Configuration Presets

# Vectra Guard - Developer Preset
# Optimized for local development with minimal friction

guard_level:
  level: auto  # Auto-detect context (low in dev, high in prod)
  allow_user_bypass: true

sandbox:
  enabled: true
  mode: auto  # Smart sandboxing based on risk
  security_level: permissive  # Minimal isolation for speed
  runtime: docker
  image: ubuntu:22.04
  timeout: 600  # 10 minutes for long builds
  enable_cache: true
  network_mode: full  # No network restrictions
  enable_metrics: true
  
policies:
  monitor_git_ops: true
  block_force_git: false  # Allow force push in dev
  detect_prod_env: true
  only_destructive_sql: true
  
  allowlist:
    - "npm install"
    - "npm run"
    - "npm test"
    - "yarn install"
    - "pip install"
    - "go install"
    - "cargo build"
    - "make"

logging:
  format: text  # Human-readable for development

env_protection:
  enabled: false  # Don't block env access in dev

# Vectra Guard - CI/CD Preset
# Balanced protection for automated pipelines

guard_level:
  level: high  # Strong protection but allow automation
  allow_user_bypass: false  # No interactive prompts in CI

sandbox:
  enabled: true
  mode: always  # Sandbox everything for reproducible builds
  security_level: strict  # Strong isolation
  runtime: docker
  image: ubuntu:22.04
  timeout: 900  # 15 minutes for CI builds
  enable_cache: true  # Speed up CI with caching
  network_mode: restricted  # Allow outbound, block inbound
  enable_metrics: true
  
policies:
  monitor_git_ops: true
  block_force_git: true
  detect_prod_env: true
  only_destructive_sql: true
  
  allowlist:
    - "npm ci"
    - "npm test"
    - "npm run build"
    - "pip install -r requirements.txt"
    - "cargo test"
    - "go test"
    - "make test"
    - "docker build"

logging:
  format: json  # Structured logs for CI parsing

env_protection:
  enabled: true
  masking_mode: partial
  block_dotenv_read: true
  block_env_access: false  # Allow env in CI

# Vectra Guard - Production Preset
# Maximum protection for production environments

guard_level:
  level: paranoid  # Require approval for everything
  allow_user_bypass: false  # No bypasses in production

sandbox:
  enabled: true
  mode: always  # Always sandbox, no exceptions
  security_level: paranoid  # Maximum isolation
  runtime: docker
  image: ubuntu:22.04
  timeout: 300
  enable_cache: false  # No caching for reproducibility
  network_mode: none  # No network access
  enable_metrics: true
  
policies:
  monitor_git_ops: true
  block_force_git: true  # Block force push
  detect_prod_env: true
  only_destructive_sql: false  # Flag all SQL
  
  denylist:
    - "rm -rf"
    - "sudo"
    - "DROP DATABASE"
    - "DROP TABLE"
    - "git push --force"

logging:
  format: json  # Structured logging for production

env_protection:
  enabled: true
  masking_mode: full  # Full masking of sensitive vars
  block_dotenv_read: true
  block_env_access: true

# Fast Development Configuration - Namespace-Based Sandboxing
# Provides native performance with strong security

guard_level:
  level: high
  allow_user_bypass: true

sandbox:
  enabled: true
  mode: auto
  
  # Runtime configuration - auto-select fastest
  runtime: auto                # Try bubblewrap → namespace → docker
  auto_detect_env: true        # Auto-detect dev environment
  prefer_fast: true            # Prefer fast runtimes
  
  # Network and caching
  allow_network: false         # Block network for safety
  enable_cache: true           # Essential for dev workflow
  use_overlayfs: true          # Isolate /tmp with OverlayFS
  
  # Security (balanced for dev)
  seccomp_profile: moderate    # Block dangerous syscalls
  capability_set: minimal      # Drop dangerous capabilities
  
  # Observability
  show_runtime_info: true      # Show selected runtime
  enable_metrics: true
  log_output: false

policies:
  monitor_git_ops: true
  block_force_git: true
  only_destructive_sql: true
  
  # Comprehensive denylist
  denylist:
    # System destruction
    - "rm -rf /"
    - "rm -r /*"
    - "rm -rf /*"
    - "rm -rf /bin"
    - "rm -rf /usr"
    - "rm -rf /etc"
    
    # Home directory
    - "rm -rf ~/*"
    - "rm -rf $HOME/*"
    
    # Dangerous operations
    - ":(){ :|:& };:"
    - "dd if=/dev/zero"
    - "mkfs"
    
    # Network exploits
    - "curl * | sh"
    - "curl * | bash"
    - "wget * | sh"
    - "wget * | bash"

# CI/CD Optimized Configuration
# Uses Docker for consistency, with caching enabled

guard_level:
  level: paranoid
  allow_user_bypass: false

sandbox:
  enabled: true
  mode: always              # Always sandbox in CI
  
  # Runtime configuration - Docker for consistency
  runtime: docker           # Use Docker for maximum compatibility
  image: ubuntu:22.04
  timeout: 600              # 10 minutes max
  
  # Network and caching
  allow_network: true       # CI often needs network
  enable_cache: true        # Speed up CI runs
  
  # Security (strict for CI)
  seccomp_profile: strict   # Block all dangerous syscalls
  capability_set: none      # Drop all capabilities
  
  # Observability
  show_runtime_info: true   # Show what's happening
  enable_metrics: true
  log_output: true          # Log all output

policies:
  monitor_git_ops: true
  block_force_git: true
  detect_prod_env: true
  only_destructive_sql: true
  
  # Comprehensive denylist
  denylist:
    - "rm -rf /"
    - "rm -r /*"
    - "rm -rf /*"
    - "rm -rf ~/*"
    - ":(){ :|:& };:"
    - "curl * | sh"
    - "wget * | sh"