4f60681d63
Turns out we set datacenter to 'staging' in staging, and that is not really a hostname/certname we want to use. So, since nothing is outside of iad2 here, just hardcode iad2. Signed-off-by: Kevin Fenzi <kevin@scrye.com>
74 lines
2.7 KiB
Django/Jinja
74 lines
2.7 KiB
Django/Jinja
# This is a configuration for the sigul server.
|
|
|
|
[server]
|
|
# Host name of the publically acessible bridge to clients
|
|
|
|
{% if env == "production" %}
|
|
bridge-hostname: sign-bridge.{{datacenter}}.fedoraproject.org
|
|
{% else %}
|
|
bridge-hostname: sign-bridge01.stg.iad2.fedoraproject.org
|
|
{% endif %}
|
|
server-cert-nickname: sign-vault{{ env_suffix }}.iad2.fedoraproject.org
|
|
|
|
# Port on which the bridge expects server connections
|
|
bridge-port: 44333
|
|
# Maximum accepted size of payload stored on disk
|
|
max-file-payload-size: 5147483648
|
|
# Maximum accepted size of payload stored in server's memory
|
|
max-memory-payload-size: 1048576
|
|
|
|
[database]
|
|
# Path to a directory containing a SQLite database
|
|
;database-path: /var/lib/sigul
|
|
|
|
[gnupg]
|
|
# Path to a directory containing GPG configuration and keyrings
|
|
gnupg-home: /var/lib/sigul/gnupg
|
|
# Default primary key type for newly created keys
|
|
gnupg-key-type: RSA
|
|
# Default primary key length for newly created keys
|
|
gnupg-key-length: 4096
|
|
# Default subkey type for newly created keys, empty for no subkey
|
|
gnupg-subkey-type:
|
|
# Default subkey length for newly created keys if gnupg-subkey-type is not empty
|
|
; gnupg-subkey-length: 2048
|
|
# Default key usage flags for newly created keys
|
|
gnupg-key-usage: encrypt, sign
|
|
# Length of key passphrases used for newsly created keys
|
|
passphrase-length: 128
|
|
|
|
[daemon]
|
|
# The user to run as
|
|
unix-user: sigul
|
|
# The group to run as
|
|
unix-group: sigul
|
|
|
|
[nss]
|
|
# Path to a directory containing a NSS database
|
|
nss-dir: /var/lib/sigul
|
|
# Password for accessing the NSS database. If not specified, the server will
|
|
# ask on startup
|
|
; nss-password is not specified by default
|
|
# Minimum and maximum versions of TLS used
|
|
nss-min-tls: tls1.2
|
|
nss-max-tls: tls1.2
|
|
|
|
[binding]
|
|
{% if env == "production" %}
|
|
# List of binding modules enabled
|
|
enabled: pkcs11
|
|
pkcs11_tokens: yubikey_sv03,yubikey_sv04,yubikey_sv05,yubikey_sv06
|
|
pkcs11_yubikey_sv03_pubkey: /etc/sigul/yubikey_sv03.pem
|
|
pkcs11_yubikey_sv04_pubkey: /etc/sigul/yubikey_sv04.pem
|
|
pkcs11_yubikey_sv05_pubkey: /etc/sigul/yubikey_sv05.pem
|
|
pkcs11_yubikey_sv06_pubkey: /etc/sigul/yubikey_sv06.pem
|
|
{% if inventory_hostname.startswith('sign-vault03') %}
|
|
pkcs11_yubikey_sv03_privkey: pkcs11:serial=8f2a341e00d7a665;id=%03;type=private
|
|
{% elif inventory_hostname.startswith('sign-vault04') %}
|
|
pkcs11_yubikey_sv04_privkey: pkcs11:serial=b38ee13e56b3b987;id=%03;type=private
|
|
{% elif inventory_hostname.startswith('sign-vault05') %}
|
|
pkcs11_yubikey_sv05_privkey: pkcs11:serial=e8dae68ae187ff13;id=%03;type=private
|
|
{% elif inventory_hostname.startswith('sign-vault06') or inventory_hostname == "sign-vault01.iad2.fedoraproject.org" %}
|
|
pkcs11_yubikey_sv06_privkey: pkcs11:serial=e3c4804a6631dd5f;id=%03;type=private
|
|
{% endif %}
|
|
{% endif %}
|