Configuration file

# MyOwnPKI server configuration – example (phase 1).
#
# Check a file with:   myownpki config check --config /etc/myownpki/config.yaml
#
# Every key can be overridden by an environment variable: the key path in upper
# case with "_" for ".", prefixed with MYOWNPKI_ – for example
# MYOWNPKI_ADMIN_LISTEN=0.0.0.0:9443. Unknown keys and unknown MYOWNPKI_*
# variables are errors, so a typo never goes unnoticed.
#
# Not configurable here, on purpose:
# - Dev mode: only the command-line flag `myownpki serve --dev`.
# - The unseal passphrase: it is entered at runtime and never stored in a file.

# Database files (system.db, tenants/<name>/…). Absolute path. Back it up with
# `myownpki backup`, and keep the unseal passphrase somewhere else.
data_dir: /var/lib/myownpki

log:
  # debug | info | warn | error
  level: info
  # json (for log collectors) | text (for reading on the console)
  format: json

# Admin listener: web UI and REST API.
admin:
  # IP:port – loopback by default. For remote administration use 0.0.0.0:9443
  # (IPv4) or [::]:9443 (IPv4 and IPv6), ideally behind a firewall or VPN.
  listen: 127.0.0.1:9443
  # Operator certificate (PEM). Leave both empty to get a self-signed bootstrap
  # certificate; its SHA-256 fingerprint is printed on the console at start.
  tls_cert_file: ""
  tls_key_file: ""
  # Further names in the bootstrap certificate (comma-separated DNS names or
  # IPs) – the names you type into the browser. Host name, the listen IP and
  # loopback are always in it. With tls_issuer: exactly the names of the
  # issued certificate.
  tls_names: ""
  # An intermediate CA of this instance (its name, e.g. issuing; not a root)
  # that issues the admin certificate: the server issues it itself while
  # unsealed (90 days at most, renewed at 2/3) and falls back to the bootstrap
  # certificate if it expires while sealed. Empty: tls_cert_file, or the
  # bootstrap certificate.
  tls_issuer: ""
  # Who may connect at all (IPs or CIDRs, comma-separated), checked before
  # TLS. Empty: everybody. Strongly recommended when listen is not loopback –
  # better still, never expose the admin listener to the internet.
  allowed_networks: ""

# Public listener: CRLs now, OCSP and ACME later. Must be reachable by every
# client that checks revocation. Empty disables it.
public:
  listen: ":8080"

# Sign-in to the admin listener.
auth:
  # Key that encrypts the TOTP secrets and keys the recovery code hashes,
  # created by `myownpki init`. Empty: <data_dir>/auth.key. It may live outside
  # the data directory (Docker secret, systemd credential) – then a copy of the
  # databases alone holds no usable TOTP secret. Whoever has the databases and
  # this file has both; `myownpki backup` includes it.
  key_file: ""
  # Reverse proxies whose X-Forwarded-For header is believed (IPs or CIDRs,
  # comma-separated), for example "10.0.0.5, 198.51.100.0/24". Empty: the
  # direct peer is the client. Never list networks that clients use.
  trusted_proxies: ""
  # The address users open the admin UI with, for example
  # https://pki.homelab.lan:9443. Passkeys are bound to its host name and work
  # only there. Empty: no passkeys, sign-in with an authenticator app (TOTP).
  passkey_origin: ""

# ACME server (certbot, acme.sh, Traefik, Caddy, lego). By default it runs
# behind a reverse proxy that terminates TLS; with tls_issuer it speaks TLS
# itself – see docs/OPERATIONS.md "ACME".
acme:
  # The address clients use, e.g. https://pki.homelab.lan/acme: the proxy's
  # https URL, or with tls_issuer this listener's. Every URL the server hands
  # out is built from it (X-Forwarded-Host/-Proto are never trusted). Empty:
  # ACME is off.
  base_url: ""
  # The ACME listener – never the public CRL port. Without tls_issuer plain
  # HTTP for the proxy only; with tls_issuer TLS for the clients, e.g. ":443"
  # (a port below 1024 needs the drop-in low-ports.conf).
  listen: 127.0.0.1:8081
  # Who may connect to acme.listen (IPs or CIDRs, comma-separated); others get
  # 403. Only their X-Forwarded-For is used as the client address. Ignored
  # with tls_issuer: every client connects directly.
  trusted_proxies: "127.0.0.1, ::1"
  # DNS server for dns-01 and for resolving http-01 names: the server that
  # knows your internal names (split DNS), e.g. 192.0.2.53. Empty: the
  # system resolver.
  resolver: ""
  # An intermediate CA of this instance (its name, e.g. issuing; not a root):
  # ACME speaks TLS itself on listen, with a certificate for the host of
  # base_url that the server issues from this CA while unsealed (90 days at
  # most, renewed at 2/3). Clients
  # connect directly; the client address is the peer. Empty: plain HTTP behind
  # a reverse proxy.
  tls_issuer: ""

# The agent listener (v0.3, docs/OPERATIONS.md "Agent"): myownpki-agent on the
# hosts connects here – Connect-RPC over mTLS, outbound from the host.
agent:
  # The address agents use, e.g. https://pki.homelab.lan:8444. Its host is
  # the name in the listener's certificate. Empty: no agent listener.
  base_url: ""
  # The agent listener – a port of its own (open it for the hosts).
  listen: ":8444"
  # An intermediate CA of this instance that issues the listener's
  # certificate while unsealed (like admin.tls_issuer). Required with base_url.
  tls_issuer: ""
  # The agent CA: an intermediate with the EKU limit clientAuth only. It
  # signs the agents' 7-day certificates; only those pass the listener's
  # client authentication. Required with base_url.
  ca: ""
  # Exact-version .deb, .rpm, tarball and checksums.txt staged by install.sh.
  # The agent listener serves only these files; no runtime download is needed.
  # Docker sets /opt/myownpki/agent-dist instead.
  package_dir: /var/lib/myownpki/agent-dist

# Monitoring (v0.3.3): what turns into an alert on the dashboard and in the
# log. Checked every minute; works while the server is sealed.
monitor:
  # End-entity certificates: warning and critical days before they expire.
  # A certificate is no longer an alert once a newer one for the same names
  # exists.
  expiry_days: "14, 3"
  # CA certificates: warning and critical days before they expire.
  ca_expiry_days: "90, 30"
  # How long the server may stay sealed before it alerts (1m–1h). A sealed
  # server can't sign CRLs, so it turns critical a day before one is due.
  sealed_after: 10m
  # How long an agent may be silent before it alerts (10m–24h); critical
  # after 24 hours.
  agent_silent_after: 1h
  # A reminder for an alert that is still open (1h–168h).
  repeat_every: 24h
  # The TLS scan (v0.3.4): the server connects to the endpoints an admin enters
  # (Endpoints), reads the certificate each one serves and compares it with
  # what this PKI issued. One TLS handshake, no data sent; works while sealed.
  # How often each endpoint is scanned (5m–24h, or "off" to never connect).
  scan_interval: 15m
  # Resolve, connect and handshake of one scan together (2s–30s).
  scan_timeout: 10s
  # The only ports an endpoint may have (1–32 ports, TLS from the first byte).
  # STARTTLS ports (25, 143, 587) are not supported.
  scan_ports: "443, 465, 636, 853, 993, 995, 5061, 6514, 8443, 8883, 9443"
  # How many endpoints may be entered (1–500).
  scan_max_endpoints: 100
  # Failed scans in a row before "unreachable" is an alert (1–10); a host that
  # only reboots stays quiet.
  scan_unreachable_after: 3
  # An older certificate that is still served is an alert once the newest one
  # for the name is this old (5m–24h): the time a deployment may take.
  scan_mismatch_after: 1h

# Notifications (v0.3.3): one message per change – what opened, became
# critical, is still open after repeat_every, or was resolved. Both channels
# are off while smtp and url are empty; alerts still show in the UI. They
# live here, not in the database, so "sealed" is sent while sealed. Secret
# files: readable by the service user only (chmod 600), read at each send.
notify:
  email:
    # host:port of the mail server, e.g. mail.homelab.lan:587.
    smtp: ""
    # starttls (port 587), tls (port 465) or none (only without username).
    security: starttls
    # Optional; with a username, password_file is required.
    username: ""
    password_file: ""
    from: ""
    # One or more addresses, comma-separated.
    to: ""
    # Extra roots for the mail server's certificate, e.g. this PKI's root.
    ca_file: ""
  webhook:
    # https:// (http:// only to a loopback address). Gets a JSON POST.
    url: ""
    # HMAC-SHA256 key: the header X-MyOwnPKI-Signature: sha256=<hex> signs
    # the body. Required with url.
    secret_file: ""
    # Extra roots for the receiver's certificate.
    ca_file: ""