Configuration Reference

fogwall uses layered YAML configuration merged at startup. Defaults ship inside the jar; the default config file fogwall.yml, profile files and environment variable overrides are applied on top in a defined order.

A section introducing a new config surface is tagged with the release it first shipped in, e.g. _Available since v1.3.0._, right under the heading. Untagged sections predate this convention — it isn’t backfilled retroactively, only applied going forward from the section’s introduction.

Contents

• Configuration files and profiles — load order, profiles, and the bundled profile files
• Environment variable overrides — mapping a YAML key to a FOGWALL_* variable
• Server settings — ports, service URL, timeouts, and session persistence
• Secrets — the value and file forms of each sensitive key, and requiring the file form
• Local mirror cache — the local clone fogwall keeps of each upstream repo
• TLS — the HTTPS listener and trusting a custom upstream CA
• Outbound proxy — reaching upstreams through a corporate HTTP proxy
• Database — JDBC and MongoDB backends, pool tuning, connection strings
• Authentication — local, LDAP, Active Directory and OIDC sign-in, plus role mappings
• Providers — declaring the upstream SCM hosts fogwall proxies for
• SCM OAuth — linking a fogwall account to an SCM identity
• SCM API — proxying PR/MR traffic from gh, glab, tea and fj
• SSH transport — serving git-receive-pack/git-upload-pack over SSH
• Commit validation — author email policy and required commit trailers
• Diff scan — content block matchers for added lines
• Secret scanning — gitleaks configuration and binary resolution
• Binary blob detection — size and MIME-type limits on added blobs
• Content-pattern scanning — bundled recognizers for structured sensitive data
• Hot reload — which sections reload without a restart, and how to trigger one
• Commit attribution policy — requiring commits to be attributed to the pushing user
• URL rules — matching pushes by repo URL to decide what applies
• Permissions — granting users PUSH, APPROVE, PROPOSE and friends
• Groups — naming a set of users once and reusing it
• Attestations — the questions a reviewer answers before approving
• Running and logging — starting the process, log levels, and git client output
• Observability — OpenTelemetry traces and metrics over OTLP, and trace/span log correlation