# logdbd configuration — production template for strong audit.
#
# Start:  logdbd --config /etc/logdbd/logdbd.yaml
# Environment variables ($FOO) in this file are substituted at load time.
# Individual LOGDBD_* env vars also override YAML values at runtime.

node:
  id: "primary-1"                 # unique node identifier
  role: primary                   # primary | standby
  cluster_id: "agent-audit-prod"  # cluster identity; standbys must match
  epoch: 1                        # increment on every manual failover

server:
  bind: "0.0.0.0:50051"
  tls:
    mode: mtls                    # mtls | tls | disabled
    cert_file: /etc/logdbd/certs/server.crt
    key_file:  /etc/logdbd/certs/server.key
    ca_file:   /etc/logdbd/certs/ca.crt
  auth:
    type: both                    # token | mtls | both
    token_file: /etc/logdbd/token

logdb:
  data_dir: /var/lib/logdbd
  shards: 4                       # power of 2; immutable after init
  segment_size: 268435456         # 256 MiB
  ring_size: 65536
  durability_mode: sync           # sync | batch | async
  flush_timeout_ms: 5000
  backpressure:
    policy: block                 # block | reject
    max_in_flight: 65536

storage:
  index_stride: 1024
  compression:
    enabled: true
    algorithm: zstd
    level: 1
  encryption:
    enabled: false                     # AES-256-GCM at rest. When true, keys are
                                       # REQUIRED (startup fails otherwise).
    algorithm: aes-256-gcm             # only aes-256-gcm is supported
    # Where keys come from. "file" (default, built-in) reads them from `keys`
    # below (after ${ENV} substitution). "awskms" / "vault" select out-of-tree
    # provider crates (opt-in; the core never takes a vendor dependency).
    provider: file
    # Generate a key: `openssl rand -hex 32` (64 hex chars = 32 bytes).
    # key_hex may reference an env var so the secret never lives in the YAML:
    #   key_hex: "${LOGDBD_ENC_KEY_HEX}"
    keys:
      - key_id: "2026-07"
        key_hex: "0102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f20"
      # Prior keys stay in the decrypt window so records written under them
      # remain readable after a rotation. To ROTATE: add the new key below,
      # set active_key_id to it, and keep the old key(s) listed.
      # - key_id: "2026-09"
      #   key_hex: "<new-32-byte-key-in-hex>"
    active_key_id: "2026-07"           # which `keys` entry encrypts new writes

audit:
  hash_chain: true
  hash_algorithm: blake3          # blake3 | sha256

limits:
  max_record_size: 1048576        # 1 MiB
  max_batch_records: 1000
  max_batch_bytes: 16777216       # 16 MiB
  max_scan_limit: 10000
  max_tail_batch_size: 10000

replication:
  mode: sync                      # sync | async
  sync_policy: all                # all | quorum | n
  sync_timeout_ms: 5000
  on_sync_timeout: fail           # fail | async_warn | block
  batch_size: 1024
  batch_bytes: 262144             # 256 KiB
  standbys:
    # - id: "standby-1"
    #   addr: "standby1.example.com:50051"

retention:
  enabled: true
  max_segments: 100
  max_age_days: 7
  require_replicated: true
  require_exported: false

observability:
  health_bind: "0.0.0.0:9090"
  metrics: true
  metrics_bind: "0.0.0.0:9091"
  log_level: info
