custodia.conf

# This config file supports extended interpolations
# https://docs.python.org/3/library/configparser.html#configparser.ExtendedInterpolation
# Environment variables can be references from the ENV section:
#
# Example:
#    [DEFAULT]
#    cafile = 'path/to/ca.pem'
#    [global]
#    tls_cafile = ${DEFAULT:cafile}
#    server_socket = ${ENV:HOME}/server_socket

[global]
server_version = "Secret/0.0.7"
debug = True
#server_url = https://0.0.0.0:10443
server_socket = ./server_socket
auditlog = ${configdir}/custodia.audit.log
tls_certfile = tests/ca/custodia-server.pem
tls_keyfile = tests/ca/custodia-server.key
tls_cafile = tests/ca/custodia-ca.pem
tls_verify_client = true
umask = 027

#[auth:simple]
#handler = SimpleCredsAuth
#uid = 48
#gid = 48

[auth:header]
handler = SimpleHeaderAuth
header = REMOTE_USER

[authz:paths]
handler = SimplePathAuthz
paths = /.

[authz:namespaces]
handler = UserNameSpace
path = /secrets/
store = simple

[store:simple]
handler = SqliteStore
dburi = secrets.db
table = secrets
filemode = 640

[/]
handler = Root
store = simple


# Multi-tenant example
[store:tenant1]
handler = SqliteStore
dburi = secrets.db
table = tenant1

[authz:tenant1]
handler = UserNameSpace
path = /tenant1/secrets/
store = tenant1

[/tenant1/secrets]
handler = Secrets
store = tenant1


# Encstore example
[store:encrypted]
handler = EncryptedStore
dburi = examples/enclite.db
table = enclite
master_key = examples/enclite.sample.key
master_enctype = A128CBC-HS256

[auth:sak]
handler = SimpleAuthKeys
store = encrypted
# sample key: test=foo-host-key

[authz:encrypted]
handler = UserNameSpace
path = /enc/secrets/
store = encrypted

[store:kemkeys]
handler = EncryptedStore
dburi = examples/enclite.db
table = enclite
master_key = examples/enclite.sample.key
master_enctype = A128CBC-HS256

[authz:kkstore]
handler = KEMKeysStore
path = /enc/secrets/
store = kemkeys

[/enc/secrets]
handler = Secrets
allowed_keytypes = simple kem
store = encrypted

# Forward
[authz:forwarders]
handler = SimplePathAuthz
paths = /forwarder /forwarder_loop

[/forwarder]
handler = Forwarder
forward_uri = http+unix://%2e%2fserver_socket/secrets
forward_headers = {"CUSTODIA_AUTH_ID": "test", "CUSTODIA_AUTH_KEY": "foo-host-key"}

[/forwarder_loop]
handler = Forwarder
forward_uri = http+unix://%2e%2fserver_socket/forwarder_loop
forward_headers = {"REMOTE_USER": "test"}

# Encgen example
[store:backing]
handler = SqliteStore
dburi = examples/enclite.db
table = enclite

[store:overlay]
handler = EncryptedOverlay
backing_store = backing
master_key = examples/enclite.sample.key
master_enctype = A128CBC-HS256

[authz:kemgen]
handler = KEMKeysStore
path = /encgen/secrets/
store = overlay