إعدادات مسبقة

نظرة سريعة

تقوم Decision Gate بشحن أربعة إعدادات مسبقة مختارة لتحقيق توازن بين سرعة الانضمام ووضع الأمان. اختر واحدة، قم بتشغيلها، ثم انتقل إلى التالية.

الإعدادات المسبقة	النية	المسار
Quickstart-Dev	أقل احتكاك في التهيئة المحلية	configs/presets/quickstart-dev.toml
Default-Recommended	استخدام محلي آمن بشكل افتراضي	configs/presets/default-recommended.toml
Container-Prod	قاعدة خادم محوسب (مصادقة حامل، TLS علوية)	configs/presets/container-prod.toml
Hardened	موقف أمني محلي قوي (مصادقة حامل + توقيع)	configs/presets/hardened.toml

مهم: كل إعداد قابل للتشغيل. للتعرض في الإنتاج، استخدم TLS (داخل الحاوية أو إنهاء البيانات في المنبع) وmTLS كما هو موضح في دليل الأمان.

---

بدء سريع - تطوير (أقل احتكاك)

شغله:

cargo run -p decision-gate-cli -- serve --config configs/presets/quickstart-dev.toml

الإعداد:

# Decision Gate preset: Quickstart-Dev
# Lowest-friction local setup for first-time users.
# NOT for shared machines or production.

[server]
transport = "http"
bind = "127.0.0.1:4000"
mode = "strict"

[server.auth]
mode = "local_only"

[dev]
permissive = true
permissive_warn = true

[namespace]
allow_default = true
default_tenants = [1]

[trust]
# Audit mode (no signature enforcement).
default_policy = "audit"
min_lane = "verified"

[evidence]
allow_raw_values = false
require_provider_opt_in = true

[schema_registry]
type = "sqlite"
path = "decision-gate-registry.db"

[schema_registry.acl]
# Allow local-only registry access without explicit principal mappings.
allow_local_only = true
require_signing = false

[run_state_store]
# Use SQLite for local durability.
type = "sqlite"
path = "decision-gate.db"
journal_mode = "wal"
sync_mode = "full"
busy_timeout_ms = 5000

[[providers]]
name = "time"
type = "builtin"

[[providers]]
name = "env"
type = "builtin"

[[providers]]
name = "json"
type = "builtin"
config = { root = "./evidence", root_id = "evidence-root", max_bytes = 1048576, allow_yaml = true }

[[providers]]
name = "http"
type = "builtin"

وضع المخاطر: تم تمكين تجاوز محلي فقط للوصول إلى السجل. هذا مناسب لجهاز مستخدم واحد ولكنه غير مناسب للمضيفين المشتركين.

ملاحظة: تفترض هذه الإعدادات المسبقة وجود دليل ./evidence لجذر موفر json. قم بإنشائه (أو تغيير root) قبل بدء الخادم.

---

افتراضي-موصى به (افتراضي محلي آمن)

شغله:

cargo run -p decision-gate-cli -- serve --config configs/presets/default-recommended.toml

الإعداد:

# Decision Gate preset: Default-Recommended
# Safe-by-default local configuration with explicit principal mapping.

[server]
transport = "http"
bind = "127.0.0.1:4000"
mode = "strict"

[server.auth]
mode = "local_only"

[[server.auth.principals]]
subject = "loopback"
policy_class = "prod"

[[server.auth.principals.roles]]
name = "TenantAdmin"
tenant_id = 1
namespace_id = 1

[namespace]
allow_default = true
default_tenants = [1]

[trust]
# Audit mode (no signature enforcement).
default_policy = "audit"
min_lane = "verified"

[evidence]
allow_raw_values = false
require_provider_opt_in = true

[schema_registry]
type = "sqlite"
path = "decision-gate-registry.db"

[schema_registry.acl]
# Enforce principal mapping even for local-only requests.
allow_local_only = false
require_signing = false

[run_state_store]
# Use SQLite for local durability.
type = "sqlite"
path = "decision-gate.db"
journal_mode = "wal"
sync_mode = "full"
busy_timeout_ms = 5000

[[providers]]
name = "time"
type = "builtin"

[[providers]]
name = "env"
type = "builtin"

[[providers]]
name = "json"
type = "builtin"
config = { root = "./evidence", root_id = "evidence-root", max_bytes = 1048576, allow_yaml = true }

[[providers]]
name = "http"
type = "builtin"

---

حاوية-الإنتاج (خط الأساس للحاوية)

شغله:

DECISION_GATE_ALLOW_NON_LOOPBACK=1 cargo run -p decision-gate-cli -- serve \
  --config configs/presets/container-prod.toml

الإعداد:

# Decision Gate preset: Container-Prod
# Production-oriented container configuration.
# Requires explicit auth and upstream TLS termination.

[server]
transport = "http"
bind = "0.0.0.0:8080"
mode = "strict"
tls_termination = "upstream"

[server.auth]
mode = "bearer_token"
# Replace this token and update the principal subject hash below.
bearer_tokens = ["dg-container-demo-token"]

[[server.auth.principals]]
# Subject is token:sha256(bearer_token). Update when rotating the token.
subject = "token:5e268e45a49c26207274917a880f33eafbf6e98563170d0bfe1504408d33d18c"
policy_class = "prod"

[[server.auth.principals.roles]]
name = "TenantAdmin"
tenant_id = 1

[namespace]
# Disable the default namespace id=1; use a non-default namespace (e.g., 2).
allow_default = false

[trust]
# Audit mode (no signature enforcement).
default_policy = "audit"
min_lane = "verified"

[evidence]
allow_raw_values = false
require_provider_opt_in = true

[schema_registry]
type = "memory"

[schema_registry.acl]
allow_local_only = false
require_signing = false

[run_state_store]
type = "memory"

[[providers]]
name = "time"
type = "builtin"

[[providers]]
name = "env"
type = "builtin"

[[providers]]
name = "json"
type = "builtin"
config = { root = "./evidence", root_id = "evidence-root", max_bytes = 1048576, allow_yaml = true }

[[providers]]
name = "http"
type = "builtin"

وضع المخاطر: يتطلب مصادقة صريحة؛ يُفترض إنهاء TLS في المنبع. انظر Docs/guides/container_deployment.md للحصول على إرشادات النشر.

---

مُعزَّز (مصادقة الحامل + التوقيع)

شغله:

cargo run -p decision-gate-cli -- serve --config configs/presets/hardened.toml

الإعداد:

# Decision Gate preset: Hardened
# Strong local security posture. For production, add TLS + mTLS.

[server]
transport = "http"
bind = "127.0.0.1:4000"
mode = "strict"

[server.auth]
mode = "bearer_token"
# Replace this token and update the principal subject hash below.
bearer_tokens = ["dg-hardened-demo-token"]

[[server.auth.principals]]
# Subject is token:sha256(bearer_token). Update when rotating the token.
subject = "token:73a7ceabc74caaa14553ad02540165ba8ad8b709f15e6503b8879552f22042a1"
policy_class = "prod"

[[server.auth.principals.roles]]
name = "TenantAdmin"
tenant_id = 1

[namespace]
# Disable the default namespace id=1; use a non-default namespace (e.g., 2).
allow_default = false

[trust]
# Audit mode (no signature enforcement).
default_policy = "audit"
min_lane = "verified"

[evidence]
allow_raw_values = false
require_provider_opt_in = true

[schema_registry]
type = "sqlite"
path = "decision-gate-registry.db"

[schema_registry.acl]
# Require signatures for schema registry writes.
allow_local_only = false
require_signing = true

[run_state_store]
# Use SQLite for local durability.
type = "sqlite"
path = "decision-gate.db"
journal_mode = "wal"
sync_mode = "full"
busy_timeout_ms = 5000

[[providers]]
name = "time"
type = "builtin"

[[providers]]
name = "env"
type = "builtin"

[[providers]]
name = "json"
type = "builtin"
config = { root = "./evidence", root_id = "evidence-root", max_bytes = 1048576, allow_yaml = true }

[[providers]]
name = "http"
type = "builtin"

تحديث خريطة المبدأ لرمز الحامل

قم بإنشاء سلسلة الموضوع token:<sha256> عند تغيير الرمز:

python3 - <<'PY'
import hashlib

token = "your-token"
print("token:" + hashlib.sha256(token.encode()).hexdigest())
PY

---

تعيين سلوك الإعدادات المسبقة

كل إعداد مسبق يحدد عمدًا نفس الأقسام الأساسية بحيث يكون السلوك واضحًا:

• المصادقة: server.auth (محلي فقط مقابل رمز الحامل)
• إذن التسجيل: schema_registry.acl (تجاوز محلي فقط مقابل مفروض)
• سياسة مساحة الأسماء: namespace.allow_default
• وضع الثقة: trust و dev.permissive
• التحمل: run_state_store و schema_registry واجهات SQLite
• إنهاء TLS: server.tls_termination (الخادم مقابل المصب)

إذا قمت بتغيير أحد هذه الأقسام، قم بتحديث الإعداد المسبق والتوقعات المقابلة في system-tests/tests/suites/presets.rs.