fibril/fibril.example.toml at main · Axmouth/fibril · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
[server]
data_dir = "server_data"

[broker.listener]
bind = "0.0.0.0:9876"

[admin]
# Prometheus /metrics on the admin listener always exports node-level
# aggregates. This flag adds per-channel series (queue ready/inflight,
# stream subscriptions and lag evictions) for materialized channels. Turn
# it off when many active channels would strain the scraper.
metrics_per_channel = true

[admin.listener]
bind = "0.0.0.0:8081"

[admin.auth]
enabled = false
username = "fibril"
# password = "change-me"

# First-boot setup: with mode = true and no completed-setup marker in the
# data dir, the server serves only a localhost setup page (choose generated
# TLS, supply a certificate, or explicitly skip) and the broker starts after
# the choice. Delete <data_dir>/setup_complete to run setup again.
[setup]
mode = false

[auth]
# The built-in fibril/fibril pair works from loopback only. Remote
# connections need a real user (seeded here on first boot, or created via
# fibrilctl / the dashboard afterwards).
allow_default_loopback = true
# seed_users = [{ username = "ops", password = "change-me" }]

# [coordination]
# Cluster shared secret for node-to-node authentication, required in
# ganglion mode. Generate with: fibrilctl secret generate
# secret_path = "/etc/fibril/cluster.secret"

[tls]
enabled = false
# Supply your own PEM files:
# cert_path = "/etc/fibril/tls/server.pem"
# key_path = "/etc/fibril/tls/server.key"
# Or generate per-deployment material under <data_dir>/tls on first boot:
# auto_self_signed = true
# The admin dashboard serves HTTPS from the same material when TLS is
# enabled. Opt it out when a reverse proxy terminates TLS for the dashboard:
# admin_enabled = false
# Follower-to-owner replication follows `enabled` too. Opt it out when a
# service mesh or tunnel already encrypts inter-broker traffic:
# inter_broker = false
# CA that peer certificates chain to. Unset falls back to the generated
# <data_dir>/tls/ca.pem, then OS roots:
# peer_ca_path = "/etc/fibril/tls/ca.pem"
# Client certificates as credentials: "request" verifies a presented
# certificate (certless clients still password-auth), "require" rejects
# certless clients in the handshake. Issue with: fibrilctl cert issue
# client_auth = "off"
# CA that client certificates chain to. Unset falls back to the generated CA:
# client_ca_path = "/etc/fibril/tls/ca.pem"

[storage.keratin]
fsync_interval_ms = 5
# Floor between storage commits while the fsync worker is idle. 0 self-clocks
# group commit on fsync completions, best on fast storage. On slow-fsync
# storage such as SATA SSDs a floor around 5 helps.
min_fsync_interval_ms = 0

[storage.keratin.message_log]
segment_max_bytes = 268435456

[storage.keratin.event_log]
segment_max_bytes = 33554432

[runtime_seed.delivery]
inflight_ttl_ms = 30000
expiry_poll_min_ms = 15000
expiry_batch_max = 8192
delivery_poll_max_ms = 5000

[runtime_seed.idle_queue_cleanup]
enabled = false
evict_after_ms = 600000
sweep_interval_ms = 60000
# Set this for sparse workloads with long-lived publishing connections.
# publisher_idle_timeout_ms = 600000

[runtime_locks]
idle_queue_cleanup = false