mokey.yaml.sample

---
#------------------------------------------------------------------------------
# Database connection
#------------------------------------------------------------------------------
dsn: "user:pass@/dbname?parseTime=true"

#------------------------------------------------------------------------------
# Database driver
#------------------------------------------------------------------------------
driver: "mysql"

#------------------------------------------------------------------------------
# Secure webserver port to listen on
#------------------------------------------------------------------------------
port: 8080

#------------------------------------------------------------------------------
# Insecure redirect host and port. If set will redirect http to https
#------------------------------------------------------------------------------
# insecure_redirect_port: 80
# insecure_redirect_host: localhost

#------------------------------------------------------------------------------
# Webserver interface to listen on
#------------------------------------------------------------------------------
# For utilizing all available IP interfaces, use:
# bind: "0.0.0.0"
# For localhost only, use:
bind: "127.0.0.1"

#------------------------------------------------------------------------------
# SSL certificate 
#------------------------------------------------------------------------------
# cert: "/path/to/cert"

#------------------------------------------------------------------------------
# SSL private key 
#-------------------------------------------------------------------
# key: "/path/to/key"

#------------------------------------------------------------------------------
# Password requirements
#------------------------------------------------------------------------------
# min_passwd_len: 8
# min_passwd_classes: 2

#------------------------------------------------------------------------------
# Authentication key used for HMAC token signing and secure cookies 
#------------------------------------------------------------------------------
auth_key: mysecret

#------------------------------------------------------------------------------
# Encryption key used for encrypting cookies 
#------------------------------------------------------------------------------
enc_key: mysecret

#------------------------------------------------------------------------------
# Templates directory
#------------------------------------------------------------------------------
templates: /usr/share/mokey/templates

#------------------------------------------------------------------------------
# Custom URL context path
#------------------------------------------------------------------------------
# path_prefix: "/mokey"

#------------------------------------------------------------------------------
# FreeIPA server hostname (defaults to /etc/ipa/default.conf)
#------------------------------------------------------------------------------
# ipahost: "ipa.example.edu"

#------------------------------------------------------------------------------
# Keytab file and username for mokey to user for operations requiring elevated
# privileges (should have "Modify users and Reset passwords" privilege in
# FreeIPA)
#------------------------------------------------------------------------------
keytab: "/path/to/client.keytab"
ktuser: "username"

#------------------------------------------------------------------------------
# Enable rate limiting based on remote ip (requires redis)
#------------------------------------------------------------------------------
rate_limit: false

#------------------------------------------------------------------------------
# Redis server (used for rate limiting)
#------------------------------------------------------------------------------
# redis: ":6379"

#------------------------------------------------------------------------------
# Max POST requests. This value sets a max limit on the number of POST requests
# made in a given time period. The time is defined by "rate_limit_expire".
#------------------------------------------------------------------------------
# max_requests: 15

#------------------------------------------------------------------------------
# The expire time in seconds for the max_requests counter. By default the
# number of post requests from a given IP address is limited to 15 requests per
# hour.  
#------------------------------------------------------------------------------
# rate_limit_expire: 3600

#------------------------------------------------------------------------------
# SMTP server
#------------------------------------------------------------------------------
smtp_host: "localhost"
#smtp_username: "username"
#smtp_password: "password"

#------------------------------------------------------------------------------
# SMTP port / TLS
# Possible values for TLS are:
#   - on: Connection is fully encrypted with TLS
#   - off: Connection is unencrypted
#   - starttls: Connections is encrypted on demand via the STARTTLS command
#------------------------------------------------------------------------------
smtp_port: 25
smtp_tls: "off"

#------------------------------------------------------------------------------
# From address used when sending emails
#------------------------------------------------------------------------------
email_from: "helpdesk@example.edu"

#------------------------------------------------------------------------------
# Email signature used when sending emails
#------------------------------------------------------------------------------
email_sig: "Mr. System Administrator"

#------------------------------------------------------------------------------
# Base URL of mokey server. Used for links in emails
#------------------------------------------------------------------------------
email_link_base: "http://localhost:8080"

#------------------------------------------------------------------------------
# Subject prefix used when sending emails
#------------------------------------------------------------------------------
email_prefix: "mokey"

#------------------------------------------------------------------------------
# Max age (in seconds) of setup account email tokens.
#------------------------------------------------------------------------------
setup_max_age: 86400

#------------------------------------------------------------------------------
# Max age (in seconds) of reset password email tokens.
#------------------------------------------------------------------------------
reset_max_age: 3600

#------------------------------------------------------------------------------
# Max attempts for password resets and account setup.
#------------------------------------------------------------------------------
max_attempts: 10

#------------------------------------------------------------------------------
# Allow password tokens to be replaced
# default: false
#------------------------------------------------------------------------------
# replace_token: false

#------------------------------------------------------------------------------
# Sign emails using PGP/Mime
#------------------------------------------------------------------------------
pgp_sign: false

#------------------------------------------------------------------------------
# PGP private key
#------------------------------------------------------------------------------
# pgp_key: "/path/to/key.gpg"

#------------------------------------------------------------------------------
# passphrase for PGP private key (if encrypted)
#------------------------------------------------------------------------------
# pgp_passphrase: "secret"

#------------------------------------------------------------------------------
# CAPTCHA support
#------------------------------------------------------------------------------
# enable_captcha: true

#------------------------------------------------------------------------------
# New User Account Signup
#------------------------------------------------------------------------------
# enable_user_signup: true
# default_shell: "/bin/bash"
# default_homedir: "/home"
#

#------------------------------------------------------------------------------
# Require FreeIPA admin to activate the account. With this option enabled new
# accounts are disabled by default until a FreeIPA admin activates them.
# This option is mutually exclusive with require_verify_email.
#------------------------------------------------------------------------------
# require_verify_admin: false

#------------------------------------------------------------------------------
# Require users to verify email address. With this option enabled new accounts
# are disabled by default until the user verifies their email address
# This option is mutually exclusive with require_verify_admin.
#------------------------------------------------------------------------------
# require_verify_email: false

#------------------------------------------------------------------------------
# Developer mode
#------------------------------------------------------------------------------
develop: false

#------------------------------------------------------------------------------
# Globus Signup
#------------------------------------------------------------------------------
# globus_signup: false
# globus_iss: "https://auth.globus.org"
# globus_client_id: "xxx"
# globus_secret: "xxx"
# globus_trusted_providers:
#   - xxx
#   - xxx

#------------------------------------------------------------------------------
# Hydra config
#------------------------------------------------------------------------------
# hydra_admin_url: "https://localhost:4445"
# hydra_consent_skip: false
# hydra_consent_timeout: 86400
# hydra_login_timeout: 86400
# hydra_fake_tls_termination: true

#------------------------------------------------------------------------------
# Public oauth2 clients for Api Key access (requires Hydra)
#------------------------------------------------------------------------------
# enable_api_keys: false
# enabled_api_client_ids:
#   - openstack-api
#   - mypublic-api
# 
# openstack-api:
#   name: "Openstack CLI"
#   desc: "Access to Openstack CLI"
#   scopes: openid
# 
# mypublic-api:
#   name: "Some other API"
#   desc: "Access to some other API"
#   scopes: openid
...