Config.example.toml

# ─────────────────────────────────────────────────────────────────────────────
# Pano — Multi-chain deposit detector configuration
# ─────────────────────────────────────────────────────────────────────────────
#
# Environment variable substitution:
#   ${VAR_NAME}          — resolved at load time; unset causes a load error.
#   ${VAR_NAME:-default} — resolved at load time; the default is used when unset.
#
# Command-line:  pano --config Config.toml
# Environment:   PANO_CONFIG=Config.toml pano
#
# Universal integration: Pano uses shared root-level [chains.<id>], [assets.<id>],
# [paths.<id>], [transports.*.<id>], and [stores.<id>] profiles. Package-specific
# behaviour (ingress, egress, detector, chain overrides) lives under [pano.*].
#
# When running alongside other packages (Ladon, Bria, Oracles) from a single
# merged Config.toml, Pano ignores [ladon], [bria], and [oracles] sections.
# ─────────────────────────────────────────────────────────────────────────────

# ── Pano namespace ───────────────────────────────────────────────────────────

[pano]
# Chain ids from shared [chains] to scan.
chains = ["eth"]

# Asset ids from shared [assets] to detect.
assets = ["eth"]

# ── Server (requires --features server) ──────────────────────────────────────
[pano.server]
# Whether Pano should start its internal HTTP integration server. Requires feature "server".
# Do not publish this port: Artur is the sole public gateway/security/payment owner.
enabled = false

# Bind address.
bind = "0.0.0.0"

# Listen port.
port = 3210

# URL prefix for all API routes.
prefix = "v1"

# Optional internal-hop API key. This is defense in depth, not a public gateway.
# When non-empty, all HTTP routes require either
#   Authorization: Bearer <key>
#   X-Pano-API-Key: <key>
api_key = ""

# Path profile from [paths] for the static dashboard directory.
dashboard_path_ref = ""

# Export masked config.json and addresses.json into the dashboard directory.
dashboard_export = false

# Seconds to wait for background tasks during graceful shutdown.
shutdown_timeout_secs = 1

# ── Detector ─────────────────────────────────────────────────────────────────
[pano.detector]
# Maximum number of recent deposit event keys retained for in-memory deduplication.
# Set to 0 to disable eviction (unbounded memory growth).
dedup_window_size = 100000

# Number of async workers used for per-address delivery overrides.
delivery_workers = 8

# Bounded internal queue capacity for per-address delivery overrides.
delivery_queue_capacity = 4096

# Bounded command queue capacity between ingress and detector.
command_queue_capacity = 256

# Stale unconfirmed-event eviction multiplier.
stale_event_eviction_multiplier = 10

# Minimum block/slot distance before stale unconfirmed events are evicted.
stale_event_eviction_min_blocks = 1000

# Maximum accepted asset decimals.
max_decimals = 30

# ── RPC defaults (applied to all chains; chain-specific overrides not yet supported) ──
[pano.rpc_defaults]
max_concurrent = 10
delay_ms = 0
# Bitcoin blocks/Solana block-scan slots per cycle, Solana signature-page size,
# and EVM ERC-20 request batch size. Solana signature scans do not slot-cap.
batch_size = 200
evm_log_address_batching = true
scan_lookback_blocks = 50
scan_interval_secs = 5
scan_timeout_secs = 60
max_native_scan_per_cycle = 100
request_timeout_secs = 15
max_retries = 3
retry_base_ms = 500
solana_max_supported_transaction_version = 0
solana_scan_mode = "blocks"

# ── Override permissions ─────────────────────────────────────────────────────
[pano.overrides.chain]
# Allow per-watch asset overrides via WatchSpec.
assets = false

[pano.overrides.egress]
webhook = false
file = false
pg = false
sqlite = false
queue = false
http = false

# ── Ingress — Address ingest sources ─────────────────────────────────────────
[pano.ingress]
command_queue_capacity = 4096

[pano.ingress.file]
enabled = true
# Path profile from [paths]. File parsing semantics remain Pano-specific.
path_ref = "pano_watches"
# Example override; the default file polling interval is 5 seconds.
poll_interval_secs = 2

[pano.ingress.http]
# Requires --features server.
enabled = false
path = "watch"
max_body_bytes = 1048576

[pano.ingress.sqlite]
# Requires --features sqlite (enabled by default).
enabled = false
store = "pano"
poll_interval_secs = 5
table = "watched_addresses"

[pano.ingress.pg]
# Requires --features postgres.
enabled = false
store = "postgres"
poll_interval_secs = 5
table = "watched_addresses"

[pano.ingress.amqp]
# Requires --features amqp.
enabled = false
transport = "local"
exchange = "pano.ingress"
routing_key = "watch"
consumer_tag = "pano-ingress"
qos_prefetch = 0

# ── Egress — Deposit event delivery ──────────────────────────────────────────
[pano.egress.file]
enabled = true
path_ref = "pano_events"

[pano.egress.sqlite]
# Requires --features sqlite (enabled by default).
enabled = false
store = "pano"
table = "deposit_events"

[pano.egress.pg]
# Requires --features postgres.
enabled = false
store = "postgres"
table = "deposit_events"

[pano.egress.amqp]
# Requires --features amqp.
enabled = false
transport = "local"
exchange = "pano.egress"
detected_routing_key = "deposit.detected"
confirmed_routing_key = "deposit.confirmed"

[pano.egress.webhook]
# Requires --features webhook.
enabled = false
transport = "ops"
secret = "${PANO_WEBHOOK_SECRET:-}"
signature_header = "X-Pano-Signature"

# Each enabled file, SQLite, PostgreSQL, AMQP, and webhook sink has its own
# lossless bounded queue. A full queue applies backpressure to the detector.
[pano.egress]
persistent_queue_capacity = 4096

[pano.egress.stream]
# SSE/WebSocket event stream. Requires --features server and pano.server.enabled = true.
enabled = false
sse = "events"
websocket = "ws"
ws_heartbeat_secs = 15
sse_keepalive_secs = 15
broadcast_capacity = 1024

# ─────────────────────────────────────────────────────────────────────────────
# Shared profiles — reusable definitions referenced by pano.* sections above.
# ─────────────────────────────────────────────────────────────────────────────

# ── Chains: shared chain identity ────────────────────────────────────────────
[chains.eth]
caip2 = "eip155:1"
rpc_urls = ["https://eth.llamarpc.com"]
confirmations = 12
# Optional bounded scan range. Environment values are unquoted TOML integers.
# start_block = ${PANO_ETH_START_BLOCK}
# end_block = ${PANO_ETH_END_BLOCK}

# ── Assets: shared asset identity ────────────────────────────────────────────
[assets.eth]
enabled = true
chain = "eth"
symbol = "ETH"
decimals = 18
# Optional Solana token program profile; omit it to scan both classic and Token-2022.
# token_program = "${PANO_ASSET_TOKEN_PROGRAM}"

# ── Stores: durable database profiles ────────────────────────────────────────
[stores.pano]
driver = "sqlite"
url = "sqlite://data/pano/pano.db"

# ── Paths: shared file locations ─────────────────────────────────────────────
[paths.pano_watches]
kind = "file"
path = "data/pano/addresses.jsonl"

[paths.pano_events]
kind = "file"
path = "data/pano/deposits.jsonl"

# ── Transport profiles: shared connection defaults ───────────────────────────
# Reference these from [pano.ingress.amqp], [pano.egress.amqp],
# [pano.egress.webhook], etc. via the `transport` field.
# Direct package-local values override profile values.

[transports.amqp.local]
url = "amqp://localhost:5672"
username = ""
password = "${AMQP_PASSWORD:-}"
reconnect_secs = 5
qos_prefetch = 100

[transports.webhook.ops]
url = "${OPS_WEBHOOK_URL:-}"
timeout_secs = 10
max_retries = 3
# Example override; the webhook retry base default is 250 milliseconds.
retry_base_ms = 500