cryptos-manager/config.example.yaml at main · CryptOS-PKI/cryptos-manager · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
# CryptOS Fleet Manager — example configuration.
#
# Copy to config.yaml (gitignored) and set the real paths for your environment.
# The paths below are placeholders.
#
# Node inventory for a local nodeID / TPM-less QEMU fleet. Map each node's FQDN
# to the host in /etc/hosts; the QEMU host-forwards land on each node's guest
# :443. The manager dials each node's mTLS gRPC listener presenting that node's
# admin client cert+key, which the node enforces. The manager verifies every
# node's server cert and refuses a node it can't verify: the cert must chain to
# caCertPath and be valid for the endpoint's host, or match a server.crt pin
# next to the node's adminCertPath (see docs/node-trust.md). caCertPath is that
# node's identity chain (`cryptosctl identity show -o pem`): root = 1 cert,
# intermediate = 2 certs [intermediate, root]. It is optional; a node with no
# CA yet is verified by its pin. insecureSkipNodeVerify: true skips the check
# for one node, for lab testing only.
listen: "127.0.0.1:8080"
corsOrigins: ["http://localhost:5173", "http://127.0.0.1:5173"]
authBypass: true
# The manager refuses to start with neither database_url nor storage.mode:
# memory set (see docs/storage.md). This example uses memory mode for offline
# dev: nothing persists across a restart. Set database_url instead for durable
# Postgres state; the manager then applies the schema, seeds the catalog into
# an empty database on first run, and persists enrollments and the audit chain.
# database_url: "postgres://manager:secret@localhost:5432/manager"
storage:
  mode: memory
# mcp serves the Model Context Protocol endpoint for AI agents at /mcp (see
# docs/mcp.md). Off by default. Enabling it requires authBypass: false and
# database_url, or the manager refuses to start.
# mcp:
#   enabled: true
#   public_url: "https://fleetos.example.org"
nodes:
  - name: pki-root
    endpoint: "pki-root.acme.com:4443"
    role: root
    adminCertPath: "/etc/cryptos/fleet/pki-root/admin.crt"
    adminKeyPath: "/etc/cryptos/fleet/pki-root/admin.key"
    caCertPath: "/etc/cryptos/fleet/pki-root/ca.pem"
  - name: pki-inter
    endpoint: "pki-inter.acme.com:4444"
    role: intermediate
    adminCertPath: "/etc/cryptos/fleet/pki-inter/admin.crt"
    adminKeyPath: "/etc/cryptos/fleet/pki-inter/admin.key"
    caCertPath: "/etc/cryptos/fleet/pki-inter/ca.pem"