mirror of
https://github.com/NLnetLabs/krill.git
synced 2026-08-31 20:29:42 +02:00
185 lines
7.8 KiB
Plaintext
185 lines
7.8 KiB
Plaintext
######################################################################################
|
|
# #
|
|
# DATA #
|
|
# #
|
|
######################################################################################
|
|
|
|
# Specify the directory where the publication server will store its data.
|
|
# Note that clustering through a shared data directory is not supported.
|
|
# But, we plan to look into a proper clustering solution later.
|
|
#
|
|
### data_dir = "./data"
|
|
|
|
# Specify the path to the PID file for Krill.
|
|
#
|
|
# Defaults to "krill.pid" under the 'data_dir' specified above.
|
|
#
|
|
### pid_file = "./data/krill.pid"
|
|
|
|
# Specify a log directory for logging RFC 8181 (publication protocol)
|
|
# exchanges. If this directive is set Krill will log all meaningful
|
|
# RFC 8181 exchanges in this directory, meaning exchanges that resulted
|
|
# in a change or an error.
|
|
#
|
|
# If this directive is not specified, Krill will NOT log these exchanges.
|
|
# Do not set an empty value for the directive in this case, just leave
|
|
# it out.
|
|
#
|
|
# Defaults to NO logging!
|
|
#
|
|
### rfc8181_log_dir = </some/path>
|
|
|
|
|
|
######################################################################################
|
|
# #
|
|
# LOGGING #
|
|
# #
|
|
######################################################################################
|
|
|
|
# Log level
|
|
#
|
|
# The maximum log level ("off", "error", "warn", "info", or "debug") for
|
|
# which to log messages.
|
|
#
|
|
# Defaults to "warn"
|
|
#
|
|
### log_level = "warn"
|
|
|
|
# Log type
|
|
#
|
|
# Where to log to. One of "stderr" for stderr, "syslog" for syslog, or "file"
|
|
# for a file. If "file" is given, the "log_file" field needs to be given, too.
|
|
#
|
|
### log_type = "file"
|
|
|
|
# Syslog facility
|
|
#
|
|
# The syslog facility to log to if syslog logging is used. Defaults to "daemon".
|
|
#
|
|
### syslog_facility = "daemon"
|
|
|
|
# Log file
|
|
#
|
|
# The path to the file to log to if file logging is used. If the path is
|
|
# relative, it is relative to the current working directory from which
|
|
# the binary is executed.
|
|
#
|
|
### log_file = "./krill.log"
|
|
|
|
|
|
######################################################################################
|
|
# #
|
|
# ACCESS #
|
|
# #
|
|
######################################################################################
|
|
|
|
# Master Authorization Bearer Token
|
|
#
|
|
# Define a master token that can be used to interact with the API. Token use
|
|
# is modelled after OAuth 2.0 Bearer Tokens (RFC 6750), which are expected be
|
|
# included as an HTTP header in requests by clients.
|
|
#
|
|
# If you do not specify a value here, the server will insist that you provide
|
|
# a token as an environment variable with the key "KRILL_AUTH_TOKEN".
|
|
#
|
|
### auth_token =
|
|
|
|
# Specify the ip address and port number that the server will use.
|
|
#
|
|
# Note: we recommend that you use the defaults and use a proxy if you
|
|
# must make your Krill instance accessible remotely.
|
|
#
|
|
### ip = "localhost"
|
|
### port = 3000
|
|
|
|
# Specify the base public service URI hostname and port.
|
|
#
|
|
# Make sure that you use the public hostname and port as exposed by your proxy here,
|
|
# and then set up your proxy to pass the following requests to this server:
|
|
#
|
|
# <service_uri>api/v1/... (api)
|
|
# <service_uri>rfc8181 (for remote publishers)
|
|
# <service_uri>rrdp/.. (override with rddp_service_uri, see below)
|
|
#
|
|
### service_uri = "https://localhost:3000/"
|
|
|
|
######################################################################################
|
|
# #
|
|
# REPOSITORY SETTINGS #
|
|
# #
|
|
######################################################################################
|
|
|
|
# Archive publication events after X days. If you do NOT set this
|
|
# value then Krill will not do any archiving.
|
|
#
|
|
# If enabled this option will make sure that the republish events,
|
|
# where your CA simply generates a new Manifest and CRL are archived
|
|
# after the given number of days.
|
|
#
|
|
# If you run Krill as a Publication Server then this option will
|
|
# enable the archiving of publication deltas received by your server
|
|
# from CAs.
|
|
#
|
|
# Archived commands (containing e.g. details of when the change happened),
|
|
# and following events will be moved to an "archived" subdirectory under
|
|
# your data directory as follows:
|
|
# $data_dir/pubd/0/archived <-- for Publication Server
|
|
# $data_dir/cas/ca/archived <-- for a CA named 'ca'
|
|
#
|
|
# If you want to save space you can delete the files from these archived
|
|
# directories, e.g. from cron. However, you could also archive them in
|
|
# a different way: e.g. compress and move to long term storage. Krill will
|
|
# no longer need this data, but if you ever wanted to see these details in
|
|
# history you would need to move them back into the parent directory of
|
|
# the 'archived' directory.
|
|
#
|
|
# To enable this set the following key value pair.
|
|
#
|
|
### archive_threshold_days = 7
|
|
|
|
# Restrict size of messages sent to the API
|
|
#
|
|
# Default 256 kB
|
|
#
|
|
### post_limit_api = 262144
|
|
|
|
# Restrict size of messages sent to the RFC 8181 publication protocol
|
|
#
|
|
# Default 32MB (enough for a keyroll with about 8000 issued certificates)
|
|
#
|
|
### post_limit_rfc8181 = 33554432
|
|
|
|
|
|
######################################################################################
|
|
# #
|
|
# --------======== DANGER ZONE ========-------- #
|
|
# #
|
|
# Do not change the options below, unless you are really certain that you need to #
|
|
# override Krill's default behaviour. #
|
|
# #
|
|
######################################################################################
|
|
|
|
# Set the following to true to force Krill to always perform full rechecks
|
|
# of its data directories at startup. This is disabled by default because
|
|
# if can slow down startup significantly.
|
|
#
|
|
# By default Krill will do some basic checks at startup already, and if any
|
|
# errors are encountered force a full recovery automatically: Krill will try
|
|
# to load all its state in its internal memory cache at startup. If there are
|
|
# no errors in reloading the latest 'info' about the state, any surplus data
|
|
# will be assumed to be the result from an incompletely finished transaction - or -
|
|
# a data directory backup which was taken during a transaction. In either case
|
|
# additional data is discarded and the last (committed) state is recreated.
|
|
#
|
|
# Note that when a Krill Publication Server performs a recovery it will also
|
|
# execute an RRDP session reset. This ensures that relying parties will get
|
|
# a full and consistent set of data, even if this data may be old. Furthermore,
|
|
# Krill CAs will *always* verify with their Publication Server which files it
|
|
# publishes currently, and if it finds that there are any missing files they
|
|
# will send all needed updates.
|
|
#
|
|
# So, while a (forced) fallback to a prior state is not ideal, the CAs will
|
|
# in fact recover. However, it may take a while
|
|
#
|
|
### always_recover_data = false
|