394 lines
11 KiB
JSON
394 lines
11 KiB
JSON
{
|
|
"schema": "awoooi_signoz_metadata_export_policy_v1",
|
|
"policy_version": "2026-07-22",
|
|
"work_item_id": "P0-OBS-002",
|
|
"source_runtime": {
|
|
"canonical_id": "signoz-110-control-plane",
|
|
"signoz_version": "v0.113.0",
|
|
"minimum_python_version": "3.10",
|
|
"raw_database_access_allowed": false,
|
|
"raw_volume_access_allowed": false,
|
|
"github_supply_chain_allowed": false
|
|
},
|
|
"authentication": {
|
|
"header_name": "SIGNOZ-API-KEY",
|
|
"secret_value_in_arguments_allowed": false,
|
|
"secret_reference_type": "root_owned_regular_file",
|
|
"accepted_file_modes": [
|
|
"0400",
|
|
"0600"
|
|
]
|
|
},
|
|
"limits": {
|
|
"request_timeout_seconds": 15,
|
|
"max_response_bytes": 4194304,
|
|
"max_asset_count": 16,
|
|
"max_items_per_asset": 1000,
|
|
"max_restore_actions": 500,
|
|
"stable_read_count": 2
|
|
},
|
|
"forbidden_key_names": [
|
|
"access_key",
|
|
"access_token",
|
|
"api_key",
|
|
"authorization",
|
|
"client_secret",
|
|
"cookie",
|
|
"credential",
|
|
"password",
|
|
"private_key",
|
|
"refresh_token",
|
|
"routing_key",
|
|
"secret",
|
|
"service_account_json",
|
|
"session",
|
|
"token",
|
|
"webhook_url"
|
|
],
|
|
"forbidden_value_patterns": [
|
|
"-----BEGIN [A-Z ]*PRIVATE KEY-----",
|
|
"(?i)\\bBearer\\s+[A-Za-z0-9._~+/-]{16,}={0,2}\\b",
|
|
"(?i)https?://[^/@\\s]+:[^/@\\s]+@"
|
|
],
|
|
"forbidden_endpoints": [
|
|
{
|
|
"id": "personal_access_tokens",
|
|
"path": "/api/v1/pats",
|
|
"reason": "response may contain an API token"
|
|
},
|
|
{
|
|
"id": "authentication_domains",
|
|
"path": "/api/v1/domains",
|
|
"reason": "response may contain OIDC or Google client secrets"
|
|
},
|
|
{
|
|
"id": "notification_channels",
|
|
"path": "/api/v1/channels",
|
|
"reason": "response may contain webhook and routing credentials"
|
|
},
|
|
{
|
|
"id": "users_and_credentials",
|
|
"path": "/api/v1/user",
|
|
"reason": "credential lifecycle is reconstructed, not exported"
|
|
},
|
|
{
|
|
"id": "invitations",
|
|
"path": "/api/v1/invite",
|
|
"reason": "invitation tokens are non-portable credentials"
|
|
},
|
|
{
|
|
"id": "sessions",
|
|
"path": "/api/v1/sessions",
|
|
"reason": "sessions are explicitly outside backup scope"
|
|
}
|
|
],
|
|
"assets": [
|
|
{
|
|
"id": "dashboards",
|
|
"endpoint": "/api/v1/dashboards",
|
|
"method": "GET",
|
|
"response_pointer": "/data",
|
|
"response_kind": "collection",
|
|
"classification": "portable",
|
|
"restore": {
|
|
"method": "POST",
|
|
"endpoint": "/api/v1/dashboards",
|
|
"strategy": "collection_items",
|
|
"strip_top_level_fields": [
|
|
"createdAt",
|
|
"id",
|
|
"orgId",
|
|
"updatedAt",
|
|
"uuid"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "alert_rules",
|
|
"endpoint": "/api/v1/rules",
|
|
"method": "GET",
|
|
"response_pointer": "/data/rules",
|
|
"response_kind": "collection",
|
|
"classification": "portable",
|
|
"restore": {
|
|
"method": "POST",
|
|
"endpoint": "/api/v1/rules",
|
|
"strategy": "collection_items",
|
|
"strip_top_level_fields": [
|
|
"createdAt",
|
|
"id",
|
|
"orgId",
|
|
"updatedAt"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "explorer_views_logs",
|
|
"endpoint": "/api/v1/explorer/views",
|
|
"query_parameters": {
|
|
"sourcePage": "logs"
|
|
},
|
|
"method": "GET",
|
|
"response_pointer": "/data",
|
|
"response_kind": "collection",
|
|
"empty_collection_sentinels": [
|
|
"null",
|
|
"empty_object"
|
|
],
|
|
"classification": "portable",
|
|
"restore": {
|
|
"method": "POST",
|
|
"endpoint": "/api/v1/explorer/views",
|
|
"strategy": "collection_items",
|
|
"strip_top_level_fields": [
|
|
"createdAt",
|
|
"id",
|
|
"orgId",
|
|
"updatedAt",
|
|
"userId"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "explorer_views_meter",
|
|
"endpoint": "/api/v1/explorer/views",
|
|
"query_parameters": {
|
|
"sourcePage": "meter"
|
|
},
|
|
"method": "GET",
|
|
"response_pointer": "/data",
|
|
"response_kind": "collection",
|
|
"empty_collection_sentinels": [
|
|
"null",
|
|
"empty_object"
|
|
],
|
|
"classification": "portable",
|
|
"restore": {
|
|
"method": "POST",
|
|
"endpoint": "/api/v1/explorer/views",
|
|
"strategy": "collection_items",
|
|
"strip_top_level_fields": [
|
|
"createdAt",
|
|
"id",
|
|
"orgId",
|
|
"updatedAt",
|
|
"userId"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "explorer_views_metrics",
|
|
"endpoint": "/api/v1/explorer/views",
|
|
"query_parameters": {
|
|
"sourcePage": "metrics"
|
|
},
|
|
"method": "GET",
|
|
"response_pointer": "/data",
|
|
"response_kind": "collection",
|
|
"empty_collection_sentinels": [
|
|
"null",
|
|
"empty_object"
|
|
],
|
|
"classification": "portable",
|
|
"restore": {
|
|
"method": "POST",
|
|
"endpoint": "/api/v1/explorer/views",
|
|
"strategy": "collection_items",
|
|
"strip_top_level_fields": [
|
|
"createdAt",
|
|
"id",
|
|
"orgId",
|
|
"updatedAt",
|
|
"userId"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "explorer_views_traces",
|
|
"endpoint": "/api/v1/explorer/views",
|
|
"query_parameters": {
|
|
"sourcePage": "traces"
|
|
},
|
|
"method": "GET",
|
|
"response_pointer": "/data",
|
|
"response_kind": "collection",
|
|
"empty_collection_sentinels": [
|
|
"null",
|
|
"empty_object"
|
|
],
|
|
"classification": "portable",
|
|
"restore": {
|
|
"method": "POST",
|
|
"endpoint": "/api/v1/explorer/views",
|
|
"strategy": "collection_items",
|
|
"strip_top_level_fields": [
|
|
"createdAt",
|
|
"id",
|
|
"orgId",
|
|
"updatedAt",
|
|
"userId"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "roles",
|
|
"endpoint": "/api/v1/roles",
|
|
"method": "GET",
|
|
"response_pointer": "/data",
|
|
"response_kind": "collection",
|
|
"classification": "export_only",
|
|
"coverage_gap": "role relation objects require a separately bounded enumerator"
|
|
},
|
|
{
|
|
"id": "organization_preferences",
|
|
"endpoint": "/api/v1/org/preferences",
|
|
"method": "GET",
|
|
"response_pointer": "/data",
|
|
"response_kind": "collection",
|
|
"classification": "export_only",
|
|
"coverage_gap": "preference names require a reviewed per-name restore allowlist"
|
|
},
|
|
{
|
|
"id": "user_preferences",
|
|
"endpoint": "/api/v1/user/preferences",
|
|
"method": "GET",
|
|
"response_pointer": "/data",
|
|
"response_kind": "collection",
|
|
"classification": "export_only",
|
|
"coverage_gap": "principal-scoped preferences are not portable without identity reconstruction"
|
|
},
|
|
{
|
|
"id": "global_config",
|
|
"endpoint": "/api/v1/global/config",
|
|
"method": "GET",
|
|
"response_pointer": "/data",
|
|
"response_kind": "document",
|
|
"classification": "export_only",
|
|
"coverage_gap": "readback-only configuration has no supported write endpoint"
|
|
}
|
|
],
|
|
"restore_isolation": {
|
|
"target_url_scope": "loopback_only",
|
|
"required_image_ref": "signoz/signoz:v0.113.0",
|
|
"required_image_id": "sha256:c17991d10966aedcb0d4d83805a0baf5310f1553d90611629036fcfaee8d969b",
|
|
"image_id_sha256_required": true,
|
|
"images": {
|
|
"signoz": {
|
|
"ref": "signoz/signoz:v0.113.0",
|
|
"id": "sha256:c17991d10966aedcb0d4d83805a0baf5310f1553d90611629036fcfaee8d969b"
|
|
},
|
|
"clickhouse": {
|
|
"ref": "clickhouse/clickhouse-server:25.5.6",
|
|
"id": "sha256:8248e5926d7304400e44ecdf0c7181fbde28e6a9b1d647780eca839f34c00cc6"
|
|
},
|
|
"zookeeper": {
|
|
"ref": "signoz/zookeeper:3.7.1",
|
|
"id": "sha256:3ab0e8f032ab58f14ac1e929ac40305a4a464cf320bdfe4151d62d6922729ba0"
|
|
}
|
|
},
|
|
"startup_contract": {
|
|
"reviewed": true,
|
|
"review_source": "agent99_typed_live_nonsecret_preflight_2026-07-22",
|
|
"server_entrypoint": [
|
|
"./signoz",
|
|
"server"
|
|
],
|
|
"server_environment": {
|
|
"SIGNOZ_TELEMETRYSTORE_CLICKHOUSE_DSN": "tcp://clickhouse:9000",
|
|
"SIGNOZ_SQLSTORE_SQLITE_PATH": "/var/lib/signoz/signoz.db"
|
|
},
|
|
"server_data_mount_destination": "/var/lib/signoz",
|
|
"clickhouse_network_alias": "clickhouse",
|
|
"zookeeper_network_alias": "restore-zookeeper",
|
|
"required_production_key_presence": [
|
|
"SIGNOZ_TELEMETRYSTORE_CLICKHOUSE_DSN",
|
|
"SIGNOZ_SQLSTORE_SQLITE_PATH"
|
|
],
|
|
"production_dsn_class": "tcp://clickhouse:9000*",
|
|
"production_sqlite_path": "/var/lib/signoz/signoz.db",
|
|
"secret_value_output_allowed": false,
|
|
"full_environment_output_allowed": false
|
|
},
|
|
"resource_prefix": "awoooi-signoz-md-restore-",
|
|
"canonical_id_prefix": "ephemeral-signoz-metadata-restore-",
|
|
"secondary_resource_label_key": "com.awoooi.restore.identity",
|
|
"private_workspace_parent": "/tmp",
|
|
"server_container_port": 8080,
|
|
"loopback_publish_host": "127.0.0.1",
|
|
"resource_limits": {
|
|
"zookeeper": {
|
|
"cpus": "0.50",
|
|
"nano_cpus": 500000000,
|
|
"memory": "512m",
|
|
"memory_bytes": 536870912,
|
|
"memory_swap": "512m",
|
|
"memory_swap_bytes": 536870912,
|
|
"pids_limit": 128
|
|
},
|
|
"clickhouse": {
|
|
"cpus": "2.00",
|
|
"nano_cpus": 2000000000,
|
|
"memory": "2g",
|
|
"memory_bytes": 2147483648,
|
|
"memory_swap": "2g",
|
|
"memory_swap_bytes": 2147483648,
|
|
"pids_limit": 512
|
|
},
|
|
"signoz": {
|
|
"cpus": "1.00",
|
|
"nano_cpus": 1000000000,
|
|
"memory": "1g",
|
|
"memory_bytes": 1073741824,
|
|
"memory_swap": "1g",
|
|
"memory_swap_bytes": 1073741824,
|
|
"pids_limit": 256
|
|
}
|
|
},
|
|
"resource_log_config": {
|
|
"type": "local",
|
|
"max_size": "10m",
|
|
"max_file": "2"
|
|
},
|
|
"isolated_cluster_config": "isolated-cluster.xml",
|
|
"production_continuity": {
|
|
"signoz": {
|
|
"container": "signoz",
|
|
"image_ref": "signoz/signoz:v0.113.0",
|
|
"image_id": "sha256:c17991d10966aedcb0d4d83805a0baf5310f1553d90611629036fcfaee8d969b"
|
|
},
|
|
"clickhouse": {
|
|
"container": "signoz-clickhouse",
|
|
"image_ref": "clickhouse/clickhouse-server:25.5.6",
|
|
"image_id": "sha256:8248e5926d7304400e44ecdf0c7181fbde28e6a9b1d647780eca839f34c00cc6"
|
|
},
|
|
"zookeeper": {
|
|
"container": "signoz-zookeeper-1",
|
|
"image_ref": "signoz/zookeeper:3.7.1",
|
|
"image_id": "sha256:3ab0e8f032ab58f14ac1e929ac40305a4a464cf320bdfe4151d62d6922729ba0"
|
|
},
|
|
"otel_collector": {
|
|
"container": "signoz-otel-collector",
|
|
"image_ref": "signoz/signoz-otel-collector:v0.144.1",
|
|
"image_id": "sha256:47cbed488288df7bac6aab3665275bec6d6e24fe5c545c66914827a891e538d8"
|
|
}
|
|
},
|
|
"image_pull_allowed": false,
|
|
"production_network_attachment_allowed": false,
|
|
"production_volume_attachment_allowed": false,
|
|
"ephemeral_volumes_only": true,
|
|
"cleanup_controller_required": true,
|
|
"zero_residue_verifier_required": true,
|
|
"resource_label_key": "awoooi.signoz.metadata.restore.run_id"
|
|
},
|
|
"completion_contract": {
|
|
"portable_export_alone_is_completion": false,
|
|
"independent_bundle_verifier_required": true,
|
|
"isolated_restore_semantic_readback_required": true,
|
|
"zero_residue_terminal_required": true,
|
|
"durable_terminal_receipt_required_for_apply": true,
|
|
"failure_terminal_receipt_required": true,
|
|
"secret_assets_reissue_required": true,
|
|
"full_sqlite_completion_claim_allowed": false
|
|
}
|
|
}
|