This is an automated email from the ASF dual-hosted git repository. hsluoyz pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/casbin-gateway.git
commit 609c2e0ca413079987dc59596a93af3547146cc8 Author: Yang Luo <[email protected]> AuthorDate: Fri Sep 4 09:36:01 2026 +0800 docs(conf): trim the comments in app.conf --- conf/app.conf | 102 ++++++++++++++++++++++++---------------------------------- 1 file changed, 42 insertions(+), 60 deletions(-) diff --git a/conf/app.conf b/conf/app.conf index b56e46b..5d5266e 100644 --- a/conf/app.conf +++ b/conf/app.conf @@ -1,63 +1,56 @@ -; This file seeds the settings on the very first start. Casbin Gateway then -; keeps them in its database and reads them from there, so a line changed below -; afterwards has no effect — use the Settings page of the web UI instead. The -; exceptions are the keys read before the database is open: "appname", -; "httpport", "runmode", "driverName", "dataSourceName", "dbName" and -; "redisEndpoint". Those are only ever read from this file. +; Seeds the settings on the very first start. Casbin Gateway then keeps them in +; its database, so a line changed here afterwards has no effect — use the +; Settings page of the web UI. The exceptions, read before the database is open, +; are "appname", "httpport", "runmode", "driverName", "dataSourceName", "dbName" +; and "redisEndpoint". appname = casbin-gateway -; Port of the management UI and the REST API. Whatever is already listening on -; it is killed on startup, so a previous run does not have to be stopped by hand. +; Port of the management UI and the REST API. Whatever already holds it is +; killed on startup. httpport = 17000 -; Interface the management UI binds to. It is loopback by default: the local -; admin is signed in without a password and the relay hands out the provider -; keys, so exposing both to the network is opt-in. Set it to 0.0.0.0 to serve -; other machines, and change the admin password before you do. One address is -; opened regardless: while an agent that runs in a sandbox of its own is routed -; through the gateway, this host's own address is served too, since loopback -; inside such a sandbox is the sandbox rather than this machine. +; Interface the management UI binds to. Loopback by default: the local admin is +; signed in without a password and the relay hands out the provider keys, so +; change that password before serving other machines with 0.0.0.0. This host's +; own address is always served too, for agents that run in a sandbox of their +; own, where loopback is the sandbox rather than this machine. httpaddr = 127.0.0.1 runmode = dev copyrequestbody = true -; Names Gateway answers to, beside this host's own addresses, "localhost" and -; this machine's hostname, which are always answered to. A browser request for -; any other name is refused, so that a domain someone points at 127.0.0.1 cannot -; drive Gateway through the browser of whoever is signed in here. List the name -; here (comma-separated) when Gateway is reached through a reverse proxy or any -; other name that is not this machine's. +; Extra names Gateway answers to, comma-separated, for a reverse proxy or any +; other name that is not this machine's. Its own addresses, "localhost" and its +; hostname always work; a browser request for any other name is refused, so that +; a domain pointed at 127.0.0.1 cannot drive Gateway through the operator's +; browser. allowedHosts = ; Browser origins allowed to call the API from another site, comma-separated and -; written in full, e.g. "https://app.example.com";. Gateway serves its own web UI, -; which needs none of these; a page of your own that calls the relay does. +; written in full, e.g. "https://app.example.com";. The web UI needs none of +; these; a page of your own that calls the relay does. allowedOrigins = -; Database. An empty "dataSourceName" means "./data/casbin-gateway.db"; "dbName" is -; unused by SQLite. XORM is used, so mysql, postgres, mssql and sqlite are all -; supported. To use MySQL instead, replace the two lines below with: +; Database. XORM is used, so mysql, postgres, mssql and sqlite are all supported. +; An empty "dataSourceName" means "./data/casbin-gateway.db"; "dbName" is unused +; by SQLite and created on first start by the others. For MySQL: ; driverName = mysql ; dataSourceName = root:123@tcp(localhost:3306)/ -; Gateway then creates "dbName" on first start if it does not exist. driverName = sqlite dataSourceName = dbName = casbin_gateway ; Optional Redis for sessions. Sessions are kept in ./tmp files when empty. redisEndpoint = -; Optional AES-256-GCM encryption for provider API keys at rest. Any length works -; ("openssl rand -base64 32"); leave it empty to keep storing keys as plaintext. -; Existing plaintext keys are re-written as ciphertext the first time they are -; read, so turning this on needs no manual step. Back the key up with the -; database: losing it makes already-encrypted keys unreadable. +; Optional AES-256-GCM encryption for provider API keys at rest, any length +; ("openssl rand -base64 32"). Existing plaintext keys are re-written as +; ciphertext when read, so turning this on needs no manual step. Back the key up +; with the database: losing it makes encrypted keys unreadable. apiKeyEncryptionKey = -; Optional SOCKS5 proxy ("host:port") for outbound traffic such as update -; downloads. +; Optional SOCKS5 proxy ("host:port") for outbound traffic such as updates. httpProxy = "" ; Casdoor is optional. Leave "casdoorEndpoint" empty to sign in against Gateway's -; own user table instead, with the built-in "admin" account (password "123"). -; Filling in all five values below switches sign-in over to Casdoor SSO. +; own user table, with the built-in "admin" account (password "123"); filling in +; all five values switches sign-in over to Casdoor SSO. casdoorEndpoint = ; casdoorEndpoint = https://door.casdoor.com clientId = @@ -68,40 +61,29 @@ casdoorApplication = ; Demo mode makes the REST API read-only: only sign-in and sign-out may write. isDemoMode = false -; Agent patch manifests, config backups, ingest tokens, and file-tail cursors. -; Agent activity records themselves are held only in memory. +; Agent patch manifests, config backups, ingest tokens and file-tail cursors. agentPatchStateDir = "./data/agent-patches" -; How many agent monitoring records to keep in memory. They are never persisted, -; so this is also the memory bound for the live window. +; How many agent monitoring records to keep. They are never persisted, so this +; is also the memory bound for the live window. agentRecordCapacity = 1000 ; How often to rescan the append-only logs of file-tailed agents, in seconds. agentMonitorPollSeconds = 5 -; Channel probes. A probe sends a few short requests to a provider's upstream to -; check that what answers is what it claims to be: the model name it reports and -; which vendor the model itself says trained it, whether anything was injected in -; front of the request, a bank of questions with one right answer, whether the -; parameters the API documents are honoured or quietly dropped, whether identical -; requests come back from the same model, and then the envelope — vendor headers, -; the shape of the event stream, whether prompt caching is really accounted for, -; and whether two identical requests are billed the same. It spends a few cents of -; that provider's own credit. -; What it asks is a suite of test cases, published and editable on the -; Authenticity page, and what it answers is a score out of 100 and a grade. -; "auto" probes a provider when it is added, when its endpoint, type or key -; changes, when it has never been probed, and again whenever its report goes -; stale. "manual" only probes when it is asked for. "off" never probes. +; Channel probes. A probe spends a few cents of a provider's own credit asking +; its upstream a suite of test cases — published and editable on the +; Authenticity page — and scores out of 100 what answers: the model it reports +; and the vendor it says trained it, anything injected in front of the request, +; parameters quietly dropped, and the envelope it all comes back in. +; "auto" probes a provider when it is added or changed and whenever its report +; goes stale, "manual" only on request, "off" never. providerProbeMode = "auto" -; How long a probe report stays current. An automatic sweep asks a provider the -; suite again once its last report is older than this, which is what makes a -; backend that was swapped since visible: nothing about the provider changes -; when its upstream does, so only another probe would ever show it. +; How long a probe report stays current. Re-probing is the only thing that shows +; an upstream swapped behind a provider that itself never changed. providerProbeIntervalHours = 24 ; LLM request records. "off" keeps nothing, "metadata" records who called which ; model with which outcome, and "full" also stores the sanitized request body. -; The default is "full": the records are what the dashboards are made of, and -; they stay on this machine. Set it to "metadata" or "off" to keep less. +; They stay on this machine and are what the dashboards are made of. llmRecordMode = "full" llmRecordQueueCapacity = 1000 llmRecordRetentionDays = 30 --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
