mirror of
https://github.com/NLnetLabs/krill.git
synced 2026-09-12 04:27:41 +02:00
255 lines
10 KiB
Plaintext
255 lines
10 KiB
Plaintext
######################################################################################
|
|
# #
|
|
# DATA #
|
|
# #
|
|
######################################################################################
|
|
|
|
# Specify the storage used by Krill.
|
|
#
|
|
# Currently, Krill supports disk based storage only.
|
|
#
|
|
# You can use a shared disk and a standby Krill node for redundancy.
|
|
# However, data corruption issues can occur if you run multiple active
|
|
# Krill nodes using a shared disk. Therefore, you MUST ensure that only
|
|
# one Krill node is active at any given time.
|
|
#
|
|
# Example configurations:
|
|
# storage_uri = "/var/lib/krill/data/"
|
|
#
|
|
# Default:
|
|
# storage_uri = "./data"
|
|
#
|
|
# For backward compatibility 'data_dir' is accepted as an
|
|
# alternative to 'storage_uri'.
|
|
#
|
|
### storage_uri = "./data"
|
|
|
|
# TLS Keys Dir
|
|
#
|
|
# Specify the location of the TLS directory for Krill's
|
|
# built-in HTTPS server. This MUST be set in case the
|
|
# storage_uri maps to a database.
|
|
#
|
|
# Default:
|
|
# tls_keys_dir = $storage_uri/ssl
|
|
|
|
# Repository Directory
|
|
#
|
|
# This is the directory used by the Krill Publication Server
|
|
# for the publication of RPKI objects.
|
|
#
|
|
# This defaults a directory called "repo" under your server's
|
|
# data directory. If your server uses a database for storage,
|
|
# this value MUST be set - even if you do not use Krill as a
|
|
# Publication Server. This will change when issues #1092 and
|
|
# #1093 are implemented.
|
|
#
|
|
# repo_dir = /path/to/repo/
|
|
|
|
# Upgrade Storage Uri
|
|
#
|
|
# This MUST be set if a database is used. We will remove this
|
|
# when we implement issue #1094.
|
|
#
|
|
# upgrade_storage_uri = $data_dir/upgrade-data/
|
|
|
|
# History Cache
|
|
#
|
|
# Krill keeps meta-information on all past changes for each CA
|
|
# and the Publication Server. This information is cached by default
|
|
# to ensure that the history (audit log) API is fast.
|
|
#
|
|
# However, this data can add up over time, so operators of
|
|
# instances with many CAs or a lot of historical may choose
|
|
# to turn this off to save memory. Note that memory will still
|
|
# be used temporarily in case the history API is accessed.
|
|
#
|
|
### use_history_cache = true
|
|
|
|
# Specify the path to the PID file for Krill.
|
|
#
|
|
# Defaults to "krill.pid" under the 'data_dir' specified above.
|
|
#
|
|
### pid_file = "./data/krill.pid"
|
|
|
|
# Specify a log directory for logging RFC 8181 (publication protocol)
|
|
# exchanges. If this directive is set Krill will log all meaningful
|
|
# RFC 8181 exchanges in this directory, meaning exchanges that resulted
|
|
# in a change or an error.
|
|
#
|
|
# If this directive is not specified, Krill will NOT log these exchanges.
|
|
# Do not set an empty value for the directive in this case, just leave
|
|
# it out.
|
|
#
|
|
# Defaults to NO logging!
|
|
#
|
|
### rfc8181_log_dir = </some/path>
|
|
|
|
|
|
######################################################################################
|
|
# #
|
|
# LOGGING #
|
|
# #
|
|
######################################################################################
|
|
|
|
# Log level
|
|
#
|
|
# The maximum log level ("off", "error", "warn", "info", or "debug") for
|
|
# which to log messages.
|
|
#
|
|
# Defaults to "warn"
|
|
#
|
|
### log_level = "warn"
|
|
|
|
# Log type
|
|
#
|
|
# Where to log to. One of "stderr" for stderr, "syslog" for syslog, or "file"
|
|
# for a file. If "file" is given, the "log_file" field needs to be given, too.
|
|
#
|
|
### log_type = "file"
|
|
|
|
# Syslog facility
|
|
#
|
|
# The syslog facility to log to if syslog logging is used. Defaults to "daemon".
|
|
#
|
|
### syslog_facility = "daemon"
|
|
|
|
# Log file
|
|
#
|
|
# The path to the file to log to if file logging is used. If the path is
|
|
# relative, it is relative to the current working directory from which
|
|
# the binary is executed.
|
|
#
|
|
### log_file = "./krill.log"
|
|
|
|
|
|
######################################################################################
|
|
# #
|
|
# ACCESS #
|
|
# #
|
|
######################################################################################
|
|
|
|
# Admin Token
|
|
#
|
|
# Define an admin token that can be used to interact with the API. Token use
|
|
# is modelled after OAuth 2.0 Bearer Tokens (RFC 6750), which are expected be
|
|
# included as an HTTP header in requests by clients.
|
|
#
|
|
# If you do not specify a value here, the server will insist that you provide
|
|
# a token as an environment variable with the key "KRILL_ADMIN_TOKEN".
|
|
#
|
|
### admin_token =
|
|
|
|
# Specify the ip addresses and port number that the server will use.
|
|
#
|
|
# Note: by default Krill uses "127.0.0.1" (IPv4 localhost) as its IP address.
|
|
# We recommend that you keep this setting and use a proxy server such as NGINX
|
|
# or Apache if you must make your Krill instance accessible remotely.
|
|
#
|
|
# You can use the 'ip' setting in this config file to override the default. You
|
|
# can specify a single IP address or an array of addresses.
|
|
#
|
|
# If you want to support remote delegated CAs to be children under a CA and/or
|
|
# publish their content, then you should set the "service uri" setting described
|
|
# below. If you do not set this, then Krill will use the (first) IP address as
|
|
# the hostname for this settting.
|
|
#
|
|
#
|
|
### ip = "127.0.0.1" # default
|
|
### ip = [ "127.0.0.1", "::1" ] # multiple IP addresses
|
|
### port = 3000 # applies to all ip addresses
|
|
|
|
# Specify the base public service URI hostname and port.
|
|
#
|
|
# Make sure that you use the public hostname and port as exposed by your proxy here,
|
|
# and then set up your proxy to pass the following requests to this server:
|
|
#
|
|
# <service_uri>api/v1/... (api)
|
|
# <service_uri>rfc8181 (for remote publishers)
|
|
# <service_uri>rrdp/.. (override with rddp_service_uri, see below)
|
|
#
|
|
### service_uri = "https://localhost:3000/"
|
|
|
|
######################################################################################
|
|
# #
|
|
# REPOSITORY SETTINGS #
|
|
# #
|
|
######################################################################################
|
|
|
|
# Restrict size of messages sent to the API
|
|
#
|
|
# Default 256 kB
|
|
#
|
|
### post_limit_api = 262144
|
|
|
|
# Restrict size of messages sent to the RFC 8181 publication protocol
|
|
#
|
|
# Default 32MB (enough for a keyroll with about 8000 issued certificates)
|
|
#
|
|
### post_limit_rfc8181 = 33554432
|
|
|
|
|
|
######################################################################################
|
|
# #
|
|
# REPOSITORY RRDP SETTINGS #
|
|
# #
|
|
######################################################################################
|
|
|
|
|
|
#
|
|
# RRDP DELTA FILES
|
|
#
|
|
# The RRDP protocol uses deltas to allow Relying Parties to synchronise efficiently.
|
|
# If Relying Parties cannot retrieve deltas, they will fall back to using snapshots.
|
|
# The RRDP protocol specifies that no more deltas should be presented than the total
|
|
# size of the snapshot. However, it is good to limit the amount of deltas further than
|
|
# this because:
|
|
# 1) big notification files are expensive to serve and parse
|
|
# 2) it's not just size, because of latency parsing many small deltas may
|
|
# be more time consuming than falling back to a delta
|
|
#
|
|
# So, the objective would be to optimize things such that the notification.xml files
|
|
# remain relatively small, while still allowing the vast majority of Relying Party
|
|
# implementations to use deltas, under normal operations.
|
|
#
|
|
# We use the following strategy to prune excessive deltas:
|
|
#
|
|
# - never keep more than the size of the snapshot
|
|
# - always keep 'rrdp_delta_files_min_nr' files
|
|
# - always keep 'rrdp_delta_files_min_seconds' files
|
|
# - beyond this:
|
|
# - never keep more than 'rrdp_delta_files_max_nr'
|
|
# - never keep older than 'rrdp_delta_files_max_seconds'
|
|
# - keep the others
|
|
#
|
|
# With these defaults:
|
|
# rrdp_delta_files_min_nr = 5
|
|
# rrdp_delta_files_min_seconds = 1200
|
|
# \- (20 mins: twice the interval of commonly used RPs)
|
|
# rrdp_delta_files_max_seconds = 7200
|
|
# \- (2 hours: twice the interval of slowest RPs)
|
|
# rrdp_delta_files_max_nr = 50
|
|
|
|
# Furthermore, you may choose to limit the RRDP deltas interval. If this value is set, then
|
|
# RRDP deltas will be produced no more frequently than the specified interval. If the server
|
|
# is quiet, then typically the first update sent to it will result in an RRDP update straightaway.
|
|
# But, if the server is busy, then subsequent updates will be held until the interval period has
|
|
# passed since the last RRDP update.
|
|
#
|
|
# By default every change gets its own RRDP delta. But on systems with many publishers it is
|
|
# a good idea to limit the amount of deltas a bit. E.g. for a system with 5000 CAs with 20 ROAs
|
|
# each a higher interval is needed - otherwise the system will be too busy writing large snapshot
|
|
# files and essentially won't be able to handle the (normal, mft/crl renewal) publication load.
|
|
#
|
|
# Since Relying Party software (validators, such as Routinator) use update intervals in the order
|
|
# of 10 minutes, there is no problem in limiting the delta interval to a couple of minutes.
|
|
#
|
|
# rrdp_delta_interval_min_seconds = 0
|
|
|
|
# Optionally archive - rather than delete - old snapshot and delta files. They can then be backed
|
|
# up and/deleted at the repository operator's discretion. This may be particularly useful for
|
|
# audit or research.
|
|
#
|
|
# If set to true files will be archived in a directory under '$data_dir/repo/archive'
|
|
# rrdp_files_archive = false
|