zot/examples/config-policy.json

{
  "distSpecVersion": "1.1.1",
  "storage": {
    "rootDirectory": "/tmp/zot"
  },
  "http": {
    "auth": {
      "htpasswd": {
        "path": "test/data/htpasswd"
      }
    },
    "accessControl": {
      "groups": {
        "group1": {
          "users": ["jack", "john", "jane", "ana"]
        },
        "group2": {
          "users": ["alice", "mike", "jim"]
        }
      },
      "repositories": {
        "**": {
          "policies": [{
            "users": ["charlie"],
            "groups": ["admins", "developers", "group1"],
            "actions": ["read", "create", "update"]
          },
          {
            "users": ["mary"],
            "groups": ["group2"],
            "actions": ["read", "create", "update", "delete"]
          }],
          "defaultPolicy": ["read", "create"]
        },
        "tmp/**": {
          "defaultPolicy": ["read", "create", "update"]
        },
        "infra/*": {
          "policies": [{
              "users": ["alice", "bob"],
              "groups": ["maintainers","platformteam"],
              "actions": ["create", "read", "update", "delete"]
            },
            {
              "users": ["mallory"],
              "actions": ["create", "read"]
            }
          ],
          "defaultPolicy": ["read"]
        },
        "repos2/repo": {
          "policies": [{
              "users": ["bob"],
              "groups": ["sparkle_team","repo2_team"],
              "actions": ["read", "create"]
            },
            {
              "users": ["mallory"],
              "actions": ["create", "read"]
            }
          ],
          "defaultPolicy": ["read"]
        },
        "prod/**": {
          "policies": [{
              "users": ["alice"],
              "actions": ["read", "create", "update"],
              "conditions": [{
                  "expression": "req.time < timestamp(\"2099-12-31T23:59:59Z\")",
                  "message": "alice's prod access expires end of 2099"
                },
                {
                  "expression": "req.referenceType == \"digest\"",
                  "message": "prod pushes must use digest references, not mutable tags"
                }
              ]
            }
          ]
        }
      },
      "adminPolicy": {
        "users": ["admin"],
        "groups": ["admins","developers"],
        "actions": ["read", "create", "update", "delete"]
      }
    }
  },
  "log": {
    "level": "debug",
    "output": "/tmp/zot.log"
  }
}