# Example Krill testbed configuration
#
# ************************* NOTE: ********************************
#
#       THIS ONLY MEANT TO BE USED FOR TESTING / TRAINING
#
# *****************************************************************
#
# With the disclaimer out of the way.. you can run Krill in testbed
# mode. If you do, then it will enable an embedded repository, and
# setup a trust anchor, and intermediate CA called 'testbed'.
#
# Furthermore the UI will expose where users can register their CA
# as a publisher under the embedded repository, and as a child under
# the testbed CA - claiming any resources they like to use for test
# purposes.
#
# You are going to need to do some general Krill configuration first.
# In particular: choose your 'admin_token' and 'data_dir' wisely..
# But feel free to review other settings as well.
#
# The testbed and repository are configured under the [testbed] section
# below. Note that the testbed will use an embedded publication server,
# so you should probably read up on the publication server section in
# our documentation. But note that a key difference is that in case of
# the testbed the public URIs for the publication server are configured
# in the config. This is needed so that Krill can automatically create
# and configure a Trust Anchor CA and 'testbed' CA below it.
#

######################################################################################
#                                                                                    #
#                                      DATA                                          #
#                                                                                    #
######################################################################################

# Specify the storage used by Krill.
#
# Currently, Krill supports disk based storage only.
#
# You can use a shared disk and a standby Krill node for redundancy.
# However, data corruption issues can occur if you run multiple active
# Krill nodes using a shared disk. Therefore, you MUST ensure that only
# one Krill node is active at any given time.
#
# Example configurations:
# storage_uri = "/var/lib/krill/data/"
#
# Default:
# storage_uri = "./data"
#
# For backward compatibility 'data_dir' is accepted as an
# alternative to 'storage_uri'.
#
### storage_uri = "./data"

# TLS Keys Dir
#
# Specify the location of the TLS directory for Krill's
# built-in HTTPS server. This MUST be set in case the
# storage_uri maps to a database.
#
# Default:
# tls_keys_dir = $storage_uri/ssl

# Repository Directory
#
# This is the directory used by the Krill Publication Server
# for the publication of RPKI objects.
#
# This defaults a directory called "repo" under your server's
# data directory. If your server uses a database for storage,
# this value MUST be set - even if you do not use Krill as a
# Publication Server. This will change when issues #1092 and
# #1093 are implemented.
#
# repo_dir = /path/to/repo/

# Upgrade Storage Uri
#
# This MUST be set if a database is used. We will remove this
# when we implement issue #1094.
#
# upgrade_storage_uri = $data_dir/upgrade-data/

# History Cache
#
# Krill keeps meta-information on all past changes for each CA
# and the Publication Server. This information is cached by default
# to ensure that the history (audit log) API is fast.
#
# However, this data can add up over time, so operators of
# instances with many CAs or a lot of historical may choose
# to turn this off to save memory. Note that memory will still
# be used temporarily in case the history API is accessed.
#
### use_history_cache = true

# Specify the path to the PID file for Krill.
#
# Defaults to "krill.pid" under the 'data_dir' specified above.
#
### pid_file = "./data/krill.pid"

# Specify a log directory for logging RFC 8181 (publication protocol)
# exchanges. If this directive is set Krill will log all meaningful
# RFC 8181 exchanges in this directory, meaning exchanges that resulted
# in a change or an error.
#
# If this directive is not specified, Krill will NOT log these exchanges.
# Do not set an empty value for the directive in this case, just leave
# it out.
#
# Defaults to NO logging!
#
### rfc8181_log_dir = </some/path>


######################################################################################
#                                                                                    #
#                                     LOGGING                                        #
#                                                                                    #
######################################################################################

# Log level
#
# The maximum log level ("off", "error", "warn", "info", or "debug") for
# which to log messages.
#
# Defaults to "warn"
#
### log_level = "warn"

# Log type
#
# Where to log to. One of "stderr" for stderr, "syslog" for syslog, or "file"
# for a file. If "file" is given, the "log_file" field needs to be given, too.
#
### log_type = "file"

# Syslog facility
#
# The syslog facility to log to if syslog logging is used. Defaults to "daemon".
#
### syslog_facility = "daemon"

# Log file
#
# The path to the file to log to if file logging is used. If the path is
# relative, it is relative to the current working directory from which
# the binary is executed.
#
### log_file = "./krill.log"


######################################################################################
#                                                                                    #
#                                     ACCESS                                         #
#                                                                                    #
######################################################################################

# Admin Token
#
# Define an admin token that can be used to interact with the API. Token use
# is modelled after OAuth 2.0 Bearer Tokens (RFC 6750), which are expected be
# included as an HTTP header in requests by clients.
#
# If you do not specify a value here, the server will insist that you provide
# a token as an environment variable with the key "KRILL_ADMIN_TOKEN".
#
### admin_token =

# Specify the ip addresses and port number that the server will use.
#
# Note: by default Krill uses "127.0.0.1" (IPv4 localhost) as its IP address.
# We recommend that you keep this setting and use a proxy server such as NGINX
# or Apache if you must make your Krill instance accessible remotely.
#
# You can use the 'ip' setting in this config file to override the default. You
# can specify a single IP address or an array of addresses.
#
# If you want to support remote delegated CAs to be children under a CA and/or
# publish their content, then you should set the "service uri" setting described
# below. If you do not set this, then Krill will use the (first) IP address as
# the hostname for this settting.
#
#
### ip             = "127.0.0.1"            # default
### ip             = [ "127.0.0.1", "::1" ] # multiple IP addresses
### port           = 3000                   # applies to all ip addresses

# Specify the base public service URI hostname and port.
#
# The default service URI is set to https://localhost:3000/. This is fine for
# setups where you use Krill to run your own CA only. You do not need to set this
# to enable remote access to # the UI or API (e.g. for using the CLI remotely).
# Simply setting up a proxy suffices for this.
#
# However, if you are serving as a parent CA or Publication Server that needs
# to be accessible by remote CAs, then you will need to tell your Krill instance
# what its public (base) URI will be, so that it can include the proper URIs
# in responses to those CAs.
#
# At present this MUST be an https URI with a hostname and optional port number only.
# It is not allowed to use a Krill specific path prefix. If you have a strong
# motivation for this, then please comment on the following github issue:
# https://github.com/NLnetLabs/krill/issues/263
#
# Krill UI, API and service URIs will be derived as follows:
#  <service_uri>api/v1/...                (api)
#  <service_uri>rfc6492                   (for remote children)
#  <service_uri>...                       (various UI resources)
### service_uri = "https://localhost:3000/"

######################################################################################
#                                                                                    #
#      ----------------=========== TESTBED CONFIG ===========----------------        #                                 
#                                                                                    #
######################################################################################

# To enable the testbed just add the following section to you config,
# and edit ALL settings - there are no defaults.

[testbed]

# RRDP BASE URI
#
# Set the base RRDP uri for the testbed repository server.
#
# It is highly recommended to use a proxy in front of Krill.
#
# To expose the RRDP files you can actually proxy back to your testbed
# Krill server (https://<yourkrill>/rrdp/), or you can expose the
# files as they are written to disk ($data_dir/repo/rrdp/)
#
# Set the following value to *your* public proxy hostname and path.
rrdp_base_uri = "https://testbed.example.com/rrdp/"

# RSYNC BASE URI
#
# Set the base rsync URI (jail) for the testbed repository server.
#
# Make sure that you have an rsyncd running and a module which is
# configured to expose the rsync repository files. By default these
# files would be saved to: $data/repo/rsync/current/
rsync_jail = "rsync://testbed.example.com/repo/"

# TA AIA
#
# Set the rsync location for your testbed trust anchor certificate.
# 
# You need to configure an rsync server to expose another module for the
# TA certificate. Don't use the module for the repository as its
# content will be overwritten.
#
# Manually retrieve the TA certificate from Krill and copy it
# over - it won't change again. You can get it at:
# https://<yourkrill>/ta/ta.cer
ta_aia = "rsync://testbed.example.com/ta/ta.cer"

# TA URI
#
# Like above, make the TA certificate available over HTTPS and
# specify the url here so that it may be included in the TAL.
ta_uri = "https://testbed.example.com/ta/ta.cer"
