# Configuration

One YAML file, env overrides, and the rule that secrets never live in it.

One YAML file, passed with `--config` (or `GITDR_CONFIG`). Two rules:

1. **Secrets never go in the YAML.** They come from env only, and they're redacted in
   every log line and error.
2. **Any field can be overridden via env**, `GITDR_<PATH>` with underscores, e.g.
   `GITDR_DESTINATION_S3_BUCKET=foo`. Handy in CI and Kubernetes.

## The file

```yaml
source:
  type: github                 # github | gitlab
  baseURL: ""                  # GHES /api/v3, or self-managed GitLab URL
  repo: "octo-org/octo-repo"   # single repo; empty = all accessible (filtered)
  include: []
  exclude: []
  github:
    appID: 0
    installationID: 0
    privateKeyPath: ""         # or GITDR_GITHUB_APP_PRIVATE_KEY

destination:
  type: s3                     # s3 (AWS + S3-compatible) | gcs | azure
  s3:
    bucket: "my-worm-bucket"
    region: "us-east-1"
    endpoint: ""               # empty = AWS; e.g. MinIO http://localhost:9000
    usePathStyle: false        # true for MinIO and most S3-compatible stores
  gcs:
    bucket: ""                 # bucket with a LOCKED retention policy
  azure:
    account: ""                # uses DefaultAzureCredential
    container: ""              # container with an immutability policy
  retention:
    mode: COMPLIANCE           # COMPLIANCE (true WORM) or GOVERNANCE, S3 only
    days: 30

backup:
  concurrency: 4               # repos backed up in parallel
  resume: true                 # skip repos already backed up for the run date
  lfs: true                    # fetch LFS objects (separate .lfs.tar artifact)

manifest:
  signingKeyPath: ""           # ed25519 private key (or GITDR_MANIFEST_SIGNING_KEY)
  publicKeyPath: ""            # ed25519 public key, needed by `gitdr verify`

metrics:
  textfilePath: ""             # node_exporter textfile .prom; empty = off

encryption:
  enabled: false               # client-side envelope encryption before upload

worm:
  require: false               # true = fail closed when immutability isn't confirmed

log:
  level: info                  # debug|info|warn|error
  format: json                 # json|text
```

## Secrets (env only)

| Env var | What |
|---|---|
| `GITDR_GITHUB_APP_PRIVATE_KEY` | GitHub App private key, PEM contents |
| `GITDR_GITLAB_TOKEN` | GitLab token, `read_api` + `read_repository` |
| `GITDR_MANIFEST_SIGNING_KEY` | ed25519 signing key, PEM contents |
| `GITDR_ENCRYPTION_KEY` | 32-byte AES-256 key (64-char hex, base64, or raw) |
| `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` | S3-compatible static keys, opt-in |
| `GITDR_DESTINATION_AZURE_CONNECTIONSTRING` | Azure connection string, only for emulators like Azurite. Real Azure uses `DefaultAzureCredential` |

Cloud credentials resolve through each SDK's default chain, so keyless workload identity
(IRSA, GKE Workload Identity, Azure Managed Identity) works with zero config and beats
static keys. Static keys are for S3-compatible providers that have nothing better.