Skip to content

config_file

config_file

Pydantic schema for the CLI-loaded config.yml.

The library proper is a pure function of its inputs and never reads a config file — that concern belongs to the CLI (cli/main.py), which loads and validates config.yml into a ShieldFileConfig before constructing a ShieldConfig.

Kept apart from config so that importing the package's public data vocabulary (ShieldConfig, ShieldMode, …) does not drag in pydantic: the schema below is the sole pydantic user in the library, and only the CLI path touches it.

AuditFileConfig

Bases: BaseModel

Audit section of config.yml.

enabled = Field(default=True, description='Enable JSON-lines audit logging') class-attribute instance-attribute

model_config = ConfigDict(extra='forbid') class-attribute instance-attribute

ShieldFileConfig

Bases: BaseModel

Validated schema for config.yml.

Loaded by the CLI at startup. extra="forbid" rejects unknown keys so typos (e.g. mod: hook) produce a clear error instead of being silently ignored.

mode = Field(default='auto', description='Firewall mode (``auto`` selects the best available)') class-attribute instance-attribute

default_profiles = Field(default_factory=(lambda: ['dev-standard']), description='Profiles applied when no explicit list is given') class-attribute instance-attribute

audit = Field(default_factory=AuditFileConfig, description='Audit logging settings') class-attribute instance-attribute

model_config = ConfigDict(extra='forbid') class-attribute instance-attribute