###################################################################################### # # # DATA # # # ###################################################################################### # Specify the storage used by Krill. # # Currently, Krill supports two flavours of storage: disk # or a Postgresql database. Support for other databases or # key value store implementations may be added in future. # # If you use disk-backed storage, you MUST ensure that # only one Krill node using this storage is active at any # given moment. Transactionality is not guaranteed across nodes # when using this option. # # If a database back-end is used, it is possible to have multiple # concurrent active Krill instances use it. Database replication # can further improve availability as long as this is transparent to Krill. # # Example configurations: # storage_uri = "/var/lib/krill/data/" # storage_uri = "postgres://postgres@localhost/postgres" # # Default: # storage_uri = "./data" # # For backward compatibility 'data_dir' is accepted as an # alternative to 'storage_uri'. # ### storage_uri = "./data" # TLS Keys Dir # # Specify the location of the TLS directory for Krill's # built-in HTTPS server. This MUST be set in case the # storage_uri maps to a database. # # Default: # tls_keys_dir = $storage_uri/ssl # Repository Directory # # This is the directory used by the Krill Publication Server # for the publication of RPKI objects. # # This defaults a directory called "repo" under your server's # data directory. If your server uses a database for storage, # this value MUST be set - even if you do not use Krill as a # Publication Server. This will change when issues #1092 and # #1093 are implemented. # # repo_dir = /path/to/repo/ # Upgrade Storage Uri # # This MUST be set if a database is used. We will remove this # when we implement issue #1094. # # upgrade_storage_uri = $data_dir/upgrade-data/ # History Cache # # Krill keeps meta-information on all past changes for each CA # and the Publication Server. This information is cached by default # to ensure that the history (audit log) API is fast. # # However, this data can add up over time, so operators of # instances with many CAs or a lot of historical may choose # to turn this off to save memory. Note that memory will still # be used temporarily in case the history API is accessed. # ### use_history_cache = true # Specify the path to the PID file for Krill. # # Defaults to "krill.pid" under the 'data_dir' specified above. # ### pid_file = "./data/krill.pid" ###################################################################################### # # # LOGGING # # # ###################################################################################### # Log level # # The maximum log level ("off", "error", "warn", "info", or "debug") for # which to log messages. # # Defaults to "warn" # ### log_level = "warn" # Log type # # Where to log to. One of "stderr" for stderr, "syslog" for syslog, or "file" # for a file. If "file" is given, the "log_file" field needs to be given, too. # ### log_type = "file" # Syslog facility # # The syslog facility to log to if syslog logging is used. Defaults to "daemon". # ### syslog_facility = "daemon" # Log file # # The path to the file to log to if file logging is used. If the path is # relative, it is relative to the current working directory from which # the binary is executed. # ### log_file = "./krill.log" ###################################################################################### # # # ACCESS # # # ###################################################################################### # Admin Token # # Define an admin token that can be used to interact with the API. Token use # is modelled after OAuth 2.0 Bearer Tokens (RFC 6750), which are expected be # included as an HTTP header in requests by clients. # # If you do not specify a value here, the server will insist that you provide # a token as an environment variable with the key "KRILL_ADMIN_TOKEN". # ### admin_token = # Specify the ip addresses and port number that the server will use. # # Note: by default Krill uses "127.0.0.1" (IPv4 localhost) as its IP address. # We recommend that you keep this setting and use a proxy server such as NGINX # or Apache if you must make your Krill instance accessible remotely. # # You can use the 'ip' setting in this config file to override the default. You # can specify a single IP address or an array of addresses. # # If you want to support remote delegated CAs to be children under a CA and/or # publish their content, then you should set the "service uri" setting described # below. If you do not set this, then Krill will use the (first) IP address as # the hostname for this settting. # # ### ip = "127.0.0.1" # default ### ip = [ "127.0.0.1", "::1" ] # multiple IP addresses ### port = 3000 # applies to all ip addresses # Specify the HTTPS mode. Krill supports three modes: # # "generate" (DEFAULT) # # Krill will generate a key pair and create a self-signed certificate # if no previous key pair or certificate is found. File names used # are data_dir/ssl/key.pem and data_dir/ssl/cert.pem respectively. # # "existing" # # Krill expects an existing key pair and certificate in the same # locations where it would otherwise store its generated key pair # and self-signed certificate. # # "disable" # # Krill will use plain HTTP. # # This mode is not recommended as HTTPS adds little overhead, and # even with a self-signed certificate provides better security # out of the box. # # That said, if you are running an HTTPS proxy server on the same # host as Krill and Krill is listening on localhost only, then # using plain HTTP between Krill and your proxy server may be an # option you would want to use. # # We recommend STRONGLY that you do not use this option if your # Krill instance is configured to bind to a public IP address. # # **NOTE**: Even if you use "disable" here, Krill still insists on # using HTTPS for its service_uri. See below. # ### https_mode = "generate" # Specify the base public service URI hostname and port. # # The default service URI is set to https://localhost:3000/. This is fine for # setups where you use Krill to run your own CA only. You do not need to set this # to enable remote access to the UI or API (e.g. for using the CLI remotely). # Simply setting up a proxy suffices for this. # # However, if you are serving as a parent CA or Publication Server that needs # to be accessible by remote CAs, then you will need to tell your Krill instance # what its public (base) URI will be, so that it can include the proper URIs # in responses to those CAs. # # Note that Krill insists on HTTPS for this, even if you elect to use "disable" # for the https_mode. The reason is that, while RFC 6492 (provisioning) and # RFC 8181 (publication) allow for plain HTTP and provide security through # signed messages, we believe it is better if this (remote) traffic is also # encrypted and one can (and should) use an HTTPS capable proxy in this case. # # At present this MUST be an https URI with a hostname and optional port number only. # It is not allowed to use a Krill specific path prefix. If you have a strong # motivation for this, then please comment on the following github issue: # https://github.com/NLnetLabs/krill/issues/263 # # Krill UI, API and service URIs will be derived as follows: # api/v1/... (api) # rfc6492 (for remote children) # ... (various UI resources) ### service_uri = "https://localhost:3000/" ###################################################################################### # # # METRICS # # # ###################################################################################### # Krill exposes metrics for use with Prometheus under: /metrics # # By default a lot of details are included in these metrics. Generating these metrics # is not particularly hard on Krill, but in case you have many CAs, children or publishers # under your Krill instance you may still want to disable certain metrics to reduce # the amount of data fetched and stored by Prometheus. # # Note that you can also get all of this information through the API, so there # are other ways than using Prometheus to monitor details. # Always enabled: ################# # # krill_server_start unix timestamp in seconds of last Krill server start # krill_version_major Krill server major version number # krill_version_minor Krill server minor version number # krill_version_patch Krill server patch version number # krill_cas number of cas in Krill # # [with multi-user support enabled (default)] # krill_auth_session_cache_size total number of cached login session tokens # Per CA details: ################# # # There are a number of metrics which use a label like {ca="ca_name"}. You can disable # all of them by setting: # # metrics_hide_ca_details = true # # krill_ca_parent_success{ca="ca", parent="parent"} status of last CA to parent connection (0=issue, 1=success) # krill_ca_parent_last_success_time{ca="ca", parent="parent"} unix timestamp in seconds of last successful CA to parent connection # krill_ca_ps_success{ca="ca"} status of last CA to Publication Server connection (0=issue, 1=success) # krill_ca_ps_last_success_time{ca="ca"} unix timestamp in seconds of last successful CA to Publication Server connection # krill_ca_ps_next_planned_time{ca="ca"} unix timestamp in seconds of next planned CA to Publication Server connection (unless e.g. ROAs are changed) # # CA -> Child metrics # ------------------- # # NOTE: These metrics are only shown if you have any child CAs under your CA(s) in Krill. # # By default Krill will also show metrics on child CAs for each CA. If you left the # showing CA details enabled, but you wish to hide these details then you can do so # by setting: # # metrics_hide_child_details = true # # krill_cas_children{ca="ca"} number of children for CA # krill_ca_child_success{ca="ca", child="child"} status of last child to CA connection (0=issue, 1=success) # krill_ca_child_state{ca="ca", child="child"} child state (see 'suspend_child_after_inactive_hours' config) (0=suspended, 1=active) # krill_ca_child_last_connection{ca="ca", child="child"} unix timestamp in seconds of last child to CA connection # krill_ca_child_last_success{ca="ca", child="child"} unix timestamp in seconds of last successful child to CA connection # krill_ca_child_agent_total{ca="ca", user_agent="ua string"} total children per user agent based on their last connection # # CA -> ROA metrics # ----------------- # # By default Krill will also show metrics on ROAs in relation to known BGP announcements # for each CA. If you left the showing CA details enabled, but you wish to hide these details # then you can do so by setting: # # metrics_hide_roa_details = true # # krill_cas_bgp_announcements_valid{ca="ca"} number of announcements seen for CA resources with RPKI state VALID # krill_cas_bgp_announcements_invalid_asn{ca="ca"} number of announcements seen for CA resources with RPKI state INVALID (ASN mismatch) # krill_cas_bgp_announcements_invalid_length{ca="ca"} number of announcements seen for CA resources with RPKI state INVALID (prefix exceeds max length) # krill_cas_bgp_announcements_not_found{ca="ca"} number of announcements seen for CA resources with RPKI state NOT FOUND (none of the CA's ROAs cover this) # krill_cas_bgp_roas_too_permissive{ca="ca"} number of ROAs for this CA which allow excess announcements (0 may also indicate that no BGP info is available) # krill_cas_bgp_roas_redundant{ca="ca"} number of ROAs for this CA which are redundant (0 may also indicate that no BGP info is available) # krill_cas_bgp_roas_stale{ca="ca"} number of ROAs for this CA for which no announcements are seen (0 may also indicate that no BGP info is available) # krill_cas_bgp_roas_total{ca="ca"} total number of ROAs for this CA # Publication Server metrics ############################ # Always enabled if you have an active Publication Server ######################################################### # krill_repo_publisher number of publishers in repository # krill_repo_rrdp_last_update unix timestamp in seconds of last update by any publisher # krill_repo_rrdp_serial RRDP serial # Per Publisher metrics ####################### # The following metrics can be disabled by setting: # metrics_hide_publisher_details = true # # krill_repo_objects{publisher="publisher"} number of objects in repository for publisher # krill_repo_size{publisher="publisher"} size of objects in bytes in repository for publisher # krill_repo_last_update{publisher="publisher"} unix timestamp in seconds of last update for publisher ###################################################################################### # # # OTHER SEVER SETTINGS # # # ###################################################################################### # CA certificate refresh rate # # This defines the rate, in seconds, for Krill CAs to to contact their parent CA # via the RFC 6492 up-down protocol and query for updates in resource entitlements. # # Minimum value is 1 hour (3600 seconds), maximum is 3 days. Values below of this range # are set to the minimum, values above this range are capped at the maximum. # # Defaults to 24 hours: 86400 seconds # # This value is specified in seconds for compatability with earlier Krill versions. # ### ca_refresh_seconds = 86400 # CA certificate refresh jitter # # In order to avoid that many child CAs contact their parent at the same time # Krill adds a random extra 'jitter' time between 0 and the number of seconds # specified using 'ca_refresh_jitter_seconds'. # # Defaults to 12 hours: 43200 seconds. # # Values are capped to a maximum of: 50% of ca_refresh_seconds # ### ca_refresh_jitter_seconds = 43200 # Enable loading BGP Dumps from RIS for ROA vs BGP analysis. # # bgp_risdumps_enabled = true # bgp_risdump_v4_uri = "http://www.ris.ripe.net/dumps/riswhoisdump.IPv4.gz" # bgp_risdump_v6_uri = "http://www.ris.ripe.net/dumps/riswhoisdump.IPv6.gz" # Restrict size of messages sent to the API. # # Default 256 kB # ### post_limit_api = 262144 # Restrict size of messages sent to the RFC 6492 up-down protocol. Only relevant # if you operate Krill as a parent to other CAs. # # Default 1MB (enough for a keyroll with certs of ~400kb, the biggest known cert is 220kB) # ### post_limit_rfc6492 = 1048576 # Set the timeout for a complete RFC 6492 and RFC 8181 client HTTP request-response # round-trip to the parent or publisher, excluding the time required to establish # the connection. # # Default is double what it was in Krill <0.9.5 and should be long enough in most # cases. Change this if you see timeout errors. # # Defaults to 4 minutes # ### post_protocol_msg_timeout_seconds = 240 ###################################################################################### # # # --------======== DANGER ZONE ========-------- # # # # Do not change the options below, unless you are really certain that you need to # # override Krill's default behaviour. # # # ###################################################################################### # # ROA Aggregation # # It is recommended that separate ROAs are used for each authorized prefix, even # though the RFC allows for multiple prefixes for the same ASN to be combined on # a single ROA object. The reason for this is that the ROA will become invalid # if any of the listed prefixes no longer appears on your CA's certificate. Note # that Krill will automatically clean up over-claiming ROAs when it finds that its # resources have been shrunk, but there is a possible time window where ROAs can # be invalid before Krill discovers the shrinkage. # # That said, if there would be too many ROAs then this will impact all RPKI # validators, therefore Krill will by default start aggregating ROAs per ASN # when more than 100 ROAs would be issued. Conversely, Krill will start de- # aggregating again when the number of authorizations drops below 90. # # This behaviour can be overridden with the following directives: # roa_aggregate_threshold = 100 # roa_deaggregate_threshold = 90 # # Republication Intervals # # The RPKI uses Manifests (RFC 6486) to communicate the list of current RPKI # objects (such as ROAs) to RPKI Validators. Manifests are used to protect against # attacks, or incidents, where Validators only see a partial view of the RPKI # repository. For this to work properly Validators will need to know how 'fresh' # the Manifests are - otherwise they would be vulnerable to replay attacks where # they are presented old versions of Manifests thus withholding them from discovering # new RPKI objects. # # Krill issues manifests with a default next update and validity period of 24 hours, # plus a random value between 0 and 4 hours. This random value is added in order to # spread out scheduled next publication times between CAs. # # This means that the maximum replay window is 28 hours. Krill checks every 10 minutes # whether the next update time is less then 8 hours (by default) in the future, and in # that case it will re-issue them to avoid that Validators would end up with expired # manifests. This means that an operator has a minimum of just under 8 hours to deal # with issues with their CA or Publication Server before RPKI Validators would notice. # # The default values can be overridden, but with care.. make the next update interval # too short and this causes too much work for all RPKI validators, puts load on your # publication server and shortens your window to deal with issues. Make it too long # and you could be vulnerable to replay attacks. Re-issue to quickly and again you # cause extra load to RPKI validators and publication server. # # All that said.. if you are willing to accept the, in practice, small risk of a replay # attack then you could for example opt for a 'timing_publish_next_hours' value of # 48 hours, and a 'timing_publish_hours_before_next' value of 24 hours. That way you # would have a full day to fix issues. # # timing_publish_next_hours = 24 # (must be 2 or higher) # timing_publish_next_jitter_hours = 4 # must be 0 - timing_publish_next_hours / 2 # timing_publish_hours_before_next = 8 # (must be 1 or higher) # # ROA and Delegate Certificate Times # # Krill will issue ROAs, and child CA certificates if you have delegated resources # to child CAs, with a "not after" time of 52 weeks from issuance, and it will # re-issue those ROAs and certificates 4 weeks before they would expire. # # Because of the automatic renewal there should be no real need to use longer # validity times. In fact using longer times could have a negative impact on # Validator performance because the Certificate Revocation Lists would become # bigger. # # So, we do NOT recommend overriding the following values, except perhaps for # testing purposes: # timing_child_certificate_valid_weeks = 52 # timing_child_certificate_reissue_weeks_before = 4 # timing_roa_valid_weeks = 52 # timing_roa_reissue_weeks_before = 4