "review" (CL pipeline).
# Restart-required. Trunk fail-closed startup: cedar.enforcement must be "off",
# no open CLs, empty non-terminal push_queue on policy change, and git.push_auth
# must be an explicit "token" or "none" (set in [git] below). For the review
# morphology see config/config-review.toml.
# push_policy = "trunk"
# Trunk-only first-parent chain bound. Review morphology keeps MAX_CL_CHAIN_COMMITS=250.
# max_push_commits = 250

[monorepo.rename]
# Similarity threshold (0-100) for move/rename detection in diff classification.
similarity_threshold = 50

# Skip exhaustive inexact rename matching when deleted_count * new_count exceeds rename_limit^2.
# Set to 0 to disable the limit.
rename_limit = 1000

[pack]
# The maximum memory used by decode
# Support the following units/notations: K, M, G, T, KB, MB, GB, TB, KiB, MiB, GiB, TiB, `%` and decimal percentages
# Capacity units are case-insensitive and can also be spelled as mb or Mb
# Abbreviated units are treated as binary byte units, for example M is treated as MiB
pack_decode_mem_size = "4G"
pack_decode_disk_size = "20%"

# The location where the object stored when the memory used by decode exceeds the limit
pack_decode_cache_path = "${base_dir}/cache"

clean_cache_after_decode = true

# The maximum message size in channel buffer while decode
channel_message_size = 1_000_000

# Max concurrent `save_entry` batches during receive-pack.
# Set to 0 to disable the limit (unbounded).
save_entry_concurrency = 1

[lfs]

[lfs.ssh]
# The lfs ssh transport protocol still relies on http to send files
http_url = "http://localhost:8000"

[lfs.local]
# set the local path of the lfs storage
lfs_file_path = "${base_dir}/lfs"


[object_storage]
# Global backend for Git blobs, LFS, and artifact protocol objects.
# Values: "s3", "s3compatible", "gcs", "local"
storage_type = "local"

[object_storage.s3]
# AWS region name.
# For AWS S3 this must match the bucket's region.
# For S3-compatible services (e.g. RustFS), this is usually ignored
# but still required by the AWS SDK.
region = "us-east-1"

# Name of the S3 bucket used to store objects.
# The bucket must already exist, or the application should create it on startup.
bucket = "mega"

# Access key ID for S3 authentication.
# For AWS: IAM user's access key.
# For S3-compatible services: service-specific access key.
access_key_id = ""

# Secret access key corresponding to the access_key_id.
# Keep this value secure and never commit it to version control. Current
# object storage bootstrap credentials are not resolved through mega2
# Vault SecretRef; inject them via env/profile/deployment secret instead.
# `config validate` rejects vault:// values in access_key_id/secret_access_key.
secret_access_key = ""


# Custom S3 endpoint URL.
# Use the default AWS endpoint when empty.
# For local or self-hosted S3-compatible services (e.g. RustFS),
# set this to the service endpoint.
endpoint_url = "http://localhost:9000"

# Optional host used only to sign presigned URLs (artifact and LFS transfers)
# on the s3compatible backend, for clients that cannot reach endpoint_url
# (e.g. a container-network address). It must be a bare http(s) origin with
# no credentials, query, fragment or path; empty = sign with endpoint_url.
# Real AWS S3 ignores it. Changing it requires a restart.
# public_endpoint_url = "http://127.0.0.1:29000"


[object_storage.gcs]
# Name of the GCS bucket
bucket = "gitmega"

[object_storage.local]
# Root directory where all objects will be stored
root_dir = "${base_dir}/objects"

[oauth]
# Website Better Auth integration (OAuthConfig). Key reference:
# docs/refactoring/website-auth.md
# Base URL for GET /api/auth/get-session (required for service http).
website_api_base_url = "http://127.0.0.1:3000"
# session_cookie_names defaults to Better Auth cookie names when omitted.
# `allowed_cors_origins` is the HTTP API CORS allow-list; when empty the server
# falls back to built-in development defaults. Overridable via
# MEGA_OAUTH__ALLOWED_CORS_ORIGINS as a comma-separated list.
allowed_cors_origins = [
    "http://local.gitmega.com",
    "https://app.gitmega.com",
    "http://app.gitmono.test",
    "http://localhost:3000",
    "http://127.0.0.1:3000",
]

[blame]
# Configuration for blame functionality and large file handling
# Maximum number of lines before considering a file as large
max_lines_threshold = 1000

# Maximum file size in bytes before considering a file as large
# Support the following units/notations: K, M, G, T, KB, MB, GB, TB, KiB, MiB, GiB, TiB
max_size_threshold = "1MB"

# Default chunk size for streaming operations when processing large files
default_chunk_size = 100

# Maximum number of commits to process in memory at once during blame traversal
max_commits_in_memory = 50

# Enable caching of intermediate blame results for better performance
enable_caching = true

[redis]
url = "redis://127.0.0.1:6379"

# Buck upload API configuration (optional)
# Uncomment the following section to customize upload settings
[buck]
# Session timeout in seconds (default: 3600 = 1 hour)
session_timeout = 3600
# Maximum file size (default: "100MB")
max_file_size = "100MB"
# Maximum number of files per session (default: 1000)
max_files = 1000
# Maximum concurrent uploads (default: 5) - returned to client as suggestion
max_concurrent_uploads = 5

# === Server-side rate limiting ===
# Global upload concurrency limit (default: 50)
# Controls total concurrent upload requests being processed
upload_concurrency_limit = 50
# Large file concurrency limit (default: 10)
# Controls concurrent large file uploads to prevent memory exhaustion
large_file_concurrency_limit = 10
# Large file threshold (default: "1MB")
# Files larger than this are subject to additional concurrency limits
large_file_threshold = "1MB"

# Enable session cleanup task (default: true)
# When the HTTP service starts with cleanup enabled, interval/retention changes
# and switching this to false are hot-reloaded. Enabling it from false still needs restart.
enable_session_cleanup = true
# Cleanup task interval in seconds (default: 300 = 5 minutes)
cleanup_interval = 300
# Retention days for completed sessions (default: 7)
# Completed sessions older than this will be deleted along with file records
completed_retention_days = 7

# Repo artifact blob GC (`artifact_objects` with no `artifact_set_files` references; see docs/artifacts-protocol.md §10.6).
[artifacts_gc]
# When the HTTP service starts with artifact GC enabled, interval/grace/batch changes
# and switching this to false are hot-reloaded. Enabling it from false still needs restart.
enable = false
interval_secs = 3600
grace_secs = 86400
batch_limit = 100

# Experimental history projections are default off. Enabling them requires
# monorepo.push_policy = "trunk" and monorepo.object_format = "sha1".
[views]
# Restart-required: workers and route mounting are decided at startup.
enabled = false
# Hot-reloadable: background projection worker interval in seconds.
worker_interval_secs = 10
# Hot-reloadable: root commits projected in one batch.
batch_size = 1000
# Hot-reloadable: root-chain commits processed by an advertise or B0 walk.
max_append_walk = 1000
# Hot-reloadable: commits an advertise may synchronously project.
sync_catch_up_commits = 64
# Hot-reloadable: maximum filters that occupy derived state.
max_filters = 100
# Hot-reloadable: maximum concurrent cold-starting filters.
max_concurrent_cold_starts = 2
# Hot-reloadable: new registrations per requester in a 3600 second window.
register_rate_per_token = 10
# Restart-required: anonymous registration changes the write authorization surface.
allow_anonymous_register = false

[notification]
# Global notification kill switch.
enabled = true

# Optional generic outbound webhook channel (docs/notification.md phase 3). The
# URL is operator-trusted (non-secret); an optional bearer token is a SecretRef
# sent as `Authorization: Bearer <token>`.
# [notification.webhook]
# enabled = true
# url = "https://hooks.example.com/notify"
# token_ref = "vault://secret/config/<profile>/notification/webhook/token#value"

[vault.audit]
# Secret-access auditing (docs/vault.md stage H). When enabled (the default),
# VaultCore emits one record per secret read/write/delete with the operation,
# logical secret name, outcome and caller only (never the secret value). Set to
# false to opt out.
enabled = true
# Audit sink: "tracing" (default; the `vault_audit` tracing target, infallible)
# or "file" (a durable append-only JSONL log, fsync'd per record, for
# non-repudiation independent of the process log pipeline).
sink = "tracing"
# Required when sink = "file": the durable audit log path.
# file_path = "/var/log/mega2/vault-audit.jsonl"
# When true (and sink is fallible, e.g. "file"), a failed audit-record write
# fails the secret operation (non-repudiation over availability). Default false
# (fail-open: a sink write failure is logged but does not block secret access).
fail_closed = false

# Traces archive (plan-20261015). Stays off until an operator sets enabled and
# a persistent server_id UUID. The process never generates server_id. scope is
# an optional operator label. Protocol budgets are not config fields.
[traces]
enabled = false

[cedar]
# Authorization enforcement switch (ADR-UN-01). Three states:
#   off     = do not build or consume authorization data (default; zero behavior change)
#   shadow  = build the store, evaluate, record would-deny logs, but do not change allow
#   enforce = build the store, evaluate, and deny unauthorized requests
enforcement = "off"

# Git protocol / trunk push authentication (TP-15 config surface; authenticator is TP-19).
# Trunk (the default push_policy) requires an explicit push_auth: "none" accepts
# anonymous pushes and is for local / trusted networks only; use "token" with
# [[git.push_tokens]] for shared or internet-facing deployments.
# Omitted push_auth = OAuth/UserStorage chain (review morphology only).
# Credentials via ${file:...} or vault://secret/config/<profile>/git/push_tokens/<name>#value.
# SSH read (upload-pack): storage-only + anonymous_access=true → auth_none (no UserStorage key).
# none + anonymous_access=false is fail-closed. Review never Accepts auth_none (keeps publickey push).
[git]
anonymous_access = true
push_auth = "none"
ssh_receive_pack = false
# [[git.push_tokens]]
# name = "team-foo"
# token = "${file:/run/secrets/team_foo_token}"
# paths = ["/project/foo"]

# OCI Distribution (container registry, plan-20260902). Storage-only only:
# enabled=true requires an explicit [git].push_auth ("token" | "none") above,
# otherwise startup is rejected (fail-closed). The /v2 protocol surface
# (docker push/pull) is only mounted when both conditions hold.
# [oci]
# enabled = true

# Agent Capture ingest (plan-20260911). Storage-only only:
# enabled=true requires git.push_auth and at least one [[agent_capture.ingest_tokens]]
# entry. Do not put a usable ingest token in this tracked sample. Tests inject
# tokens via in-memory Config or a temporary toml.
# [agent_capture]
# enabled = false
# tenant_id = "default"
# deployment_id = "default"
# [[agent_capture.ingest_tokens]]
# name = "capture"
# token = "${file:/run/secrets/agent_capture_token}"
# paths = ["/project/foo"]

# Storage-only committed-write outbound events (plan-20260912). Storage-only
# only: enabled=true requires git.push_auth ("token" | "none") and a persistent
# installation_id. HMAC is a SecretRef; do not commit decrypted values. This
# tracked sample stays disabled. Tests inject in-memory Config / temporary toml.
# [storage_events]
# enabled = false
# installation_id = "prod-primary-01"
# max_in_flight = 16              # 1..=64
# connect_timeout_seconds = 2     # 1..=5
# request_timeout_seconds = 5     # 1..=10
# shutdown_grace_seconds = 5      # 0..=10; 0 aborts in-flight sends at once
# [[storage_events.targets]]
# id = "ops-main"
# url = "https://events.example.invalid/ingest"  # https only; no userinfo/query/fragment
# secret_ref = "vault://secret/config/example/storage_events/targets/ops-main/hmac#value"
# events = ["repo.push", "oci.manifest.published", "lfs.object.uploaded", "lfs.media.finalized", "agent_capture.events.committed", "agent_capture.checkpoint.committed"]
# git_paths = ["/team/a"]
# oci_repositories = ["team/image"]  # canonical lowercase distribution remoteName, same rule as inbound /v2
# lfs_paths = ["/team/a.git"]  # media scope keeps the HTTP `.git` suffix; `/team/a` will not match
# include_unscoped_lfs = false
# agent_tenants = []
# agent_repo_paths = []

# GitHub outbound sync (plan-20260916). Default disabled. ssh_key_ref is a
# string only; do not put a private key in this file.
# [github_sync]
# enabled = false
# ssh_host = "github.com"
# ssh_user = "git"
# ssh_host_key = "ssh-ed25519 AAAAEXAMPLE"
# ssh_key_ref = "vault://secret/config/<profile>/github_sync/ssh_key#value"
# advertise_timeout_seconds = 30
# send_timeout_seconds = 300
# report_timeout_seconds = 60
# exit_timeout_seconds = 15
# diagnostic_budget_bytes = 4096
# [[github_sync.bindings]]
# id = "core"
# path = "/project/core"
# remote = "example/core"