# Keylime verifier configuration
[verifier]

# The configuration file version number
version = {{ verifier.version }}

# Unique identifier for each verifier instance.
uuid = {{ verifier.uuid }}

# The binding address and port for the verifier server. Use a specific address
# to bind one interface, "0.0.0.0" to listen on all IPv4 interfaces, or "::"
# to listen on all IPv6 interfaces (also accepts IPv4 on dual-stack hosts).
ip = "{{ verifier.ip }}"
port = {{ verifier.port }}

# The address and port of registrar server that the verifier communicates with
registrar_ip = {{ verifier.registrar_ip }}
registrar_port = {{ verifier.registrar_port }}

# Enable mTLS communication between agent, verifier and tenant.
# Details on why setting it to "False" is generally considered insecure can be found
# on https://github.com/keylime/keylime/security/advisories/GHSA-2m39-75g9-ff5r
enable_agent_mtls = {{ verifier.enable_agent_mtls }}

# The 'tls_dir' option defines the directory where the keys and certificates are
# stored.
#
# If set as 'generate', automatically generate a CA, keys, and certificates for
# the client and the server in the /var/lib/keylime/cv_ca directory, if not
# present.
#
# The 'server_key', 'server_cert', 'client_key', 'client_cert',
# 'trusted_client_ca', and 'trusted_server_ca' options should all be set with
# the 'default' keyword when 'generate' keyword is set for 'tls_dir'.
#
# If set as 'default', the '/var/lib/keylime/cv_ca' directory is used, which
# should contain the files indicated by  the 'server_key', 'server_cert',
# 'client_key', 'client_cert', 'trusted_client_ca', and 'trusted_server_ca'
# options.
tls_dir = {{ verifier.tls_dir }}

# The name of the file containing the Keylime verifier server private key.
# The file should be stored in the directory set in the 'tls_dir' option.
# This private key is used to serve the Keylime verifier REST API
#
# If set as 'default', the 'server-private.pem' value is used.
server_key = {{ verifier.server_key }}

# Set the password used to decrypt the server private key file.
# If 'tls_dir = generate', this password will also be used to protect the
# generated server private key.
# If left empty, the private key will not be encrypted.
server_key_password = {{ verifier.server_key_password }}

# The name of the file containing the Keylime verifier server certificate.
# The file should be stored in the directory set in the 'tls_dir' option.
#
# If set as 'default', the 'server-cert.crt' value is used.
server_cert = {{ verifier.server_cert }}

# Additional Subject Alternative Names (SANs) to include in auto-generated
# server certificates when 'tls_dir = generate'.
#
# This is a comma-separated list of hostnames and/or IP addresses that will be
# added to the server certificate's SAN extension. This allows clients to verify
# the server's hostname when connecting.
#
# By default, the certificate will automatically include:
# - localhost, 127.0.0.1, and ::1
# - The system's hostname and FQDN
# - The IP address from the 'ip' option (if not 0.0.0.0 or ::)
#
# Use this option to add additional names, such as:
# - External DNS names (e.g., verifier.example.com)
# - Load balancer addresses
# - Additional IP addresses
#
# Example: cert_subject_alternative_names = verifier.example.com,10.0.0.5,verifier-internal
# Leave empty to use only the automatically detected names.
cert_subject_alternative_names = {{ verifier.cert_subject_alternative_names }}

# The list of trusted client CA certificates.
# The files in the list should be stored in the directory set in the 'tls_dir'
# option.
#
# If set as 'default', the value is set as '[cacert.crt]'
trusted_client_ca = {{ verifier.trusted_client_ca }}

# The name of the file containing the Keylime verifier client private key.
# The file should be stored in the directory set in the 'tls_dir' option.
# This private key is used by the Keylime verifier to connect to the other
# services using TLS.
#
# If set as 'default', the 'client-private.pem' value is used.
client_key = {{ verifier.client_key }}

# Set the password used to decrypt the client private key file.
# If 'tls_dir = generate', this password will also be used to protect the
# generated client private key.
# If left empty, the private key will not be encrypted.
client_key_password = {{ verifier.client_key_password }}

# The name of the file containing the Keylime verifier client certificate.
# The file should be stored in the directory set in the 'tls_dir' option.
# This certificate is used by the Keylime verifier to connect to the other
# services using TLS.
#
# If set as 'default', the 'client-cert.crt' value is used.
client_cert = {{ verifier.client_cert }}

# The list of trusted server CA certificates.
# The files in the list should be stored in the directory set in the 'tls_dir'
# option.
#
# If set as 'default', the value is set as '[cacert.crt]'
trusted_server_ca = {{ verifier.trusted_server_ca }}

# Authorization provider to use for access control decisions.
#
# Available providers:
#   simple - Default provider implementing 4-category access control:
#            - PUBLIC: No authentication (version info, evidence verification)
#            - AGENT_ONLY: PoP bearer token + resource ownership (attestations)
#            - AGENT_OR_ADMIN: PoP token or mTLS certificate (read own agent)
#            - ADMIN: mTLS client certificate (all management operations)
#
# The 'simple' provider enforces strict separation between agent and admin
# authentication methods:
#   - Agents authenticate via PoP (Proof-of-Possession) bearer tokens only
#   - Admins authenticate via mTLS client certificates only
#   - If an Authorization header is present, mTLS is never used (prevents
#     privilege escalation)
#
# SECURITY NOTE: Never distribute client certificates signed by the verifier's
# trusted CA to agents. Agents should only have PoP tokens for authentication.
#
# Certificate requirements:
#   - Pull mode agents: Self-signed server certs are acceptable. If CA-issued,
#     must have Server Authentication EKU only.
#   - Push mode agents: No client certs from trusted CA. Use PoP tokens only.
#   - Admins: Client certs signed by trusted CA with Client Authentication EKU.
authorization_provider = {{ verifier.authorization_provider }}

# Database URL Configuration
# See this document https://keylime.readthedocs.io/en/latest/installation.html#database-support
# for instructions on using different database configurations.
#
# An example of database_url value for using sqlite:
#   sqlite:////var/lib/keylime/cv_data.sqlite
# An example of database_url value for using mysql:
#   mysql+pymysql://keylime:keylime@keylime_db:[port]/verifier?charset=utf8
#
# If set as 'sqlite' keyword, will use the configuration set by the file located
# at "/var/lib/keylime/cv_data.sqlite".
database_url = {{ verifier.database_url }}

# Limits for DB connection pool size in sqlalchemy
# (https://docs.sqlalchemy.org/en/14/core/pooling.html#api-documentation-available-pool-implementations)
database_pool_sz_ovfl = {{ verifier.database_pool_sz_ovfl }}

# Whether to automatically update the DB schema using alembic
auto_migrate_db = {{ verifier.auto_migrate_db }}

# The number of worker processes to use for the cloud verifier.
# Set to "0" to create one worker per processor.
num_workers = {{ verifier.num_workers }}

# Whether or not to use an exponential backoff algorithm for retries.
exponential_backoff = {{ verifier.exponential_backoff }}

# Either how long to wait between failed attempts to connect to a cloud agent
# in seconds, or the base for the exponential backoff algorithm.
# Floating point values accepted here.
retry_interval = {{ verifier.retry_interval }}

# Number of retries to connect to an agent before giving up. Must be an integer.
max_retries = {{ verifier.max_retries }}

# Time between integrity measurement checks, in seconds.  If set to "0", checks
# will be done as fast as possible.  Floating point values accepted here.
quote_interval = {{ verifier.quote_interval }}

# The verifier limits the size of upload payloads (allowlists) which defaults to
# 100MB (104857600 bytes). This setting can be raised (or lowered) based on the
# size of the actual payloads
max_upload_size = {{ verifier.max_upload_size }}

# Timeout in seconds for HTTP requests
request_timeout = {{ verifier.request_timeout }}

# The name of the boot attestation policy to use in comparing a measured boot event log
# with a measured boot reference state.
# A policy is a Python object that `isinstance` of `keylime.elchecking.policies.Policy`
# and was registered by calling `keylime.elchecking.policies.register`.
# The keylime agent extracts the measured boot event log.
# The verifier client specifies the measured boot reference state to use;
# this is specified independently for each agent.
# Depending on the policy, the same reference state may be usable with multiple agents.
# The `accept-all` policy ignores the reference state and approves every log.
measured_boot_policy_name = {{ verifier.measured_boot_policy_name }}

# This is a list of Python modules to dynamically load, for example to register
# additional boot attestation policies.
# Empty strings in the list are ignored.
# A module here may be relative, in which case it is interpreted
# relative to the keylime.elchecking package.
# The default value for this config item is the empty list.
measured_boot_imports = {{ verifier.measured_boot_imports }}

# This is used to manage the number of times measured boot attestation
# is done. In other words, it controls the number of times the call
# to the measured boot policy engine is made to evaluate the boot log
# against the policy specified.
# Here are its possible values and number of bootlog evaluations.
# once (default)  : Bootlog evaluation will be done for only one time.
# always          : Bootlog evaluation will always be done (i.e. for unlimited times).
measured_boot_evaluate = {{ verifier.measured_boot_evaluate }}

# Severity labels for revocation events strictly ordered from least severity to
# highest severity.
severity_labels = {{ verifier.severity_labels }}

# Severity policy that matches different event_ids to the severity label.
# The rules are evaluated from the beginning of the list and the first match is
# used. The event_id can also be a regex. Default policy assigns the highest
# severity to all events.
severity_policy = {{ verifier.severity_policy }}

# If files are already opened when IMA tries to measure them this causes
# a time of measure, time of use (ToMToU) error entry.
# By default we ignore those entries and only print a warning.
# Set to False to treat ToMToU entries as errors.
ignore_tomtou_errors = {{ verifier.ignore_tomtou_errors }}

# Durable Attestation is currently marked as an experimental feature
# In order to enable Durable Attestation, an "adapter" for a Persistent data Store
# (time-series like database) needs to be specified. Some example adapters can be
# found under "da/examples" so, for instance
#      "durable_attestation_import = keylime.da.examples.redis.py"
# could be used to interact with a Redis (Persistent data Store)
durable_attestation_import = {{ verifier.durable_attestation_import }}

# If an adapter for Durable Attestation was specified, then the URL for a Persistent Store
# needs to be specified here. A second optional URL could be specified, for a
# Rekor Transparency Log. A third additional URL could be specified, pointing to a
# Time Stamp Authority (TSA), compatible with RFC3161. Additionally, one might need to
# specify a path containing certificates required by the stores or TSA. Continuing with
# the above example, the following values could be assigned to the parameters:
#      "persistent_store_url=redis://127.0.0.1:6379?db=10&password=/root/redis.auth&prefix=myda"
#      "transparency_log_url=http://127.0.0.1:3000"
#      "time_stamp_authority_url=http://127.0.0.1:2020"
#      "time_stamp_authority_certs_path=~/mycerts/tsa_cert1.pem"
persistent_store_url = {{ verifier.persistent_store_url }}
transparency_log_url = {{ verifier.transparency_log_url }}
time_stamp_authority_url = {{ verifier.time_stamp_authority_url }}
time_stamp_authority_certs_path = {{ verifier.time_stamp_authority_certs_path }}

# If Durable Attestation was enabled, which requires a Persistent Store URL
# to be specified, the two following parameters control the format and encoding
# of the stored attestation artifacts (defaults "json" for format and "" for encoding)
persistent_store_format = {{ verifier.persistent_store_format }}
persistent_store_encoding = {{ verifier.persistent_store_encoding }}

# If Durable Attestation was enabled and a Transparency Log URL was specified,
# the digest algorithm for signatures is controlled by this parameter (default "sha256")
transparency_log_sign_algo = {{ verifier.transparency_log_sign_algo }}

# If Durable Attestation was enabled and a Transparency Log URL was specified,
# a keylime administrator can specify some agent attributes (including attestation
# artifacts, such as quotes and logs) to be signed by the verifier. The use of "all"
# will result in the whole "package" (agent + artifacts) being signed and leaving it empty
# will mean no signing should be done.
signed_attributes = {{ verifier.signed_attributes }}

# Require that allowlists are signed with a key passed via the tenant tool
require_allow_list_signatures = {{ verifier.require_allow_list_signatures }}

# Attestation mode. Can be 'pull' (traditional) or 'push' (agent-driven).
# Default: pull
mode = {{ verifier.mode }}
#
# Lifetime in seconds for challenges sent to agents in push mode.
challenge_lifetime = {{ verifier.challenge_lifetime }}
#
# Timeout in seconds for a single evidence verification task (0 = auto).
verification_timeout = {{ verifier.verification_timeout }}
#
# Rate limiting for session creation endpoint (POST /sessions) in push mode.
# These settings prevent denial-of-service attacks where an attacker floods the verifier
# with session creation requests. Only applies when mode = 'push'.
#
# Maximum number of session creation requests per IP address within the time window.
# Allows for multiple agents from same IP (testing, NAT scenarios).
# Default: 50
session_create_rate_limit_per_ip = {{ verifier.session_create_rate_limit_per_ip }}
#
# Time window in seconds for IP-based rate limiting.
# Default: 60
session_create_rate_limit_window_ip = {{ verifier.session_create_rate_limit_window_ip }}
#
# Maximum number of session creation requests per agent_id within the time window.
# Allows for agent retries (agent default is 3 retries, this allows ~5 auth attempts).
# Default: 15
session_create_rate_limit_per_agent = {{ verifier.session_create_rate_limit_per_agent }}
#
# Time window in seconds for agent-based rate limiting.
# Default: 60
session_create_rate_limit_window_agent = {{ verifier.session_create_rate_limit_window_agent }}
#
# Lifetime in seconds for authentication session tokens.
# After this time, agents must re-authenticate to continue submitting attestations.
# Default: 180 (3 minutes)
session_lifetime = {{ verifier.session_lifetime }}
#
# Whether to automatically extend the session token expiry when an agent
# submits an attestation. When enabled, active agents won't need to re-authenticate
# as long as they continue attesting within the session_lifetime window.
# Default: true
extend_token_on_attestation = {{ verifier.extend_token_on_attestation }}

# Maximum time in seconds to wait for in-flight attestation operations to
# complete during shutdown. The verifier will wait up to this long for active
# database writes and state transitions to finish before stopping the event
# loop. Increasing this value reduces the risk of inconsistent agent state
# after an unclean shutdown, at the cost of a slower shutdown.
# Floating point values accepted here.
shutdown_drain_timeout = {{ verifier.shutdown_drain_timeout }}

[revocations]

# List of revocation notification methods to enable.
#
# Available methods are:
#
# "agent": Deliver notification directly to the agent via the REST
# protocol.
#
# "zeromq": Enable the ZeroMQ based revocation notification method;
# zmq_ip and zmq_port options must be set. Currently this only works if you are
# using keylime-CA.
#
# "webhook": Send notification via webhook. The endpoint URL must be
# configured with 'webhook_url' option. This can be used to notify other
# systems that do not have a Keylime agent running.
enabled_revocation_notifications = {{ revocations.enabled_revocation_notifications }}

# The binding address and port of the revocation notifier service via ZeroMQ.
zmq_ip = {{ revocations.zmq_ip }}
zmq_port = {{ revocations.zmq_port }}

# Webhook url for revocation notifications.
webhook_url = {{ revocations.webhook_url }}
