[general]
# The URL of the Postgres database.
# Important: The database must be created manually.
# Default: "postgres://localhost:5432/pubky_homeserver"
database_url = "postgres://localhost:5432/pubky_homeserver"

# The mode for the signup. Default: "token_required" Options:
# "open" - anyone can signup.
# "token_required" - a signup token is required to signup.
signup_mode = "token_required"

# DEPRECATED: Use [storage].default_quota_mb instead.
# Kept for backwards compatibility. 0 means unlimited.
# Ignored when [storage].default_quota_mb is set.
# user_storage_quota_mb = 0

[drive]
# The port number to run an HTTPS (Pkarr TLS) server on.
# Pkarr TLS is a TLS implementation that is compatible with the Pkarr protocol.
# No need to provide a ICANN TLS certificate.
pubky_listen_socket = "127.0.0.1:6287"

# The port number to run an HTTP (clear text) server on.
# Used for http requests from regular browsers.
# May be put behind a reverse proxy with TLS enabled.
icann_listen_socket = "127.0.0.1:6286"

# Rate limit endpoints by request count.
# `path` is a glob pattern of the path. See syntax in https://crates.io/crates/fast-glob
# `method` is the HTTP method. Examples: GET, POST, PUT, HEAD, DELETE
# `quota` defines the limit in the format $rate"r"/$time_unit (request-count only).
#  - $rate is a positive integer, max 4'294'967'296.
#  - $time_unit is either "s" for second, "m" for minute.
#  Note: bandwidth quotas (kb/s, mb/s, gb/s) are NOT supported in path limits.
#  Use [default_quotas] for bandwidth throttling.
# `key` defines who is rate limited.
#  - "ip" limits based on the IP address.
#  - "user" limits based on the user pubkey. Requires the endpoint to have authentication.
# `burst` is a temporary allowance of quota that is added to the limit.
#   By default, burst is equal the quota rate.
# `whitelist` is a list of IP addresses or user pubkeys that are exempt from the rate limit.
#
# Default: Limit signup token lookups to 10 requests per minute per IP.
# This mitigates brute-forcing invite codes.
# [[drive.rate_limits]]
# path = "/signup_tokens/*"
# method = "GET"
# quota = "10r/m"
# key = "ip"
#
# Limit login attempts to 20 requests per minute per IP.
[[drive.rate_limits]]
path = "/session"
method = "POST"
quota = "20r/m"
key = "ip"
whitelist = [
    "127.0.0.1"
]

[default_quotas]
# Default bandwidth limits for the rate limiter.
# Per-user defaults (rate_read, rate_write) are the system-wide fallback
# values used when a user's quota is set to "Default" (NULL in DB).
# Per-user overrides are managed via the admin API:
#   PATCH /users/{pubkey}/quota

# Default bandwidth limit for user reads (downloads).
# rate_read = "10mb/s"
# Default bandwidth limit for user writes (uploads).
# rate_write = "5mb/s"
# Bandwidth limit for unauthenticated IP reads (downloads).
# Not per-user. Applies to all anonymous requests by IP.
# unauthenticated_ip_rate_read = "1mb/s"

[storage]
# Defines where the files are stored.
# You have multiple options defined by the type.
# Supported types: "file_system", "google_bucket".
# Depending on the option, different settings need to be provided.
# Only one storage type can be activated at one time.

# Local File System
# Files are saved on your local disk.
type = "file_system"

# Default per-user storage quota (in MB).
# Omit for unlimited. 0 means zero storage (not unlimited).
# default_quota_mb = 1024

# Google Cloud Bucket
# Files are saved in a Google Cloud Bucket.
# type = "google_bucket"
# Name of the Google Cloud Bucket. The bucket must exist already.
# bucket_name = "my_bucket"
# Path to the service account file. The content of the service account file can also be added directly in here.
# This must be absolute/full path.
# credential = "/path/to/my_service_account.json"

# In Memory storage
# Files are saved in memory. Only use when you know what you are doing!
# type = "in_memory"

[admin]
# Enable or disable the admin server
enabled = true

# The port number to run the admin HTTP (clear text) server on.
# Used for admin requests from the admin UI.
# If this API is every exposed to the public internet, make sure to add a HTTPS cert.
listen_socket = "127.0.0.1:6288"

# The password for the admin user to access the admin UI.
admin_password = "admin"

[metrics]
# Enable or disable the metrics server
enabled = true

# The socket address to run the metrics HTTP server on. It exposes Prometheus metrics at the /metrics endpoint.
# It should be isolated from the public network and only accessible to monitoring systems.
listen_socket = "127.0.0.1:6289"

[pkdns]
# The public IP address of the homeserver pubky_drive_api to be advertised on the DHT.
# Must be set to be reachable from the outside.
public_ip = "127.0.0.1"

# The pubky tls port in case it differs from the pubky_listen_socket port.
# If not set defaults to the pubky_listen_socket port.
public_pubky_tls_port = 6287

# The icann http port in case it differs from the icann_listen_socket port.
# If not set defaults to the icann_listen_socket port.
public_icann_http_port = 80

# An ICANN domain name is necessary to support legacy browsers
#
# Make sure to setup a domain name and point it the IP
# address of this machine where you are running this server.
#
# This domain should point to the `<public_ip>:<public_port>`.
#
# ICANN TLS is not natively supported, so you should be running
# a reverse proxy and managing certificates yourself.
icann_domain = "localhost"

# The interval at which user keys are republished to the DHT.
# 0 means disabled.
user_keys_republisher_interval = 14400 # 4 hours in seconds

# List of bootstrap nodes for the DHT.
# If not set, the default pkarr bootstrap nodes will be used.
# domain:port format.
dht_bootstrap_nodes = [
    "router.bittorrent.com:6881",
    "dht.transmissionbt.com:6881",
    "dht.libtorrent.org:25401",
    "relay.pkarr.org:6881",
]

# Relay node urls for the DHT.
# Improves the availability of pkarr packets.
# If not set and no bootstrap nodes are set, the default pkarr relay nodes will be used.
dht_relay_nodes = ["https://pkarr.pubky.app", "https://pkarr.pubky.org"]

# Default UDP request timeout for the DHT
dht_request_timeout_ms = 2000

[logging]
# Global runtime log level sets the default minimum logging level for all messages across the executable.
# Available options: "trace", "debug", "info", "warn", "error"
level = "info"

# Per-module log levels overrides the global log level for specific modules.
# Useful for suppressing logs from external dependencies or increasing verbosity for debugging.
module_levels = ["pubky_homeserver=debug", "tower_http=debug"]
