uid = plalonde
gid = plalonde
enable_coredumps = true
ca_file = "/home/plalonde/prog/mdr/ca/root.pem"
cert_file = "/home/plalonde/prog/mdr/ca/root.pem"
crl_file = "/home/plalonde/prog/mdr/ca/root.crl"
key_file = "/home/plalonde/prog/mdr/ca/key.pem"
require_client_cert = false
monitor_cert = true
port = 9790
listen_backlog = 1024
prefork = 2
pid_file = "/tmp/mdrd.pid"
counters_sock = "/tmp/mdrd_counters.sock"

# Maximum number of concurrent client connections per fork
max_clients = 10000

# Maximum number of concurrent client connections some the same IP address,
# per fork. This can be useful to prevent abusive clients from using up
# all connection slots from max_clients.
max_conn_per_ip = 25

# When receiving an incomplete TLS record, the SO_RCVLOWAT socket option
# will be used on the socket to ensure all remaining bytes are buffered
# before waking on read on that socket.
use_rcv_lowat = true

# OpenBSD only; sets the SO_DEBUG option on the listening socket, which
# is inherited on accept()
so_debug = false

# The TCP SO_RCVBUF and SO_SNDBUF socket options. If set to 0, we leave it
# up to the operating system to decide and auto-tune.
rcvbuf = 0
sndbuf = 0

socket_timeout_min = 3
socket_timeout_max = 300

# Because TLS records are normally smaller than 16 KiB, as well as to
# prevent excessive memory usage, it is advised to keep the maximum payload
# size under this amount and break down messages. Moreover, pipe size on
# OpenBSD is 16KiB so going above this will require a blocking write.
# Keep in mind that mdrd will also pass the client's cert along with the
# message so the backend can receive message over this size.
max_payload_size = 16384

# Put an upper bound to avoid clients sending absurd certs.
max_cert_size = 4096

allowed_mdr_domains = [ 0x00000000 ]

backend_argv = [
	"/home/plalonde/prog/mdr/mdrd_backend_echo"
	"/home/plalonde/prog/mdr/ca/root.pem"
	"/home/plalonde/prog/mdr/ca/root.crl"
]
backend_uid = plalonde
backend_gid = plalonde

# The following only affect OpenBSD's pledge() and unveil() calls
backend_promises = "stdio rpath"
backend_unveils = [
	"x=/home/plalonde/prog/mdr/mdrd_backend_echo"
	"r=/home/plalonde/prog/mdr/ca/root.pem"
	"r=/home/plalonde/prog/mdr/ca/root.crl"
]
