Skip to content
gitdr

Configuration

One YAML file, passed with --config (or GITDR_CONFIG). Two rules:

  1. Secrets never go in the YAML. They come from env only, and they’re redacted in every log line and error.
  2. Any field can be overridden via env, GITDR_<PATH> with underscores, e.g. GITDR_DESTINATION_S3_BUCKET=foo. Handy in CI and Kubernetes.

The file

Section titled “The file”
source:
  type: github                 # github | gitlab
  baseURL: ""                  # GHES /api/v3, or self-managed GitLab URL
  repo: "octo-org/octo-repo"   # single repo; empty = all accessible (filtered)
  include: []
  exclude: []
  github:
    appID: 0
    installationID: 0
    privateKeyPath: ""         # or GITDR_GITHUB_APP_PRIVATE_KEY


destination:
  type: s3                     # s3 (AWS + S3-compatible) | gcs | azure
  s3:
    bucket: "my-worm-bucket"
    region: "us-east-1"
    endpoint: ""               # empty = AWS; e.g. MinIO http://localhost:9000
    usePathStyle: false        # true for MinIO and most S3-compatible stores
  gcs:
    bucket: ""                 # bucket with a LOCKED retention policy
  azure:
    account: ""                # uses DefaultAzureCredential
    container: ""              # container with an immutability policy
  retention:
    mode: COMPLIANCE           # COMPLIANCE (true WORM) or GOVERNANCE, S3 only
    days: 30


backup:
  concurrency: 4               # repos backed up in parallel
  resume: true                 # skip repos already backed up for the run date
  lfs: true                    # fetch LFS objects (separate .lfs.tar artifact)


manifest:
  signingKeyPath: ""           # ed25519 private key (or GITDR_MANIFEST_SIGNING_KEY)
  publicKeyPath: ""            # ed25519 public key, needed by `gitdr verify`


metrics:
  textfilePath: ""             # node_exporter textfile .prom; empty = off


encryption:
  enabled: false               # client-side envelope encryption before upload


worm:
  require: false               # true = fail closed when immutability isn't confirmed


log:
  level: info                  # debug|info|warn|error
  format: json                 # json|text

Secrets (env only)

Section titled “Secrets (env only)”
Env var What
GITDR_GITHUB_APP_PRIVATE_KEY GitHub App private key, PEM contents
GITDR_GITLAB_TOKEN GitLab token, read_api + read_repository
GITDR_MANIFEST_SIGNING_KEY ed25519 signing key, PEM contents
GITDR_ENCRYPTION_KEY 32-byte AES-256 key (64-char hex, base64, or raw)
AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY S3-compatible static keys, opt-in
GITDR_DESTINATION_AZURE_CONNECTIONSTRING Azure connection string, only for emulators like Azurite. Real Azure uses DefaultAzureCredential

Cloud credentials resolve through each SDK’s default chain, so keyless workload identity (IRSA, GKE Workload Identity, Azure Managed Identity) works with zero config and beats static keys. Static keys are for S3-compatible providers that have nothing better.