1/* 2 * This Source Code Form is subject to the terms of the Mozilla Public 3 * License, v. 2.0. If a copy of the MPL was not distributed with this 4 * file, You can obtain one at http://mozilla.org/MPL/2.0/. 5 */ 6 7/* 8 * This is derived from Caiyeon goldfish/config/sample.hcl just for testing 9 * OpenGrok's HCL handling and modified arbitrarily to test other HCL syntax. 10 */ 11 12# [Required] listener defines how goldfish will listen to incoming connections 13listener "tcp" { 14 # [Required] [Format: "address", "address:port", or ":port"] 15 # goldfish's listening address and/or port. Simply ":443" would suffice. 16 address = ":8000" 17 18 # [Optional] [Default: 0] [Allowed values: 0, 1] 19 # set to 1 to disable tls & https 20 tls_disable = 1 21 22 # [Optional] [Default: 0] [Allowed values: 0, 1] 23 # set to 1 to redirect port 80 to 443 (hard-coded port numbers) 24 tls_autoredirect = 0 25 26 # Option 1: local certificate 27 certificate "local" { 28 cert_file = "/path/to/certificate.cert" 29 key_file = "/path/to/keyfile.pem" 30 } 31 32 # Option 2: using Vault's PKI backend [Requires vault_token at launch time] 33 # goldfish will request new certificates at half-life and hot-reload, 34 pki_certificate "pki" { 35 # [Required] 36 pki_path = "pki/issue/<role_name>" 37 common_name = "goldfish.vault.service" 38 39 # [Optional] see Vault PKI docs for what these mean 40 alt_names = ["goldfish.vault.srv", "ui.vault.srv"] 41 ip_sans = ["10.0.0.10", "127.0.0.1", "172.0.0.1"] 42 } 43} 44 45# [Required] vault defines how goldfish should bootstrap to vault 46vault { 47 # [Required] [Format: "protocol://address:port"] 48 # This is vault's address. Vault must be up before goldfish is deployed! 49 address = "http://127.0.0.1:8200" 50 51 # [Optional] [Default: 0] [Allowed values: 0, 1] 52 # Set this to 1 to skip verifying the certificate of vault (e.g. self-signed certs) 53 tls_skip_verify = 0 54 55 # [Required] [Default: "secret/goldfish"] 56 # This should be a generic secret endpoint where runtime settings are stored 57 # See wiki for what key values are required in this 58 runtime_config = "secret/goldfish" 59 60 # [Optional] [Default: "auth/approle/login"] 61 # You can omit this, unless you mounted approle somewhere weird 62 approle_login = "auth/approle/login" 63 64 # [Optional] [Default: "goldfish"] 65 # You can omit this if you already customized the approle ID to be 'goldfish' 66 approle_id = "goldfish" 67 68 # [Optional] [Default: ""] 69 # If provided, goldfish will use this CA cert to verify Vault's certificate 70 # This should be a path to a PEM-encoded CA cert file 71 ca_cert = "" 72 73 # [Optional] [Default: ""] 74 # See above. This should be a path to a directory instead of a single cert 75 ca_path = "" 76} 77 78# [Optional] [Default: 0] [Allowed values: 0, 1] 79# Set to 1 to disable mlock. Implementation is similar to vault - see vault docs for details 80# This option will be ignored on unsupported platforms (e.g Windows) 81disable_mlock = 0 82