mirror of
https://github.com/NLnetLabs/krill.git
synced 2026-09-21 08:57:47 +02:00
89 lines
3.4 KiB
Plaintext
89 lines
3.4 KiB
Plaintext
######################################################################################
|
|
# #
|
|
# LOGGING #
|
|
# #
|
|
######################################################################################
|
|
|
|
# Log level
|
|
#
|
|
# The maximum log level ("off", "error", "warn", "info", or "debug") for
|
|
# which to log messages.
|
|
#
|
|
# Defaults to "warn"
|
|
#
|
|
### log_level = "warn"
|
|
|
|
# Log type
|
|
#
|
|
# Where to log to. One of "stderr" for stderr, "syslog" for syslog, or "file"
|
|
# for a file. If "file" is given, the "log_file" field needs to be given, too.
|
|
#
|
|
### log_type = "file"
|
|
log_type = "stderr"
|
|
|
|
######################################################################################
|
|
# #
|
|
# DATA #
|
|
# #
|
|
######################################################################################
|
|
|
|
# The following is used for normal operations
|
|
# data_dir = "/var/lib/krill/ta_data/"
|
|
|
|
# But for testing we need to use an in-memory store
|
|
# to avoid leaving test data on disk.
|
|
storage_uri = "memory://"
|
|
|
|
######################################################################################
|
|
# #
|
|
# TIMING #
|
|
# #
|
|
######################################################################################
|
|
|
|
#
|
|
# Include the following section '[timing_config]' if the default TA
|
|
# timing settings need to be changed.
|
|
#
|
|
# !!!!!IMPORTANT!!!!!!
|
|
#
|
|
# If you include this, make sure that both the TA signer and your Krill
|
|
# server where the TA Proxy lives use the same configuration.
|
|
#
|
|
[timing_config]
|
|
|
|
# The number of years the TA certificate is valid for. The TA certificate
|
|
# is only generated once, so set this value before initialising the TA.
|
|
#
|
|
### certificate_validity_years = 100,
|
|
|
|
# The validity time in weeks for certificates issued under the TA. Note
|
|
# that these certifcates get re-issued by request of the child before
|
|
# they would expire.
|
|
#
|
|
### issued_certificate_validity_weeks = 52
|
|
|
|
# The threshold in weeks before expiry of a current issued certificate
|
|
# used to determine when a new certificate should be requested.
|
|
#
|
|
### issued_certificate_reissue_weeks_before = 26
|
|
|
|
# The time before the manifest and CRL expire for objects published by
|
|
# the TA. This determines the minimal re-signing frequency needed.
|
|
#
|
|
### mft_next_update_weeks = 12
|
|
|
|
# The validity time for signed messages between the online and offline
|
|
# TA components (TA Proxy and TA Signer). This determines how fast messages
|
|
# need to exchanged between the components.
|
|
#
|
|
# Note that there is replay protection in addition to this constraint, meaning
|
|
# that a message that has been previously processed cannot be applied again,
|
|
# even if it's still cryptographically valid.
|
|
#
|
|
### signed_message_validity_days = 14
|
|
|
|
# For testing:
|
|
certificate_validity_years = 398
|
|
issued_certificate_validity_weeks = 52
|
|
mft_next_update_weeks = 12
|