# Specify how to set up the HTTPS certificate for Krill # existing: Expects an existing certificate and key in $data_dir/ssl # generate: Will generate a new key-pair and self-signed cert if # they cannot be found in $data_dir/ssl # # Note: we strongly recommend that you use a proxy like nginx, apache, or # for HTTPS on a public network. # ### https_mode = "generate" # Specify the ip address and port number that the server will use. # # Note: we recommend that you use the defaults and use a proxy if you # must make your Krill instance accessible remotely. # ### ip = "localhost" ### port = 3000 # Specify the directory where the publication server will store its data. # Note that clustering through a shared data directory is not supported. # But, we plan to look into a proper clustering solution later. # ### data_dir = "./data" # Specify the path to the PID file for Krill. # # Defaults to "krill.pid" under the 'data_dir' specified above. # ### pid_file = "./data/krill.pid" # Specify the base public service URI hostname and port. # # The default service URI is set to https://localhost:3000/ regardless of the # IP and port configured above (but matching their default). This is fine for # simple setups where you use Krill to run your own CA only and you use the # CLI from localhost. # # However, if you need to access Krill remotely, or if you are serving as a # parent CA, or Publication Server, to others, then make sure that you use a # public URI here *and* make sure that you use a proxy server with a proper # HTTPS certificate in front of Krill. # # At present this MUST be an https URI with a hostname and optional port number only. # It is not allowed to use a Krill specific path prefix. If you have a strong # motivation for this, then please commont on the following github issue: # https://github.com/NLnetLabs/krill/issues/263 # # Krill UI, API and service URIs will be derived as follows: # api/v1/... (api) # rfc8181 (for remote publishers) # rfc6492 (for remote children) # rrdp/.. (override with rddp_service_uri, see below) # ... (various UI resources) ### service_uri = "https://localhost:3000/" # Specify whether an embedded repository should be started. For many users # it will be better to use a repository server provided by a third party, e.g. # the RIR or NIR under which resources are received. # # Note that an existing embedded repository server will be removed if this # setting is set to 'false' (default) AND there are no current publishers (i.e. # all CAs use an external repository). # # For more information on running Krill as Publication Server see: # https://rpki.readthedocs.io/en/latest/krill/publication-server.html # ### repo_enabled = false # Specify the base rsync repository for this server. Publishers will get # a base URI that is based on the 'publisher_handle' in the XML file. # # Note, you need to set this parameter if (and only if) you chose to enable # the repository function above (repo_enabled). If you did, you should set up # an rsync daemon to expose $data_dir/rsync to serve this data. The uri defined # here should match the module name in your rsync configuration. # # Furthemore.. note that the default 'localhost' is only allowed to be used # when the KRILL_TEST ENV variable has been set. # ### rsync_base = "rsync://localhost/repo/" # Note, you may need to set this parameter if you chose to enable the repository # function above (repo_enabled). By default Krill will use a public RRDP URI # which is based on the service_uri. Use this directive use a different public # URI to access the RRDP files. # ### rrdp_service_uri = "$service_uri/rrdp/" # Log level # # The maximum log level ("off", "error", "warn", "info", or "debug") for # which to log messages. # # Defaults to "warn" # ### log_level = "warn" # Log type # # Where to log to. One of "stderr" for stderr, "syslog" for syslog, or "file" # for a file. If "file" is given, the "log_file" field needs to be given, too. # ### log_type = "file" # Syslog facility # # The syslog facility to log to if syslog logging is used. Defaults to "daemon". # ### syslog_facility = "daemon" # Log file # # The path to the file to log to if file logging is used. If the path is # relative, it is relative to the current working directory from which # the binary is executed. # ### log_file = "./krill.log" # Master Authorization Bearer Token # # Define a master token that can be used to interact with the API. Token use # is modelled after OAuth 2.0 Bearer Tokens (RFC 6750), which are expected be # included as an HTTP header in requests by clients. # # If you do not specify a value here, the server will insist that you provide # a token as an environment variable with the key "KRILL_AUTH_TOKEN". # ### auth_token = # CA certificate refresh rate # # This defines the rate, in seconds, for Krill CAs to to contact their parent # CA and query for updates in resource entitlements. # # Defaults to 10 minutes # ### ca_refresh = 600 # Restrict size of messages sent to the API # # Default 256 kB # ### post_limit_api = 262144 # Restrict size of messages sent to the RFC 8181 publication protocol # # Default 32MB (enough for a keyroll with about 8000 issued certificates) # ### post_limit_rfc8181 = 33554432 # Specify a log directory for logging RFC 8181 (publication protocol) # exchanges. If this directive is set Krill will log all meaningful # RFC 8181 exchanges in this directory, meaning exchanges that resulted # in a change or an error. # # If this directive is not specified, Krill will NOT log these exchanges. # Do not set an empty value for the directive in this case, just leave # it out. # # Defaults to NO logging! # ### rfc8181_log_dir = # Restrict size of messages sent to the RFC 6492 up-down protocol # # Default 1MB (enough for a keyroll with certs of ~400kb, the biggest known cert is 220kB) # ### post_limit_rfc6492 = 1048576 # Specify a log directory for logging RFC 6492 (up-down protocol) # exchanges. If this directive is set Krill will log all meaningful # RFC 6492 exchanges in this directory, meaning exchanges that resulted # in a change or an error. # # If this directive is not specified, Krill will NOT log these exchanges. # Do not set an empty value for the directive in this case, just leave # it out. # # Defaults to NO logging! # ### rfc6492_log_dir = # Enable loading BGP Dumps from RIS for ROA vs BGP analysis. # # bgp_risdump_enable = true # bgp_risdump_v4_uri = http://www.ris.ripe.net/dumps/riswhoisdump.IPv4.gz # bgp_risdump_v6_uri = http://www.ris.ripe.net/dumps/riswhoisdump.IPv6.gz