---
#
# 'network_gateway': <map>
#
# The 'network_gateway' section is for system-wide settings.
#
network_gateway:
  #
  # hostname: <string>
  #
  # The hostname of the DNG, used in the authentication path and for
  # Identity Provider configuration.
  #
  hostname: 'dng.my.example.com'

  #
  # admin_email: <string>
  #
  # This email address will be used to generate Let's Encrypt certificates
  # and will be contacted if there are issues renewing the automatically
  # generated certificates.
  #
  admin_email: 'admin@my.example.com'

  #
  # enable_ui: <boolean>
  #
  # Enable or disable the admin UI. It is recommended that you disable the
  # UI if using scripted configuration, because changes made in UI will not
  # be tracked by user provided scripted configuration settings. Changes made
  # via the UI will be overwritten the next time any scripted configuration is
  # applied.
  #
  # If true, 'password' must be set. If false, 'password' must not be set.
  #
  enable_ui: false

  #
  # password: <string>
  #
  # The plaintext password for the admin UI. This will be hashed before being
  # saved.
  #
  # Must be set if 'enable_ui' is true, must not be set if 'enable_ui' is false.
  #

  #
  # ssl_cert: <map>
  #
  # The 'ssl_cert' map of 'primary_host' is to hold configuration of the
  # SSL certificate used by the DNG portal and admin containers.
  #
  ssl_cert:
    #
    # source: <string>
    #
    # Source of certificate:
    #   'own' - certificate and key provided in 'cert' and 'key' fields.
    #   'selfsigned' - autogenerate a self signed certificate
    #   'letsencrypt' - autogenerate a certificate using Let's Encrypt
    #
    source: 'own'

    #
    # cert: <string>
    #
    # The certificate to use when 'source' is 'own'. Must be PEM formatted.
    #
    cert: |
      -----BEGIN CERTIFICATE-----
      Put valid PEM data here!
      -----END CERTIFICATE-----

    #
    # key: <string>
    #
    # The key to use when 'source' is 'own'. Must be PEM formatted.
    #
    key: |
      -----BEGIN PRIVATE KEY-----
      Put valid PEM data here!
      -----END PRIVATE KEY-----

#
# 'primary_auth': <map>
#
# The 'primary_auth' section is for system-wide authentication settings.
#
# The Identity Provider will need to be supplied with several URLs from the
# DNG. These are based on the 'hostname' in the 'primary_host' section:
#
# Entity ID or Issuer ID:
#    https://<hostname>/metadata/
#
# Assertion Consumer Service URL or Single Sign-On URL
#     https://<hostname>/acs/
#
# Single Logout Service URL
#     https://<hostname>/sls/
#
# Audience Restriction
#     https://<hostname>/metadata/
#
primary_auth:
  #
  # entity_id: <string>
  #
  # This is the Entity ID provided by your Identity Provider
  #
  entity_id: 'http://my.idp.example.com/eid'

  #
  # single_signon_url: <string>
  #
  # This is the Single Sign-on URL provided by your Identity Provider
  #
  single_signon_url: 'http://my.idp.example.com/sso'

  #
  # single_logout_url: <string>
  #
  # This is the Single Logout URL provided by your Identity Provider
  #
  single_logout_url: 'http://my.idp.example.com/slo'

  #
  # signing_cert: <string>
  #
  # This is the Signing Certificate provided by your Identity Provider
  #
  signing_cert: |
    -----BEGIN CERTIFICATE-----
    Put valid PEM data here!
    -----END CERTIFICATE-----

  #
  # enforced_email_domain: <string>
  #
  # Only accept primary authentication for users in the specified domain.
  # If set to '', no restriction is applied.
  #
  # This defaults to ''
  #
  enforced_email_domain: ''

  #
  # username_attribute: <string>
  #
  # Specify an alternate SAML username attribute instead of NameID.
  # If set to '', NameID will be used.
  #
  # This defaults to ''
  #
  username_attribute: ''

#
# web_applications: <list of maps>
#
# This is a list of maps describing all web applications.
#
web_applications:
  #
  # Web application name - this can be anything as long as it is unique for
  # the rest of the 'web_applications' map.
  #

  "Sample web application config":
    #
    # external_hostname: <string>
    #
    # The external hostname of the application, which must be a CNAME
    # pointing to the DNG.
    #
    external_hostname: 'external-web.example.com'

    #
    # external_port: <integer>
    #
    # The port of the external application. Since all external applications
    # use SSL, this is normally 443.
    #
    external_port: 443

    #
    # external_ssl_cert: <map>
    #
    # This describes the SSL certificate of the external application.
    #
    external_ssl_cert:

      #
      # source: <string>
      #
      # Source of certificate:
      #   'own' - certificate and key provided in 'cert' and 'key' fields.
      #   'selfsigned' - autogenerate a self signed certificate
      #   'letsencrypt' - autogenerate a certificate using Let's Encrypt
      #
      source: 'own'

      #
      # cert: <string>
      #
      # The certificate to use when 'source' is 'own'. Must be PEM formatted.
      #
      cert: |
        -----BEGIN CERTIFICATE-----
        Put valid PEM data here!
        -----END CERTIFICATE-----

      #
      # key: <string>
      #
      # The certificate to use when 'source' is 'own'. Must be PEM formatted.
      #
      key: |
        -----BEGIN PRIVATE KEY-----
        Put valid PEM data here!
        -----END PRIVATE KEY-----

    #
    # internal_hostname: <string>
    #
    # The internal hostname of the application.
    #
    internal_hostname: 'internal.example.com'

    #
    # internal_port: <integer>
    #
    # The internal port of the application.
    #
    internal_port: 443

    #
    # internal_use_ssl: <boolean>
    #
    # Describes if ssl should be used when communicating with
    # 'internal_hostname' on 'internal_port'.
    #
    internal_use_ssl: true

    #
    # internal_trusted_cert: <string>
    #
    # The trusted cert of 'internal_hostname'. This is only used if
    # 'internal_use_ssl' is true.
    #
    # If this is not set, the certificates are verified against the installed
    # cert bundle.
    #
    internal_trusted_cert: |
      -----BEGIN CERTIFICATE-----
      Put valid PEM data here!
      -----END CERTIFICATE-----

    #
    # duo_2fa: <map>
    #
    # This contains the integration configuration from the Duo Admin Panel or
    # the Duo Admin API.
    #
    duo_2fa:
      #
      # ikey: <string>
      #
      # The integration key from the Duo Admin Panel.
      #
      ikey: 'Valid ikey from admin panel'

      #
      # skey: <string>
      #
      # The secret key from the Duo Admin Panel.
      #
      skey: 'Valid skey from admin panel'

      #
      # apihost: <string>
      #
      # The api host from the Duo Admin Panel / Admin API.
      #
      apihost: 'api-xxxxxxxx.duosecurity.com'


    #
    # use_internal_name_for_sni: <boolean>
    #
    # If true, this sends the 'internal_name' as the SNI and Host header and
    # uses this to validate the SSL certificate sent by the internal host.
    # If false, the 'external_hostname' is used.
    #
    # Default: false
    #
    use_internal_name_for_sni: true

    #
    # session_duration: <integer>
    #
    # Duration in seconds for the user's authentication token. Users will have
    # to reauthenticate after the session expires.
    #
    # Default value: 480
    #
    session_duration: 480

    #
    # whitelist_ips: <list of strings>
    #
    # This is a list of strings that describe hosts to whitelist to not
    # require authentication. Valid values can be:
    #   - single IP, ie "10.0.0.1"
    #   - IP CIDRs, ie "10.0.0.0/8"
    #   - IP ranges, ie "10.0.0.20-10.0.0.40"
    #
    # Default value: an empty list
    #
    whitelist_ips:
      - '10.0.0.1'
      - '10.0.0.0/8'
      - '10.0.0.20-10.0.0.40'

    #
    # whitelist_prefix: <list of strings>
    #
    # This is a list URL prefixes that are whitelisted to not require
    # authentication.
    #
    # Default value: an empty list
    #
    whitelist_prefixes:
      - '/ignore/'

    #
    # whitelist_suffix: <list of strings>
    #
    # This is a list of URL suffixes that are whitelisted to not require
    # authentication.
    #
    # Default value: an empty list
    #
    whitelist_suffixes:
      - '.jpg'

  #
  # (more applications)
  #

#
# SSH Servers - <list of maps>
#
# This is a list of maps describing all ssh_servers.
#
ssh_servers:
  #
  # SSH servers name - this can be anything as long as it is unique for
  # the rest of the 'ssh_servers' map.
  #
  "Sample SSH server config":

    #
    # external_hostname: <string>
    #
    # The external hostname of the application, which must be a CNAME
    # pointing to the DNG.
    #
    external_hostname: 'external-ssh.example.com'

    #
    # external_ssl_cert: <map>
    #
    # This describes the SSL certificate of the external application.
    #
    external_ssl_cert:

      #
      # source: <string>
      #
      # Source of certificate:
      #   'own' - certificate and key provided in 'cert' and 'key' fields.
      #   'selfsigned' - autogenerate a self signed certificate
      #   'letsencrypt' - autogenerate a certificate using Let's Encrypt
      #
      source: 'own'

      #
      # cert: <string>
      #
      # The certificate to use when 'source' is 'own'. Must be PEM formatted.
      #
      cert: |
        -----BEGIN CERTIFICATE-----
        Put valid PEM data here!
        -----END CERTIFICATE-----

      #
      # key: <string>
      #
      # The certificate to use when 'source' is 'own'. Must be PEM formatted.
      #
      key: |
        -----BEGIN PRIVATE KEY-----
        Put valid PEM data here!
        -----END PRIVATE KEY-----

    #
    # internal_servers: <list of maps>
    #
    # This is a list of maps that describe the internal servers reachable
    # through 'external_hostname'.
    #
    internal_servers:
        #
        # host_pattern: <string>
        #
        # The hostname or IP(s) of the internal endpoint(s). It can be:
        #   - single IP, ie "10.0.0.1"
        #   - IP CIDRs, ie "10.0.0.0/8"
        #   - IP ranges, ie "10.0.0.20-10.0.0.40"
        #   - hostnames, ie "whitelistedhost.example.com"
        #
      - host_pattern: '10.0.0.0/8'

        #
        # ports: <integer>
        #
        # The port(s) on the host(s) described in 'host_pattern' to forward ssh
        # traffic to. Can be a port or port range. Multiple ports or ranges
        # can be comma separated.
        #
        # Default value: 22
        #
        ports: 22

    #
    # duo_2fa: <map>
    #
    # This contains the integration configuration from the Duo Admin Panel or
    # the Duo Admin API.
    #
    duo_2fa:
      #
      # ikey: <string>
      #
      # The integration key from the Duo Admin Panel.
      #
      ikey: 'Valid ikey from admin panel'

      #
      # skey: <string>
      #
      # The secret key from the Duo Admin Panel.
      #
      skey: 'Valid skey from admin panel'

      #
      # apihost: <string>
      #
      # The api host from the Duo Admin Panel / Admin API.
      #
      apihost: 'api-xxxxxxxx.duosecurity.com'

    #
    # session_duration: <integer>
    #
    # Duration in seconds for the user's authentication token. Users will have
    # to reauthenticate after the session expires.
    #
    # Default value: 480
    #
    session_duration: 480

  #
  # (more ssh_servers)
  #
