v: 3

#trace:
#  path:                 ctrl.trace

#profile:
#  memory:
#    path: ctrl.memprof

db: testdata/${ZITI_TEST_DB}.db

identity:
  cert: testdata/ca/intermediate/certs/ctrl-client.cert.pem
  server_cert: testdata/ca/intermediate/certs/ctrl-server.cert.pem
  key: testdata/ca/intermediate/private/ctrl.key.pem
  ca: testdata/ca/intermediate/certs/ca-chain.cert.pem

ctrl:
  listener: tls:127.0.0.1:6262

mgmt:
  listener: tls:127.0.0.1:10000

terminator:
  validators:
    edge: edge

#metrics:
#  influxdb:
#    url:                http://localhost:8086
#    database:           ziti

# xctrl_example
#
#example:
#  enabled:              false
#  delay:                5

# By having an 'edge' section defined, the ziti-controller will attempt to parse the edge configuration. Removing this
# section, commenting out, or altering the name of the section will cause the edge to not run.
edge:
  # This section represents the configuration of the Edge API that is served over HTTPS
  api:
    # (required) The interface and port that the Edge API should be served on.
    listener: 127.0.0.1:1281
    # (required) The host/port combination that is reported as publicly accessible for the Edge API
    advertise: localhost:1281
    # (optional, defaults to 10) The number of minutes before an Edge API session will timeout. Timeouts are reset by
    # API requests and connections that are maintained to Edge Routers
    sessionTimeoutMinutes: 30
    #(optional, defaults to the root identity) An alternate "identity" to use for the Edge API. If this section is not
    # defined the root identity section will be used. This is useful for situations where Edge API will present a
    # publicly signed certificate instead of one generated by a private PKI created by ziti pki create
  #    identity:
  #      server_cert: src/github.com/openziti/edge/tests/pki/ziti-dev-controller01.external.cert.pem
  #      server_key:  src/github.com/openziti/edge/tests/pki/ziti-dev-controller01.external.key.pem
  #      ca:          src/github.com/openziti/edge/tests/pki/ziti-dev-controller01.external.chain.cert.pem
  # This section is used to define option that are used during enrollment of Edge Routers, Ziti Edge Identities.
  enrollment:
    # (required) A Ziti Identity configuration section that specifically makes use of the cert and key fields to define
    # a signing certificate from the PKI that the Ziti environment is using to sign certificates. The CA is used to
    # specify the chain that should be added to the /.well-known CA store that is used to bootstrap trust with the
    # Ziti Controller. This chain should be from intermediate to root and can contain multiple chains if necessary.
    signingCert:
      cert: testdata/ca/intermediate/certs/intermediate.cert.pem
      key: testdata/ca/intermediate/private/intermediate.key.decrypted.pem
      ca: testdata/ca/intermediate/certs/ca-chain.cert.pem
    edgeIdentity:
      # (optional, defaults to 5) The length of time that a Ziti Edge Identity enrollment should remain valid. After
      # this duration, the enrollment will expire and not longer be usable.
      durationMinutes: 5
    edgeRouter:
      # (optional, defaults to 5) The length of time that a Ziti Edge Router enrollment should remain valid. After
      # this duration, the enrollment will expire and not longer be usable.
      durationMinutes: 5