Configuration file

Edition: Community and Enterprise

sealfix.yaml holds everything except secrets. A field that needs a secret names an environment variable or a file instead. Most installations set it up in the browser, with the setup wizard and "Admin" > "Configuration", where every version is kept with its diff.

Section	Holds	Changes are
config	Where the configuration lives: the database (editable in the console) or this file only	Sensitive
ldap	The directory: URL, base DN, filter, attributes, service account variables	Sensitive
oidc	Single sign-on: issuer, client, claims	Sensitive
auth	Sign-in throttling, MFA and step-up, break-glass networks, sign-in notice	Sensitive
policies	Per environment: approvals, ticket, signed approvals, risk rules, checks, windows, promotion, capture, emergencies	For production: loosening the approvals or the ticket, and any change to the other settings, is sensitive
defaults	Row limits, approval lifetime, execution time limit, session lengths	Raising a limit is sensitive
executor	Where the executor's keys are	Sensitive
masking	Whether amounts are shown	Sensitive
webauthn	Passkeys: relying party id and origin	Sensitive
audit	Checkpoint interval and verifier keys	Sensitive
notifications	Channels and routes	Sensitive
git	Repository, keys, whether executions are bound to Git	Sensitive
siem	Syslog receiver, TLS files	Sensitive
health	Who may see each component's state on /readyz
telemetry	Where metrics and traces go	Sensitive

A sensitive change is flagged in the audit log, every administrator and auditor is told, and it goes to your SIEM. Installations that want it can also require a second administrator to approve it (dual control).

Before a change is saved

sealfix parses a proposed configuration the way the processes read it at start. A change they could not start with is refused when it is proposed, with the parser's own message naming the setting, and nothing is stored.

Example

sealfix.yaml

executor:
  private_key_file_env: SEALFIX_EXECUTOR_KEY_FILE
  public_key_file: /run/sealfix/executor.pub

ldap:
  url: ldaps://dc.example.local:636
  base_dn: DC=example,DC=local
  bind_dn_env: SEALFIX_LDAP_BIND_DN
  bind_password_env: SEALFIX_LDAP_BIND_PASSWORD
  user_filter: (sAMAccountName={username})

policies:
  prod:
    approvals: [dba_reviewer, business_approver]
    ticket_required: true
  non_prod:
    approvals: [dba_reviewer]

defaults:
  max_rows: 1000
  approval_ttl_h: 24