43 lines
1.4 KiB
TOML
43 lines
1.4 KiB
TOML
# Copy to ~/.config/rex/server.toml on the server, then replace every secret.
|
|
# Rex writes this file with mode 0600 when it creates or updates it.
|
|
|
|
# Public API listener. Keep 127.0.0.1 when Nginx terminates TLS on this host.
|
|
public_host = "127.0.0.1"
|
|
public_port = 8010
|
|
|
|
# Internal status API. Do not expose this through a reverse proxy.
|
|
management_host = "127.0.0.1"
|
|
management_port = 8011
|
|
|
|
# Uncomment both lines only if Rex, rather than a reverse proxy, terminates TLS.
|
|
# tls_certfile = "/etc/letsencrypt/live/rex.example.net/fullchain.pem"
|
|
# tls_keyfile = "/etc/letsencrypt/live/rex.example.net/privkey.pem"
|
|
|
|
# Per direct peer address, over a rolling 60-second window.
|
|
rate_limit_per_minute = 120
|
|
|
|
# Individual IP addresses and CIDR networks are accepted.
|
|
blacklist = ["203.0.113.24", "198.51.100.0/24"]
|
|
|
|
# Only listed names may connect a device WebSocket.
|
|
devices = ["desk"]
|
|
|
|
# Use a distinct secret for each role. Generate production keys with:
|
|
# rex server keys create <name> --permission <connect|execute|admin>
|
|
[[keys]]
|
|
name = "desk-client"
|
|
secret = "REPLACE_WITH_A_CONNECT_KEY"
|
|
permissions = ["connect"]
|
|
|
|
[[keys]]
|
|
name = "automation"
|
|
secret = "REPLACE_WITH_AN_EXECUTE_KEY"
|
|
permissions = ["execute"]
|
|
|
|
# Optional: this key can access the loopback-only management status API and
|
|
# also has connect and execute rights. Do not use it in a client or automation.
|
|
[[keys]]
|
|
name = "local-admin"
|
|
secret = "REPLACE_WITH_AN_ADMIN_KEY"
|
|
permissions = ["admin"]
|