# rust-bfd configuration. Install as /etc/rust-bfd/config.yaml (or pass --config / set BFD_CONFIG).
#
# Precedence, lowest to highest: built-in defaults < this file < BFD_* environment < command line.
# Values shown below are the built-in defaults unless noted. Unknown keys are an error.

# Local address(es) to bind and use as the source of BFD control packets. Required (here, in BFD_BIND, or via --bind).
# Accepts a single address, a list, or a comma-separated string. The daemon currently supports exactly one address;
# the list form is accepted so configs do not need to change once multiple binds are implemented.
#   Env:  BFD_BIND="192.0.2.1"            (or "192.0.2.1,2001:db8::1")
#   CLI:  --bind 192.0.2.1 [--bind ...]   (replaces the addresses configured here)
bind: 192.0.2.1
# bind: [192.0.2.1, "2001:db8::1"]

# Directory of executable scripts run, in lexical order, on every session state change.
#   Env: BFD_HOOKS_DIR
hooks_dir: /etc/rust-bfd/hooks.d

# Settings inherited by every peer that does not override them. Durations are humantime strings (300ms, 1s, 2m).
# A peer is never allowed a zero interval or a detect_mult of 0.
defaults:
  # Minimum interval between transmitted control packets that we would like to use once the session is Up. Sessions
  # that are not Up transmit no faster than once per second regardless (RFC 5880 section 6.8.3).
  #   Env: BFD_DEFAULTS_DESIRED_MIN_TX
  desired_min_tx: 300ms
  # Minimum interval between received control packets we can support.
  #   Env: BFD_DEFAULTS_REQUIRED_MIN_RX
  required_min_rx: 300ms
  # Detection time multiplier: we declare the session down after this many missed packets.
  #   Env: BFD_DEFAULTS_DETECT_MULT
  detect_mult: 3

# Peers to establish sessions with. Peers can only be configured here and with --peer (repeatable, addresses only,
# default settings); they cannot be set from the environment. Each peer's address must match the family of at least
# one bind address.
peers:
  - address: 192.0.2.2
  # Per-peer overrides of any `defaults` key:
  # - address: 192.0.2.3
  #   desired_min_tx: 1s
  #   required_min_rx: 1s
  #   detect_mult: 5
  #
  # Authentication (RFC 5880 section 6.7), per peer and off by default. Both ends must be configured identically; a
  # peer that does not authenticate as configured is discarded. `key_id` is a number (0-255) that must match the remote's.
  # Keys are used verbatim (not hashed or derived), so they must be exactly the length shown. Give them as a string;
  # use YAML double-quoted escapes (\x00, \x1b, ...) for bytes that are not printable. Strings are UTF-8, so only bytes
  # 0x00-0x7f can be written this way. To use bytes 0x80-0xff, give the key as a list of integers instead, one per
  # byte (hex is fine), with the same length requirement:
  #   key: [0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x61, 0x62, 0x63, 0x64, 0x80, 0xff]
  #
  # Keyed MD5: `key` is exactly 16 bytes. `meticulous` (default true) selects Meticulous Keyed MD5, in which every
  # packet must carry a newer sequence number; the remote must be set to the same mode.
  # - address: 192.0.2.4
  #   auth:
  #     type: md5
  #     key_id: 1
  #     key: "0123456789abcdef"
  #     meticulous: true
  #
  # Keyed SHA1: `key` is exactly 20 bytes. `meticulous` as above.
  # - address: 192.0.2.5
  #   auth:
  #     type: sha1
  #     key_id: 1
  #     key: "0123456789abcdef\x00\x01\x7f\x1b"
  #
  # Simple password: 1 to 16 bytes, sent in the clear. Provides no protection against an attacker on the path.
  # - address: 192.0.2.6
  #   auth:
  #     type: password
  #     key_id: 1
  #     password: "secret"