gamertan
92a66db3df
Export the reviewed allowlisted snapshot from private source commit 05928cebd01b586cf9e9d4b8c8537a7605a6068c. This records the exact candidate, bounded capacity result, stateful migration scratch requirement, authenticated batch identity proof, and immediate live acceptance evidence. AI-Assisted: OpenAI Codex Signed-off-by: Cole Speelman <crspeelman@gmail.com>
Examples
Copy these files into your own deployment repository and adapt them. Production configuration belongs at /etc/gamertan-observatory/, must be root-owned mode 0600, and should reference secrets stored in separate root-owned files. The example systemd unit uses LoadCredential= so the agent can consume runtime copies while remaining an unprivileged service.
The optional web_push block expects a private key created on the server with
observatory admin web-push generate-key --output-file /etc/gamertan-observatory/web-push.json.
Remove the block when browser notifications are not wanted. Never commit the
generated file.
agent.json demonstrates the privacy-minimized collection default. If an
application's privacy policy and operating purpose permit collection of client
addresses, queries, referrers, user agents, or anonymous session identifiers,
select those names explicitly in that source's sensitive_fields array. The
agent will not retain them merely because they exist in the producer log.
Caddyfile.sensitive-access-log is an intentionally richer edge-log example.
It still deletes request and response header maps, filters common credential
query keys, masks client addresses, and keeps the application request ID as a
correlation field. Its deny list cannot know an application's vocabulary:
review and extend it before use. Treat the resulting file as sensitive source
evidence with narrow read permissions and a documented retention period.