charon.toml

listen = "127.0.0.1:3129"

[realm]
id = "realm-developer"
tenant = "tenant-example"
persona = "developer"
generation = 1
# Production example:
# [upstream_proxy]
# url = "http://egress.example.internal:8888"
# username = "egress"
# password_file = "/run/credentials/egress-proxy-password"

[provider]
kind = "vaultwarden"
cli_path = "/usr/local/bin/bw"
appdata_dir = "/var/lib/charon/bitwarden-cli"
session_file = "/run/credentials/charon-vaultwarden-session"
cache_ttl_seconds = 30

[tls]
ca_certificate = "/run/charon-ca/ca.pem"
ca_private_key = "/run/credentials/charon-ca-key.pem"

[[provider.items]]
secret_ref = "github/developer"
persona = "developer"
item_id = "00000000-0000-4000-8000-000000000001"

[identity]
issuer = "example-control-plane"
audience = "charon"
# Public test key only. The corresponding private key must be held by the
# workload-identity issuer and is intentionally absent from Charon.
public_key = "11qYAYKxCrfVS/7TyWQHOg7hcvPapiMlrwIaaPcHURo="
max_ttl_seconds = 60
clock_skew_seconds = 2

[receipts]
journal_path = "/var/lib/charon/receipts.jsonl"
state_path = "/var/lib/charon/receipt-chain"
queue_capacity = 1024

[[capabilities]]
name = "github-read-user"
persona = "developer"
service = "github"
methods = ["GET"]
paths = ["/user"]

[[services]]
name = "github"
hosts = ["api.github.com"]
secret_ref = "github/developer"

[services.hydration]
kind = "authorization"
value_template = "Bearer {secret}"

[services.response]
compression = "identity-only"
max_bytes = 16777216
max_duration_seconds = 300
idle_timeout_seconds = 30
max_secret_bytes = 4096

[services.response.body]
mode = "buffered-structured"
max_bytes = 1048576
forbidden_fields = ["access_token", "refresh_token", "token", "signed_url"]