mirror of
https://github.com/NLnetLabs/krill.git
synced 2026-09-29 12:54:52 +02:00
187 lines
7.2 KiB
Plaintext
187 lines
7.2 KiB
Plaintext
# Example Krill testbed configuration
|
|
#
|
|
# ************************* NOTE: ********************************
|
|
#
|
|
# THIS ONLY MEANT TO BE USED FOR TESTING / TRAINING
|
|
#
|
|
# *****************************************************************
|
|
#
|
|
# With the disclaimer out of the way.. you can run Krill in testbed
|
|
# mode. If you do, then it will enable an embedded repository, and
|
|
# setup a trust anchor, and intermediate CA called 'testbed'.
|
|
#
|
|
# Furthermore the UI will expose where users can register their CA
|
|
# as a publisher under the embedded repository, and as a child under
|
|
# the testbed CA - claiming any resources they like to use for test
|
|
# purposes.
|
|
#
|
|
# You are going to need to do some general Krill configuration first.
|
|
# In particular: choose your 'admin_token' and 'data_dir' wisely..
|
|
# But feel free to review other settings as well.
|
|
#
|
|
# The testbed and repository are configured under the [testbed] section
|
|
# below. Note that the testbed will use an embedded publication server,
|
|
# so you should probably read up on the publication server section in
|
|
# our documentation. But note that a key difference is that in case of
|
|
# the testbed the public URIs for the publication server are configured
|
|
# in the config. This is needed so that Krill can automatically create
|
|
# and configure a Trust Anchor CA and 'testbed' CA below it.
|
|
#
|
|
|
|
######################################################################################
|
|
# #
|
|
# DATA #
|
|
# #
|
|
######################################################################################
|
|
|
|
# Specify the directory where the publication server will store its data.
|
|
# Note that clustering through a shared data directory is not supported.
|
|
# But, we plan to look into a proper clustering solution later.
|
|
#
|
|
### data_dir = "./data"
|
|
|
|
# Specify the path to the PID file for Krill.
|
|
#
|
|
# Defaults to "krill.pid" under the 'data_dir' specified above.
|
|
#
|
|
### pid_file = "./data/krill.pid"
|
|
|
|
# Specify a log directory for logging RFC 8181 (publication protocol)
|
|
# exchanges. If this directive is set Krill will log all meaningful
|
|
# RFC 8181 exchanges in this directory, meaning exchanges that resulted
|
|
# in a change or an error.
|
|
#
|
|
# If this directive is not specified, Krill will NOT log these exchanges.
|
|
# Do not set an empty value for the directive in this case, just leave
|
|
# it out.
|
|
#
|
|
# Defaults to NO logging!
|
|
#
|
|
### rfc8181_log_dir = </some/path>
|
|
|
|
|
|
######################################################################################
|
|
# #
|
|
# LOGGING #
|
|
# #
|
|
######################################################################################
|
|
|
|
# Log level
|
|
#
|
|
# The maximum log level ("off", "error", "warn", "info", or "debug") for
|
|
# which to log messages.
|
|
#
|
|
# Defaults to "warn"
|
|
#
|
|
### log_level = "warn"
|
|
|
|
# Log type
|
|
#
|
|
# Where to log to. One of "stderr" for stderr, "syslog" for syslog, or "file"
|
|
# for a file. If "file" is given, the "log_file" field needs to be given, too.
|
|
#
|
|
### log_type = "file"
|
|
|
|
# Syslog facility
|
|
#
|
|
# The syslog facility to log to if syslog logging is used. Defaults to "daemon".
|
|
#
|
|
### syslog_facility = "daemon"
|
|
|
|
# Log file
|
|
#
|
|
# The path to the file to log to if file logging is used. If the path is
|
|
# relative, it is relative to the current working directory from which
|
|
# the binary is executed.
|
|
#
|
|
### log_file = "./krill.log"
|
|
|
|
|
|
######################################################################################
|
|
# #
|
|
# ACCESS #
|
|
# #
|
|
######################################################################################
|
|
|
|
# Admin Token
|
|
#
|
|
# Define an admin token that can be used to interact with the API. Token use
|
|
# is modelled after OAuth 2.0 Bearer Tokens (RFC 6750), which are expected be
|
|
# included as an HTTP header in requests by clients.
|
|
#
|
|
# If you do not specify a value here, the server will insist that you provide
|
|
# a token as an environment variable with the key "KRILL_ADMIN_TOKEN".
|
|
#
|
|
### admin_token =
|
|
|
|
# Specify the ip address and port number that the server will use.
|
|
#
|
|
# Note: we recommend that you use the defaults and use a proxy if you
|
|
# must make your Krill instance accessible remotely.
|
|
#
|
|
### ip = "localhost"
|
|
### port = 3000
|
|
|
|
# Specify the base public service URI hostname and port.
|
|
#
|
|
# Make sure that you use the public hostname and port as exposed by your proxy here,
|
|
# and then set up your proxy to pass the following requests to this server:
|
|
#
|
|
# <service_uri>api/v1/... (api)
|
|
# <service_uri>rfc8181 (for remote publishers)
|
|
# <service_uri>rrdp/.. (override with rddp_service_uri, see below)
|
|
#
|
|
### service_uri = "https://localhost:3000/"
|
|
|
|
######################################################################################
|
|
# #
|
|
# ----------------=========== TESTBED CONFIG ===========---------------- #
|
|
# #
|
|
######################################################################################
|
|
|
|
# To enable the testbed just add the following section to you config,
|
|
# and edit ALL settings - there are no defaults.
|
|
|
|
[testbed]
|
|
|
|
# RRDP BASE URI
|
|
#
|
|
# Set the base RRDP uri for the testbed repository server.
|
|
#
|
|
# It is highly recommended to use a proxy in front of Krill.
|
|
#
|
|
# To expose the RRDP files you can actually proxy back to your testbed
|
|
# krill server (https://<yourkrill>/rrdp/), or you can expose the
|
|
# files as they are written to disk ($data_dir/repo/rrdp/)
|
|
#
|
|
# Set the following value to *your* public proxy hostname and path.
|
|
rrdp_base_uri = "https://testbed.example.com/rrdp/"
|
|
|
|
# RSYNC BASE URI
|
|
#
|
|
# Set the base rsync URI (jail) for the testbed repository server.
|
|
#
|
|
# Make sure that you have an rsyncd running and a module which is
|
|
# configured to expose the rsync repository files. By default these
|
|
# files would be saved to: $data/repo/rsync/current/
|
|
rsync_jail = "rsync://testbed.example.com/repo/"
|
|
|
|
# TA AIA
|
|
#
|
|
# Set the rsync location for your testbed trust anchor certificate.
|
|
#
|
|
# You need to configure an rsync server to expose another module for the
|
|
# TA certificate. Don't use the module for the repository as its
|
|
# content will be overwritten.
|
|
#
|
|
# Manually retrieve the TA certificate from krill and copy it
|
|
# over - it won't change again. You can get it at:
|
|
# https://<yourkrill>/ta/ta.cer
|
|
ta_aia = "rsync://testbed.example.com/ta/ta.cer"
|
|
|
|
# TA URI
|
|
#
|
|
# Like above, make the TA certificate available over HTTPS and
|
|
# specify the url here so that it may be included in the TAL.
|
|
ta_uri = "https://testbed.example.com/ta/ta.cer"
|