# Helr — minimal config. See README and docs/integrations/gws-gcp.md.

global:
  log_level: info
  log_format: json
  # Optional backpressure when downstream (stdout/file consumer) can't keep up.
  # backpressure:
  #   enabled: true
  #   detection:
  #     event_queue_size: 10000
  #     memory_threshold_mb: 512
  #   strategy: block   # block | disk_buffer | drop
  #   drop_policy: oldest_first   # when strategy is drop
  state:
    backend: sqlite
    path: "./helr-state.db"
  api:
    enabled: true
    address: "0.0.0.0"
    port: 8080
  metrics:
    enabled: true
    address: "0.0.0.0"
    port: 9090
  hooks:
    enabled: true
    path: "./hooks"
    timeout_secs: 5
    allow_network: true

sources:
  # --- GWS (Admin SDK): docs/integrations/gws-gcp.md. One source per app; duplicate and change URL path for drive, admin, etc.
  # gws-login:
  #   url: "https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/login"
  #   schedule:
  #     interval_secs: 300
  #     jitter_secs: 30
  #   auth:
  #     type: google_service_account
  #     credentials_file: "./credentials.json"
  #     subject_env: GWS_DELEGATED_USER
  #     scopes:
  #       - "https://www.googleapis.com/auth/admin.reports.audit.readonly"
  #   pagination:
  #     strategy: cursor
  #     cursor_param: pageToken
  #     cursor_path: nextPageToken
  #     max_pages: 50
  #   query_params:
  #     maxResults: "500"
  #   resilience:
  #     timeout_secs: 30
  #     retries:
  #       max_attempts: 5
  #       initial_backoff_secs: 2
  #       max_backoff_secs: 60
  #       multiplier: 2.0
  #     circuit_breaker:
  #       enabled: true
  #       failure_threshold: 5
  #       success_threshold: 2
  #       half_open_timeout_secs: 60

  # --- Okta: set OKTA_DOMAIN and OKTA_API_TOKEN; auth prefix SSWS. See docs/integrations/okta.md.
  okta-audit:
    url: "https://${OKTA_DOMAIN}/api/v1/logs"
    schedule:
      interval_secs: 60
      jitter_secs: 10
    auth:
      type: bearer
      token_env: OKTA_API_TOKEN
      prefix: SSWS
    pagination:
      strategy: link_header
      rel: next
      max_pages: 20
    resilience:
      timeout_secs: 30
      retries:
        max_attempts: 5
        initial_backoff_secs: 2
        max_backoff_secs: 60
        multiplier: 2.0
      circuit_breaker:
        enabled: true
        failure_threshold: 5
        success_threshold: 2
        half_open_timeout_secs: 60
      rate_limit:
        respect_headers: true
        page_delay_secs: 1

  # --- Okta via OAuth2 (API service integration): client_credentials, org server.
  # Org AS requires private_key_jwt: set OKTA_DOMAIN, OKTA_CLIENT_ID, OKTA_CLIENT_PRIVATE_KEY (PEM).
  # See docs/integrations/okta.md and https://developer.okta.com/docs/guides/build-api-integration/main/
  # okta-audit-oauth2:
  #   url: "https://${OKTA_DOMAIN}/api/v1/logs"
  #   schedule:
  #     interval_secs: 60
  #     jitter_secs: 10
  #   auth:
  #     type: oauth2
  #     token_url: "https://${OKTA_DOMAIN}/oauth2/v1/token"
  #     client_id_env: OKTA_CLIENT_ID
  #     client_private_key_file: "./private-key.pem"
  #     scopes:
  #       - "okta.logs.read"
  #     dpop: true
  #   pagination:
  #     strategy: link_header
  #     rel: next
  #     max_pages: 20
  #   resilience:
  #     timeout_secs: 30
  #     retries:
  #       max_attempts: 5
  #       initial_backoff_secs: 2
  #       max_backoff_secs: 60
  #       multiplier: 2.0
  #     circuit_breaker:
  #       enabled: true
  #       failure_threshold: 5
  #       success_threshold: 2
  #       half_open_timeout_secs: 60
  #     rate_limit:
  #       respect_headers: true
  #       page_delay_secs: 1

  # --- GitHub audit log. Org endpoint: GET orgs/{org}/audit-log (only for orgs on Enterprise Cloud).
  # If you get 404, use the enterprise endpoint instead: url "https://${GITHUB_API_HOST}/enterprises/${GITHUB_ENTERPRISE}/audit-log", set GITHUB_ENTERPRISE and GITHUB_API_HOST. See docs/integrations/github.md.
  # github-audit:
  #   url: "https://api.github.com/orgs/${GITHUB_ORG}/audit-log"
  #   schedule:
  #     interval_secs: 300
  #     jitter_secs: 30
  #   auth:
  #     type: bearer
  #     token_env: GITHUB_TOKEN
  #   headers:
  #     Accept: "application/vnd.github+json"
  #     X-GitHub-Api-Version: "2022-11-28"
  #     User-Agent: "Helr"
  #   query_params:
  #     per_page: "100"
  #     order: "asc"
  #   pagination:
  #     strategy: link_header
  #     rel: next
  #     max_pages: 15
  #   resilience:
  #     timeout_secs: 30
  #     retries:
  #       max_attempts: 5
  #       initial_backoff_secs: 2
  #       max_backoff_secs: 60
  #       multiplier: 2.0
  #     circuit_breaker:
  #       enabled: true
  #       failure_threshold: 5
  #       success_threshold: 2
  #       half_open_timeout_secs: 60
  #     rate_limit:
  #       respect_headers: true
  #       page_delay_secs: 2

  # --- Slack Audit Logs API. Enterprise only. User token (xoxp) with auditlogs:read, installed by Org Owner. See docs/integrations/slack.md.
  # slack-audit:
  #   url: "https://api.slack.com/audit/v1/logs"
  #   schedule:
  #     interval_secs: 300
  #     jitter_secs: 30
  #   auth:
  #     type: bearer
  #     token_env: SLACK_AUDIT_TOKEN
  #   headers:
  #     Accept: "application/json"
  #   query_params:
  #     limit: "200"
  #   pagination:
  #     strategy: cursor
  #     cursor_param: cursor
  #     cursor_path: response_metadata.next_cursor
  #     max_pages: 25
  #   resilience:
  #     timeout_secs: 30
  #     retries:
  #       max_attempts: 5
  #       initial_backoff_secs: 2
  #       max_backoff_secs: 60
  #       multiplier: 2.0
  #     circuit_breaker:
  #       enabled: true
  #       failure_threshold: 5
  #       success_threshold: 2
  #       half_open_timeout_secs: 60
  #     rate_limit:
  #       respect_headers: true
  #       page_delay_secs: 2

  # --- 1Password Events API (audit events). Bearer token from Events Reporting integration with auditevents. POST, cursor in body. See docs/integrations/1password.md.
  # 1password-audit:
  #   url: "https://events.1password.com/api/v2/auditevents"
  #   method: post
  #   body: {}
  #   schedule:
  #     interval_secs: 300
  #     jitter_secs: 30
  #   auth:
  #     type: bearer
  #     token_env: ONEPASSWORD_EVENTS_TOKEN
  #   headers:
  #     Accept: "application/json"
  #     Content-Type: "application/json"
  #   pagination:
  #     strategy: cursor
  #     cursor_param: cursor
  #     cursor_path: cursor
  #     max_pages: 50
  #   resilience:
  #     timeout_secs: 30
  #     retries:
  #       max_attempts: 5
  #       initial_backoff_secs: 2
  #       max_backoff_secs: 60
  #       multiplier: 2.0
  #     circuit_breaker:
  #       enabled: true
  #       failure_threshold: 5
  #       success_threshold: 2
  #       half_open_timeout_secs: 60
  #     rate_limit:
  #       respect_headers: true
  #       page_delay_secs: 1

  # --- Tailscale configuration audit logs. API token with logs:configuration:read; Basic auth (token as user, empty password). No pagination; start/end in URL. See docs/integrations/tailscale.md.
  # tailscale-audit:
  #   url: "https://api.tailscale.com/api/v2/tailnet/${TAILNET_ID}/logging/configuration?start=${TAILSCALE_START}&end=${TAILSCALE_END}"
  #   schedule:
  #     interval_secs: 3600
  #     jitter_secs: 60
  #   auth:
  #     type: basic
  #     user_env: TAILSCALE_API_TOKEN
  #     password_env: TAILSCALE_API_TOKEN_PASSWORD
  #   headers:
  #     Accept: "application/json"
  #   resilience:
  #     timeout_secs: 30
  #     retries:
  #       max_attempts: 5
  #       initial_backoff_secs: 2
  #       max_backoff_secs: 60
  #       multiplier: 2.0
  #     circuit_breaker:
  #       enabled: true
  #       failure_threshold: 5
  #       success_threshold: 2
  #       half_open_timeout_secs: 60

  # --- Tailscale network flow logs. Premium/Enterprise only; enable in admin console. API token with logs:network:read. See docs/integrations/tailscale.md.
  # tailscale-network:
  #   url: "https://api.tailscale.com/api/v2/tailnet/${TAILNET_ID}/logging/network?start=${TAILSCALE_START}&end=${TAILSCALE_END}"
  #   schedule:
  #     interval_secs: 3600
  #     jitter_secs: 60
  #   auth:
  #     type: basic
  #     user_env: TAILSCALE_API_TOKEN
  #     password_env: TAILSCALE_API_TOKEN_PASSWORD
  #   headers:
  #     Accept: "application/json"
  #   resilience:
  #     timeout_secs: 30
  #     retries:
  #       max_attempts: 5
  #       initial_backoff_secs: 2
  #       max_backoff_secs: 60
  #       multiplier: 2.0
  #     circuit_breaker:
  #       enabled: true
  #       failure_threshold: 5
  #       success_threshold: 2
  #       half_open_timeout_secs: 60

  # --- Andromeda Security audit trail. GraphQL API; hooks for backfill (skip). Auth via getAuth hook: set ANDROMEDA_PAT (Helr exchanges for cookie) or ANDROMEDA_COOKIE. See docs/integrations/andromeda.md.
  # andromeda-audit:
  #   url: "https://api.live.andromedasecurity.com/graphql"
  #   method: post
  #   headers:
  #     User-Agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:147.0) Gecko/20100101 Firefox/147.0"
  #     Referer: "https://app.live.andromedasecurity.com/"
  #     Origin: "https://app.live.andromedasecurity.com"
  #     Accept: "*/*"
  #     Accept-Language: "en-US,en;q=0.9"
  #   schedule:
  #     interval_secs: 300
  #     jitter_secs: 30
  #   hooks:
  #     script: "andromeda-audit.js"
  #   dedupe:
  #     id_path: "id"
  #     capacity: 100000
  #   resilience:
  #     timeout_secs: 30
  #     retries:
  #       max_attempts: 5
  #       initial_backoff_secs: 2
  #       max_backoff_secs: 60
  #       multiplier: 2.0
  #     circuit_breaker:
  #       enabled: true
  #       failure_threshold: 5
  #       success_threshold: 2
  #       half_open_timeout_secs: 60

  # --- GWS via Cloud Logging (LogEntry format): POST entries:list, auth oauth2, scope logging.read.
  # gws-audit-cloud-logging:
  #   url: "https://logging.googleapis.com/v2/entries:list"
  #   method: post
  #   body:
  #     resourceNames: ["organizations/123"]
  #     filter: 'logName="organizations/123/logs/cloudaudit.googleapis.com%2Fdata_access"'
  #     orderBy: "timestamp asc"
  #     pageSize: 500
  #   schedule:
  #     interval_secs: 300
  #     jitter_secs: 30
  #   auth:
  #     type: oauth2
  #     token_url: "https://oauth2.googleapis.com/token"
  #     client_id_env: GCP_CLIENT_ID
  #     client_secret_env: GCP_CLIENT_SECRET
  #     refresh_token_env: GCP_REFRESH_TOKEN
  #     scopes:
  #       - "https://www.googleapis.com/auth/logging.read"
  #   pagination:
  #     strategy: cursor
  #     cursor_param: pageToken
  #     cursor_path: nextPageToken
  #     max_pages: 50
  #   resilience:
  #     timeout_secs: 30
  #     retries:
  #       max_attempts: 5
  #       initial_backoff_secs: 2
  #       max_backoff_secs: 60
  #       multiplier: 2.0
  #     circuit_breaker:
  #       enabled: true
  #       failure_threshold: 5
  #       success_threshold: 2
  #       half_open_timeout_secs: 60
