OpexFlow reads YAML (`config.yaml` by default). Any string value supports `${ENV_VAR}`
substitution, useful for secrets. Top-level sections:

| Key | Description |
| --- | --- |
| `connector` | Identity + delivery: `name`, `push_endpoint`, `hmac_secret`, `health_check_port` (default `3000`), `poll_interval_ms`. |
| `adapters` | `modbus` / `opcua` / `http` device definitions. |
| `nats` / `mqtt` | Stream sources (ingest), also usable as sinks. |
| `transform` | Per-source routes, default route, caps (`timeout_ms`, `memory_limit_mb`, `on_error`). |
| `clickhouse` / `postgres` | Sink connection config. Postgres expects TimescaleDB. |
| `ai` | OpenAI-compatible codegen endpoint (see [AI generator](/docs/ai-generator)). |
| `telemetry` | Stall-alert threshold, sample interval, alert targets (webhook / Telegram). |