|
| 1 | +# secrets-dispatcher configuration |
| 2 | +# Copy to ~/.config/secrets-dispatcher/config.yaml |
| 3 | + |
| 4 | +listen: "127.0.0.1:8484" # Web UI address |
| 5 | +state_dir: "~/.local/state/secrets-dispatcher" |
| 6 | + |
| 7 | +serve: |
| 8 | + log_level: info # debug, info, warn, error |
| 9 | + timeout: 5m # approval request timeout |
| 10 | + approval_window: 2s # batch concurrent requests |
| 11 | + notification_delay: 1s # suppress short-lived requests |
| 12 | + notifications: true # desktop notifications |
| 13 | + ignore_chrome_dummy_secret: true # suppress Chrome's dummy secret probe |
| 14 | + |
| 15 | + # Trust rules — auto-approve known-safe patterns instead of prompting. |
| 16 | + # Rules match on process attributes (exe, name, cwd, unit) and secret |
| 17 | + # attributes (collection, label, custom attributes). All patterns support globs. |
| 18 | + # Process matching checks the full process chain, not just the immediate caller. |
| 19 | + rules: [] |
| 20 | + # Example: auto-approve Firefox accessing any secret |
| 21 | + # - name: firefox |
| 22 | + # action: approve |
| 23 | + # process: |
| 24 | + # exe: "/usr/lib/firefox/firefox" |
| 25 | + |
| 26 | + # Example: auto-approve tools running from your project directory |
| 27 | + # - name: my-project |
| 28 | + # action: approve |
| 29 | + # process: |
| 30 | + # cwd: "/home/me/src/my-project/*" |
| 31 | + |
| 32 | + # Example: ignore Chrome's dummy secret probe |
| 33 | + # - name: chrome-probe |
| 34 | + # action: ignore |
| 35 | + # request_types: [write] |
| 36 | + # process: |
| 37 | + # exe: "*chrome*" |
| 38 | + |
| 39 | + # Auto-approve GPG signing from specific editors |
| 40 | + trusted_signers: [] |
| 41 | + # - exe_path: /usr/bin/nvim |
| 42 | + # - exe_path: /usr/bin/code |
0 commit comments