NLnetLabs-krill/defaults/krill.conf

# Specify how to set up the HTTPS certificate for Krill
#   existing: Expects an existing certificate and key in $data_dir/ssl
#   generate: Will generate a new key-pair and self-signed cert if
#             they cannot be found in $data_dir/ssl
#
# Note: we strongly recommend that you use a proxy like nginx, apache, or
# <your-choice-here> for HTTPS on a public network.
#
### https_mode = "generate"

# Specify the ip address and port number that the server will use.
#
# Note: we recommend that you use the defaults and use a proxy if you
# must make your Krill instance accessible remotely.
#
### ip             = "localhost"
### port           = 3000

# Specify the directory where the publication server will store its data.
# Note that clustering through a shared data directory is not supported.
# But, we plan to look into a proper clustering solution later.
#
### data_dir = "./data"

# Archive publication events after X days. If you do NOT set this
# value then Krill will not do any archiving.
#
# If enabled this option will make sure that the republish events,
# where your CA simply generates a new Manifest and CRL are archived
# after the given number of days.
#
# If you run Krill as a Publication Server then this option will
# enable the archiving of publication deltas received by your server
# from CAs.
#
# Archived commands (containing e.g. details of when the change happened),
# and following events will be moved to an "archived" subdirectory under
# your data directory as follows:
#   $data_dir/pubd/0/archived      <-- for Publication Server
#   $data_dir/cas/ca/archived      <-- for a CA named 'ca'
#
# If you want to save space you can delete the files from these archived
# directories, e.g. from cron. However, you could also archive them in
# a different way: e.g. compress and move to long term storage. Krill will
# no longer need this data, but if you ever wanted to see these details in
# history you would need to move them back into the parent directory of
# the 'archived' directory.
#
# To enable this set the following key value pair.
#
### archive_threshold_days = 7

# Specify the path to the PID file for Krill.
#
# Defaults to "krill.pid" under the 'data_dir' specified above.
#
### pid_file = "./data/krill.pid"

# Specify the base public service URI hostname and port.
#
# The default service URI is set to https://localhost:3000/ regardless of the
# IP and port configured above (but matching their default). This is fine for
# simple setups where you use Krill to run your own CA only and you use the
# CLI from localhost.
#
# However, if you need to access Krill remotely, or if you are serving as a
# parent CA, or Publication Server, to others, then make sure that you use a
# public URI here *and* make sure that you use a proxy server with a proper
# HTTPS certificate in front of Krill.
#
# At present this MUST be an https URI with a hostname and optional port number only.
# It is not allowed to use a Krill specific path prefix. If you have a strong
# motivation for this, then please commont on the following github issue:
# https://github.com/NLnetLabs/krill/issues/263
#
# Krill UI, API and service URIs will be derived as follows:
#  <service_uri>api/v1/...                (api)
#  <service_uri>rfc8181                   (for remote publishers)
#  <service_uri>rfc6492                   (for remote children)
#  <service_uri>rrdp/..                   (override with rddp_service_uri, see below)
#  <service_uri>...                       (various UI resources)
### service_uri = "https://localhost:3000/"

# Specify whether an embedded repository should be started. For many users
# it will be better to use a repository server provided by a third party, e.g.
# the RIR or NIR under which resources are received.
#
# Note that an existing embedded repository server will be removed if this
# setting is set to 'false' (default) AND there are no current publishers (i.e.
# all CAs use an external repository).
#
# For more information on running Krill as Publication Server see:
# https://rpki.readthedocs.io/en/latest/krill/publication-server.html
#
### repo_enabled = false

# Specify the base rsync repository for this server. Publishers will get
# a base URI that is based on the 'publisher_handle' in the XML file.
#
# Note, you need to set this parameter if (and only if) you chose to enable
# the repository function above (repo_enabled). If you did, you should set up
# an rsync daemon to expose $data_dir/rsync to serve this data. The uri defined
# here should match the module name in your rsync configuration.
#
# Furthermore.. note that the default 'localhost' is only allowed to be used
# when the KRILL_TEST ENV variable has been set.
#
### rsync_base = "rsync://localhost/repo/"

# Note, you may need to set this parameter if you chose to enable the repository
# function above (repo_enabled). By default Krill will use a public RRDP URI
# which is based on the service_uri. Use this directive use a different public
# URI to access the RRDP files.
#
### rrdp_service_uri = "$service_uri/rrdp/"

# Log level
#
# The maximum log level ("off", "error", "warn", "info", or "debug") for
# which to log messages.
#
# Defaults to "warn"
#
### log_level = "warn"

# Log type
#
# Where to log to. One of "stderr" for stderr, "syslog" for syslog, or "file"
# for a file. If "file" is given, the "log_file" field needs to be given, too.
#
### log_type = "file"

# Syslog facility
#
# The syslog facility to log to if syslog logging is used. Defaults to "daemon".
#
### syslog_facility = "daemon"

# Log file
#
# The path to the file to log to if file logging is used. If the path is
# relative, it is relative to the current working directory from which
# the binary is executed.
#
### log_file = "./krill.log"

# Master Authorization Bearer Token
#
# Define a master token that can be used to interact with the API. Token use
# is modelled after OAuth 2.0 Bearer Tokens (RFC 6750), which are expected be
# included as an HTTP header in requests by clients.
#
# If you do not specify a value here, the server will insist that you provide
# a token as an environment variable with the key "KRILL_AUTH_TOKEN".
#
### auth_token =

# CA certificate refresh rate
#
# This defines the rate, in seconds, for Krill CAs to to contact their parent
# CA and query for updates in resource entitlements.
#
# Defaults to 10 minutes
#
### ca_refresh = 600

# Restrict size of messages sent to the API
#
# Default 256 kB
#
### post_limit_api = 262144

# Restrict size of messages sent to the RFC 8181 publication protocol
#
# Default 32MB (enough for a keyroll with about 8000 issued certificates)
#
### post_limit_rfc8181 = 33554432

# Specify a log directory for logging RFC 8181 (publication protocol)
# exchanges. If this directive is set Krill will log all meaningful
# RFC 8181 exchanges in this directory, meaning exchanges that resulted
# in a change or an error.
#
# If this directive is not specified, Krill will NOT log these exchanges.
# Do not set an empty value for the directive in this case, just leave
# it out.
#
# Defaults to NO logging!
#
### rfc8181_log_dir = </some/path>

# Restrict size of messages sent to the RFC 6492 up-down protocol
#
# Default 1MB (enough for a keyroll with certs of ~400kb, the biggest known cert is 220kB)
#
### post_limit_rfc6492 = 1048576

# Specify a log directory for logging RFC 6492 (up-down protocol)
# exchanges. If this directive is set Krill will log all meaningful
# RFC 6492 exchanges in this directory, meaning exchanges that resulted
# in a change or an error.
#
# If this directive is not specified, Krill will NOT log these exchanges.
# Do not set an empty value for the directive in this case, just leave
# it out.
#
# Defaults to NO logging!
#
### rfc6492_log_dir = </some/path>

# Enable loading BGP Dumps from RIS for ROA vs BGP analysis.
#
# bgp_risdump_enable = true
# bgp_risdump_v4_uri = http://www.ris.ripe.net/dumps/riswhoisdump.IPv4.gz
# bgp_risdump_v6_uri = http://www.ris.ripe.net/dumps/riswhoisdump.IPv6.gz


######################################################################################
#                                                                                    #
#                --------======== DANGER ZONE ========--------                       #
#                                                                                    #
#  Do not change the options below, unless you are really certain that you need to   #
#  override Krill's default behaviour.                                               #
#                                                                                    #
######################################################################################


# Set the following to true to force Krill to always perform full rechecks
# of its data directories at startup. This is disabled by default because
# if can slow down startup significantly.
#
# By default Krill will do some basic checks at startup already, and if any
# errors are encountered force a full recovery automatically: Krill will try
# to load all its state in its internal memory cache at startup. If there are
# no errors in reloading the latest 'info' about the state, any surplus data
# will be assumed to be the result from an incompletely finished transaction - or -
# a data directory backup which was taken during a transaction. In either case
# additional data is discarded and the last (committed) state is recreated.
#
# Note that this 'recovery' will make Krill fall back to the last possible
# consistent state that it can. But, there may be important changes missing.
# For example any changes in ROAs made after the last recoverable state will
# be missing. You will have to verify the state yourself.
#
# In short: use this option only if you suspect that there is an issue with
# your backed up data. And if you do, you may want to set the ENV variable
# "KRILL_UPGRADE_ONLY" as well, in order to force that Krill exits after doing
# all its data checks and clean ups, and you have a chance to check the logs
# before proceeding.
#
### always_recover_data = false


#
#                               ROA Aggregation
#
# It is recommended that separate ROAs are used for each authorized prefix, even
# though the RFC allows for multiple prefixes for the same ASN to be combined on
# a single ROA object. The reason for this is that the ROA will become invalid
# if any of the listed prefixes no longer appears on your CA's certificate. Note
# that Krill will automatically clean up over-claiming ROAs when it finds that its
# resources have been shrunk, but there is a possible time window where ROAs can
# be invalid before Krill discovers the shrinkage.
#
# That said, if there would be too many ROAs then this will impact all RPKI
# validators, therefore Krill will by default start aggregating ROAs per ASN
# when more than 100 ROAs would be issued. Conversely, Krill will start de-
# aggregating again when the number of authorizations drops below 90.
#
# This behaviour can be overridden with the following directives:
# roa_aggregate_threshold = 100
# roa_deaggregate_threshold = 90


#
#                               Republication Intervals
#
# The RPKI uses Manifests (RFC 6486) to communicate the list of current RPKI
# objects (such as ROAs) to RPKI Validators. Manifests are used to protect against
# attacks, or incidents, where Validators only see a partial view of the RPKI
# repository. For this to work properly Validators will need to know how 'fresh'
# the Manifests are - otherwise they would be vulnerable to replay attacks where
# they are presented old versions of Manifests thus withholding them from discovering
# new RPKI objects.
#
# Manifests have two important dates included in them:
# 1- the 'next update time'
# 2- an expiration time
#
# When the next update time is passed manifests will become 'stale'. This means
# the Validators may either warn about the objects listed in these manifests, or
# they may even reject these objects altogether. There is current discussion about
# aligning this behaviour in the IETF - but for the moment the outcome will vary
# between Validator implementations.
#
# When the expiration time (not after time on the embedded EE certificate of the
# Manifest) passes, then the Manifest will be considered invalid by all Validator
# implementations.
#
# So, if Validators are subject to replay attacks of Manifests they will be
# unaware until these times have passed. After these times the Manifest and all
# listed RPKI objects will become invalid. When ROA objects become invalid, this
# typically means that the Route Announcement will be considered "Not Found", rather
# than invalid. So, typically they would not be dropped, but they are no longer
# protected by RPKI.
#
# One could therefore argue that short times should be used. However, if the times
# chosen are too short, then this will leave your CA vulnerable to possible
# operational issues with its RPKI repository - or outages of your CA itself.
#
# So, in short, the chosen values are a balance between the wish to limit the
# vulnerability to replay attacks vs the time an operator has to solve operational
# issues.
#
# Krill uses the following defaults:
#
# The "next update" time is 24 hours:
# timing_publish_next_hours = 24
#
# The "not after time" on the EE certificate is 7 days from issuance:
# timing_publish_valid_days = 7
#
# Krill will automatically re-publish new Manifests if they would become stale
# in 8 hours. Because re-publication happens hourly, this leaves the operator
# with a minimum of 7 hours to fix issues if re-publication should fail.
# timing_publish_hours_before_next = 8


#
#                 ROA and Delegate Certificate Times
#
# Krill will issue ROAs, and child CA certificates if you have delegated resources
# to child CAs, with a "not after" time of 52 weeks from issuance, and it will
# re-issue those ROAs and certificates 4 weeks before they would expire.
#
# Because of the automatic renewal there should be no real need to use longer
# validity times. In fact using longer times could have a negative impact on
# Validator performance because the Certificate Revocation Lists would become
# bigger.
#
# So, we do NOT recommend overriding the following values, except perhaps for
# testing purposes:
# timing_child_certificate_valid_weeks = 52
# timing_child_certificate_reissue_weeks_before = 4
# timing_roa_valid_weeks = 52
# timing_roa_reissue_weeks_before = 4