# policy/openshell/overlays/vagaro.yaml
# Vagaro policy overlay (applied at S7 when Vagaro is connected).
#
# Allows the sandbox to reach Vagaro's REST API for appointments, clients,
# services, and staff data. Webhook ingestion is handled by the local
# vagaro-webhooks service (compose-managed), not direct sandbox egress.
#
# Apply via: nemohermes <name> policy-add --from-file <this-file> --yes

preset:
  name: vagaro
network_policies:
  vagaro:
    name: vagaro
    endpoints:
      - host: api.vagaro.com
        port: 443
        protocol: rest
        enforcement: enforce
        rules:
          - allow:
              method: GET
              path: /**
          - allow:
              method: POST
              path: /**
          - allow:
              method: PUT
              path: /**
    binaries:
      - path: /usr/local/bin/hermes
      - path: /usr/bin/python3*
      - path: /opt/hermes/.venv/bin/python