# Synapse Backupper configuration file
# Generated by: synapse-backupper generate-config --lang en
# Dotted key example: pg.host

# PostgreSQL connection settings
pg:
  # host: string — PostgreSQL server hostname or IP address.
  host: "localhost"

  # port: integer — PostgreSQL server port.
  port: 5432

  # user: string — PostgreSQL username for the backup connection.
  user: ""

  # password: string — PostgreSQL password for the backup connection.
  # Do not commit real passwords to version control.
  password: ""

  # database: string — Name of the Synapse database to back up.
  database: ""

  # sslmode: string — PostgreSQL SSL mode (disable, allow, prefer, require, verify-ca, verify-full).
  sslmode: "prefer"

  # exclude_tables: list of strings — Tables to skip during pg_dump.
  # The default excludes the large one-time-keys table to reduce dump size.
  exclude_tables:
    - "e2e_one_time_keys_json"

# Backup scheduling and retention settings
backup:
  # dir: string — Directory where encrypted backup files are stored.
  dir: ""

  # retention_days: integer — How many days to keep backups before pruning.
  retention_days: 180

  # cron: string — Cron expression for automatic backup schedule.
  cron: "0 0 3 * * *"

# Encryption scheme identifiers
# pq_scheme: uint16 — Post-quantum KEM scheme ID.
#   0x0006 = ML-KEM-768 (NIST FIPS 203)
pq_scheme: 0x0006

# classical_scheme: uint16 — Classical KEM scheme ID.
#   0x0007 = X25519 ECDH
classical_scheme: 0x0007

# Public key file paths for hybrid encryption
# pq_public_key_path: string — Path to the post-quantum public key PEM file.
pq_public_key_path: ""

# classical_public_key_path: string — Path to the classical public key PEM file.
classical_public_key_path: ""

# Health check HTTP server settings
healthz:
  # port: integer — TCP port for the /healthz endpoint.
  port: 8080

# Logging settings
log:
  # level: string — Log verbosity (debug, info, warn, error).
  level: "info"