Configuration¶

settings:
  host: 127.0.0.1
  port: 9998
  # 0 / null = disabled (always-on). Under a socket-activation
  # supervisor (FreeBSD inetd wait mode, systemd socket activation)
  # set to e.g. 900 so the daemon frees memory after 15 min idle —
  # the supervisor re-spawns it on the next request.
  idle_timeout_s: 0

  # Per-IP rate limiting (sliding window), bucketed by endpoint family so the
  # cheap validation calls and the expensive renders are throttled apart. Set a
  # bucket's max_requests to 0 to disable limiting for that family.
  #
  # The client IP is taken from the reverse proxy, never from the client: when
  # REMOTE_ADDR is one of trusted_proxies, X-Real-IP (then the first
  # X-Forwarded-For hop) is used. nginx MUST therefore set
  #   proxy_set_header X-Real-IP $remote_addr;
  # and trusted_proxies MUST list nginx's address as automathd sees it (its
  # REMOTE_ADDR). Entries may be single IPs or CIDR blocks (e.g. an internal
  # 10.x.0.0/24), so a whole trusted subnet can be covered at once. Without a
  # forwarded header from a trusted proxy the request is left unlimited
  # (fail-open) rather than counted against the proxy itself — which would
  # throttle every visitor at once.
  rate_limit:
    trusted_proxies: ['127.0.0.1', '::1']
    render: {window_s: 60, max_requests: 120}  # /render/* (also the default)
    check: {window_s: 60, max_requests: 600}   # /check/* (cheap validation)
    upload: {window_s: 60, max_requests: 20}   # POST /fonts (font uploads)

# Publishing user web apps (the Publication panel's "Publier" button).
# Disabled by default: with no serve_root, POST /publish and GET /whoami
# answer 503. A deployment that publishes sets serve_root (where the bundles
# are unpacked, one dir per identifier) in its config overlay, plus one token
# per publisher. Each token is stored as the hex sha256 of the secret only —
# generate a secret with `python -c "import secrets;print(secrets.token_urlsafe(32))"`,
# hash it with `python -c "import hashlib,sys;print(hashlib.sha256(sys.argv[1].encode()).hexdigest())" <secret>`,
# and keep the secret out of the config (it lives only in the publisher's browser).
publish:
  serve_root: null            # e.g. /usr/local/www/apps ; null => publishing disabled
  public_base_url: null       # e.g. https://automathics.net ; used to report the published URL
  tokens: []                  # list of { identifier: <slug>, sha256: <hex> }

logging:
  log_dir: /var/log/automathd
  use_syslog: True
  syslog_facility: daemon
  log_level: INFO
  max_bytes: 1 # MB
  backup_count: 9