###################################################################################### # # # DATA # # # ###################################################################################### # Specify the directory where the publication server will store its data. # Note that clustering through a shared data directory is not supported. # But, we plan to look into a proper clustering solution later. # ### data_dir = "./data" # Specify the path to the PID file for Krill. # # Defaults to "krill.pid" under the 'data_dir' specified above. # ### pid_file = "./data/krill.pid" # Specify a log directory for logging RFC 8181 (publication protocol) # exchanges. If this directive is set Krill will log all meaningful # RFC 8181 exchanges in this directory, meaning exchanges that resulted # in a change or an error. # # If this directive is not specified, Krill will NOT log these exchanges. # Do not set an empty value for the directive in this case, just leave # it out. # # Defaults to NO logging! # ### rfc8181_log_dir = ###################################################################################### # # # LOGGING # # # ###################################################################################### # Log level # # The maximum log level ("off", "error", "warn", "info", or "debug") for # which to log messages. # # Defaults to "warn" # ### log_level = "warn" # Log type # # Where to log to. One of "stderr" for stderr, "syslog" for syslog, or "file" # for a file. If "file" is given, the "log_file" field needs to be given, too. # ### log_type = "file" # Syslog facility # # The syslog facility to log to if syslog logging is used. Defaults to "daemon". # ### syslog_facility = "daemon" # Log file # # The path to the file to log to if file logging is used. If the path is # relative, it is relative to the current working directory from which # the binary is executed. # ### log_file = "./krill.log" ###################################################################################### # # # ACCESS # # # ###################################################################################### # Master Authorization Bearer Token # # Define a master token that can be used to interact with the API. Token use # is modelled after OAuth 2.0 Bearer Tokens (RFC 6750), which are expected be # included as an HTTP header in requests by clients. # # If you do not specify a value here, the server will insist that you provide # a token as an environment variable with the key "KRILL_AUTH_TOKEN". # ### auth_token = # Specify the ip address and port number that the server will use. # # Note: we recommend that you use the defaults and use a proxy if you # must make your Krill instance accessible remotely. # ### ip = "localhost" ### port = 3000 # Specify the base public service URI hostname and port. # # Make sure that you use the public hostname and port as exposed by your proxy here, # and then set up your proxy to pass the following requests to this server: # # api/v1/... (api) # rfc8181 (for remote publishers) # rrdp/.. (override with rddp_service_uri, see below) # ### service_uri = "https://localhost:3000/" ###################################################################################### # # # REPOSITORY SETTINGS # # # ###################################################################################### # Archive publication events after X days. If you do NOT set this # value then Krill will not do any archiving. # # If enabled this option will make sure that the republish events, # where your CA simply generates a new Manifest and CRL are archived # after the given number of days. # # If you run Krill as a Publication Server then this option will # enable the archiving of publication deltas received by your server # from CAs. # # Archived commands (containing e.g. details of when the change happened), # and following events will be moved to an "archived" subdirectory under # your data directory as follows: # $data_dir/pubd/0/archived <-- for Publication Server # $data_dir/cas/ca/archived <-- for a CA named 'ca' # # If you want to save space you can delete the files from these archived # directories, e.g. from cron. However, you could also archive them in # a different way: e.g. compress and move to long term storage. Krill will # no longer need this data, but if you ever wanted to see these details in # history you would need to move them back into the parent directory of # the 'archived' directory. # # To enable this set the following key value pair. # ### archive_threshold_days = 7 # Restrict size of messages sent to the API # # Default 256 kB # ### post_limit_api = 262144 # Restrict size of messages sent to the RFC 8181 publication protocol # # Default 32MB (enough for a keyroll with about 8000 issued certificates) # ### post_limit_rfc8181 = 33554432 ###################################################################################### # # # --------======== DANGER ZONE ========-------- # # # # Do not change the options below, unless you are really certain that you need to # # override Krill's default behaviour. # # # ###################################################################################### # Set the following to true to force Krill to always perform full rechecks # of its data directories at startup. This is disabled by default because # if can slow down startup significantly. # # By default Krill will do some basic checks at startup already, and if any # errors are encountered force a full recovery automatically: Krill will try # to load all its state in its internal memory cache at startup. If there are # no errors in reloading the latest 'info' about the state, any surplus data # will be assumed to be the result from an incompletely finished transaction - or - # a data directory backup which was taken during a transaction. In either case # additional data is discarded and the last (committed) state is recreated. # # Note that when a Krill Publication Server performs a recovery it will also # execute an RRDP session reset. This ensures that relying parties will get # a full and consistent set of data, even if this data may be old. Furthermore, # Krill CAs will *always* verify with their Publication Server which files it # publishes currently, and if it finds that there are any missing files they # will send all needed updates. # # So, while a (forced) fallback to a prior state is not ideal, the CAs will # in fact recover. However, it may take a while # ### always_recover_data = false