# FIPS Node Configuration

node:
  identity:
    # By default, a new ephemeral keypair is generated on each start.
    # Uncomment persistent to keep the same identity across restarts;
    # on first start a keypair is saved to fips.key/fips.pub next to
    # this config file (mode 0600/0644).
    # persistent: true
    #
    # Or set an explicit key (overrides persistent):
    # nsec: "nsec1..."
  discovery:
    # Optional Nostr-mediated overlay endpoint discovery.
    # nostr:
    #   enabled: true
    #   policy: configured_only  # disabled | configured_only | open
    #   open_discovery_max_pending: 64 # caps queued open-discovery retries
    #   app: "fips-overlay-v1"
    #   advertise: true
    #   advert_relays:
    #     - "wss://relay.damus.io"
    #     - "wss://nos.lol"
    #     - "wss://offchain.pub"
    #   dm_relays:
    #     - "wss://relay.damus.io"
    #     - "wss://nos.lol"
    #     - "wss://offchain.pub"
    #   # Optional override. If omitted, FIPS uses the built-in STUN list.
    #   # Built-in relay/STUN defaults are best-effort and should be
    #   # overridden by operators for production use.
    #   stun_servers:
    #     - "stun:stun.l.google.com:19302"
    #     - "stun:stun.cloudflare.com:3478"
    #     - "stun:global.stun.twilio.com:3478"

tun:
  enabled: true
  name: fips0
  mtu: 1280

dns:
  enabled: true
  # bind_addr defaults to "::1" (IPv6 loopback). The shipped
  # fips-dns-setup script configures systemd-resolved with a global
  # /etc/systemd/resolved.conf.d/fips.conf drop-in pointing at
  # [::1]:5354.
  #
  # Set "::" to expose the responder to mesh peers as well (e.g. for
  # gateway hosts that resolve .fips on behalf of LAN clients). The
  # mesh-interface filter in src/upper/dns.rs will still defend
  # /etc/fips/hosts aliases from cross-mesh enumeration.
  # bind_addr: "::1"
  port: 5354

transports:
  udp:
    bind_addr: "0.0.0.0:2121"
    # advertise_on_nostr: true
    # public: false # false => advertise udp:nat; true => advertise bound host:port
    # accept_connections: true # default; refuse inbound msg1 when false
    # outbound_only: false     # true => bind ephemeral, no listener on a
    #                          # known port. Forces advertise_on_nostr=false
    #                          # and accept_connections=false. Pure-client
    #                          # posture; bind_addr is ignored.

  tcp:
    # Accepts inbound connections. No static outbound peers.
    bind_addr: "0.0.0.0:8443"
    # advertise_on_nostr: true

  # Ethernet transport — uncomment and set your interface name.
  # ethernet:
  #   interface: "eth0"
  #   discovery: true
  #   announce: true
  #   auto_connect: true
  #   accept_connections: true

  # Bluetooth Low Energy transport — requires BlueZ and the 'ble' feature.
  # ble:
  #   adapter: "hci0"
  #   mtu: 2048
  #   advertise: true
  #   scan: true
  #   auto_connect: true
  #   accept_connections: true

# Outbound LAN gateway. Allows non-FIPS hosts on the LAN to reach
# mesh destinations via DNS-allocated virtual IPs and kernel NAT.
# Requires: IPv6 forwarding enabled, fips daemon running with DNS.
# gateway:
#   enabled: true
#   pool: "fd01::/112"
#   lan_interface: "eth0"
#   dns:
#     listen: "[::1]:5353"
#     # upstream must match the daemon's dns.bind_addr above. The
#     # default "[::1]:5354" matches the daemon's default. If you set
#     # the daemon to bind on a wildcard ("::") or specific address,
#     # update upstream to match — explicit ::1 sockets do not accept
#     # v4 traffic.
#     upstream: "[::1]:5354"
#     ttl: 60
#   pool_grace_period: 60
#   conntrack:
#     tcp_established: 432000
#     udp_timeout: 30
#     udp_assured: 180
#     icmp_timeout: 30

peers: []
  # Static peers for bootstrapping (UDP or TCP):
  # - npub: "npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98"
  #   alias: "gateway"
  #   via_nostr: true
  #   addresses:
  #     - transport: udp
  #       addr: "217.77.8.91:2121"  # IP or hostname (e.g., "peer.example.com:2121")
  #     - transport: udp
  #       addr: "nat"  # Use node.discovery.nostr for Nostr/STUN hole punching
  #   connect_policy: auto_connect