#
# silcd.conf
#
# Example configuration file.  Note that this attempts to present various
# configuration possibilities and may not actually give any sensible
# configuration.  For real life example see the examples/ directory.
#

#
# Include global algorithms from the "silcalgs.conf" file. This file
# defines ciphers, hash functions, HMACs and PKCS algorithms that can
# be used.
#
Include "@ETCDIR@/silcalgs.conf";

#
# General configuration options
#
# These defines the default behaviour of the server.  Most of these values
# can be overridden with ConnectionParam, which can be defined independently
# for different connections.
#
General {
	# This is the default path where to search modules.  If omitted
	# built-in modules will be used.  Built-in modules will also be
	# used if a module file cannot be located.
	module_path = "@MODULESDIR@";

	# If both passphrase and public key authentication is set for a
	# connection the public key authentication is the preferred one
	# to use.  Set this to `true' to prefer passphrase authentication
	# over public key authentication in these cases.
	#prefer_passphrase_auth = true;

	# Set this to true if the server should require fully qualified
	# domain names (FQDN) for incoming connections.
	#require_reverse_lookup = false;	

	# Default keepalive frequency (seconds). This can be overridden
	# with ConnectionParam.
	keepalive_secs = 300;

	# Default reconnection parameters defines how the server reconnect
	# to the remote if the connection was lost.  The reconnection phase
	# use so called exponential backoff algorithm;  The reconnect
	# interval grows when reconnect count grows.  Next example will
	# attempt to reconnect after 10 seconds of disconnect, and the
	# interval grows up to 600 seconds or until 7 times was attempted
	# to reconnect.  These settings has effect only when connecting
	# as initiator.
	#
	# reconnect_count        - how many times reconnect is attempted
	# reconnect_interval	 - how often reconnect it performed (seconds)
	# reconnect_interval_max - maximum interval for reconnect, the
	#                          server never waits longer than this to
	#                          reconnect (seconds).
	# reconnect_keep_trying  - whether to keep trying even after 
	#                          reconnect_count is reached (the interval
	#                          will be reconnect_interval_max).
	#
	# These can be overridden with ConnectionParam.
	reconnect_count = 7;
	reconnect_interval = 10;
	reconnect_interval_max = 600;
	reconnect_keep_trying = true;
};

#
# Server information
#
ServerInfo {
	#
	# Server FQDN and IP address
	#
	hostname = "lassi.kuo.fi.ssh.com";
	ip = "10.2.1.6";
	port = 706;

	#
	# ServerType field specifies the purpose of this server
	# This is only a descriptive field.
	#
	ServerType = "Test Server";

	#
	# Geographic location
	#
	Location = "Kuopio, Finland";

	#
	# Full admin name
	#
	Admin = "Pekka Riikonen";

	#
	# Admin's email address
	#
	AdminEmail = "priikone@poseidon.pspt.fi";

	#
	# Run SILC server as specific user and group. The server must be 
	# initially run as root.
	#
	User = "nobody";
	Group = "nobody";

	#
	# Public and private keys
	#
	PublicKey = "@ETCDIR@/silcd.pub";
	PrivateKey = "@ETCDIR@/silcd.prv";

	#
	# Motd file
	#
	# Specifies the text file displayed on client connection
	#
	#MotdFile = "@ETCDIR@/motd.txt";

	#
	# Pid file
	#
	PidFile = "@PIDFILE@";
};

#
# Log files.
#
# This section is used to set various logging files, their paths, maximum
# sizes and logging options.
#
# There are only four defined channels allowed for defining (see below).
# The log channels have an importance value, and most important channels
# are redirected on the less important ones, thus setting a valid logging
# file for "infologfile" will ensure logging for all channels, while setting
# logging file for "errorlogfile" will ensure logging for channels "error"
# and "fatal"
#
Logging {
	#
	# If QuickLogs is true, then the logging files will be updated
	# real-time. This causes a bit more CPU and HDD activity, but
	# reduces memory usage. (if unsure say true).
	#
	QuickLogs = false;

	#
	# (Only if QuickLogs is false)
	# FlushDelay tells log files update delay in case you have chosen
	# buffering output.
	#
	FlushDelay = 180;

	Info {
		File = "@LOGSDIR@/silcd.log";
		Size = "50k";
	};
	Warnings {
		File = "@LOGSDIR@/silcd_warnings.log";
		Size = "50k";
	};
	Errors {
		File = "@LOGSDIR@/silcd_errors.log";
		Size = "50k";
	};
	Fatals {
		File = "@LOGSDIR@/silcd_fatals.log";
		Size = "50k";
	};
};

#
# Connection Parameters
#
# This section defined connection parameters.  It is possible to use
# specific parameters in different connections, and to define different
# parameters to different connections.  The parameters can define how the
# connection is handled and how the session is managed.  If connection
# parameters are not used in connections the default values will apply
# (or values defined in General section).  You can have multiple
# ConnectionParams blocks defined.
#
ConnectionParam {
	# unique name. The name is used to reference to this parameter 
	# block from the connections.
	name = "normal";

	# Keepalive frequency (seconds).
	keepalive_secs = 300;

	# Reconnection parameters defines how the server reconnects to
	# the remote if the connection was lost.  The reconnection phase
	# use so called exponential backoff algorithm;  The reconnect
	# interval grows when reconnect count grows.  Next example will
	# attempt to reconnect after 10 seconds of disconnect, and the
	# interval grows up to 600 seconds or until 7 times was attempted
	# to reconnect.  These settings has effect only when connecting
	# as initiator.
	#
	# reconnect_count        - how many times reconnect is attempted
	# reconnect_interval	 - how often reconnect it performed (seconds)
	# reconnect_interval_max - maximum interval for reconnect, the
	#                          server never waits longer than this to
	#                          reconnect (seconds).
	# reconnect_keep_trying  - whether to keep trying even after 
	#                          reconnect_count is reached (the interval
	#                          will be reconnect_interval_max).
	reconnect_count = 7;
	reconnect_interval = 10;
	reconnect_interval_max = 600;
	reconnect_keep_trying = true;

	#TODO:
	#key_exchange_rekey - rekey timeout
	#key_exchange_pfs - rekey PFS
	#key_exchange_mutual_auth - SKE mutual auth

	#connections_max - max incoming connection
	#connections_interval - incoming connection interval limit ?
};

#
# Configured client connections.
#
# The "host" defines the incoming IP address or hostname of the client.
# If it is omitted all hosts will match this client connection.  The
# "param" is optional and can be used to set specific connection parameters
# for this connection.
#
# The authentication data is specified by Passphrase and/or Publickey.
# If both are provided then both password and public key based authentication
# is allowed.  If the Publickey is used it includes the file path to the
# public key file.  If none of them is provided then authentication is not
# required.
#
# Next example connection will match to all incoming client connections,
# and no authentication is required
#
Client {
	#Host = "10.1.*";
	#Passphrase = "secret";
	#PublicKey = "/path/to/the/public.key";
	Param = "normal";
};

#
# Configured server administrator connections
#
# The fields "Host", "User", and "Nick", are optional but you are encouraged
# in using them to better identify your admins.
#
# The authentication data is specified by Passphrase and/or Publickey.
# If both are provided then both password and public key based authentication
# is allowed.  If the Publickey is used it includes the file path to the
# public key file.  If none of them is provided then authentication is not
# required.
#
Admin {
	Host = "10.2.1.199";
	User = "priikone";
	Nick = "pekka";
	Passphrase = "verysecret";
	# Publickey = "/path/to/the/public.key";
};

#
# Configured server connections.
#
# If server connections are configured it means that this server is
# router server.  Normal servers must not configure server connections.
# Thus, if this server is not router do not configure this section.  If
# your server is router, this must be configured.
#
# The authentication data is specified by Passphrase and/or Publickey.
# If both are provided then both password and public key based authentication
# is allowed.  If the Publickey is used it includes the file path to the
# public key file.  If none of them is provided then authentication is not
# required.
#
# If the connection is backup connection then set the "Backup" option
# to true. For normal connections set it false. If it is set to true then
# this server will be backup router.
#
ServerConnection {
	Host = "10.2.1.7";
	Passphrase = "verysecret";
	#Publickey = "/path/to/the/public.key";
	VersionID = 1;
	Param = "normal";
	Backup = false;
};

#
# Configured router connections
#
# For normal servers only one entry maybe configured to this section.  It
# must be the router this server will be connected to.  For router servers,
# this section includes all configured router connections.  The first
# configured connection is the primary route.
#
# The authentication data is specified by Passphrase and/or Publickey.
# If both are provided then both password and public key based authentication
# is allowed.  If the Publickey is used it includes the file path to the
# public key file.  If none of them is provided then authentication is not
# required.
#
# If you are the initiator of the connection then set the "Initiator"
# option to true.  If you are the responder of the connection (waiting for
# incoming connection) then set it to false.
#
# If the connection is backup router connection then set the "BackupHost"
# option to the IP address of the router that the backup router will
# replace if it becomes unavailable.  Set also the router's port to the
# "BackupPort" option.  For normal connection leave both commented. If this
# backup router is in our cell then set the "LocalBackup" option to true.
# If the backup router is in other cell then set it to false.
#
RouterConnection {
	Host = "10.2.1.100";
	Port = 706;
	Passphrase = "verysecret";
	#Publickey = "/path/to/the/public.key";
	VersionID = 1;
	Param = "normal";
	Initiator = true;
	#BackupHost = "10.2.1.6";
	#BackupPort = 706;
	#LocalBackup = true;
};

#
# Denied connections
#
# These connections are denied to connect to our server.
#
# The "Reason" field is mandatory, while the "Host" and "Port" fields can be
# omitted to match everything.
#
#Deny {
#	Host = "10.2.1.99";
#	Port = 706;
#	Reason = "Go away spammer";
#};
#Deny {
#	Host = "10.3.*";
#	Reason = "You are not welcome.";
#};