zeroid/zeroid.yaml at main · highflame-ai/zeroid · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
# ZeroID — Sample Configuration for Local Development
# Override any value via ZEROID_* environment variables.

server:
  port: "8899"
  # env gates production-only safety checks in Validate(): when set to
  # "production" (or "prod"), ZeroID refuses to start with the unsafe dev
  # attestation stub on or with the built-in default issuer / wimse_domain
  # left unchanged. Leave as "development" for local/test.
  env: development
  read_timeout: "15s"
  write_timeout: "15s"
  idle_timeout: "60s"
  shutdown_timeout_seconds: 30
  # Trust X-Forwarded-Proto / X-Forwarded-Host when reconstructing the
  # request URL for DPoP htu validation (RFC 9449 §4.3). Set true ONLY
  # behind a trusted edge proxy that strips client-supplied values;
  # leave false when ZeroID terminates TLS itself. Env: ZEROID_TRUST_FORWARDED_HEADERS
  trust_forwarded_headers: false

database:
  url: "postgres://zeroid:zeroid@localhost:5432/zeroid?sslmode=disable"
  max_open_conns: 25
  max_idle_conns: 5
  auto_migrate: true  # Set to false in production — use zeroid.Migrate() or MigrationFiles() instead

keys:
  private_key_path: "./keys/private.pem"
  public_key_path: "./keys/public.pem"
  key_id: "zeroid-key-1"
  # RSA keys (needed for api_key grant and RS256 token flows)
  rsa_private_key_path: "./keys/rsa_private.pem"
  rsa_public_key_path: "./keys/rsa_public.pem"
  rsa_key_id: "v1"

token:
  # Issuer is the canonical URL of this AS — the JWT iss claim, the
  # RFC 8414 §3 discovery anchor, AND the URL prefix for every endpoint
  # advertised in AS metadata / PRM / RFC 7592 registration_client_uri.
  #
  # This file is the local-dev sample; localhost:8899 matches where
  # `make run` actually serves. Production deployments override via
  # ZEROID_ISSUER (Helm/Terraform) to their public URL — e.g.
  # https://auth.highflame.ai for the hosted Highflame instance.
  #
  # The code default in loadDefaults() is https://auth.highflame.ai;
  # YAML overrides it for `make run`, env vars override both.
  issuer: "http://localhost:8899"
  default_ttl: 3600
  max_ttl: 7776000  # 90 days
  # hmac_secret signs/verifies stateless authorization_code JWTs (HS256).
  # Only needed if the authorization_code grant is enabled. When set it
  # MUST be at least 32 bytes (Validate() rejects shorter secrets — a short
  # secret is forgeable, and a leak forges auth codes). Prefer the env var
  # ZEROID_HMAC_SECRET over committing a secret to YAML.
  # hmac_secret: ""

  # allow_unauthenticated_token_inspection controls whether the introspection
  # (RFC 7662) and revocation (RFC 7009) endpoints accept anonymous callers.
  # true  → accept-and-verify: anonymous allowed, presented client credentials
  #         still verified. Suitable for a standalone, network-isolated
  #         deployment or local development.
  # false → strict: a caller MUST present client credentials; anonymous calls
  #         are rejected with invalid_client (RFC 7662 §2.1 / RFC 7009 §2.1).
  # Default true, BUT Validate() rejects true when server.env=production, so
  # production is spec-compliant (strict) by default. Env override:
  # ZEROID_ALLOW_UNAUTHENTICATED_TOKEN_INSPECTION.
  allow_unauthenticated_token_inspection: true

wimse_domain: "highflame.ai"

# Admin routes (/api/v1/*) have no built-in auth.
# In production, protect them at the network layer (reverse proxy, VPN, firewall)
# or use the AdminAuth hook when embedding ZeroID as a library.

telemetry:
  enabled: false
  service_name: "zeroid"
  sampling_rate: 1.0
  # NOTE: exporter endpoint / TLS are NOT configured here. They are read
  # by the OTel SDK from the standard env vars OTEL_EXPORTER_OTLP_ENDPOINT
  # and OTEL_EXPORTER_OTLP_INSECURE. The old telemetry.endpoint /
  # telemetry.insecure keys were removed — setting them now fails startup.

logging:
  level: "debug"

# Attestation verification. The OIDC verifier is always wired and runs
# fail-closed. The dev stub backs up image_hash and tpm proof types
# (whose real verifiers haven't shipped yet) so demos and smoke tests
# that submit those keep working — a WARN log prints on startup whenever
# it's active. Deployments that don't use those proof types, or where
# the real verifiers have landed, should set this to false (or via
# ZEROID_ALLOW_UNSAFE_DEV_STUB=false).
attestation:
  allow_unsafe_dev_stub: true
  # Relaxes the SSRF guard the OIDC verifier applies to a proof's issuer
  # endpoint (the URL it fetches OIDC discovery + JWKS from). Default false
  # rejects issuers resolving to private/loopback/link-local IPs. Set true
  # ONLY in single-tenant dev/test where the attestation issuer is itself
  # on localhost / a private network. Production MUST keep this false.
  # Env: ZEROID_ATTESTATION_ALLOW_PRIVATE_ISSUER_ENDPOINTS
  allow_private_issuer_endpoints: false

# CIBA (OpenID Client-Initiated Backchannel Authentication) settings.
backchannel:
  # Relaxes the SSRF guard on CIBA outbound client_notification_endpoint
  # destinations. Default false rejects endpoints resolving to
  # private/loopback/link-local IPs (re-checked at request time as a
  # DNS-rebinding defense). Set true ONLY in single-tenant dev/test that
  # registers endpoints like https://localhost:9000/. Production MUST keep
  # this false (see GHSA-599q-j34m-33vc).
  # Env: ZEROID_BACKCHANNEL_ALLOW_PRIVATE_ENDPOINTS
  allow_private_notification_endpoints: false

# CIMD — Client ID Metadata Documents (draft-ietf-oauth-client-id-metadata-document).
# Lets an OAuth client onboard with ZERO pre-registration by using a stable
# https:// URL as its client_id. On the authorization_code flow, ZeroID fetches
# and validates the JSON metadata document published at that URL and treats it as
# an ephemeral public PKCE client. This is the MCP Authorization 2025-11-25
# preferred default for open agent ecosystems. See docs/cimd.md.
cimd:
  # On by default so agents can onboard against this AS without registration.
  # Env: ZEROID_CIMD_ENABLED
  enabled: true
  # PRODUCTION HARDENING LEVER. Allowlist of client_id hosts (exact,
  # case-insensitive); a host not in the list is rejected BEFORE any outbound
  # fetch. Empty (default) = any public HTTPS host, so ZeroID will fetch
  # arbitrary attacker-supplied URLs (SSRF-guarded/capped, but still outbound).
  # Set this to the hosts you trust to run CIMD as a closed ecosystem —
  # recommended for enterprise/closed deployments. Leave empty only for open
  # agent ecosystems, and rate-limit /oauth2/authorize at the edge. YAML only.
  # allowed_domains: ["client.example.com", "apps.acme.dev"]
  #
  # Relaxes the SSRF guard on the metadata-document fetch. Default false rejects
  # client_id URLs resolving to private/loopback/link-local/metadata ranges
  # (DNS-rebinding-safe dialer). Set true ONLY in single-tenant dev/test that
  # publishes documents on localhost / a private network. Production MUST keep
  # this false.
  # Env: ZEROID_CIMD_ALLOW_PRIVATE_ENDPOINTS
  allow_private_metadata_endpoints: false
  # Fetch size cap (bytes) and resolved-client cache lifetime (seconds).
  # Defaults: 5120 bytes, 3600 s (cache clamped to a 24 h hard cap).
  # Env: ZEROID_CIMD_MAX_DOCUMENT_BYTES / ZEROID_CIMD_CACHE_TTL_SECONDS
  # max_document_bytes: 5120
  # cache_ttl_seconds: 3600

# Direct OIDC IdP federation (issue #88).
# Each entry registers a trusted upstream issuer for RFC 8693 token exchange
# with subject_token_type=urn:ietf:params:oauth:token-type:id_token.
# When empty (default), only the broker path remains available.
# external_issuers:
#   - issuer:           "https://auth.example.okta.com"
#     jwks_uri:         "https://auth.example.okta.com/.well-known/jwks.json"
#     audience:         "https://zeroid.example.com"
#     algorithms:       ["RS256", "ES256"]
#     max_token_age:    10m
#     jwks_cache_ttl:   5m
#     claim_mapping:
#       user_id:        sub
#       email:          email
#     allowed_accounts: ["acct_123"]   # REQUIRED, non-empty: the tenants this IdP serves. An empty list is rejected at startup (it would let a token issued for one tenant be exchanged under another)
#     propagate_claims: ["auth_time", "acr", "amr"]
#     allow_private_endpoints: false  # true ONLY for an internal/VPN IdP or localhost dev — relaxes the SSRF guard on the jwks_uri fetch