# Copy to ~/.config/rex/server.toml on the server, then replace every secret.
# Rex writes this file with mode 0600 when it creates or updates it.

# Public API listener. Keep 127.0.0.1 when Nginx terminates TLS on this host.
public_host = "127.0.0.1"
public_port = 8010

# Internal status API. Do not expose this through a reverse proxy.
management_host = "127.0.0.1"
management_port = 8011

# Uncomment both lines only if Rex, rather than a reverse proxy, terminates TLS.
# tls_certfile = "/etc/letsencrypt/live/rex.example.net/fullchain.pem"
# tls_keyfile = "/etc/letsencrypt/live/rex.example.net/privkey.pem"

# Per direct peer address, over a rolling 60-second window.
rate_limit_per_minute = 120

# Individual IP addresses and CIDR networks are accepted.
blacklist = ["203.0.113.24", "198.51.100.0/24"]

# Only listed names may connect a device WebSocket.
devices = ["desk"]

# Use a distinct secret for each role. Generate production keys with:
#   rex server keys create <name> --permission <connect|execute|admin>
[[keys]]
name = "desk-client"
secret = "REPLACE_WITH_A_CONNECT_KEY"
permissions = ["connect"]

[[keys]]
name = "automation"
secret = "REPLACE_WITH_AN_EXECUTE_KEY"
permissions = ["execute"]

# Optional: this key can access the loopback-only management status API and
# also has connect and execute rights. Do not use it in a client or automation.
[[keys]]
name = "local-admin"
secret = "REPLACE_WITH_AN_ADMIN_KEY"
permissions = ["admin"]