# FIPS Node Configuration

node:
  identity:
    # By default, a new ephemeral keypair is generated on each start.
    # Uncomment persistent to keep the same identity across restarts;
    # on first start a keypair is saved to fips.key/fips.pub next to
    # this config file (mode 0600/0644).
    # persistent: true
    #
    # Or set an explicit key (overrides persistent):
    # nsec: "nsec1..."

tun:
  enabled: true
  name: fips0
  mtu: 1280

dns:
  enabled: true
  # bind_addr defaults to "::" (all interfaces, dual-stack). Required so
  # systemd-resolved can reach the responder via fips0 when resolvectl
  # configures per-interface DNS forwarding.
  # bind_addr: "::"
  port: 5354

transports:
  udp:
    bind_addr: "0.0.0.0:2121"

  tcp:
    # Accepts inbound connections. No static outbound peers.
    bind_addr: "0.0.0.0:8443"

  # Ethernet transport — uncomment and set your interface name.
  # ethernet:
  #   interface: "eth0"
  #   discovery: true
  #   announce: true
  #   auto_connect: true
  #   accept_connections: true

  # Bluetooth Low Energy transport — requires BlueZ and the 'ble' feature.
  # ble:
  #   adapter: "hci0"
  #   mtu: 2048
  #   advertise: true
  #   scan: true
  #   auto_connect: true
  #   accept_connections: true

# Outbound LAN gateway. Allows non-FIPS hosts on the LAN to reach
# mesh destinations via DNS-allocated virtual IPs and kernel NAT.
# Requires: IPv6 forwarding enabled, fips daemon running with DNS.
# gateway:
#   enabled: true
#   pool: "fd01::/112"
#   lan_interface: "eth0"
#   dns:
#     listen: "[::]:53"
#     upstream: "127.0.0.1:5354"
#     ttl: 60
#   pool_grace_period: 60
#   conntrack:
#     tcp_established: 432000
#     udp_timeout: 30
#     udp_assured: 180
#     icmp_timeout: 30

peers: []
  # Static peers for bootstrapping (UDP or TCP):
  # - npub: "npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98"
  #   alias: "gateway"
  #   addresses:
  #     - transport: udp
  #       addr: "217.77.8.91:2121"  # IP or hostname (e.g., "peer.example.com:2121")
  #   connect_policy: auto_connect