uid = "<%= @mdrd_uid %>"
gid = "<%= @mdrd_gid %>"
enable_coredumps = true

ca_file = "/etc/certes/root.pem"
<% if @ca -%>
key_file = "/etc/certes/proxy_key.pem"
cert_file = "/etc/certes/proxy_cert.pem"
<% else -%>
key_file = "/etc/certes/key.pem"
cert_file = "<%= @var_path %>/cert.pem"
<% end -%>
crl_path = "<%= @var_path %>/crls"
require_client_cert = false
 
port = 9790
listen_backlog = 1024
prefork = <%= @facts['processors']['count'] %>
pid_file = "/var/run/mdrd.pid"
counters_sock = "/var/run/mdrd/counters.sock"
 
max_clients = 10000
max_conn_per_ip = 25
use_rcv_lowat = true
so_debug = false
rcvbuf = 0
sndbuf = 0
socket_timeout_min = 3
socket_timeout_max = 300
max_payload_size = 16384
max_cert_size = 4096
dbg_delay_to_backend_seconds = 0
 
allowed_mdr_domains = [ 0x00000002 ]
 
backend_argv = [
	"<%= @certes_bin %>"
	"-config"
	"/etc/certes/certes.conf"
	"mdrd-backend"
]
backend_uid = "<%= @certes_uid %>"
backend_gid = "<%= @certes_gid %>"
<% if @facts['os']['family'] == 'OpenBSD' -%>
backend_promises = "stdio rpath wpath cpath inet flock unix dns proc error"
backend_unveils = [
	"x=<%= @certes_bin %>"
	"r=/etc/certes/certes.conf"
	"r=/etc/certes/root.pem"
<% if @ca -%>
	"r=/etc/certes/ca_key.pem"
	"r=/etc/certes/ca_cert.pem"
<% else -%>
	"r=/etc/certes/key.pem"
<% end -%>
	"rwc=<%= @var_path %>"
]
<% end -%>
