88 lines
3 KiB
TOML
88 lines
3 KiB
TOML
|
# Lazaret Configuration Template (config.toml)
|
||
|
|
# Copy this file to ~/.config/lazaret/config.toml or ./lazaret.toml
|
||
|
|
|
||
|
|
[storage]
|
||
|
|
# Mount path on the host where persistent profile directories
|
||
|
|
# (e.g., usr, var, etc, opt, root) will be initialized and stored.
|
||
|
|
data_root = "~/.local/share/lazaret"
|
||
|
|
|
||
|
|
[network]
|
||
|
|
# Default global whitelist applied to the Netlink router gateway.
|
||
|
|
# Nameservers from the host's /etc/resolv.conf are also appended dynamically.
|
||
|
|
default_allow = [
|
||
|
|
"198.51.100.53/32", # Documentation address
|
||
|
|
"192.0.2.53/32" # Documentation address
|
||
|
|
]
|
||
|
|
|
||
|
|
# Default global blacklist applied to the Netlink router gateway.
|
||
|
|
# Private RFC 1918 ranges are blackholed by default to prevent scanning/accessing the local network.
|
||
|
|
default_deny = [
|
||
|
|
"10.0.0.0/8", # Class A Private Network Range
|
||
|
|
"172.16.0.0/12", # Class B Private Network Range
|
||
|
|
"192.168.0.0/16" # Class C Private Network Range
|
||
|
|
]
|
||
|
|
|
||
|
|
[escalation]
|
||
|
|
# Set to true to enable the agent-to-host escalation Unix Domain Socket server on the host.
|
||
|
|
enabled = true
|
||
|
|
|
||
|
|
# Path on the host filesystem where profile-specific Unix escalation sockets are created.
|
||
|
|
socket_dir = "/tmp/lazaret"
|
||
|
|
|
||
|
|
# Host commands that the agent is allowed to execute on the host automatically
|
||
|
|
# without triggering an interactive Human-In-The-Loop (HITL) prompt.
|
||
|
|
auto_approve = [
|
||
|
|
"aws sts get-caller-identity "
|
||
|
|
]
|
||
|
|
|
||
|
|
# AI AGENT PROFILES
|
||
|
|
|
||
|
|
[profiles.gemini]
|
||
|
|
image = "docker.io/library/debian:trixie"
|
||
|
|
persistent_dirs = ["/root", "/usr", "/var", "/etc", "/opt"]
|
||
|
|
allow_egress = ["10.222.0.0/16"]
|
||
|
|
env = { GEMINI_API_KEY = "env:GEMINI_API_KEY" }
|
||
|
|
volumes = [
|
||
|
|
{ host = "{profile_dir}/.gemini", container = "/root/.gemini", mode = "z" }
|
||
|
|
]
|
||
|
|
|
||
|
|
[profiles.claude]
|
||
|
|
image = "docker.io/library/debian:trixie"
|
||
|
|
persistent_dirs = ["/root", "/usr", "/var", "/etc", "/opt"]
|
||
|
|
allow_egress = ["10.222.0.0/16"]
|
||
|
|
env = { ANTHROPIC_API_KEY = "env:ANTHROPIC_API_KEY" }
|
||
|
|
volumes = [
|
||
|
|
{ host = "{profile_dir}/.claude", container = "/root/.claude", mode = "z" }
|
||
|
|
]
|
||
|
|
|
||
|
|
[profiles.codex]
|
||
|
|
image = "docker.io/library/debian:trixie"
|
||
|
|
persistent_dirs = ["/root", "/usr", "/var", "/etc", "/opt"]
|
||
|
|
allow_egress = ["10.222.0.0/16"]
|
||
|
|
env = { OPENAI_API_KEY = "env:OPENAI_API_KEY" }
|
||
|
|
volumes = [
|
||
|
|
{ host = "{profile_dir}/.codex", container = "/root/.codex", mode = "z" }
|
||
|
|
]
|
||
|
|
|
||
|
|
[profiles.grok]
|
||
|
|
image = "docker.io/library/debian:trixie"
|
||
|
|
persistent_dirs = ["/root", "/usr", "/var", "/etc", "/opt"]
|
||
|
|
allow_egress = ["10.222.0.0/16"]
|
||
|
|
env = { XAI_API_KEY = "env:XAI_API_KEY" }
|
||
|
|
volumes = [
|
||
|
|
{ host = "{profile_dir}/.grok", container = "/root/.grok", mode = "z" }
|
||
|
|
]
|
||
|
|
|
||
|
|
[profiles.opencode]
|
||
|
|
image = "docker.io/library/debian:trixie"
|
||
|
|
persistent_dirs = ["/root", "/usr", "/var", "/etc", "/opt"]
|
||
|
|
allow_egress = ["10.222.0.0/16"]
|
||
|
|
env = {
|
||
|
|
ANTHROPIC_API_KEY = "env:ANTHROPIC_API_KEY",
|
||
|
|
OPENAI_API_KEY = "env:OPENAI_API_KEY",
|
||
|
|
GEMINI_API_KEY = "env:GEMINI_API_KEY"
|
||
|
|
}
|
||
|
|
volumes = [
|
||
|
|
{ host = "{profile_dir}/opencode-config", container = "/root/.config/opencode", mode = "z" },
|
||
|
|
{ host = "{profile_dir}/opencode-share", container = "/root/.local/share/opencode", mode = "z" }
|
||
|
|
]
|