api: allow listening to Unix sockets

1 files changed, 9 insertions, 5 deletions

diff --git a/docs/example.toml b/docs/example.toml
index b6a6ad0..43fdaf1 100644
--- a/docs/example.toml
+++ b/docs/example.toml
@@ -52,8 +52,10 @@ node-key-file = "/var/lib/continuum/node.key"
 
 # --- The HTTP API ------------------------------------------------------------------------
 
-# Address of the HTTP API. Plain HTTP: to expose it, put a TLS proxy in front.
-# bind-addr = "127.0.0.1:3000"
+# Where the HTTP API listens: TCP addresses, and Unix sockets (unix:PATH, made readable
+# and writable by the node's user and group only), as many as given. Plain HTTP: to
+# expose it, put a TLS proxy in front.
+# bind-addr = ["127.0.0.1:3000", "unix:/run/continuum/api.sock"]
 
 # Users of the HTTP API (an htpasswd file with Argon2 hashes). Required (but with
 # user-header, or relay-only: without either, no HTTP API).
@@ -65,9 +67,11 @@ htpasswd = "/etc/continuum/htpasswd"
 # authentication. The proxy must set or clear it on every request.
 # user-header = "X-Remote-User"
 
-# Addresses (an IP address, or a range as ADDRESS/BITS) of the reverse proxies whose
-# user-header is believed.
-# trusted-proxies = ["127.0.0.1", "::1"]
+# Where the reverse proxies whose user-header is believed connect from: IP addresses (or
+# ranges, as ADDRESS/BITS), and unix for the API's Unix sockets (bind-addr). On a host
+# with other users, leave out the addresses and have the proxy use a Unix socket: others
+# can connect over loopback too.
+# trusted-proxies = ["127.0.0.1", "::1", "unix"]
 
 # HTTP API users (from htpasswd or user-header) who may write protocol data under /store/_continuum
 # (remake records, members, forget records), e.g. to repair a stuck remake. Such writes