diff options
Diffstat (limited to 'docs/example.toml')
| -rw-r--r-- | docs/example.toml | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/docs/example.toml b/docs/example.toml index 95b6f52..67f2cfd 100644 --- a/docs/example.toml +++ b/docs/example.toml @@ -51,10 +51,20 @@ node-key-file = "/var/lib/continuum/node.key" # bind-addr = "127.0.0.1:3000" # Users of the HTTP API (an htpasswd file with Argon2 hashes). Required (but with -# relay-only: without it, no HTTP API). +# user-header, or relay-only: without either, no HTTP API). htpasswd = "/etc/continuum/htpasswd" -# HTTP API users (from htpasswd) who may write protocol data under /store/_continuum +# A request header naming the user, set by a reverse proxy in front of the HTTP API that +# authenticated the request itself (e.g. X-Remote-User, from nginx's $remote_user). +# Believed only from trusted-proxies; other requests need htpasswd's basic +# authentication. The proxy must set or clear it on every request. +# user-header = "X-Remote-User" + +# Addresses (an IP address, or a range as ADDRESS/BITS) of the reverse proxies whose +# user-header is believed. +# trusted-proxies = ["127.0.0.1", "::1"] + +# HTTP API users (from htpasswd or user-header) who may write protocol data under /store/_continuum # (remake records, members, forget records), e.g. to repair a stuck remake. Such writes # act on the whole swarm and are logged. Epoch metadata and the swarm ID are never # writable. |