config-example.yaml

# The URL is presented over the config API
url: https://dns3l.foobar.example.com
adminemail:
  # These addresses are presented over the config API
  - admin1@example.com
  - admin2@example.net
dns: # DNS service providers
  providers:
    infblxA: # Infoblox NIOS over WAPI
      type: infoblox
      name: Infoblox A
      host: foo.bar2.local
      port: 443
      version: 2.10 #WAPI version to use
      dnsview: my-dnsview # The DNS view configured in Infoblox
      auth: #endpoint specific
        user: username
        pass: password
      # sslverify: "false" #only set this in case cert validation shall be disabled
    infblxB:
      type: infoblox
      disabled: true
      name: Infoblox B
      host: foo.bar.local
      port: 1234
      version: 2.8
      dnsview: my-dnsview
      auth:
        user: username
        pass: password
      #sslverify: "false"
    dns3l:
      type: otc # Open Telekom Cloud (OTC) DNS
      disabled: false
      name: DNS3L Labs Inc. OTC tenant
      auth:
        authurl: https://iam.eu-de.otc.t-systems.com/v3
        projectname: #omitted
        projectid: #omitted
        ak: accesskeyID
        sk: secretaccesskey
      ttl:
        challenge: 60
        autodns: 3600
      os-region: eu-de
      precheck:
        enabled: true
        checkNameservers:
          # These nameservers are used to check if and when the DNS entries are propagated
          # so the ACME provider can read the challenges
          - 1.2.3.4:53
          - 5.6.7.8:53
        precheckInterval: 2s
        precheckTimeout: 2m
# somepdns:
#   type: pdns # PowerDNS AS
#   ...
ca: #ACME and none ACME CA
  providers:
    le: #Add least /directory to endpoint URL
      type: acme
      name: Let's Encrypt
      catype: public
      api: https://acme-v02.api.letsencrypt.org/directory
      url: https://letsencrypt.org
      roots: https://letsencrypt.org/certificates/
      description: "Let's Encrypt Official"
      logopath: "/images/logo.png"
      relativeLifetimeUntilRenew: 0.7 #The fraction of the certificate lifetime that needs to be over until
      # dns3ld automatically renews a certificate during the daily renewal job. Float value > 0 and <= 1
      # Example: A value of 0.66 will renew a certificate valid for 90 days after 60 days
      acmeUserScheme: key # 1 ACME user per dns3ld-managed certificate (default)
      #acmeUserScheme: user # 1 ACME user per API user
      #acmeUserScheme: one # 1 ACME user for all certs managed by this ACME provider
      ttl: #Certificate lifetime value (unit: days)
        min: 5 #Minimum ttl value accepted in the hints section of the claim request body
        max: 90 #Maximum ttl value accepted
        default: 60 #Default value if no user input was set in the hints section (if omitted, ACME service sets TTL)
        # ignoreUserTTL: true #set if ttl user input from the hints section in the
                              #request shall be ignored
      rootCertUrls: # List of URLs where dns3ld can retrieve the PEM-encoded root certificate in case the ACME service
                    # does not provide it in its chain. If empty, chain is provided as-is. If multiple URLs are given,
                    # they are successively tried, in case the cert is a valid root certificate for the chain it is appended
                    # to the chain. Fails with an error if no cert in the chain is a valid root cert.
        - "https://letsencrypt.org/certs/isrgrootx1.pem"
        - "https://letsencrypt.org/certs/isrg-root-x2.pem"
      disableAIARetrieval: false  # if the Authority Information Access field shall be ignored and no root cert shall be 
                                  #fetched during claim
      disableRootValidityCheck: false # if the fetched root certificate (either AIA or rootCertUrls) shall not be checked
                                      # for validity
    tsec-staging:
      type: acme
      name: T-Sec Trust Center ACME Staging
      catype: public
      api: https://acme.npp.test.telesec.de/v2/directory
      url: https://www.telesec.de
      eab: # External Account Bindings
        kid: EAB_KeyId
        # Note that the HMAC must be given in base64, but in the URL-friendly
        # safe alphabet according to RFC 4648 Section 5.
        # Change / to _ and + to -, remove any padding =
        hmac: AaBbCc_Dd_EfGHiJK
      roots: https://www.telesec.de/en/root-program/root-program/overview/
      description: "Telesec Trust Center ACME Staging"
      logopath: "../logo.png"
      relativeLifetimeUntilRenew: 0.7
      httpInsecureSkipVerify: true #if TLS cert check shall be disabled
      acmeRegisterWithoutEmail: true # if registration of new ACME users should 
                                     # be done without e-mail address
      disableWildcards: false #e.g. if the acme provider does not support wildcard certs
      disableSAN: false #e.g. if the acme provider does not support subject alt names (SANs)
    step:
      type: acme
      name: ACME RA for Smallstep CM
      catype: private
      api: https://acme.example.com/acme/acme/directory
      url: https://example.com
      roots: null
      description: "ACME RA for Smallstep CM. Lorem Ipsum."
      logopath: "https://foo.bar/logo.png"
      relativeLifetimeUntilRenew: 0.7
    tsec:
      type: legacy
      name: T-Sec Trust Center
      catype: public
      roots: https://www.telesec.de/en/root-program/root-program/overview/
      description:  "Telesec Trust Center. Lorem Ipsum."
      logopath: "https://foo.baz/logo.png"
#AutoDNS & DNS-01 validation
#DNS provider implementations shall support zone nesting
#For legacy CA a CSR template can be assigned to each rtzn implicitly by convention
rtzn:
  - root: foo.example.org. #Rootzones always have a dot at the end
    autodns: null
    acmedns: dns3l
    ca:
      - step
      - tsec
  - root: bar.example.com.
    autodns: infblxA
    acmedns: dns3l
    ca: ['*'] 
  - root: foo.bar.example.com.
    autodns: infblxB
    acmedns: dns3l
    ca: ['*']
db:
  # Since database providers are not 100% abstracted in Go, only "mysql" is supported
  # at the moment. "sqlite3" might work but is unsupported.
  type: mysql

  # SQL data source string
  # === For mysql:
  # MySQL data source name (DSN)
  # Reference: https://github.com/go-sql-driver/mysql#dsn-data-source-name
  # ?parseTime=true MUST be added to the end, otherwise errors will occur
  # === For sqlite3:
  # Database file name
  url: user:password@tcp(192.168.0.1)/dns3ld?parseTime=true

  # This prefix is added to every table created/used
  dbprefix: dns3l

bootstrap:
  certs:
    - ca: le
      # The name of the dns3l cert and the first domain
      name: dns3l.foobar.example.com
      # List other domains here (can be a wildcard)
      otherdomains:
        - dns3l.alt.example.com
      # If force is set to true, dns3ld will terminate if
      # claim was not successful. If set to false, it will
      # try to claim the cert on start but start up normally
      # if it failed.
      force: true


# Auth config (currently token-based and Open ID Connect is supported)
auth:
  # Token-based auth allows setting a secret token in the request header
  # "X-DNS3L-API-Key" to access the API instead of doing OIDC auth.
  # Currently there is no API token self-service implemented but tokens
  # can be used by statically configuring them here.
  # Using tokens, while there is no self service, is not recommended for
  # all-day usage, only for administrative tasks like bootstrapping the
  # dns3l stack or low-churn M2M auth.
  # If a token is not given or invalid, dns3ld falls back to OIDC auth.
  tokens:
    static:
        # Name is used e.g. for traceability in logging.
        # It must be at least 3 characters long
      - name: bootstrap_token_ingress
        # Token must be secure-random 32 bytes, base64-encoded.
        # Generate it e.g. with openssl rand -base64 32.
        # Keep it secret.
        plain: <base64-token>
        domainsallowed:
          - foo.example.org
          - bar.example.com.
      - name: some_admin_token
        # Token can also be stored here in a sha256-hashed form
        # (base64, not hex).
        # Generate the token to be used e.g. with openssl rand -base64 32
        # Keep the unhashed token secret.
        # To hash it, use echo -n "<token>" | openssl sha256 -binary | base64 -
        sha256:  <base64-sha256-token>
        domainsallowed:
          - foo.example.org
        # Write must be explicitly allowed if necessary.
        write: true

  # You can define multiple OIDC token issuers.
  # dns3ld will spawn an individual OIDC client instance per issuer.
  # The OIDC client for authx will be selected by the issuer URL in the
  # token of a request.
  #
  # Note that an attacker can choose the weakest issuer defined here by
  # arbitrarily setting the issuer URL in the token, so ensure all your
  # OIDC configurations and endpoints are adequately secure.
  oidc_bindings:
    https://token.issuer.url.de/auth:
      #OIDC Client ID
      client_id: cli-app

      #When contacting the auth provider service, SSL cert verification is disabled
      http_insecure_skip_verify: false

      #Stop with an error on startup if the token issuer cannot be detected
      #immediately. Otherwise, will retry on first request.
      force_on_startup: false

      #Time until a TCP handshake fails (optional)
      #tcp_timeout: 3s
  # https://other.issuer.com/auth
  #   ...


  #Disables authentication, everyone can use the API
  authn_disabled: false

  #Disables authorization if authn is enabled, everybody who is logged in can do anything
  authz_disabled: false

  #If set to true, information in the claims is dumped to the log
  debug_claims: false

  #User e-mail address used (for ACME, persistency) if authn is disabled
  authn_disabled_email: foo@telekom.de

  # If any authenticated users can read information stored on dns3ld that normally is shared
  # publicly (like certs, issuer certs, and thus any information stored in certs, but not
  # private keys)
  authned_can_read_public: false

  # If unauthenticated, anonymous users can read information stored on dns3ld that normally
  # is shared publicly
  anon_can_read_public: false

  #If your auth provider cannot provide you with the "groups" list in the token
  #claims, use this as a workaround to inject values to a user's list. Not suitable
  #for scalable LDAP auth, but sufficient for testing setups.
  inject_groups:

    #First level: e-mail address
    kilgore@kilgore.trout:
      #List of groups to inject
      - read #allow read actions
      #- write #allow write actions
      - foo.example.org.
      - bar.example.com.

  # Prefix of the groups in the claim. Groups without the given prefix will be ignored.
  # The prefix is stripped from the group to render the allowed root zone
  # The prefix also applies to the "read" and "write" groups (i.e. "<prefix>write")
  # Default: ""
  groups_prefix: dns3l_

  # If not an empty string or '.', replace all occurrences of the groups_domain_delim character
  # with '.' for every OIDC group of a user. Useful if your authz provider does not support groups
  # with a '.' in the name. This replacement is done *after* the groups prefix has been stripped (see above).
  # Note that if you select a domain delimiter, you cannot use the character in an actual domain
  # name specified in the groups.
  groups_domain_delim: "_"

  # === Example for groups_prefix: dns3l_ and groups_domain_delim: _
  # OIDC group "dns3l_foo_bar_com" will allow domain "foo.bar.com"
  # OIDC group "dns3l_read" will allow read access

renew:
  #Renewal jobs start every day at the specified time (UTC).
  jobStartTime: 01:00

  #Renewal jobs are scheduled so they are over after the given duration.
  maxDuration: 6h

  #Not more than the given amount of jobs is scheduled per day in order to
  #avoid overload and suffering from rate limits. If the limit is hit, a warning
  #is set in the log.
  limitPerDay: 2048

  #Additionally, last-resort warnings are logged if certificates are about to 
  #expire, e.g. if they have not been renewed for any reason.
  daysWarnBeforeExpiry: 10