howk/config.example.yaml at main · renatocron/howk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
# HOWK Configuration Example
# Copy to config.yaml and modify as needed

api:
  port: 8080
  read_timeout: 10s
  write_timeout: 10s
  max_request_size: 1048576  # 1MB

kafka:
  brokers:
    - localhost:19092
  topics:
    pending: howk.pending
    results: howk.results
    deadletter: howk.deadletter
    scripts: howk.scripts
  consumer_group: howk-workers
  retention: 168h  # 7 days
  producer_batch_size: 16384
  producer_linger_ms: 50
  producer_compression: snappy  # none, gzip, snappy, lz4, zstd
  consumer_fetch_min_bytes: 1
  consumer_fetch_max_wait: 500ms

redis:
  addr: localhost:6379
  password: ""
  db: 0
  pool_size: 100
  min_idle_conns: 10
  dial_timeout: 5s
  read_timeout: 3s
  write_timeout: 3s

delivery:
  timeout: 30s
  max_idle_conns: 100
  max_conns_per_host: 10
  idle_conn_timeout: 90s
  tls_handshake_timeout: 10s
  user_agent: "HOWK/1.0"
  dump_requests: false  # debug: log exact outgoing request (headers+body) after Lua/overrides/signing

retry:
  base_delay: 10s
  max_delay: 24h
  max_attempts: 20
  jitter: 0.2  # ±20%

circuit_breaker:
  failure_threshold: 5        # failures before opening circuit
  failure_window: 60s         # window for counting failures
  recovery_timeout: 5m        # time before transitioning to half-open
  probe_interval: 60s         # time between probe requests in half-open
  success_threshold: 2        # successes needed to close circuit

scheduler:
  poll_interval: 1s
  batch_size: 500
  lock_timeout: 30s

# TTL configuration for Redis keys
ttl:
  circuit_state_ttl: 24h     # Circuit breaker state TTL
  status_ttl: 168h           # Webhook status TTL (7 days)
  stats_ttl: 48h             # Statistics TTL
  idempotency_ttl: 24h       # Idempotency key TTL

# Lua Script Engine configuration
lua:
  enabled: false             # Feature flag - must be explicitly enabled
  timeout: 500ms             # Script execution timeout
  memory_limit_mb: 50        # Memory limit per script execution
  allowed_hosts:             # HTTP module hostname allowlist
    - "*"                    # Allow all by default (use specific hosts in production)
  crypto_keys:               # RSA private keys for credential decryption
    # Example:
    # PAYMENT_KEY: /etc/howk/keys/payment.pem
    # API_KEY: /etc/howk/keys/api.pem
  http_timeout: 5s           # Timeout for HTTP module requests
  kv_ttl_default: 24h        # Default TTL for KV module storage

# Dead Letter Queue configuration
# Controls what is persisted to the `howk.deadletter` topic. Defaults are safe:
# secret-bearing headers are redacted and the first 1KB of the endpoint
# response body is attached (helpful for diagnosing 4xx errors).
dlq:
  # Optional FULL OVERRIDE of the built-in redact list (case-insensitive).
  # Built-in defaults (used when this is empty/unset):
  #   Authorization, Proxy-Authorization, Cookie, Set-Cookie, X-API-Key, X-Auth-Token
  # Setting this replaces the defaults entirely — include Authorization yourself.
  # redact_headers:
  #   - Authorization
  #   - X-Tenant-Secret

  disable_redaction: false        # Turn off header redaction entirely (full request fidelity, no masking)
  include_response_body: true     # Attach first 1KB of endpoint response body to DLQ records