mirror of
https://github.com/NLnetLabs/krill.git
synced 2026-09-21 08:57:47 +02:00
130 lines
5.4 KiB
Plaintext
130 lines
5.4 KiB
Plaintext
# Specify the ip address and port number that the server will use.
|
|
#ip = "localhost"
|
|
#port = 3000
|
|
|
|
# Specify whether https is to be used instead of plain http. Allowed values are
|
|
# "no", "yes" and "test". Defaults to "no".
|
|
#
|
|
# "no" : Plain HTTP will be used.
|
|
# "yes" : The server will look for a 'cert.pem' and 'key.pem' file, under the
|
|
# 'ssl' sub-folder of the 'data_dir' specified below.
|
|
# "test" : The server will generate a key pair and a long-lived self-signed
|
|
# certificate if no 'cert.pem' or 'key.pem' file can be found.
|
|
#
|
|
# Note, we recommend that you use "test" only in real test environments, and
|
|
# that you use an industry proven HTTPS proxy (apache, nginx, etc) for
|
|
# production environments.
|
|
#use_ssl = "no"
|
|
|
|
# Specify the directory where the publication server will store its data.
|
|
# Note that clustering through a shared data directory is not supported.
|
|
# But, we plan to look into a proper clustering solution later.
|
|
#data_dir = "./data"
|
|
|
|
# Specify the base rsync repository for this server. Publishers will get
|
|
# a base URI that is based on the 'publisher_handle' in the XML file.
|
|
#
|
|
# Note, you should set up an rsync daemon to expose $data_dir/rsync to serve
|
|
# this data. The uri defined here should match the module name in your rsync
|
|
# configuration.
|
|
#rsync_base = "rsync://localhost/repo/"
|
|
|
|
# Specify the notify SIA for this server. This will be reported in the
|
|
# response.xml files to publishers so that they can include the proper SIA
|
|
# in their certificates.
|
|
#rrdp_base_uri = "http://localhost:3000/rrdp/"
|
|
|
|
# Log level
|
|
#
|
|
# The maximum log level ("off", "error", "warn", "info", or "debug") for
|
|
# which to log messages.
|
|
#
|
|
# Defaults to "warn"
|
|
#log_level = "warn"
|
|
|
|
# Log type
|
|
#
|
|
# Where to log to. One of "stderr" for stderr, "syslog" for syslog, or "file"
|
|
# for a file. If "file" is given, the "log_file" field needs to be given, too.
|
|
#
|
|
# Defaults to "file".
|
|
#log_type = "file"
|
|
|
|
# Syslog facility
|
|
#
|
|
# The syslog facility to log to if syslog logging is used. Defaults to "daemon".
|
|
#syslog_facility = "daemon"
|
|
|
|
# Log file
|
|
#
|
|
# The path to the file to log to if file logging is used. If the path is
|
|
# relative, it is relative to the current working directory from which
|
|
# the binary is executed.
|
|
#log_file = "./krill.log"
|
|
|
|
# Master Authorization Bearer Token
|
|
#
|
|
# Define a master token that can be used to interact with the API. Token use
|
|
# is modelled after OAuth 2.0 Bearer Tokens (RFC 6750), which are expected be
|
|
# included as an HTTP header in requests by clients.
|
|
#
|
|
# If you do not specify a value here, the server will insist that you provide
|
|
# a token as an environment variable with the key "KRILL_AUTH_TOKEN".
|
|
#
|
|
#auth_token
|
|
|
|
# CA certificate refresh rate
|
|
#
|
|
# This defines the rate, in seconds, for Krill CAs to to contact their parent
|
|
# CA and query for updates in resource entitlements.
|
|
#
|
|
# Defaults to 10 minutes
|
|
#
|
|
#ca_refresh = 600
|
|
|
|
# Shrink grace period
|
|
#
|
|
# The number of hours that a child CA is given the chance to request a new
|
|
# certificate when resources are being removed, before pro-actively revoking
|
|
# and re-issuing certificates with the remaining resources only.
|
|
#
|
|
# If you want to use no grace period, then make sure that you use the 'force'
|
|
# option when you update a child CA's resource entitlements.
|
|
#
|
|
# There is no graceperiod defined in the RFC6492 RPKI provisioning protocol.
|
|
# Because of this a krill child CA cannot know whether its parent allows for a
|
|
# graceperiod or not. And if the child CA had issued some resources that it itself
|
|
# lost to its own children, then these (grand)child CA certificates would be
|
|
# rendered invalid. For this reason krill CAs will always proactively shrink
|
|
# certificates that they had issued the moment that they discover that they are
|
|
# no longer entitled to certain resources.
|
|
#
|
|
# There are two potential future remedies to this:
|
|
# 1) Deployment of 'reconsidered' RPKI validation (RFC 8360). Using 'reconsidered'
|
|
# validation rules overclaiming CA certificates are still accepted for the
|
|
# intersection of resources between the issuing and issued certificates. In other
|
|
# words, validation would act as though a shrunk certificate had been issued
|
|
# immediately. And impact would be limited to statements related to the lost
|
|
# resources only. However, deployment of this RFC is still under discussion:
|
|
# https://tools.ietf.org/id/draft-va-sidrops-deploy-reconsidered-01.html
|
|
#
|
|
# 2) Allow for grace period in a follow up to RFC6492. By allowing an, optional even,
|
|
# graceperiod to be communicated in the provisioning protocol, child CAs will
|
|
# have a chance to clean up overclaiming RPKI objects and/or warn their own
|
|
# children about a shrink - and allow them to clean up their objects within the
|
|
# grace period.
|
|
# We may suggest an update to RFC6492 with this, and some other, additions
|
|
# in the near future.
|
|
#
|
|
# In short though, a value of 24 hours (default) here allows the immediate
|
|
# children of your krill CAs to tidy things up, before they lose their resources.
|
|
# But if your krill CA itself loses resources, it behaves the same as though no
|
|
# grace period was used.
|
|
#
|
|
# Note that shrinking is done as part of the CA certificate refresh process. So,
|
|
# if a 10 minute ca_refresh interval is used and a shrink_grace of 24 hours, shrinking
|
|
# may actually happen after 24 hours 9 minutes 59 seconds, and change. We believe
|
|
# that at this time we do not need more precision, but if it turns out that we do
|
|
# then we will re-evaluate the strategy.
|
|
#
|
|
#shrink_grace = 24 |