Configuration

Settings

bash

memnox config list
memnox config get mode
memnox config set mode enforce

Setting	Values	Default
`mode`	`off`, `observe`, `advise`, `enforce`	`observe` on a new machine
`retentionDays`	days of history kept, see `memnox purge`	`30`
`failOpen`	let a call through when Memnox cannot answer	`false`
`telemetry`	send counts only, never contents	`false`
`approvedAgents`	agents you allow here, others are reported	empty
`noticeUnusual`	ask about an action this agent has never taken	`true`
`noticeWarmupDays`	days after setup when a first action is only recorded	`3`

Environment variables

Variable	What it does
`MEMNOX_POLICIES`	Which rule file to load first
`MEMNOX_SESSION`	The session an action belongs to. `memnox run` sets it.
`MEMNOX_AGENT_NAME`	The agent name rules match against
`MEMNOX_HOME`	Where `~/.memnox` lives

For an agent started by systemd, Docker or cron, print what it needs:

bash

memnox env --format systemd
memnox env --format docker

Files

Path	What it is
`memnox.policies.toml`	Your repository's rules
`~/.memnox/machine.policies.toml`	Rules for every repository on this machine
`~/.memnox/config.toml`	The settings above
`~/.memnox/memnox.db`	The decision log
`~/.memnox/bin/`	The shell wrappers
`~/.memnox/backup/`	Agent configs as they were before setup

Which file wins

A file named on the command line beats MEMNOX_POLICIES, which beats the file in the current folder. Inside the rules, the strictest answer wins, not the first one in the file.