# mcias.conf.docker.example — Config template for container deployment
#
# Mount this file into the container at /srv/mcias/mcias.toml:
#
#   docker run -d \
#     --name mcias \
#     -v /srv/mcias:/srv/mcias \
#     -e MCIAS_MASTER_PASSPHRASE=your-passphrase \
#     -p 8443:8443 \
#     -p 9443:9443 \
#     mcias:latest
#
# The container runs as uid 10001 (mcias). Ensure that:
#   - /srv/mcias is writable by uid 10001
#   - TLS cert and key are readable by uid 10001
#
# TLS: The server performs TLS termination inside the container; there is no
# plain-text mode. Place your certificate and key under /srv/mcias/.
# For Let's Encrypt certificates, mount the live/ directory read-only.

[server]
listen_addr = "0.0.0.0:8443"
grpc_addr   = "0.0.0.0:9443"
tls_cert    = "/srv/mcias/server.crt"
tls_key     = "/srv/mcias/server.key"
# If a reverse proxy (nginx, Caddy, Traefik) sits in front of this container,
# set trusted_proxy to its container IP so real client IPs are used for rate
# limiting and audit logging. Leave commented out for direct exposure.
# trusted_proxy = "172.17.0.1"

[database]
# All data lives under /srv/mcias for a single-volume deployment.
path = "/srv/mcias/mcias.db"

[tokens]
issuer         = "https://auth.example.com"
default_expiry = "168h"
admin_expiry   = "8h"
service_expiry = "8760h"

[argon2]
time    = 3
memory  = 65536
threads = 4

[master_key]
# Pass the passphrase via the MCIAS_MASTER_PASSPHRASE environment variable.
# Set it with: docker run -e MCIAS_MASTER_PASSPHRASE=your-passphrase ...
# or with a Docker secret / Kubernetes secret.
passphrase_env = "MCIAS_MASTER_PASSPHRASE"