config.example.yaml

Rama main · réplica de lectura del repositorio original.

# CertPilot configuration template.
#
# Copy to config.dev.yaml (development) or config.yaml (production) and edit.
# Values of the form ${VAR} are expanded from the environment at load time, so
# secrets never need to live in this file.
#
# Before starting, set CERTPILOT_KEK. Certificate private keys and CA
# credentials are encrypted with it before they reach the database, and the
# core refuses to start against a database without one:
#
#   make generate-kek

server:
  host: "127.0.0.1"
  port: 8080
  # development | production
  #
  # Production mode refuses settings that are convenient locally and dangerous
  # when deployed: an insecure gateway channel (plugins.tls.insecure), a "*" in
  # allowed_origins, and running with no database. Anonymous access is not
  # among them only because it is refused in every mode, not just this one.
  mode: "development"
  # Browser origins permitted to call the API. A wildcard is not accepted
  # alongside credentials, so name the frontend explicitly.
  allowed_origins:
    - "http://localhost:3000"

auth:
  # Preferred: verify asymmetrically signed tokens against the provider's
  # published keys. The core then holds nothing capable of minting a token.
  # Works with any OIDC provider — Keycloak, Okta, Azure AD, Auth0, Authentik.
  jwks_url: "${CERTPILOT_JWKS_URL}"
  issuer: "${CERTPILOT_JWT_ISSUER}"
  audience: "authenticated"

  # Legacy shared-secret verification. Requires the core to hold a key that can
  # forge admin tokens; use jwks_url instead where the provider supports it.
  # jwt_secret: "${CERTPILOT_JWT_SECRET}"

  # Claim inside app_metadata carrying the CertPilot role. Roles are read only
  # from app_metadata, never user_metadata, which the user can write.
  role_claim: "certpilot_role"

  # Skip authentication entirely and treat every request as admin.
  # Refused unless mode is development and host is a loopback address.
  # Who becomes the first administrator. Matched only when no account can yet
  # sign in, so it grants a first role and never maintains one — removing an
  # address here does not demote anybody.
  #
  # On first start CertPilot creates this account, generates a password, and
  # prints it once. There is no anonymous mode and no default password.
  bootstrap_admins:
    - "you@example.com"

# Gateway plugins. Each CA provider runs as its own process.
plugins:
  discovery_mode: "static"

  # Mutual TLS for the core-to-gateway channel. That channel carries CSRs,
  # private keys, and CA credentials, so it is authenticated in both directions.
  #
  #   make dev-certs
  tls:
    cert_file: ".certpilot/pki/core.pem"
    key_file: ".certpilot/pki/core-key.pem"
    ca_file: ".certpilot/pki/ca.pem"
    # Disables TLS on the gateway channel. Development only; refused in
    # production mode.
    insecure: false

  gateways:
    - name: "selfsigned-dev"
      addr: "localhost:9091"
      type: "selfsigned"
      # Name expected in the gateway's certificate. Defaults to the host part
      # of addr; set it when dialing by IP or through a service alias.
      server_name: "localhost"

    - name: "letsencrypt-staging"
      addr: "localhost:9092"
      type: "acme"
      server_name: "localhost"

    # The Vault gateway holds no credential of its own. Each CA account carries
    # the AppRole or Kubernetes identity it issues under, so this process is
    # authorised to sign nothing until an account gives it an identity.
    - name: "vault"
      addr: "localhost:9093"
      type: "vault"
      server_name: "localhost"

# CA health monitoring, in minutes.
pki:
  ca_health_check_interval: 360
  crl_ocsp_check_interval: 60

# Certificate renewal.
#
# Note on lead days: the CA/Browser Forum schedule takes maximum validity to
# 200 days (March 2026), 100 days (March 2027), and 47 days (March 2029). A
# fixed 30-day lead stops making sense well before the end of that; where a CA
# publishes renewal information (RFC 9773), the ACME gateway reports the
# window it suggests, which is both better timed and what lets a CA drain a
# mass-revocation event gradually.
renewal:
  scan_interval: 60
  default_lead_days: 30
  retry_backoff: [60, 240, 720, 1440]

logging:
  level: "info"
  format: "text"

# The store is PostgreSQL 14 or later, and nothing else. CertPilot connects to a
# server you run, via CERTPILOT_DB_URL or --db; it does not manage, provision or
# migrate one on your behalf.
#
# The connection string does not live here. It carries a password, and this file
# is a template meant to be committed:
#
#   export CERTPILOT_DB_URL='postgres://certpilot:<pw>@<host>:5432/certpilot?sslmode=require'
#   make migrate
#
# If you put a connection pooler in front of it, use session mode rather than
# transaction mode: pgx caches prepared statements per connection, and
# transaction-mode pooling hands the next query to a backend that has never seen
# them. See docs/database.md.
#
# With no connection string the core uses an in-memory store seeded with sample
# data, which is discarded on every restart.