-
Notifications
You must be signed in to change notification settings - Fork 7
Expand file tree
/
Copy pathconfig.example.yaml
More file actions
110 lines (99 loc) · 4.27 KB
/
Copy pathconfig.example.yaml
File metadata and controls
110 lines (99 loc) · 4.27 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
host: "0.0.0.0"
port: 8080
log_level: "info"
buffer_size: 1000
# CT log sources are loaded from a code-owned catalog registry:
# - google_v3_usable (RSA-SHA256 verified; authoritative by default)
# - google_v3_all (RSA-SHA256 verified; non-authoritative by default)
# - apple (TLS-authenticated, no detached signature; non-authoritative by default)
# Tune per-source authority via `ct_log.catalog_authority_overrides` below.
protocols:
websocket: true
sse: true
metrics: true
health: true
example_json: true
api: false
# Stream types to serialize and serve.
# Disabling a stream type skips JSON serialization for that format
# and removes its WebSocket/SSE route entirely, saving CPU and bandwidth.
streams:
full: true # Full stream (includes DER + chain, ~4-5 KB/cert)
lite: true # Lite stream (no DER/chain, ~1 KB/cert)
domains_only: true # Domains-only stream (~200 B/cert)
ct_log:
retry_max_attempts: 3
retry_initial_delay_ms: 1000
retry_max_delay_ms: 30000
request_timeout_secs: 30
healthy_threshold: 2
unhealthy_threshold: 5
health_check_interval_secs: 60
state_file: "certstream_state.json"
# Entries requested per get-entries call. Servers clamp to their own max;
# the watcher adapts to whatever the server actually returns.
batch_size: 1024
poll_interval_ms: 1000
# Get-entries windows / tiles fetched concurrently per watcher during
# catch-up (1-16). The per-operator token bucket allows a burst of this
# size, so the sustained request rate still honours the operator rate
# limit. 1 = sequential. (env: CERTSTREAM_CT_LOG_FETCH_CONCURRENCY)
fetch_concurrency: 4
# Fresh static-CT watchers start this many leaves behind the checkpoint head.
# Default preserves the existing head-256 behavior while avoiding full-history replay.
start_overlap_leaves: 256
# Master switches per protocol family. Set `rfc6962_enabled: false` once
# you've fully cut over to static-ct logs (env: CERTSTREAM_RFC6962_ENABLED).
rfc6962_enabled: true
static_ct_enabled: true
# Per-operator outbound rate limit. default_operator_rate_limit_ms applies to
# any operator absent from operator_rate_limits.
default_operator_rate_limit_ms: 500
operator_rate_limits: {}
# Per-catalog-source runtime-authority overrides. Keys are
# google_v3_usable, google_v3_all, and apple. An override can only grant
# authority to a source that currently verifies; it cannot promote an
# unverified source. Example: opt into the broader Google all list with
# `google_v3_all: true`.
catalog_authority_overrides: {}
# Cross-log certificate dedup. Defaults sized for the 2026 RFC6962/static-ct
# transition where the same cert appears in 3-4 logs in tight 60s MMD windows.
dedup:
capacity: 1000000 # max in-flight fingerprints
ttl_secs: 900 # 15-minute window — keep above max log MMD
connection_limit:
enabled: false
max_connections: 10000
per_ip_limit: null
rate_limit:
enabled: false
auth:
enabled: false
tokens: []
header_name: "Authorization"
hot_reload:
enabled: false
watch_path: null
# Custom RFC6962 logs can optionally set `expected_log_id`, `batch_size`, and/or
# `poll_interval_ms`. For custom logs, `expected_log_id` declares the CT log ID
# used for runtime identity/metrics and duplicate-log detection; it does not
# replace a catalog-discovered source.
custom_logs: []
# Static CT logs (Sunlight / static-ct-api protocol). These are merged with logs
# discovered via the signed-catalog registry. When `expected_log_id` is set, it
# must match the discovered CT log identity before replacement; id-less entries
# keep URL-based replacement. This is also the only path to ingest an Apple-only
# or otherwise non-authoritative log.
#
# `url` is the monitoring prefix (often `mon.*`) used to fetch checkpoint and
# tile data. `log_origin` overrides the expected checkpoint origin when the
# fetch URL host differs from the submission URL host (e.g. mon.* vs log.*).
# When omitted, the origin is derived from the URL by stripping scheme and
# trailing slash.
static_logs:
- name: "Let's Encrypt 'Sycamore' 2026h1"
url: "https://mon.sycamore.ct.letsencrypt.org/2026h1/"
log_origin: "log.sycamore.ct.letsencrypt.org/2026h1"
# expected_log_id: "base64-sha256-log-id"
# batch_size: 128
# poll_interval_ms: 2000