[server]
# What ip to listen on. Set this to a specific ip if you want to listen on a
# specific interface, or use 0.0.0.0 to listen on all interfaces.
listen = 0.0.0.0
# What port we listen on
port = 8080
# How long should files be kept on disk (in seconds)
max_file_age = 300
# How often should we clean up files, tokens, etc. (in seconds)
cleanup_interval = 60

[security]
# Path to private SSL key for https
private_ssl_cert = host.key
# Path to public SSL certificate for https
public_ssl_cert = host.cert
# Who is allowed to connect to this machine? This can be a comma separated
# list of ip addresses or networks like 192.168.1.2/24
allowed_ips = 0.0.0.0/0
# What filenames are acceptable to be signed? This is a comma separated list
# of regular expressions
allowed_filenames = .*
# Minimum filesize that we'll sign
min_filesize = 10
# Maximum filesize, per format. 52428800 = 50MB, 524288000 = 500MB
max_filesize_gpg = 524288000
max_filesize_dmg = 52428800
max_filesize_mar = 52428800
max_filesize_signcode = 52428800
max_filesize_osslsigncode = 52428800
max_filesize_sha2signcode = 52428800
max_filesize_emevoucher = 52428800
# Secret for signing tokens. This should be kept private!
# It should also be the same on all equivalent signing servers.
token_secret = secretstring
# Any key starting with 'token_secret' is also valid, to allow supporting
# multiple token secrets at the same time (to make it possible to transitioning
# to new secrets without downtime). New tokens are generated with the
# 'token_secret' value
token_secret0 = oldsecretstring
# username:password for http basic authenication for generating new tokens
new_token_auth = foo:bar
# Any key starting with 'new_token_auth' is valid
new_token_auth0 = foo:baz
# Which ips are allowed to request new tokens
new_token_allowed_ips = 127.0.0.1
# Maximum age for a token
max_token_age = 3600

[paths]
# Where we store signed files
signed_dir = signed-files
# Where we store unsigned files
unsigned_dir = unsigned-files

[signing]
# What signing formats we support
formats = mar,gpg,sha2signcode,signcode,osslsigncode,emevoucher
# Which script to run to sign files
signscript = python ./signscript.py -c signing.ini
# How many files to sign at once
concurrency = 4
# Test files for the various signing formats
# signscript will be run on each of these on startup to test that passphrases
# have been entered correctly
testfile_signcode = test.exe
testfile_osslsigncode = test64.exe
testfile_sha2signcode = test.exe
testfile_mar = test.mar
testfile_gpg = test.mar
testfile_emevoucher = test.bin

[signscript]
# Various settings for signscript. signing-server.py doesn't look in here
# Where are MozAuthenticode.{pvk,spc} located
signcode_keydir = /path/to/keys
osslsigncode_keydir = /path/to/keys
sha2signcode_keydir = /path/to/keys
# Where is the gpg directory with our private key
gpg_homedir = /path/to/.gpg
# Where is the eme voucher private key
emevoucher_key = /path/to/cert.pem
emevoucher_chain = /path/to/chain.pem
# How to run mar
mar_cmd = /path/to/signmar -d /path/to/nsscerts -n keyname -s