# Reference decisions for KESL 12.4 on HAN Processing VM2.
# Do not import this partial file into KESL. Export the installed-build
# settings, review them, and apply individual values from RUNBOOK.KESL.ru.md.

[deployment]
product_major_minor=12.4
mode=standard_standalone
gui=disabled
update_source=KLServers
interceptor=fanotify
network_features=disabled
ksn=<Yes_OR_No_AFTER_SECURITY_AND_LEGAL_APPROVAL>

[resource_budget]
# VM2 starts at 8 GiB RAM. Values require measured baseline and coexistence gate.
scan_memory_limit_mb=<1024_OR_APPROVED_VALUE>
max_memory=<2048MB_OR_APPROVED_VALUE>
use_on_demand_cpu_limit=Yes
on_demand_cpu_limit_percent=<APPROVED_VALUE>

[update_task_6]
rule_type=Hourly
required_result=completed_successfully
required_bases_loaded=Yes
stale_bases_alert_hours=240

[file_threat_protection_task_1]
steady_state=Started
action_on_threat=DisinfectDeleteIfNotPossible
scan_archived=No

[message_safety_broker]
socket=/run/han-kesl/scan.sock
max_file_bytes=5242880
scan_action=Inform
fail_closed=Yes
staging=/var/lib/han-kesl-scan/staging
# Do not add staging to ExcludedFromScanScope: KESL Scan_File can skip it.
staging_exclusion=forbidden
explicit_scan_before_allow=required

[allowed_hot_data_exclusions]
item_0000=<REDIS_SAFETY_DATA_MOUNTPOINT>
item_0001=<OTEL_QUEUE_MOUNTPOINT>

[forbidden_broad_exclusions]
item_0000=/var/lib/docker
item_0001=/var/lib/docker/overlay2
item_0002=/opt/han-chat
item_0003=/var/lib/han-deploy/incoming
item_0004=/etc/han
item_0005=/run/han-chat
item_0006=/tmp
item_0007=/

[acceptance]
host_on_access_eicar=required
broker_clean_eicar_error=required
automatic_hourly_update_observed=required
message_safety_200_403_503=required
performance_two_files_per_second=required
resource_comparison_24h=required