mirror of
https://pagure.io/fedora-infra/ansible.git
synced 2026-03-20 12:07:34 +08:00
68 lines
2.1 KiB
Django/Jinja
68 lines
2.1 KiB
Django/Jinja
# This is a configuration for the sigul server.
|
|
|
|
[server]
|
|
# Host name of the publically acessible bridge to clients
|
|
|
|
{% if inventory_hostname.startswith('sign') %}
|
|
bridge-hostname: sign-bridge1
|
|
server-cert-nickname: sign-vault1 - Fedora Project
|
|
{% else %}
|
|
bridge-hostname: secondary-signer
|
|
server-cert-nickname: secondary-signer-server
|
|
{% endif %}
|
|
|
|
# Port on which the bridge expects server connections
|
|
bridge-port: 44333
|
|
# Maximum accepted size of payload stored on disk
|
|
max-file-payload-size: 4147483648
|
|
# Maximum accepted size of payload stored in server's memory
|
|
max-memory-payload-size: 1048576
|
|
|
|
[database]
|
|
# Path to a directory containing a SQLite database
|
|
;database-path: /var/lib/sigul
|
|
|
|
[gnupg]
|
|
# Path to a directory containing GPG configuration and keyrings
|
|
gnupg-home: /var/lib/sigul/gnupg
|
|
# Default primary key type for newly created keys
|
|
gnupg-key-type: RSA
|
|
# Default primary key length for newly created keys
|
|
gnupg-key-length: 4096
|
|
# Default subkey type for newly created keys, empty for no subkey
|
|
gnupg-subkey-type:
|
|
# Default subkey length for newly created keys if gnupg-subkey-type is not empty
|
|
; gnupg-subkey-length: 2048
|
|
# Default key usage flags for newly created keys
|
|
gnupg-key-usage: encrypt, sign
|
|
# Length of key passphrases used for newsly created keys
|
|
passphrase-length: 128
|
|
|
|
[daemon]
|
|
# The user to run as
|
|
unix-user: sigul
|
|
# The group to run as
|
|
unix-group: sigul
|
|
|
|
[nss]
|
|
# Path to a directory containing a NSS database
|
|
nss-dir: /var/lib/sigul
|
|
# Password for accessing the NSS database. If not specified, the server will
|
|
# ask on startup
|
|
; nss-password is not specified by default
|
|
# Minimum and maximum versions of TLS used
|
|
nss-min-tls: tls1.2
|
|
nss-max-tls: tls1.2
|
|
|
|
[binding]
|
|
# List of binding modules enabled
|
|
enabled: pkcs11
|
|
pkcs11_tokens: yubikey_sv03,yubikey_sv04
|
|
pkcs11_yubikey_sv03_pubkey: /etc/sigul/yubikey_sv03.pem
|
|
pkcs11_yubikey_sv04_pubkey: /etc/sigul/yubikey_sv04.pem
|
|
{% if inventory_hostname.startswith('sign-vault03') %}
|
|
pkcs11_yubikey_sv03_privkey: pkcs11:serial=8f2a341e00d7a665;id=%03;type=private
|
|
{% else %}
|
|
pkcs11_yubikey_sv04_privkey: pkcs11:serial=b38ee13e56b3b987;id=%03;type=private
|
|
{% endif %}
|