trustdb/configs/assessment.yaml at main · mgalore/trustdb · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
# Pre-assessment profile. It uses the same runtime controls as China
# production. Add an exception only with named approval, a ticket, and <=30d
# expiry; TrustDB signs the accepted exception into the security audit trail.
run_profile: assessment

paths:
  data_dir: "/var/lib/trustdb-assessment"
  key_registry: "/etc/trustdb/keys.tdkeys"
  wal: "/var/lib/trustdb-assessment/wal"
  object_dir: "/var/lib/trustdb-assessment/objects"
  proof_dir: "/var/lib/trustdb-assessment/proofs"

metastore: "pebble"
metastore_path: "/var/lib/trustdb-assessment/proofs/pebble"

deployment_policy:
  egress_mode: "allowlist"
  allowed_endpoints:
    - "gm-tls://10.0.0.20:20200"
    - "gm-tls://10.0.0.21:20200"
  dns_allowlist: []
  telemetry_enabled: false
  update_checks_enabled: false
  exceptions: []

server:
  listen: "0.0.0.0:8080"
  grpc_listen: "0.0.0.0:9090"
  id: "trustdb-assessment-1"
  key_id: "trustdb-assessment-server-sm2"
  transport:
    mode: "mtls"
    allow_local_plaintext: false
    cert_file: "/etc/trustdb/tls/server.crt"
    key_file: "/etc/trustdb/tls/server.key"
    client_ca_file: "/etc/trustdb/tls/client-ca.crt"
    client_ca_pins_sha256:
      - "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
    min_version: "1.2"
    reload_interval: "1m"
    revocation:
      mode: "serial_denylist"
      serial_file: "/etc/trustdb/tls/revoked-serials.txt"

nats:
  enabled: false

anchor:
  scope: "global"
  sink: "fisco-bcos"
  max_delay: "5m"
  poll_interval: "2s"
  fisco_bcos:
    trust_config_file: "/etc/trustdb/fisco-bcos/trust-config.cbor"

backup:
  compression: "gzip"
  key_provider: "sdf-kek-v1"
  key_id: "trustdb-assessment-backup-kek-1"
  frame_bytes: 1048576

audit:
  enabled: true
  required: true
  path: "/var/lib/trustdb-assessment/audit/security.audit"
  checkpoint_path: "/var/lib/trustdb-assessment/audit/security.checkpoint"
  signing_key: "/etc/trustdb/keys/audit-signer.tdkey"
  max_bytes: 4294967296
  retention: "4380h"
  time_reference_path: "/run/trustdb/trusted-time.json"
  time_max_sample_age: "2m"
  time_max_drift: "5s"
  require_synchronized_time: true

keys:
  server_private: "/etc/trustdb/keys/server-signer.tdkey"
  server_public: "/etc/trustdb/keys/server-verifier.tdkey"
  registry_public: "/etc/trustdb/keys/registry-verifier.tdkey"