mirror of
https://tangled.org/tranquil.farm/tranquil-pds
synced 2026-09-28 13:05:33 +00:00
Johanna LarssonandTangled
66ea8287a0
We were just using them for S3 support. This PR switches us over to the s3 crate which works the same way, with some minor differences. The main implication of this change is that we're no longer doing all the AWS stuff, like checking aws profile in home directory, or automatic discovery of metadata. This change is covered by our brand new s3 test suite, but I also did the old school `just test-full` with minio.
823 lines
24 KiB
TOML
823 lines
24 KiB
TOML
[server]
|
|
# Public hostname of the PDS, such as `pds.example.com`.
|
|
#
|
|
# Can also be specified via environment variable `PDS_HOSTNAME`.
|
|
#
|
|
# Required! This value must be specified.
|
|
#hostname =
|
|
|
|
# Address to bind the HTTP server to.
|
|
#
|
|
# Can also be specified via environment variable `SERVER_HOST`.
|
|
#
|
|
# Default value: "[::1]"
|
|
#host = "[::1]"
|
|
|
|
# Port to bind the HTTP server to.
|
|
#
|
|
# Can also be specified via environment variable `SERVER_PORT`.
|
|
#
|
|
# Default value: 3000
|
|
#port = 3000
|
|
|
|
# List of domains for user handles.
|
|
# Defaults to the PDS hostname when not set.
|
|
#
|
|
# Can also be specified via environment variable `PDS_USER_HANDLE_DOMAINS`.
|
|
#user_handle_domains =
|
|
|
|
# Enable PDS-hosted did:web identities. Hosting did:web requires a
|
|
# long-term commitment to serve DID documents; opt-in only.
|
|
#
|
|
# Can also be specified via environment variable `ENABLE_PDS_HOSTED_DID_WEB`.
|
|
#
|
|
# Default value: false
|
|
#enable_pds_hosted_did_web = false
|
|
|
|
# The caddy on-demand TLS requires we serve
|
|
# the endpoint `/.well-known/caddy/ask`.
|
|
# It will be used so that caddy can create TLS
|
|
# certs for us on the fly
|
|
# and we don't have to do annoying wildcard certs.
|
|
#
|
|
# Can also be specified via environment variable `ENABLE_CADDY_ON_DEMAND_TLS`.
|
|
#
|
|
# Default value: true
|
|
#enable_caddy_on_demand_tls = true
|
|
|
|
# iykyk!
|
|
#
|
|
# Can also be specified via environment variable `RFC_MOO_COMPLIANCE`.
|
|
#
|
|
# Default value: false
|
|
#rfc_moo_compliance = false
|
|
|
|
# When set to true, skip age-assurance birthday prompt for all accounts.
|
|
#
|
|
# Can also be specified via environment variable `PDS_AGE_ASSURANCE_OVERRIDE`.
|
|
#
|
|
# Default value: false
|
|
#age_assurance_override = false
|
|
|
|
# Require an invite code for new account registration.
|
|
#
|
|
# Can also be specified via environment variable `INVITE_CODE_REQUIRED`.
|
|
#
|
|
# Default value: true
|
|
#invite_code_required = true
|
|
|
|
# Allow HTTP (non-TLS) proxy requests. Only useful during development.
|
|
#
|
|
# Can also be specified via environment variable `ALLOW_HTTP_PROXY`.
|
|
#
|
|
# Default value: false
|
|
#allow_http_proxy = false
|
|
|
|
# Disable all rate limiting. Should only be used in testing.
|
|
#
|
|
# Can also be specified via environment variable `DISABLE_RATE_LIMITING`.
|
|
#
|
|
# Default value: false
|
|
#disable_rate_limiting = false
|
|
|
|
# Allow outbound fetches to private network addresses. Useful for local development using docker compose.
|
|
#
|
|
# Can also be specified via environment variable `ALLOW_PRIVATE_FETCH`.
|
|
#
|
|
# Default value: false
|
|
#allow_private_fetch = false
|
|
|
|
# Skip the verified-comms-channel gate for login and record writes.
|
|
# Please keep this off unless you're an invite-only PDS!
|
|
#
|
|
# Can also be specified via environment variable `DISABLE_ACCOUNT_VERIFICATION_GATE`.
|
|
#
|
|
# Default value: false
|
|
#disable_account_verification_gate = false
|
|
|
|
# List of additional banned words for handle validation.
|
|
#
|
|
# Can also be specified via environment variable `PDS_BANNED_WORDS`.
|
|
#banned_words =
|
|
|
|
# URL to a privacy policy page.
|
|
#
|
|
# Can also be specified via environment variable `PRIVACY_POLICY_URL`.
|
|
#privacy_policy_url =
|
|
|
|
# URL to terms of service page.
|
|
#
|
|
# Can also be specified via environment variable `TERMS_OF_SERVICE_URL`.
|
|
#terms_of_service_url =
|
|
|
|
# Operator contact email address.
|
|
#
|
|
# Can also be specified via environment variable `CONTACT_EMAIL`.
|
|
#contact_email =
|
|
|
|
# Maximum allowed blob size in bytes (default 10 GiB).
|
|
#
|
|
# Can also be specified via environment variable `MAX_BLOB_SIZE`.
|
|
#
|
|
# Default value: 10737418240
|
|
#max_blob_size = 10737418240
|
|
|
|
# Maximum allowed number of preferences
|
|
#
|
|
# Can also be specified via environment variable `MAX_PREFERENCES_COUNT`.
|
|
#
|
|
# Default value: 1000
|
|
#max_preferences_count = 1000
|
|
|
|
# If you're not altering TLS config, you don't have to worry about this.
|
|
# This is the number of trusted reverse proxies in front of Tranquil.
|
|
# We read the client IP used for rate limiting and device records this many hops
|
|
# from the right of the X-Forwarded-For header.
|
|
# When left unset, Tranquil will assume:
|
|
# - 0, if the TLS termination is happening here on Tranquil via the TLS config
|
|
# - 1, if the TLS termination *isn't* happening here.
|
|
#
|
|
# Can also be specified via environment variable `TRUSTED_PROXY_COUNT`.
|
|
#trusted_proxy_count =
|
|
|
|
[server.tls]
|
|
# The path to the TLS cert chain.
|
|
# If you set both this and `key_path`, the server terminates TLS itself rather than expecting
|
|
# a reverse proxy to do it. The certificate and key reload on SIGHUP.
|
|
#
|
|
# Can also be specified via environment variable `TLS_CERT_PATH`.
|
|
#cert_path =
|
|
|
|
# Path to the TLS private key.
|
|
#
|
|
# Can also be specified via environment variable `TLS_KEY_PATH`.
|
|
#key_path =
|
|
|
|
# Serve HTTP/3 over QUIC on the same UDP port as the TCP listener.
|
|
# Requires cert_path and key_path.
|
|
#
|
|
# Can also be specified via environment variable `TLS_HTTP3`.
|
|
#
|
|
# Default value: false
|
|
#http3 = false
|
|
|
|
[frontend]
|
|
# Whether to enable the built in serving of the frontend.
|
|
#
|
|
# Can also be specified via environment variable `FRONTEND_ENABLED`.
|
|
#
|
|
# Default value: true
|
|
#enabled = true
|
|
|
|
# Directory to serve as the frontend. The oauth_client_metadata.json will have any references to
|
|
# the frontend hostname replaced by the configured frontend hostname.
|
|
#
|
|
# Can also be specified via environment variable `FRONTEND_DIR`.
|
|
#
|
|
# Default value: "/var/lib/tranquil-pds/frontend"
|
|
#dir = "/var/lib/tranquil-pds/frontend"
|
|
|
|
[database]
|
|
# PostgreSQL connection URL.
|
|
#
|
|
# Can also be specified via environment variable `DATABASE_URL`.
|
|
#
|
|
# Required! This value must be specified.
|
|
#url =
|
|
|
|
# Maximum number of connections in the pool.
|
|
#
|
|
# Can also be specified via environment variable `DATABASE_MAX_CONNECTIONS`.
|
|
#
|
|
# Default value: 100
|
|
#max_connections = 100
|
|
|
|
# Minimum number of idle connections kept in the pool.
|
|
#
|
|
# Can also be specified via environment variable `DATABASE_MIN_CONNECTIONS`.
|
|
#
|
|
# Default value: 10
|
|
#min_connections = 10
|
|
|
|
# Timeout in seconds when acquiring a connection from the pool.
|
|
#
|
|
# Can also be specified via environment variable `DATABASE_ACQUIRE_TIMEOUT_SECS`.
|
|
#
|
|
# Default value: 10
|
|
#acquire_timeout_secs = 10
|
|
|
|
[secrets]
|
|
# Secret used for signing JWTs. Must be at least 32 characters in
|
|
# production.
|
|
#
|
|
# Can also be specified via environment variable `JWT_SECRET`.
|
|
#jwt_secret =
|
|
|
|
# Secret used for DPoP proof validation. Must be at least 32 characters
|
|
# in production.
|
|
#
|
|
# Can also be specified via environment variable `DPOP_SECRET`.
|
|
#dpop_secret =
|
|
|
|
# Master key used for key-encryption and HKDF derivation. Must be at
|
|
# least 32 characters in production.
|
|
#
|
|
# Can also be specified via environment variable `MASTER_KEY`.
|
|
#master_key =
|
|
|
|
# Optional operator-held PLC recovery key, as a public `did:key`. The PDS
|
|
# continues to sign PLC operations with the per-account signing key, which
|
|
# always remains in `rotationKeys`.
|
|
#
|
|
# Can also be specified via environment variable `PLC_ROTATION_KEY`.
|
|
#plc_rotation_key =
|
|
|
|
# Allow insecure/test secrets. NEVER enable in production.
|
|
#
|
|
# Can also be specified via environment variable `TRANQUIL_PDS_ALLOW_INSECURE_SECRETS`.
|
|
#
|
|
# Default value: false
|
|
#allow_insecure = false
|
|
|
|
[storage]
|
|
# Storage backend: `filesystem` or `s3`.
|
|
# If you set `s3` you must also provide `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`.
|
|
#
|
|
# Can also be specified via environment variable `BLOB_STORAGE_BACKEND`.
|
|
#
|
|
# Default value: "filesystem"
|
|
#backend = "filesystem"
|
|
|
|
# Path on disk for the filesystem blob backend.
|
|
#
|
|
# Can also be specified via environment variable `BLOB_STORAGE_PATH`.
|
|
#
|
|
# Default value: "/var/lib/tranquil-pds/blobs"
|
|
#path = "/var/lib/tranquil-pds/blobs"
|
|
|
|
# S3 bucket name for blob storage.
|
|
#
|
|
# Can also be specified via environment variable `S3_BUCKET`.
|
|
#s3_bucket =
|
|
|
|
# Custom S3 endpoint URL.
|
|
#
|
|
# Can also be specified via environment variable `S3_ENDPOINT`.
|
|
#s3_endpoint =
|
|
|
|
# Path on the storage for the S3 blob backend.
|
|
#
|
|
# Can also be specified via environment variable `S3_PATH`.
|
|
#
|
|
# Default value: ""
|
|
#s3_path = ""
|
|
|
|
# Repository backend: `postgres` by default, or `tranquil-store`, our embedded db.
|
|
# `tranquil-store` is our own solution, not a tried-and-tested out-of-box database. If you're not feeling brave, don't choose this.
|
|
#
|
|
# Can also be specified via environment variable `REPO_BACKEND`.
|
|
#
|
|
# Default value: "postgres"
|
|
#repo_backend = "postgres"
|
|
|
|
[tranquil_store]
|
|
# Directory for tranquil-store data: the metastore, eventlog, and blockstore.
|
|
#
|
|
# Can also be specified via environment variable `TRANQUIL_STORE_DATA_DIR`.
|
|
#
|
|
# Default value: "/var/lib/tranquil-pds/store"
|
|
#data_dir = "/var/lib/tranquil-pds/store"
|
|
|
|
# Fjall block cache size in megabytes. Defaults to 20% of system RAM when unset.
|
|
#
|
|
# Can also be specified via environment variable `TRANQUIL_STORE_MEMORY_BUDGET_MB`.
|
|
#memory_budget_mb =
|
|
|
|
# Number of handler threads. Defaults to available_parallelism / 2.
|
|
#
|
|
# Can also be specified via environment variable `TRANQUIL_STORE_HANDLER_THREADS`.
|
|
#handler_threads =
|
|
|
|
# Maximum total bytes of pending (unsynced) eventlog payloads. Appenders block
|
|
# once this budget is exhausted until in-flight events drain via fsync. Set to
|
|
# 0 to disable backpressure. Default: 1 GiB.
|
|
#
|
|
# Can also be specified via environment variable `TRANQUIL_STORE_EVENTLOG_PENDING_BYTES_BUDGET`.
|
|
#
|
|
# Default value: 1073741824
|
|
#eventlog_pending_bytes_budget = 1073741824
|
|
|
|
# Maximum size of an individual eventlog payload in bytes. Single events
|
|
# larger than this are rejected at append time. Default: 256 MiB.
|
|
#
|
|
# Can also be specified via environment variable `TRANQUIL_STORE_EVENTLOG_MAX_EVENT_PAYLOAD`.
|
|
#
|
|
# Default value: 268435456
|
|
#eventlog_max_event_payload = 268435456
|
|
|
|
# Maximum size of an individual blockstore data file in bytes. When the
|
|
# active data file reaches this size it is rolled over and becomes
|
|
# eligible for compaction. Default: 256 MiB.
|
|
#
|
|
# Can also be specified via environment variable `TRANQUIL_STORE_MAX_BLOCKSTORE_FILE_SIZE`.
|
|
#
|
|
# Default value: 268435456
|
|
#max_blockstore_file_size = 268435456
|
|
|
|
# Maximum size of an individual eventlog segment file in bytes. When the
|
|
# active segment reaches this size it is sealed and a new one is created.
|
|
# Safe to change on a running instance. Default: 256 MiB.
|
|
#
|
|
# Can also be specified via environment variable `TRANQUIL_STORE_MAX_EVENTLOG_SEGMENT_SIZE`.
|
|
#
|
|
# Default value: 268435456
|
|
#max_eventlog_segment_size = 268435456
|
|
|
|
[cache]
|
|
# Cache backend: `ripple` by default, or `valkey`.
|
|
#
|
|
# Can also be specified via environment variable `CACHE_BACKEND`.
|
|
#
|
|
# Default value: "ripple"
|
|
#backend = "ripple"
|
|
|
|
# Valkey / Redis connection URL. Required when `backend = "valkey"`.
|
|
#
|
|
# Can also be specified via environment variable `VALKEY_URL`.
|
|
#valkey_url =
|
|
|
|
[cache.ripple]
|
|
# Address to bind the Ripple gossip protocol listener. With the default
|
|
# value and no cluster_key or peers configured, the listener binds
|
|
# loopback instead and runs as a single node.
|
|
#
|
|
# Can also be specified via environment variable `RIPPLE_BIND`.
|
|
#
|
|
# Default value: "0.0.0.0:0"
|
|
#bind_addr = "0.0.0.0:0"
|
|
|
|
# List of seed peer addresses.
|
|
#
|
|
# Can also be specified via environment variable `RIPPLE_PEERS`.
|
|
#peers =
|
|
|
|
# Unique machine identifier. Auto-derived from hostname when not set.
|
|
#
|
|
# Can also be specified via environment variable `RIPPLE_MACHINE_ID`.
|
|
#machine_id =
|
|
|
|
# Gossip protocol interval in milliseconds.
|
|
#
|
|
# Can also be specified via environment variable `RIPPLE_GOSSIP_INTERVAL_MS`.
|
|
#
|
|
# Default value: 200
|
|
#gossip_interval_ms = 200
|
|
|
|
# Maximum cache size in megabytes.
|
|
#
|
|
# Can also be specified via environment variable `RIPPLE_CACHE_MAX_MB`.
|
|
#
|
|
# Default value: 256
|
|
#cache_max_mb = 256
|
|
|
|
# Pre-shared cluster key authenticating ripple peers. Every node in the
|
|
# cluster must set the same value. When unset, peers are unauthenticated.
|
|
#
|
|
# Can also be specified via environment variable `RIPPLE_CLUSTER_KEY`.
|
|
#cluster_key =
|
|
|
|
# Allow ripple to bind a non-loopback address without a cluster key.
|
|
# Peers will be unauthenticated. Intended for trusted private networks.
|
|
#
|
|
# Can also be specified via environment variable `RIPPLE_ALLOW_INSECURE`.
|
|
#
|
|
# Default value: false
|
|
#allow_insecure = false
|
|
|
|
[plc]
|
|
# Base URL of the PLC directory.
|
|
#
|
|
# Can also be specified via environment variable `PLC_DIRECTORY_URL`.
|
|
#
|
|
# Default value: "https://plc.directory"
|
|
#directory_url = "https://plc.directory"
|
|
|
|
# HTTP request timeout in seconds.
|
|
#
|
|
# Can also be specified via environment variable `PLC_TIMEOUT_SECS`.
|
|
#
|
|
# Default value: 10
|
|
#timeout_secs = 10
|
|
|
|
# TCP connect timeout in seconds.
|
|
#
|
|
# Can also be specified via environment variable `PLC_CONNECT_TIMEOUT_SECS`.
|
|
#
|
|
# Default value: 5
|
|
#connect_timeout_secs = 5
|
|
|
|
# Seconds to cache DID documents.
|
|
#
|
|
# Can also be specified via environment variable `DID_CACHE_TTL_SECS`.
|
|
#
|
|
# Default value: 300
|
|
#did_cache_ttl_secs = 300
|
|
|
|
[firehose]
|
|
# Size of the in-memory broadcast buffer for firehose events.
|
|
#
|
|
# Can also be specified via environment variable `FIREHOSE_BUFFER_SIZE`.
|
|
#
|
|
# Default value: 10000
|
|
#buffer_size = 10000
|
|
|
|
# How many hours of historical events to replay for cursor-based
|
|
# firehose connections.
|
|
#
|
|
# Can also be specified via environment variable `FIREHOSE_BACKFILL_HOURS`.
|
|
#
|
|
# Default value: 72
|
|
#backfill_hours = 72
|
|
|
|
# Maximum concurrent full-repo exports, eg. getRepo without `since`.
|
|
#
|
|
# Can also be specified via environment variable `MAX_CONCURRENT_REPO_EXPORTS`.
|
|
#
|
|
# Default value: 4
|
|
#max_concurrent_repo_exports = 4
|
|
|
|
# List of relay / crawler notification URLs.
|
|
#
|
|
# Can also be specified via environment variable `CRAWLERS`.
|
|
#
|
|
# Default value: ["https://relay.fire.hose.cam", "https://relay3.fr.hose.cam", "https://bsky.network", "https://northamerica.firehose.network", "https://europe.firehose.network", "https://asia.firehose.network", "https://atproto.africa", "https://relay.upcloud.world"]
|
|
#crawlers = ["https://relay.fire.hose.cam", "https://relay3.fr.hose.cam", "https://bsky.network", "https://northamerica.firehose.network", "https://europe.firehose.network", "https://asia.firehose.network", "https://atproto.africa", "https://relay.upcloud.world"]
|
|
|
|
[email]
|
|
# Sender email address. When unset, email sending is disabled.
|
|
#
|
|
# Can also be specified via environment variable `MAIL_FROM_ADDRESS`.
|
|
#from_address =
|
|
|
|
# Display name used in the `From` header.
|
|
#
|
|
# Can also be specified via environment variable `MAIL_FROM_NAME`.
|
|
#
|
|
# Default value: "Tranquil PDS"
|
|
#from_name = "Tranquil PDS"
|
|
|
|
# HELO/EHLO name announced to remote SMTP servers. Applies to both
|
|
# smarthost and direct-MX modes. Defaults to the server hostname.
|
|
#
|
|
# Can also be specified via environment variable `MAIL_HELO_NAME`.
|
|
#helo_name =
|
|
|
|
[email.smarthost]
|
|
# SMTP relay host. When set, mail is delivered through this host
|
|
# instead of resolving recipient MX records directly.
|
|
#
|
|
# Can also be specified via environment variable `MAIL_SMARTHOST_HOST`.
|
|
#host =
|
|
|
|
# SMTP relay port.
|
|
#
|
|
# Can also be specified via environment variable `MAIL_SMARTHOST_PORT`.
|
|
#
|
|
# Default value: 587
|
|
#port = 587
|
|
|
|
# SMTP authentication username.
|
|
#
|
|
# Can also be specified via environment variable `MAIL_SMARTHOST_USERNAME`.
|
|
#username =
|
|
|
|
# SMTP authentication password.
|
|
#
|
|
# Can also be specified via environment variable `MAIL_SMARTHOST_PASSWORD`.
|
|
#password =
|
|
|
|
# TLS mode. Valid values: "implicit", "starttls", "none". Setting "none"
|
|
# alongside a password is rejected at startup to prevent transmitting
|
|
# credentials in plaintext.
|
|
#
|
|
# Can also be specified via environment variable `MAIL_SMARTHOST_TLS`.
|
|
#
|
|
# Default value: "starttls"
|
|
#tls = "starttls"
|
|
|
|
# Max size of the connection pool.
|
|
#
|
|
# Can also be specified via environment variable `MAIL_SMARTHOST_POOL_SIZE`.
|
|
#
|
|
# Default value: 4
|
|
#pool_size = 4
|
|
|
|
# Per-command SMTP timeout in seconds. Bounds the security handshake.
|
|
#
|
|
# Can also be specified via environment variable `MAIL_SMARTHOST_COMMAND_TIMEOUT_SECS`.
|
|
#
|
|
# Default value: 30
|
|
#command_timeout_secs = 30
|
|
|
|
# Total per-message timeout in seconds. Wraps the entire send so a
|
|
# stuck relay cannot stall the comms queue.
|
|
#
|
|
# Can also be specified via environment variable `MAIL_SMARTHOST_TOTAL_TIMEOUT_SECS`.
|
|
#
|
|
# Default value: 60
|
|
#total_timeout_secs = 60
|
|
|
|
# Apply Atmos/Comail.at categories for headers to be categorized appropriately.
|
|
#
|
|
# Can also be specified via environment variable `MAIL_APPLY_ATMOS_CATEGORIES`.
|
|
#
|
|
# Default value: false
|
|
#apply_atmos_categories = false
|
|
|
|
[email.direct_mx]
|
|
# Per-command SMTP timeout in seconds.
|
|
#
|
|
# Can also be specified via environment variable `MAIL_COMMAND_TIMEOUT_SECS`.
|
|
#
|
|
# Default value: 30
|
|
#command_timeout_secs = 30
|
|
|
|
# Total per-message timeout across all MX attempts in seconds.
|
|
#
|
|
# Can also be specified via environment variable `MAIL_TOTAL_TIMEOUT_SECS`.
|
|
#
|
|
# Default value: 60
|
|
#total_timeout_secs = 60
|
|
|
|
# Max number of concurrent direct-MX sends. Limits the load placed
|
|
# on any single recipient MX during a backlog drain.
|
|
#
|
|
# Can also be specified via environment variable `MAIL_MAX_CONCURRENT_SENDS`.
|
|
#
|
|
# Default value: 8
|
|
#max_concurrent_sends = 8
|
|
|
|
# Require STARTTLS on every MX hop. When false, TLS is
|
|
# attempted opportunistically and the session falls back to plaintext
|
|
# if the remote does not advertise STARTTLS. Set true to refuse
|
|
# plaintext delivery, at the cost of failing sends to MX hosts that
|
|
# do not support TLS.
|
|
#
|
|
# Can also be specified via environment variable `MAIL_REQUIRE_TLS`.
|
|
#
|
|
# Default value: false
|
|
#require_tls = false
|
|
|
|
[email.dkim]
|
|
# DKIM selector. When unset, outgoing mail is not signed.
|
|
#
|
|
# Can also be specified via environment variable `MAIL_DKIM_SELECTOR`.
|
|
#selector =
|
|
|
|
# DKIM signing domain.
|
|
#
|
|
# Can also be specified via environment variable `MAIL_DKIM_DOMAIN`.
|
|
#domain =
|
|
|
|
# Path to the DKIM private key in PEM format. Supports RSA and
|
|
# Ed25519 keys.
|
|
#
|
|
# Can also be specified via environment variable `MAIL_DKIM_KEY_PATH`.
|
|
#private_key_path =
|
|
|
|
[discord]
|
|
# Discord bot token. When unset, Discord integration is disabled.
|
|
#
|
|
# Can also be specified via environment variable `DISCORD_BOT_TOKEN`.
|
|
#bot_token =
|
|
|
|
[telegram]
|
|
# Telegram bot token. When unset, Telegram integration is disabled.
|
|
#
|
|
# Can also be specified via environment variable `TELEGRAM_BOT_TOKEN`.
|
|
#bot_token =
|
|
|
|
# Secret token for incoming webhook verification.
|
|
#
|
|
# Can also be specified via environment variable `TELEGRAM_WEBHOOK_SECRET`.
|
|
#webhook_secret =
|
|
|
|
[notifications]
|
|
# Polling interval in milliseconds for the comms queue.
|
|
#
|
|
# Can also be specified via environment variable `NOTIFICATION_POLL_INTERVAL_MS`.
|
|
#
|
|
# Default value: 1000
|
|
#poll_interval_ms = 1000
|
|
|
|
# Number of notifications to process per batch.
|
|
#
|
|
# Can also be specified via environment variable `NOTIFICATION_BATCH_SIZE`.
|
|
#
|
|
# Default value: 100
|
|
#batch_size = 100
|
|
|
|
[sso]
|
|
[sso.github]
|
|
# Can also be specified via environment variable `SSO_GITHUB_ENABLED`.
|
|
# Default value: false
|
|
#enabled = false
|
|
|
|
# Can also be specified via environment variable `SSO_GITHUB_CLIENT_ID`.
|
|
#client_id =
|
|
|
|
# Can also be specified via environment variable `SSO_GITHUB_CLIENT_SECRET`.
|
|
#client_secret =
|
|
|
|
# Can also be specified via environment variable `SSO_GITHUB_DISPLAY_NAME`.
|
|
#display_name =
|
|
|
|
[sso.discord]
|
|
# Can also be specified via environment variable `SSO_DISCORD_ENABLED`.
|
|
# Default value: false
|
|
#enabled = false
|
|
|
|
# Can also be specified via environment variable `SSO_DISCORD_CLIENT_ID`.
|
|
#client_id =
|
|
|
|
# Can also be specified via environment variable `SSO_DISCORD_CLIENT_SECRET`.
|
|
#client_secret =
|
|
|
|
# Can also be specified via environment variable `SSO_DISCORD_DISPLAY_NAME`.
|
|
#display_name =
|
|
|
|
[sso.google]
|
|
# Can also be specified via environment variable `SSO_GOOGLE_ENABLED`.
|
|
# Default value: false
|
|
#enabled = false
|
|
|
|
# Can also be specified via environment variable `SSO_GOOGLE_CLIENT_ID`.
|
|
#client_id =
|
|
|
|
# Can also be specified via environment variable `SSO_GOOGLE_CLIENT_SECRET`.
|
|
#client_secret =
|
|
|
|
# Can also be specified via environment variable `SSO_GOOGLE_DISPLAY_NAME`.
|
|
#display_name =
|
|
|
|
[sso.gitlab]
|
|
# Can also be specified via environment variable `SSO_GITLAB_ENABLED`.
|
|
# Default value: false
|
|
#enabled = false
|
|
|
|
# Can also be specified via environment variable `SSO_GITLAB_CLIENT_ID`.
|
|
#client_id =
|
|
|
|
# Can also be specified via environment variable `SSO_GITLAB_CLIENT_SECRET`.
|
|
#client_secret =
|
|
|
|
# Can also be specified via environment variable `SSO_GITLAB_ISSUER`.
|
|
#issuer =
|
|
|
|
# Can also be specified via environment variable `SSO_GITLAB_DISPLAY_NAME`.
|
|
#display_name =
|
|
|
|
[sso.oidc]
|
|
# Can also be specified via environment variable `SSO_OIDC_ENABLED`.
|
|
# Default value: false
|
|
#enabled = false
|
|
|
|
# Can also be specified via environment variable `SSO_OIDC_CLIENT_ID`.
|
|
#client_id =
|
|
|
|
# Can also be specified via environment variable `SSO_OIDC_CLIENT_SECRET`.
|
|
#client_secret =
|
|
|
|
# Can also be specified via environment variable `SSO_OIDC_ISSUER`.
|
|
#issuer =
|
|
|
|
# Can also be specified via environment variable `SSO_OIDC_DISPLAY_NAME`.
|
|
#display_name =
|
|
|
|
[sso.apple]
|
|
# Can also be specified via environment variable `SSO_APPLE_ENABLED`.
|
|
# Default value: false
|
|
#enabled = false
|
|
|
|
# Can also be specified via environment variable `SSO_APPLE_CLIENT_ID`.
|
|
#client_id =
|
|
|
|
# Can also be specified via environment variable `SSO_APPLE_TEAM_ID`.
|
|
#team_id =
|
|
|
|
# Can also be specified via environment variable `SSO_APPLE_KEY_ID`.
|
|
#key_id =
|
|
|
|
# Can also be specified via environment variable `SSO_APPLE_PRIVATE_KEY`.
|
|
#private_key =
|
|
|
|
[moderation]
|
|
# External report-handling service URL.
|
|
#
|
|
# Can also be specified via environment variable `REPORT_SERVICE_URL`.
|
|
#report_service_url =
|
|
|
|
# DID of the external report-handling service.
|
|
#
|
|
# Can also be specified via environment variable `REPORT_SERVICE_DID`.
|
|
#report_service_did =
|
|
|
|
[import]
|
|
# Whether the PDS accepts repo imports.
|
|
#
|
|
# Can also be specified via environment variable `ACCEPTING_REPO_IMPORTS`.
|
|
#
|
|
# Default value: true
|
|
#accepting = true
|
|
|
|
# Maximum allowed import archive size in bytes (default 1 GiB).
|
|
#
|
|
# Can also be specified via environment variable `MAX_IMPORT_SIZE`.
|
|
#
|
|
# Default value: 1073741824
|
|
#max_size = 1073741824
|
|
|
|
# Maximum number of blocks allowed in an import.
|
|
#
|
|
# Can also be specified via environment variable `MAX_IMPORT_BLOCKS`.
|
|
#
|
|
# Default value: 500000
|
|
#max_blocks = 500000
|
|
|
|
# Skip CAR verification during import. Only for development/debugging.
|
|
#
|
|
# Can also be specified via environment variable `SKIP_IMPORT_VERIFICATION`.
|
|
#
|
|
# Default value: false
|
|
#skip_verification = false
|
|
|
|
[scheduled]
|
|
# Interval in seconds between scheduled delete checks.
|
|
#
|
|
# Can also be specified via environment variable `SCHEDULED_DELETE_CHECK_INTERVAL_SECS`.
|
|
#
|
|
# Default value: 3600
|
|
#delete_check_interval_secs = 3600
|
|
|
|
# Interval in seconds between data file compaction scans (tranquil-store only).
|
|
# Set to 0 to disable.
|
|
#
|
|
# Can also be specified via environment variable `COMPACTION_INTERVAL_SECS`.
|
|
#
|
|
# Default value: 3600
|
|
#compaction_interval_secs = 3600
|
|
|
|
# Liveness ratio threshold below which a data file is compacted (0.0-1.0).
|
|
#
|
|
# Can also be specified via environment variable `COMPACTION_LIVENESS_THRESHOLD`.
|
|
#
|
|
# Default value: 0.7
|
|
#compaction_liveness_threshold = 0.7
|
|
|
|
# Grace period in milliseconds before a zero-refcount block can be removed by compaction.
|
|
#
|
|
# Can also be specified via environment variable `COMPACTION_GRACE_PERIOD_MS`.
|
|
#
|
|
# Default value: 600000
|
|
#compaction_grace_period_ms = 600000
|
|
|
|
# Interval in seconds between reachability walk runs (tranquil-store only).
|
|
# Set to 0 to disable. Default: weekly.
|
|
#
|
|
# Can also be specified via environment variable `REACHABILITY_WALK_INTERVAL_SECS`.
|
|
#
|
|
# Default value: 604800
|
|
#reachability_walk_interval_secs = 604800
|
|
|
|
# Interval in seconds between continuous archival passes (tranquil-store only).
|
|
# Sealed eventlog segments are copied to the archival destination each tick.
|
|
# Set to 0 to disable. Default: 60 seconds.
|
|
#
|
|
# Can also be specified via environment variable `ARCHIVAL_INTERVAL_SECS`.
|
|
#
|
|
# Default value: 60
|
|
#archival_interval_secs = 60
|
|
|
|
# Archival destination directory for sealed eventlog segments.
|
|
# If unset, archival is disabled.
|
|
#
|
|
# Can also be specified via environment variable `ARCHIVAL_DEST_DIR`.
|
|
#archival_dest_dir =
|
|
|
|
# Maximum age of events retained in the eventlog before pruning.
|
|
# Per the atproto firehose spec, the relay backfill window only needs
|
|
# to cover "hours or days".
|
|
#
|
|
# Can also be specified via environment variable `EVENT_RETENTION_MAX_AGE_SECS`.
|
|
#
|
|
# Default value: 604800
|
|
#event_retention_max_age_secs = 604800
|
|
|
|
# Interval in seconds between event retention prune passes.
|
|
# Set to 0 to disable.
|
|
#
|
|
# Can also be specified via environment variable `EVENT_RETENTION_INTERVAL_SECS`.
|
|
#
|
|
# Default value: 3600
|
|
#event_retention_interval_secs = 3600
|