[
 {rabbit,
  [
   %% We do not want plain TCP, only TLS
   {tcp_listeners, []},
   {ssl_cert_login_from, common_name},
   %% Here goes TLS
   {ssl_listeners, [5671]},
   {ssl_options, [{cacertfile,  "/etc/rabbitmq/ca.crt"},
                  {certfile,    "/etc/rabbitmq/nodecert/node.crt"},
                  {keyfile,     "/etc/rabbitmq/nodecert/node.key"},
                  {verify,      verify_peer},
                  {fail_if_no_peer_cert, true}]},
   {auth_mechanisms, ['EXTERNAL']},

   %% Here goes the cluster config
   {cluster_nodes, {['rabbit@rabbitmq01{{env_suffix}}.{{datacenter}}.fedoraproject.org',
                     'rabbit@rabbitmq02{{env_suffix}}.{{datacenter}}.fedoraproject.org',
                     'rabbit@rabbitmq03{{env_suffix}}.{{datacenter}}.fedoraproject.org'],
                    disc}},

   %% How to respond to cluster partitions.
   %% Documentation: https://www.rabbitmq.com/partitions.html
   {cluster_partition_handling, autoheal},

   %% And some general config
   {log_levels, [{connection, none}]},
   {default_user_tags, [administrator]},
   {heartbeat, 600},
   {channel_max, 128}
  ]},
 {kernel, [{net_ticktime,  120}]},
 {rabbitmq_management,
  [
   {listener, [{port, 15672},
               {ip, "127.0.0.1"}
               %% Ansible can't use HTTPS yet
               %%{ssl, true},
               %%{ssl_opts, [{cacertfile, "/etc/rabbitmq/ca.crt"},
               %%            {certfile,   "/etc/rabbitmq/nodecert/node.crt"},
               %%            {keyfile,    "/etc/rabbitmq/nodecert/node.key"}]}
              ]}
  ]},

 {rabbitmq_management_agent,
  [
  ]},
 {rabbitmq_shovel,
  [{shovels,
    [
    ]}
  ]},
 {rabbitmq_stomp,
  [
  ]},
 {rabbitmq_mqtt,
  [
  ]},
 {rabbitmq_amqp1_0,
  [
  ]},
 {rabbitmq_auth_backend_ldap,
  [
  ]}
].
