# -----------------------------------------------------------------------------
# edh-keygen Configuration File
#
# GLOBAL SETTINGS (must appear before any service lines):
#
#   tls_tmp_path           - Temporary directory for DH parameter generation
#   tls_private_path       - Shared directory where generated DH parameters are
#                            stored permanently
#   tls_private_owner      - Owner and group for the shared DH parameter
#                            directory and generated DH parameter files,
#                            e.g. root:root
#   tls_private_dir_mode   - Octal mode for the shared DH parameter directory,
#                            e.g. 0755 or 0750
#   tls_private_file_mode  - Octal mode for generated DH parameter files,
#                            e.g. 0644 or 0640
#   key_sizes              - Optional space-separated list of DH parameter
#                            sizes to generate
#
# If omitted, the following defaults are used:
#
#   tls_tmp_path=/etc/pki/tls/tmp
#   tls_private_path=/etc/pki/tls/private/
#   tls_private_owner=root:root
#   tls_private_dir_mode=0755
#   tls_private_file_mode=0644
#
# DH parameter access:
#
#   DH parameters contain shared cryptographic group parameters and are not
#   private TLS keys. The default directory and file modes allow non-root TLS
#   services to traverse the shared directory and read DH parameter files.
#
#   Do not use a directory containing private keys such as *.key, privkey.pem,
#   or server.key with tls_private_dir_mode=0755 and
#   tls_private_file_mode=0644. Use a dedicated DH parameter directory or a
#   restrictive group-based access model in that case.
#
# key_sizes usage:
#
#   Set key_sizes to explicitly control which DH parameter files are generated,
#   independent of the sizes referenced in individual service definitions.
#
#   Example:
#     key_sizes=2048 4096
#
#   If key_sizes is not set, the script extracts numeric key sizes from
#   extended service definitions. If no sizes are configured, it generates
#   2048-bit and 4096-bit DH parameters.
#
# Example:
#
#   tls_tmp_path=/etc/pki/tls/tmp
#   tls_private_path=/etc/pki/tls/private/
#   tls_private_owner=root:root
#   tls_private_dir_mode=0755
#   tls_private_file_mode=0644
#   key_sizes=2048 4096
#
# -----------------------------------------------------------------------------
#
# SERVICE LINES
#
# Supported Formats (per line):
#
# 1. Simple format:
#      service_name:owner
#    - Only the service and owner are specified.
#    - The DH keys will be managed in the default/generic folder.
#
# 2. Extended format:
#      service_name:owner:key_size:sync_path:user.group:file_permissions
#    - All fields are specified for advanced key syncing and permission control.
#
# Fields (for extended format):
#   service_name     - The systemd service name (without .service)
#   owner            - root for a system-wide unit, or the account owning a
#                      systemd --user unit, e.g. containeradmin
#   key_size         - Size of the DH key to generate and sync (e.g. 2048, 4096)
#   sync_path        - Absolute path where the DH key should be copied/synced
#   user.group       - Ownership (user and group) to set on the sync_path and DH key
#   file_permissions - Permissions to set on the DH key file (e.g. 640, 600)
#
# Notes:
# - Lines starting with '#' or empty lines are ignored.
# - If only service_name and owner are given, the unit is managed after the
#   shared DH parameters have been updated in tls_private_path.
# - A simple service definition does not perform a service-specific DH sync.
# - A complete extended definition requires key_size, sync_path, user.group,
#   and file_permissions.
# - An incomplete extended definition is treated as an error; the script skips
#   both the service-specific DH sync and the service action.
#
# Examples:
#   # Simple usage (uses default key folder):
#   dovecot:root
#
#   # Extended usage (custom sync, owner and permissions):
#   dovecot:root:2048:/etc/dovecot/ssl:root.dovecot:640
#   postfix:root:4096:/etc/postfix/ssl:postfix.postfix:640
#
# This file can be overridden by 'edh-keygen.local' in the same directory,
# which is preserved during package upgrades.
# -----------------------------------------------------------------------------

# Global settings
#tls_tmp_path=/etc/pki/tls/tmp
#tls_private_path=/etc/pki/tls/private/
#tls_private_owner=root:root
#tls_private_dir_mode=0755
#tls_private_file_mode=0644
#key_sizes=2048 4096

# Service lines
#dovecot:root
#postfix:root:4096:/etc/postfix/ssl:postfix.postfix:640