lazaret/docs/example.toml

# Lazaret trusted-host configuration v1

schema = "lazaret-trusted-host-config-v1"

[storage]
data_root = "~/.local/share/lazaret"

[network]
default_allow = ["192.0.2.53/32", "198.51.100.53/32"]

[profiles.default]
image = "docker.io/library/debian:trixie"
isolate_gitignored = true
persistent_dirs = ["/root"]
allow_egress = ["203.0.113.10/32"]
volumes = [
    { host = "{profile_dir}/agent-state", container = "/root/.local/state/agent", kind = "directory", access = "read-write", create = true },
]

[profiles.default.readiness]
denied = [{ address = "10.20.30.40", port = 443 }]
permitted = [{ address = "203.0.113.10", port = 443 }]
dns = [{ resolver = "198.51.100.53", query = "example.invalid" }]

[profiles.default.escalation]
enabled = false