mirror of
https://github.com/NLnetLabs/krill.git
synced 2026-09-17 23:17:42 +02:00
187 lines
6.7 KiB
Plaintext
187 lines
6.7 KiB
Plaintext
# Specify how to set up the HTTPS certificate for Krill
|
|
# existing: Expects an existing certificate and key in $data_dir/ssl
|
|
# generate: Will generate a new key-pair and self-signed cert if
|
|
# they cannot be found in $data_dir/ssl
|
|
#
|
|
# Note: we strongly recommend that you use a proxy like nginx, apache, or
|
|
# <your-choice-here> for HTTPS on a public network.
|
|
#
|
|
### https_mode = "generate"
|
|
|
|
# Specify the ip address and port number that the server will use.
|
|
#
|
|
# Note: we recommend that you use the defaults and use a proxy if you
|
|
# must make your Krill instance accessible remotely.
|
|
#
|
|
### ip = "localhost"
|
|
### port = 3000
|
|
|
|
# Specify the directory where the publication server will store its data.
|
|
# Note that clustering through a shared data directory is not supported.
|
|
# But, we plan to look into a proper clustering solution later.
|
|
#
|
|
### data_dir = "./data"
|
|
|
|
# Specify the path to the PID file for Krill.
|
|
#
|
|
# Defaults to "krill.pid" under the 'data_dir' specified above.
|
|
#
|
|
### pid_file = "./data/krill.pid"
|
|
|
|
# Specify the base public service URI hostname and port.
|
|
#
|
|
# The default service URI is set to https://localhost:3000/ regardless of the
|
|
# IP and port configured above (but matching their default). This is fine for
|
|
# simple setups where you use Krill to run your own CA only and you use the
|
|
# CLI from localhost.
|
|
#
|
|
# However, if you need to access Krill remotely, or if you are serving as a
|
|
# parent CA, or Publication Server, to others, then make sure that you use a
|
|
# public URI here *and* make sure that you use a proxy server with a proper
|
|
# HTTPS certificate in front of Krill.
|
|
#
|
|
# At present this MUST be an https URI with a hostname and optional port number only.
|
|
# It is not allowed to use a Krill specific path prefix. If you have a strong
|
|
# motivation for this, then please commont on the following github issue:
|
|
# https://github.com/NLnetLabs/krill/issues/263
|
|
#
|
|
# Krill UI, API and service URIs will be derived as follows:
|
|
# <service_uri>api/v1/... (api)
|
|
# <service_uri>rfc8181 (for remote publishers)
|
|
# <service_uri>rfc6492 (for remote children)
|
|
# <service_uri>rrdp/.. (override with rddp_service_uri, see below)
|
|
# <service_uri>... (various UI resources)
|
|
### service_uri = "https://localhost:3000/"
|
|
|
|
# Specify whether an embedded repository should be started. For many users
|
|
# it will be better to use a repository server provided by a third party, e.g.
|
|
# the RIR or NIR under which resources are received.
|
|
#
|
|
# Note that an existing embedded repository server will be removed if this
|
|
# setting is set to 'false' (default) AND there are no current publishers (i.e.
|
|
# all CAs use an external repository).
|
|
#
|
|
# For more information on running Krill as Publication Server see:
|
|
# https://rpki.readthedocs.io/en/latest/krill/publication-server.html
|
|
#
|
|
### repo_enabled = false
|
|
|
|
# Specify the base rsync repository for this server. Publishers will get
|
|
# a base URI that is based on the 'publisher_handle' in the XML file.
|
|
#
|
|
# Note, you need to set this parameter if (and only if) you chose to enable
|
|
# the repository function above (repo_enabled). If you did, you should set up
|
|
# an rsync daemon to expose $data_dir/rsync to serve this data. The uri defined
|
|
# here should match the module name in your rsync configuration.
|
|
#
|
|
# Furthemore.. note that the default 'localhost' is only allowed to be used
|
|
# when the KRILL_TEST ENV variable has been set.
|
|
#
|
|
### rsync_base = "rsync://localhost/repo/"
|
|
|
|
# Note, you may need to set this parameter if you chose to enable the repository
|
|
# function above (repo_enabled). By default Krill will use a public RRDP URI
|
|
# which is based on the service_uri. Use this directive use a different public
|
|
# URI to access the RRDP files.
|
|
#
|
|
### rrdp_service_uri = "$service_uri/rrdp/"
|
|
|
|
# Log level
|
|
#
|
|
# The maximum log level ("off", "error", "warn", "info", or "debug") for
|
|
# which to log messages.
|
|
#
|
|
# Defaults to "warn"
|
|
#
|
|
### log_level = "warn"
|
|
|
|
# Log type
|
|
#
|
|
# Where to log to. One of "stderr" for stderr, "syslog" for syslog, or "file"
|
|
# for a file. If "file" is given, the "log_file" field needs to be given, too.
|
|
#
|
|
### log_type = "file"
|
|
|
|
# Syslog facility
|
|
#
|
|
# The syslog facility to log to if syslog logging is used. Defaults to "daemon".
|
|
#
|
|
### syslog_facility = "daemon"
|
|
|
|
# Log file
|
|
#
|
|
# The path to the file to log to if file logging is used. If the path is
|
|
# relative, it is relative to the current working directory from which
|
|
# the binary is executed.
|
|
#
|
|
### log_file = "./krill.log"
|
|
|
|
# Master Authorization Bearer Token
|
|
#
|
|
# Define a master token that can be used to interact with the API. Token use
|
|
# is modelled after OAuth 2.0 Bearer Tokens (RFC 6750), which are expected be
|
|
# included as an HTTP header in requests by clients.
|
|
#
|
|
# If you do not specify a value here, the server will insist that you provide
|
|
# a token as an environment variable with the key "KRILL_AUTH_TOKEN".
|
|
#
|
|
### auth_token =
|
|
|
|
# CA certificate refresh rate
|
|
#
|
|
# This defines the rate, in seconds, for Krill CAs to to contact their parent
|
|
# CA and query for updates in resource entitlements.
|
|
#
|
|
# Defaults to 10 minutes
|
|
#
|
|
### ca_refresh = 600
|
|
|
|
# Restrict size of messages sent to the API
|
|
#
|
|
# Default 256 kB
|
|
#
|
|
### post_limit_api = 262144
|
|
|
|
# Restrict size of messages sent to the RFC 8181 publication protocol
|
|
#
|
|
# Default 32MB (enough for a keyroll with about 8000 issued certificates)
|
|
#
|
|
### post_limit_rfc8181 = 33554432
|
|
|
|
# Specify a log directory for logging RFC 8181 (publication protocol)
|
|
# exchanges. If this directive is set Krill will log all meaningful
|
|
# RFC 8181 exchanges in this directory, meaning exchanges that resulted
|
|
# in a change or an error.
|
|
#
|
|
# If this directive is not specified, Krill will NOT log these exchanges.
|
|
# Do not set an empty value for the directive in this case, just leave
|
|
# it out.
|
|
#
|
|
# Defaults to NO logging!
|
|
#
|
|
### rfc8181_log_dir = </some/path>
|
|
|
|
# Restrict size of messages sent to the RFC 6492 up-down protocol
|
|
#
|
|
# Default 1MB (enough for a keyroll with certs of ~400kb, the biggest known cert is 220kB)
|
|
#
|
|
### post_limit_rfc6492 = 1048576
|
|
|
|
# Specify a log directory for logging RFC 6492 (up-down protocol)
|
|
# exchanges. If this directive is set Krill will log all meaningful
|
|
# RFC 6492 exchanges in this directory, meaning exchanges that resulted
|
|
# in a change or an error.
|
|
#
|
|
# If this directive is not specified, Krill will NOT log these exchanges.
|
|
# Do not set an empty value for the directive in this case, just leave
|
|
# it out.
|
|
#
|
|
# Defaults to NO logging!
|
|
#
|
|
### rfc6492_log_dir = </some/path>
|
|
|
|
# Enable loading BGP Dumps from RIS for ROA vs BGP analysis.
|
|
#
|
|
# bgp_risdump_enable = true
|
|
# bgp_risdump_v4_uri = http://www.ris.ripe.net/dumps/riswhoisdump.IPv4.gz
|
|
# bgp_risdump_v6_uri = http://www.ris.ripe.net/dumps/riswhoisdump.IPv6.gz |