# Generated from Goauld config/server_config.yaml. Do not edit manually.
# Age private key used by the server.
age-private-key: ""

# Domains used to serve HTTP and WebSocket traffic.
http-domain:
- www.example.com

# Domains used to serve raw TLS traffic (SSH over TLS).
tls-domain:
- app.example.com

# Domain used to serve DNS-based traffic (SSH over DNS).
dns-domain: t.example.com

# Domain used to serve DNS-based traffic (SSH over DNS-ALT).
dns-domain-alt: s.example.com

# Address and port to bind for HTTP connections (port 0 = random).
http-listen-addr: :80

# Address and port to bind for HTTPS connections (port 0 = random).
https-listen-addr: :443

# Address and port to bind for SSH connections (port 0 = random).
sshd-listen-addr: :2222

# Address and port to bind for DNS connections (port 0 = random).
dns-listen-addr: :53

# Address and port to bind for QUIC connections (port 0 = random).
quic-listen-addr: :443

# Path to the TLS private key file.
tls-key: ""

# Path to the TLS certificate file.
tls-cert: ""

# Email used when generating Let's Encrypt certificates.
letsencrypt-email: mail@example.com

# Enable TLS support.
tls: true

# Enable QUIC protocol support. Requires tls to also be enabled.
quic: true

# Enable DNS server for SSH-over-DNS connections.
dns: true

# Enable SSH server.
ssh: true

# Disable database usage.
no-db: false

# Path or filename of the database to use.
db-file-name: Goauld.db

# List of IP addresses allowed to access the /admin/ and /manage/ endpoints, SSH password authentication, and SSH local port forwarding. Also gates /ssh-ws/ if --ssh-websocket is enabled.
allowed-ips:
- 127.0.0.1
- 0.0.0.0/32

# List of reverse-proxy/load-balancer IP addresses or CIDR ranges trusted to set X-Forwarded-For. Only set this when Goauld is deployed behind a reverse proxy. Must include the proxy's own IP/CIDR. Leave empty (default) for direct internet-facing deployments; X-Forwarded-For is otherwise ignored. Only affects the allowed-ips check for the /admin/, /manage/, and /ssh-ws/ HTTP endpoints. SSH password authentication and SSH local port forwarding always use the raw TCP peer address and are not covered by this setting.
trusted-proxies: []

# Access token required for the /manage/ API endpoint and, if --ssh-websocket is enabled, the /ssh-ws/ endpoint.
access-token:
- ACCESS_TOKEN_REPLACE_ME

# Enable an HTTP(S)-tunneled WebSocket endpoint (/ssh-ws/) that bridges to the SSH server, for clients that can only reach Goauld over HTTP(S) (e.g. behind a restrictive reverse proxy). Gated by --allowed-ips/--trusted-proxies and --access-token. Direct raw-TCP SSH access on --sshd-listen-addr keeps working unchanged either way.
ssh-websocket: false

# Admin token required for the /admin/ API endpoint.
admin-token:
- ADMIN_TOKEN_REPLACE_ME

# HTTP Basic Auth credentials required to access the binaries endpoint.
binaries-basic-auth: username:password

# Filesystem path where agent binaries are stored.
binaries-path: ./binaries

# Increase log verbosity. Repeat for more detail.
verbose: 0

# Suppress all log output.
quiet: false

# Show version information and exit.
version: false

# Generate a configuration file from the current settings.
generate-config: false

# Path to the configuration file to use.
config-file: ""