panda/config.example.yaml at master · ethpandaops/panda · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
# ethpandaops Panda Server Configuration
# Copy this file to config.yaml and customize for your environment.
# Environment variables can be substituted using ${VAR_NAME} or ${VAR_NAME:-default} syntax.

server:
  host: "0.0.0.0"
  port: 2480
  base_url: "http://localhost:2480"  # ep clients should point at this URL
  sandbox_url: "http://ethpandaops-panda-server:2480"  # URL sandbox containers use to call the local server

# Sandbox configuration
sandbox:
  # Backend: docker (local dev) | gvisor (production)
  backend: docker
  image: "ethpandaops-panda-sandbox:latest"
  timeout: 60  # seconds
  memory_limit: "2g"
  cpu_limit: 1.0
  # Network for sandbox containers. The server auto-creates this network if
  # it doesn't exist.
  network: "ethpandaops-panda-internal"
  # host_shared_path: "/tmp/mcp-sandbox"  # Docker-in-Docker: host-visible path for bind mounts

  # Sessions configuration (optional)
  # When enabled, sandbox containers persist between calls (enabled by default)
  # sessions:
  #   enabled: true
  #   ttl: 30m          # idle timeout (default: 30m)
  #   max_duration: 4h  # absolute max session lifetime (default: 4h)
  #   max_sessions: 50  # max concurrent sessions (default: 50)

# Local file storage for sandbox outputs (charts, CSVs, etc.).
# Files persist on disk and are served by the server's HTTP API.
# storage:
#   base_dir: "~/.panda/data/storage"  # Default location

# Proxies the server connects to over HTTP. Each holds upstream credentials and
# advertises datasources; queries are routed to the proxy that advertised the
# datasource. The first entry is primary (auth, embedding, GitHub builds, ethnode).
proxies:
  - name: "hosted"
    url: "https://panda-proxy.ethpandaops.io"
    # auth:                  # for hosted proxies; users run `ep auth login`
    #   mode: "oidc"         # "oidc", "oauth", or "client_credentials"
    #   issuer_url: "https://panda-proxy.ethpandaops.io"
    #   client_id: "panda"
    #
    # Non-interactive service accounts (e.g. bots) use the client_credentials
    # grant with an Authentik service account + app password. Access tokens are
    # minted from the issuer's token endpoint, cached in memory, and re-minted
    # before expiry — no credential files are written.
    # auth:
    #   mode: "client_credentials"
    #   issuer_url: "https://authentik.example.com/application/o/panda-proxy/"
    #   client_id: "panda-proxy"
    #   username: "panda-chat-svc"          # service-account username
    #   password: "${PANDA_BOT_TOKEN}"      # app password, from env

# Deprecated: the old single-proxy form. Use `proxies:` above. If set it is promoted
# to proxies[0]; setting both `proxy:` and `proxies:` is an error.
# proxy:
#   url: "https://panda-proxy.ethpandaops.io"

# In-process proxy for datasources that run on the host instead of behind a remote
# proxy. On by default; runs unauthenticated on loopback.
# local_proxy:
#   enabled: true
#   clickhouse:
#     # Local Kurtosis OTel ClickHouse, exposed as `local-kurtosis` only
#     # while reachable. Use host: "localhost" when panda-server runs natively.
#     - name: "local-kurtosis"
#       description: "Local Kurtosis devnet logs (OpenTelemetry, autodiscovered). ClickHouse db `otel`, table `otel_logs` (per-service devnet logs; level is in Body, not SeverityText). Filter by EnclaveName (one per devnet) and ServiceName."
#       host: "host.docker.internal"
#       port: 18123
#       database: "otel"
#       autodiscover: true
#       autodiscover_interval: 10s

# Consensus specs configuration (optional).
# By default, fetches the latest release from ethereum/consensus-specs.
# consensus_specs:
#   repository: "ethereum/consensus-specs"  # GitHub owner/repo (for forks)
#   ref: ""                                 # Branch, tag, or SHA (empty = latest release)

# Observability configuration
observability:
  metrics_enabled: true
  metrics_port: 2490  # in-container bind port; docker-compose publishes it on the host via MCP_METRICS_PORT