# FIPS Node Configuration
#
# Edit this file before starting the FIPS daemon.
# Full reference: https://github.com/jmcorgan/fips/blob/master/docs/design/fips-configuration.md
#
# After editing, restart the daemon:
#   /etc/init.d/fips restart

node:
  identity:
    # A persistent keypair is generated on first start and saved to
    # /etc/fips/fips.key (private) and /etc/fips/fips.pub (public).
    # The router keeps the same FIPS identity across reboots.
    #
    # To use an explicit key instead, comment out 'persistent' and set:
    #   nsec: "your-64-char-hex-private-key"
    persistent: true

tun:
  enabled: true
  name: fips0
  mtu: 1280

dns:
  enabled: true
  bind_addr: "127.0.0.1"
  port: 5354

transports:
  udp:
    bind_addr: "0.0.0.0:2121"

  # Ethernet transport — uncomment and set your interface names.
  # Use physical port names, NOT bridge names (e.g. eth1, not br-lan).
  # Run 'ip link show' on the router to identify port names.
  # See: https://github.com/jmcorgan/fips/blob/master/deploy/native/README.md
  
  ethernet:
    wan:
      interface: "eth0" # WAN
      discovery: true
      announce: true
      auto_connect: true
      accept_connections: true
    wwan:
      interface: "phy0-sta0" # WWAN
      discovery: true
      announce: true
      auto_connect: true
      accept_connections: true
    lan:
      interface: "br-lan"       # LAN
      discovery: true
      announce: true
      auto_connect: true
      accept_connections: true

peers: []
  # Static peers for bootstrapping (add at least one if using UDP-only):
  # - npub: "npub1..."
  #   alias: "gateway"
  #   addresses:
  #     - transport: udp
  #       addr: "1.2.3.4:2121"  # IP or hostname

# --- Outbound LAN gateway ---
#
# Allows unmodified LAN hosts to reach FIPS mesh destinations via
# DNS-allocated virtual IPs and kernel nftables NAT.
#
# The gateway DNS listens on port 5353 by default so it does not conflict
# with dnsmasq on port 53.  The init script configures dnsmasq to forward
# .fips queries to the gateway automatically.

gateway:
  enabled: true
  pool: "fd01::/112"            # virtual IP range (up to 65535 addresses)
  lan_interface: "br-lan"       # LAN-facing interface for proxy NDP
  dns:
    listen: "[::1]:5353"        # gateway DNS listener (dnsmasq forwards here)
    upstream: "127.0.0.1:5354"  # FIPS daemon DNS resolver
    ttl: 60                     # DNS TTL and mapping lifetime (seconds)
  pool_grace_period: 60         # seconds after last session before reclaiming
