sealed-inbox/config.example.yaml at main · logicalwang/sealed-inbox · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
# Secure Record Receiver — example configuration
# Copy to config.yaml and fill in your own values.
# config.yaml is git-ignored; never commit real secrets.

# ── IMAP source ─────────────────────────────────────────────
imap:
  host: imap.gmail.com
  port: 993
  # Address that receives the encrypted record emails
  username: "your-receiver@example.com"
  # Path to a file containing the IMAP app password (NOT the account password).
  # Use an absolute path or "~"-prefixed; a bare relative path would
  # resolve against the process working directory.
  app_password_file: "~/.config/secure-record/imap-app-password"
  # Subject the receiver searches for. This MUST contain the subject
  # your sender uses — the reference web frontend (secure-relay-fast)
  # defaults to "[OpenClaw Secure Record]".
  subject_prefix: "[OpenClaw Secure Record]"
  # How far back to search for candidate messages
  since_days: 30

# ── Identity / crypto ──────────────────────────────────────
crypto:
  # Path to the RSA private key (PEM, RSA-OAEP, SHA-256)
  private_key_path: "./keys/record_decrypt_private.pem"
  # Sender-side kid secrets: {kid: {secret, ...}}. The receiver reads
  # this only for logging — it does not verify the mac (see PROTOCOL.md §6).
  kid_secrets_path: "./kid_secrets.json"
  # Sender authentication — recommended for real deployments. The
  # reference frontend already signs every record with the kid secret;
  # default off = production parity (mac ignored). Set true to reject
  # records from unknown kids or with a bad signature.
  # require_valid_mac: true
  # Optional freshness window in hours: reject records older than this
  # (0 = disabled, production parity).
  # max_age_hours: 48

# ── Storage ────────────────────────────────────────────────
storage:
  # Where the decrypted records are appended (CSV, utf-8-sig)
  records_csv: "./data/records.csv"
  # Where generated charts are written
  charts_dir: "./data/charts"
  # Pipeline dedup state (IMAP SEARCH ids + processed-id list)
  state_path: "./data/email_state.json"
  # Watcher state (last seen id + counters)
  idle_state_path: "./data/idle_state.json"

# ── Archive backend ────────────────────────────────────────
# NOTE: top-level key (the loader reads "archive" at the document root,
# not nested under storage).
archive:
  backend: "local"             # "local" = write only, "seafile" = upload too
  seafile:
    server_url: "https://seafile.example.com"
    repo_id: ""                # UUID of the target library
    # Library folder for the uploads (non-ASCII OK; use "/" for root)
    remote_dir: "/"
    token_file: "~/.config/secure-record/seafile-token"
    # When true, overwrite remote files with the same name
    replace_existing: true

# ── Notifications ──────────────────────────────────────────
# Telegram push on every successful record append — this is also the
# "confirmation" channel for non-technical senders (submit → phone buzzes).
notifications:
  telegram:
    enabled: false
    # Numeric chat id; group ids look like -100XXXXXXXXX
    chat_id: ""
    # Path to a file containing the bot token (read at runtime, git-ignored)
    # Create a bot with @BotFather.
    bot_token_file: "~/.config/secure-record/telegram-bot-token"

# ── Charts ─────────────────────────────────────────────────
charts:
  # Rolling windows to render. Each produces one PNG (records_<window>.png).
  windows: ["24h", "48h", "7d", "30d"]
  # Unit shown on the chart y-axis
  metric_unit: "mmol/L"

# ── Dashboard (local web UI) ───────────────────────────────
# Run with: python3 -m src.dashboard
dashboard:
  # Listen address. "0.0.0.0" exposes it on all interfaces (LAN/tunnel);
  # use "127.0.0.1" if you only want local access.
  bind: "0.0.0.0"
  port: 8086
  # The access password lives in a git-ignored file, never in this repo.
  # Create it with:  echo 'your-secret' > <this path>
  access_key_file: "~/.config/secure-record/dashboard-access-key"
  # Reading colour thresholds (mmol/L): below low → red, above high → amber.
  low: 3.9
  high: 7.0
  # pgrep pattern used by the "service status" card to detect the watcher.
  watcher_process_pattern: "src.watcher"
  # Login rate limiting: an IP that fails this many attempts within this
  # many seconds gets locked out (429) until the window slides clear.
  rate_limit_max: 10
  rate_limit_window: 300
  # Optional: show the last lines of these logs on the page.
  # pipeline_log: "./data/pipeline.log"
  # watcher_log: "./data/watcher.log"