// WARNING: This example configuration is not meant for production use.
// The Kea Kea's DHCP-DDNS server can refuse this configuration because
// it may contain mutually exclusive configuration parameters.
//
// The primary purpose of the example file is to provide a comprehensive
// list of parameters supported by the Kea DHCP-DDNS server along with the
// brief description of each parameter.
//
// This current version should be up to date, i.e. new keywords should be
// added in this file at the same time as in the parser specification.
{
    // Kea DHCP-DDNS server configuration begins here.
    "DhcpDdns": {

    // Global Parameters

    // IP address D2 will listen for update requests at.
    // Default is 127.0.0.1
    "ip-address": "127.0.0.1",

    // Port D2 will listen for update requests on.
    // Default is 53001.
    "port": 53001,

    // Maximum time to we will wait for a DNS server to respond to us.
    // Unit is the millisecond, default is 100ms.
    "dns-server-timeout" : 100,

    // Protocol to use for Name Change Requests from a Kea DHCP server.
    // Currently only 'UDP' is supported.
    "ncr-protocol": "UDP",

    // Format to use for Name Change Requests from a Kea DHCP server.
    // Currently only 'JSON' is supported.
    "ncr-format": "JSON",

    // Command control socket configuration parameters for Kea DHCP-DDNS server.
    "control-sockets": [
        {
            // Control socket type used by the Kea DHCP-DDNS server.
            // Must be unix, http or https.
            "socket-type": "unix",

            // Location of the UNIX domain socket file the DHCP-DDNS
            // server uses to receive control commands from the
            // local server administrator.
            "socket-name": "kea-ddns-ctrl-socket"
        },
        {
            // Control socket type used by the Kea DHCP-DDNS server.
            // Must be unix, http or https.
            "socket-type": "https",

            // Address of the HTTPS socket the Kea DHCP-DDNS server should
            // listen for incoming queries.
            "socket-address": "127.0.0.1",

            // Port of the HTTPS socket the Kea DHCP-DDNS server
            // should listen for incoming queries.
            "socket-port": 8053,

            // TLS trust anchor (Certificate Authority). This is a
            // file name or a directory path. Make sense with other
            // TLS parameters only for the https control socket type.
            "trust-anchor": "my-ca",

            // TLS server certificate file name.
            "cert-file": "my-cert",

            // TLS server private key file name.
            "key-file": "my-key",

            // TLS require client certificates flag. Default is
            // true and means require client certificates. False
            // means they are optional.
            "cert-required": true,

            // Optional authentication.
            "authentication": {
                // Required authentication type. The only supported
                // value is basic for the basic HTTP authentication.
                "type": "basic",

                // An optional parameter is the basic HTTP
                // authentication realm.  Its default is
                // "kea-dhcp-ddns-server"
                "realm": "kea-dhcp-ddns-server",

                // This optional parameter can be used to specify a common
                // prefix for files handling client credentials.
                "directory": "/usr/local/share/kea/kea-creds",

                // This list specifies the user ids and passwords to
                // use for basic HTTP authentication. If empty or not
                // present any client is authorized.
                "clients": [
                    // This specifies an authorized client.
                    {
                        // The user id must not be empty or contain
                        // the ':' character. It is a mandatory parameter.
                        "user": "admin",

                        // If password is not specified an empty
                        // password is used.
                        "password": "1234"
                    },

                    // This specifies a hidden client.
                    {
                        // The user id is the content of the
                        // file /usr/local/share/kea/kea-creds/hiddenu.
                        "user-file": "hiddenu",

                        // The password is the content of the
                        // file /usr/local/share/kea/kea-creds/hiddenp.
                        "password-file": "hiddenp"
                    },

                    // This specifies a hidden client using a secret
                    // in a file.
                    {
                        // The secret is the content of the file
                        // /usr/local/share/kea/kea-creds/hiddens which must be in
                        // the <user-id>:<password> format.
                        "password-file": "hiddens"
                    }
                ]
            }
        }
    ],

    // List of hook libraries and their specific configuration parameters
    // to be loaded by Kea DHCP-DDNS server.
    "hooks-libraries": [
        {
            // Location of the hook library to be loaded.
            "library": "/opt/local/ddns-server-commands.so",

            // Hook library-specific configuration parameters.
            "parameters": { }
        }
    ],

    // Forward DDNS (Dynamic DNS).
    "forward-ddns": {

        // List of DDNS domains.
        "ddns-domains": [
            {
                // Name of the zone (required).
                "name": "example.com.",

                // Name of the TSIG key used to protect DNS updates for
                // names in the domain.
                "key-name": "d2.md5.key",

                // List of DNS servers where to send DNS updates.
                "dns-servers": [
                    {
                        // DNS server IP address (required).
                        "ip-address": "2001:db8:1::10",

                        // DNS server UDP port. Default is 53 (DNS service).
                        "port": 7802,

                        // Name of the TSIG key used to protect DNS updates
                        // sent to the DNS server.
                        "key-name": "d2.sha1.key"
                    }
                ]
            }
        ]
    },

    // Reverse DDNS (Dynamic DNS).
    "reverse-ddns": {

        // List of DDNS domains.
        "ddns-domains": [
            {
                // Name of the zone (required).
                "name": "2.0.192.in-addr.arpa.",

                // Name of the TSIG key used to protect DNS updates for
                // names in the domain.
                "key-name": "d2.sha1.key",

                // List of DNS servers where to send DNS updates.
                "dns-servers": [
                    {
                        // DNS server IP address (required).
                        "ip-address": "172.16.1.1",

                        // DNS server UDP port. Default is 53 (DNS service).
                        "port": 5301,

                        // Name of the TSIG key used to protect DNS updates
                        "key-name": "d2.md5.key"
                    }
                ]
            }
        ]
    },

    // List of TSIG keys used to protect DNS updates.
    "tsig-keys": [
        {
            // Name of the TSIG key (required).
            "name": "d2.md5.key",

            // Algorithm of the TSIG key (required).
            // The value must be a valid algorithm name e.g.
            // HMAC-MD5, HMAC-SHA1, HMAC-SHA224, ...
            "algorithm": "HMAC-MD5",

            // Number of bits in the digest. Default is 0 which means
            // to use all bits provided by the algorithm. Too short values
            // (depending on the algorithm) are rejected.
            "digest-bits": 0,

            // Secret of the TSIG key (required) in base-64.
            "secret": "LSWXnfkKZjdPJI5QxlpnfQ=="
        },
        {
            "name": "d2.sha1.key",
            "algorithm": "HMAC-SHA1",

            // An alternative to secret: specify a file where the secret
            // can be found. i.e. the secret is the content of the file.
            "secret-file": "/usr/local/share/kea/d2-sha1-secret"
        }
    ],

    // List of loggers used by the servers using this configuration file.
    "loggers": [
        {
            // Debug level, a value between 0..99. The greater the value
            // the more detailed the debug log.
            "debuglevel": 99,

            // Name of the logger.
            "name": "kea-dhcp-ddns",

            // Configures how the log should be output.
            "output-options": [
                {
                    // Determines whether the log should be flushed to a file.
                    "flush": true,

                    // Specifies maximum filesize before the file is rotated.
                    "maxsize": 10240000,

                    // Specifies the maximum number of rotated files to be kept.
                    "maxver": 1,

                    // Specifies the logging destination.
                    "output": "stdout",

                    // Specifies log entry content
                    "pattern": "%D{%Y-%m-%d %H:%M:%S.%q} %-5p [%c/%i] %m\n"
                }
            ],

            // Specifies logging severity, i.e. "ERROR", "WARN", "INFO", "DEBUG".
            "severity": "INFO"
        }
    ],

    // Look at sample1 example for the use of user-contexts.
    "user-context": { }
}

}
