mirror of
https://github.com/NLnetLabs/krill.git
synced 2026-09-18 07:27:42 +02:00
140 lines
4.7 KiB
Plaintext
140 lines
4.7 KiB
Plaintext
# Specify how to set up the HTTPS certificate for Krill
|
|
# existing: Expects an existing certificate and key in $data_dir/ssl
|
|
# generate: Will generate a new key-pair and self-signed cert if
|
|
# they cannot be found in $data_dir/ssl
|
|
#
|
|
# Note: we strongly recommend that you use a proxy like nginx, apache, or
|
|
# <your-choice-here> for HTTPS on a public network.
|
|
#
|
|
### https_mode = "generate"
|
|
|
|
# Specify the ip address and port number that the server will use.
|
|
#
|
|
# Note: we recommend that you use the defaults and use a proxy if you
|
|
# must make your Krill instance accessible remotely.
|
|
#
|
|
### ip = "localhost"
|
|
### port = 3000
|
|
|
|
# Specify the directory where the publication server will store its data.
|
|
# Note that clustering through a shared data directory is not supported.
|
|
# But, we plan to look into a proper clustering solution later.
|
|
#
|
|
data_dir = "/var/lib/krill/data/"
|
|
|
|
# Specify whether an embedded repository should be started. For many users
|
|
# it will be better to use a repository server provided by a third party, e.g.
|
|
# the RIR or NIR under which resources are received.
|
|
#
|
|
# Note that an existing embedded repository server will be removed if this
|
|
# setting is set to 'false' (default) AND there are no current publishers (i.e.
|
|
# all CAs use an external repository).
|
|
#
|
|
repo_enabled = true
|
|
|
|
# Specify the base rsync repository for this server. Publishers will get
|
|
# a base URI that is based on the 'publisher_handle' in the XML file.
|
|
#
|
|
# Note, you should set up an rsync daemon to expose $data_dir/rsync to serve
|
|
# this data. The uri defined here should match the module name in your rsync
|
|
# configuration.
|
|
#
|
|
# Furthemore.. note that the default 'localhost' is only allowed to be used
|
|
# when the KRILL_TEST ENV variable has been set.
|
|
#
|
|
rsync_base = "rsync://myhost/repo/"
|
|
|
|
# Specify the base public URI to this service. Other URIs will be derived
|
|
# from this:
|
|
# <BASE_URI>api/v1/... (api)
|
|
# <BASE_URI>rfc8181 (for remote publishers)
|
|
# <BASE_URI>rfc6492 (for remote children)
|
|
# <BASE_URI>rrdp/.. (override with rddp_service_uri)
|
|
# <BASE_URI>ta/ta.cer (on TAL for embedded TA)
|
|
#
|
|
# MUST end with a slash.
|
|
#
|
|
# Note that the default service URI is set to https://localhost:3000/ regardless of
|
|
# the IP and port configured above (but matching their default).
|
|
#
|
|
# This service URI is fine for simple setups where you use Krill to run your own CA
|
|
# only and you use the CLI from localhost.
|
|
#
|
|
# However, if you need to access Krill remotely then make sure that you use a public
|
|
# URI here *and* make sure that you use a proxy server with a proper HTTPS certificate
|
|
# in front of Krill.
|
|
#
|
|
service_uri = "https://localhost:3001/"
|
|
|
|
# Use the following if you want to use another public URI to access the RRDP files,
|
|
# e.g. because you serve them as raw files from another machine with a web server.
|
|
#
|
|
rrdp_service_uri = "https://myhost/rrdp/"
|
|
|
|
# Log level
|
|
#
|
|
# The maximum log level ("off", "error", "warn", "info", or "debug") for
|
|
# which to log messages.
|
|
#
|
|
# Defaults to "warn"
|
|
#
|
|
### log_level = "warn"
|
|
|
|
# Log type
|
|
#
|
|
# Where to log to. One of "stderr" for stderr, "syslog" for syslog, or "file"
|
|
# for a file. If "file" is given, the "log_file" field needs to be given, too.
|
|
#
|
|
### log_type = "file"
|
|
|
|
# Syslog facility
|
|
#
|
|
# The syslog facility to log to if syslog logging is used. Defaults to "daemon".
|
|
#
|
|
### syslog_facility = "daemon"
|
|
|
|
# Log file
|
|
#
|
|
# The path to the file to log to if file logging is used. If the path is
|
|
# relative, it is relative to the current working directory from which
|
|
# the binary is executed.
|
|
#
|
|
log_file = "/var/log/krill/krill.log"
|
|
|
|
# Master Authorization Bearer Token
|
|
#
|
|
# Define a master token that can be used to interact with the API. Token use
|
|
# is modelled after OAuth 2.0 Bearer Tokens (RFC 6750), which are expected be
|
|
# included as an HTTP header in requests by clients.
|
|
#
|
|
# If you do not specify a value here, the server will insist that you provide
|
|
# a token as an environment variable with the key "KRILL_AUTH_TOKEN".
|
|
#
|
|
auth_token = "secret"
|
|
|
|
# CA certificate refresh rate
|
|
#
|
|
# This defines the rate, in seconds, for Krill CAs to to contact their parent
|
|
# CA and query for updates in resource entitlements.
|
|
#
|
|
# Defaults to 10 minutes
|
|
#
|
|
### ca_refresh = 600
|
|
|
|
# Restrict size of messages sent to the API
|
|
#
|
|
# Default 256 kB
|
|
#
|
|
### post_limit_api = 262144
|
|
|
|
# Restrict size of messages sent to the RFC 8181 publication protocol
|
|
#
|
|
# Default 32MB (enough for a keyroll with about 8000 issued certificates)
|
|
#
|
|
### post_limit_rfc8181 = 33554432
|
|
|
|
# Restrict size of messages sent to the RFC 6492 up-down protocol
|
|
#
|
|
# Default 1MB (enough for a keyroll with certs of ~400kb, the biggest known cert is 220kB)
|
|
#
|
|
### post_limit_rfc6492 = 1048576 |