# AcTrail operator configuration.

[control]
socket_path = "/tmp/actrail-agent-xiaoo-http-proxy.sock"
socket_mode_octal = "660"
pid_file = "/tmp/actrail-agent-xiaoo-http-proxy.pid"
log_path = "/tmp/actrail-agent-xiaoo-http-proxy.log"
diagnostic_log_level = "info"

[control.workload_diagnostics]

[control.finalization]

[storage]
backend = "sqlite"

[storage.sqlite]
path = "/tmp/actrail-agent-xiaoo-http-proxy.sqlite"
busy_timeout_ms = 5000

[web]
listen_addr = "127.0.0.1:18097"
request_read_timeout_ms = "1000"

[export.snapshot]
graph_schema_version = "manual-v1"
allow_active_trace_snapshot = true
directory = "/tmp/actrail-agent-xiaoo-http-proxy-export"
payload_bytes_enabled = true
payload_text_enabled = true

[capture]
profile_name = "agent-xiaoo-http-proxy"
capabilities = [
  "proc-lifecycle",
  "net-transport",
  "socket-plaintext-payload",
  "net-application-plaintext-http",
]

[ebpf]
enabled = true
memlock_rlimit = "inherit"
tracked_process_max_entries = 4096
pending_operation_max_entries = 4096
suppressed_fd_max_entries = 4096
suppressed_fd_index_slots_per_process = 64
event_ring_buffer_max_bytes = 1048576
file_path_capture_enabled = true
file_path_max_bytes = 255

[payload.tls]
enabled = false
capture_backend = "tls-sync"
source = "auto"
resolver = "auto"
library = "auto"
library_path = "auto"
binary_path = "disabled"
pattern_path = "disabled"
max_segment_bytes = 4095
max_operation_bytes = 4194304
ring_buffer_bytes = 1048576
pending_operation_max_entries = 4096
diagnostics_enabled = false
retention_max_bytes_per_trace = 10485760
redaction_policy = "authorization-header"
sync_runtime_library_path = "auto"
sync_event_socket_path = "/tmp/actrail-agent-xiaoo-http-proxy-tls-sync.sock"
sync_socket_mode_octal = "660"
sync_match_limit = 8
seccomp_syscalls = ["write", "writev", "sendto", "sendmsg"]

[payload.stdio]
enabled = false
capture_stdin = false
capture_stdout = true
capture_stderr = true
stdin_storage_mode = "full"
stdout_storage_mode = "drop"
stderr_storage_mode = "metadata-only"
max_segment_bytes = 4095
ring_buffer_bytes = 1048576
pending_operation_max_entries = 4096
stream_state_max_entries = 4096
retention_max_bytes_per_trace = 10485760
redaction_policy = "authorization-header"

[payload.socket]
enabled = true
capture_backend = "bpf-copy-seccomp-fallback"
max_segment_bytes = 4095
max_operation_bytes = 4194304
ring_buffer_bytes = 2097152
pending_operation_max_entries = 4096
stream_state_max_entries = 4096
retention_max_bytes_per_trace = 10485760
redaction_policy = "authorization-header"
http_sniff_max_bytes = 8192
seccomp_syscalls = ["write", "writev", "sendto", "sendmsg"]

[seccomp_notify]
enabled = true
reserved_listener_fd = 253

[process_seccomp]
enabled = false
syscalls = ["execve", "execveat", "fork", "vfork", "clone", "clone3"]
max_args = 64
max_arg_bytes = 4096
pending_max_entries = 4096

[agent_invocation]
enabled = false
commands = ["xiaoo"]

[semantic_retention]

[semantic_retention.l0_llm_call]

[semantic_retention.l1_sse]

[semantic_retention.l2_http]

[semantic_retention.l3_http2_frame]

[semantic_retention.l4_payload]

[file_observation]

[file_observation.tty]

[file_observation.bulk_read]

[file_observation.enumerate]

[application]
enabled = true
http1_enabled = true
http2_enabled = false

[application.http]
capture_host = false
sse_enabled = true
sse_data_policy = "preview"
sse_max_buffer_bytes = 4194304
sse_max_data_bytes = 65536

[application.http2]
max_frame_bytes = 16384
max_connection_buffer_bytes = 1048576
emit_data_preview = false
max_data_preview_bytes = 4096

[resource_metrics]
enabled = false
interval_ms = 1000
include_children = true
include_system = true
cpu_alert_percent_millis = "disabled"
memory_alert_rss_kb = "disabled"

[provider]
rules_enabled = false
rules_path = "docs/examples/03.extended-observation-e2e/provider-rules.conf"
unknown_provider_label = "unknown"

[enforcement]
enabled = false
backend = "fanotify"
scope = "trace"
rules_path = "/tmp/actrail-agent-xiaoo-http-proxy-enforcement.conf"
default_decision = "allow"
mark_strategy = "parent-directories"
audit_enabled = true
event_buffer_bytes = 65536

[supervision]
startup_wait_ms = 5000
shutdown_wait_ms = 5000
poll_interval_ms = 100