v: 3

# (required) The certificates, ca chains, and private key used to represent this routers identity
#
# If the 'edge" section is enabled and enrollment is run, the files in this section will be written to with the results.
# The "key" value can be provided through any of the support private key engines (file, etc.).
#
# If the 'key' value is a file and that file exists; it is expected to a pre-generated private key. It will be used for
# the  enrollment process and it will back the certificates generated during enrollment. If the file does not exist, it
# will be generated.
#
# The 'cert', 'server_cert', and 'ca' files will be overwritten with the results of the enrollment process.
#
# When running the ziti-router the files/values in this section will be read and used. The 'cert' value will be used
# as the client certificate to connect to the controller. The 'server_cert' is used for all servers/listeners. The
# 'ca' value is used to populate an internally Trusted CA pool.
identity:
  cert:                 ${ZITI_DATA}/edge-router-client.cert.pem
  server_cert:          ${ZITI_DATA}/edge-router-server.cert.pem
  key:                  ${ZITI_DATA}/edge-router.key.pem
  ca:                   ${ZITI_DATA}/edge-router-ca-chain.cert.pem

#trace:
# path:                 001.trace

#profile:
#  memory:
#    path:               001.memprof
#  cpu:
#    path:               001.cpuprof

ctrl:
  endpoint:             tls:127.0.0.1:6262

link:
  dialers:
    - binding:          transport

healthChecks:
  ctrlPingCheck:
    # How often to ping the controller over the control channel. Defaults to 30 seconds
    interval: 30s
    # When to timeout the ping. Defaults to 15 seconds
    timeout: 15s
    # How long to wait before pinging the controller. Defaults to 15 seconds
    initialDelay: 15s
  linkCheck:
    # Number of links required for the health check to be passing. Defaults to 0
    minLinks: 1
    # How often to check the link count, defaults to 5s
    interval: 5s
    # How long to wait before running the first check. Defaults to 1s
    initialDelay: 5s
  
metrics:
  reportInterval: 15s
  messageQueueSize: 10

# By having an 'edge' section defined, the ziti-router will attempt to parse the edge configuration. Removing this
# section, commenting out, or altering the name of the section will cause the router to no longer operate as an Edge
# Router.
edge:
  # (optional) Determines the rate at which API session heartbeats are sent for connected SDK clients (default: 60)
  heartbeatIntervalSeconds: 60
  # (required) Information used to generate the initial registration CSR. For documentation on these fields please
  # refer to the openssl documentation. These values MUST be supplied and have no defaults.
  csr:
    country: US
    province: NC
    locality: Charlotte
    organization: NetFoundry
    organizationalUnit: Ziti

    # (required) SANs that this router's certs should contain. At least one IP or DNS SAN should be defined that matches
    # the edge listeners "advertise" value from the "listeners" section.
    sans:
      dns:
        - "localhost"
        - "test-network"
        - "test-network.localhost"
        - "ziti-dev-ingress01"
      email:
        - "admin@example.com"
      ip:
        - "127.0.0.1"
      uri:
        - "ziti://ziti-dev-router01/made/up/example"

  # (optional) Configuration specific to the controller's API that is proxied through this process. If not defined
  # the API Proxy will not run.
  apiProxy:
    # (required) The interface and port that the Edge API should be served on.
    listener: 0.0.0.0:1080
    # (required) The hostname and port combination to the ziti-controller hosted Edge API
    upstream: 127.0.0.1:1280

dialers:
  - binding: udp
  - binding: transport

listeners:
  - binding: edge
    address: tls:0.0.0.0:3022
    options:
      # (required) The public hostname and port combination that Ziti SDKs should connect on. Previously this was in the chanIngress section.
      advertise: 127.0.0.1:3022
      # (optional) settings
      # set the maximum number of connect requests that are buffered and waiting to be acknowledged (1 to 5000, default 1000)
      #maxQueuedConnects:      50
      # the maximum number of connects that have  begun hello synchronization (1 to 1000, default 16)
      #maxOutstandingConnects: 100
      # the number of milliseconds to wait before a hello synchronization fails and closes the connection (30ms to 60000ms, default: 1000ms)
      #connectTimeoutMs:       3000
      # how long to wait before timing out when looking up api-sessions after client connect. Default 5 seconds.
      #lookupApiSessionTimeout: 5s
  - binding: transport
    address: tls:0.0.0.0:7099

web:
  # name - required
  # Provides a name for this listener, used for logging output. Not required to be unique, but is highly suggested.
  - name: health-check
    # bindPoints - required
    # One or more bind points are required. A bind point specifies an interface (interface:port string) that defines
    # where on the host machine the webListener will listen and the address (host:port) that should be used to
    # publicly address the webListener(i.e. mydomain.com, localhost, 127.0.0.1). This public address may be used for
    # incoming address resolution as well as used in responses in the API.
    bindPoints:
      #interface - required
      # A host:port string on which network interface to listen on. 0.0.0.0 will listen on all interfaces
      - interface: 127.0.0.1:8081
        # address - required
        # The public address that external incoming requests will be able to resolve. Used in request processing and
        # response content that requires full host:port/path addresses.
        address: 127.0.0.1:8081
    # apis - required
    # Allows one or more APIs to be bound to this webListener
    apis:
      # binding - required
      # Specifies an API to bind to this webListener. Built-in APIs are
      #   - health-checks
      - binding: health-checks