[daemon]
listen_ip=0.0.0.0
listen_port=9999
authenticate=false
daemonize=false
log_level=debug
ssl=true
ssl_cert=ssl/cert.pem
ssl_key=ssl/key.pem
post_limit=2500000000
log_out=/var/log/sightingdb/sightingdb.log
log_err=/var/log/sightingdb/sightingdb.error.log
# Where the database is snapshotted. Comment this out (or leave it blank) to
# run purely in memory, losing everything when the process stops.
dbdir=/var/lib/sighting
# Seconds between snapshots. The database is always saved on a clean shutdown;
# this bounds how much is lost in a crash. 0 saves only on shutdown.
snapshot_interval=300
# Seconds between eviction sweeps, which reclaim expired values and the
# namespaces left empty by them. 0 disables the sweeper.
sweep_interval=60
# Hourly statistics buckets kept per value. 720 is 30 days. Without a limit,
# every value accumulates one bucket per hour for as long as it is written to.
# 0 keeps all of them.
stats_retention=720
# How long a shadow sighting (the record that something was searched for) is
# kept, in seconds. 0 keeps them forever, which means `_shadow/*` grows without
# bound. 2592000 is 30 days.
shadow_ttl=2592000
# API keys and what each may reach. Without this section every key restored
# from the snapshot gets full access, which is how older versions behaved.
#
# <apikey> = <grant>[, <grant>...]
#
# A grant is r, w or rw, optionally scoped with :<namespace prefix>. Without a
# prefix the grant covers every namespace. Prefixes match whole path segments,
# so rw:feeds/misp covers feeds/misp/ips but not feeds/misp-internal.
#
# Keys are stored here in the clear, so keep this file readable only by the
# user the daemon runs as, and serve over TLS.
[acl]
changeme = rw
# analyst = r
# feed-misp = rw:feeds/misp
# mixed = r, w:staging