Configuration

# Keepword node configuration. `keepword init` writes a minimal version of this
# to <data dir>/keepword.toml.

[vantage]
# Where this node fetches from. Self-reported; peers corroborate it from the
# addresses they see (docs/DESIGN.md §6.3).
asn = 3320
country = "DE"

[capture]
# Defaults to an honest "Keepword/<version>" user agent.
# user_agent = "Mozilla/5.0 ..."
timeout_secs = 30
max_body_mib = 32
# A proxy changes the vantage point and hides the server's TLS certificate.
use_system_proxy = false
# Refuse loopback / private / link-local targets. Only enable for LAN monitoring.
allow_private_addresses = false
# chrome = "/usr/bin/chromium"   # for `capture --render`

[content]
# full        headers + raw body + normalized text (evidence and diffs)
# normalized  headers + normalized text (diffs, no raw copy; the default)
# none        hashes only (edits detected, not shown)
retain = "normalized"

[network]
# Public base URL of this node's /v1 API. Unset = push-only (behind NAT).
endpoint = "https://witness.example.org"
peers = ["https://witness.other-example.net"]
seeds = true               # also join through the built-in seed witnesses
sync_interval_secs = 60
replication = 5            # witnesses assigned per watch request
max_per_country = 2
max_requests_per_requester = 50
max_peers = 2000
gossip_fanout = 16         # random peers exchanged gossip with each round
audit_logs = 16            # auditors per log; same on every witness
checkpoint_interval_secs = 3600  # this log's checkpoint for auditors
cosign_interval_secs = 3600      # how often to audit each log
# Serve raw captured content to others only for these hosts.
serve_content_hosts = ["tagesschau.de", "bund.de"]
trust_forwarded_for = false  # true only behind your own reverse proxy
# client_ip_header = "X-Real-IP"  # behind a CDN: where that proxy puts the client
# Never capture these hosts for network requests (still relayed).
decline_hosts = ["intranet.example"]
max_request_watches = 200  # most URLs captured for the network at once
render_requests = false    # render requests in Chromium; see docs/DESIGN.md §6.4
allow_private_peers = false  # true only for a closed network on a LAN

[beacon]
drand_url = "https://api.drand.sh"   # "" to disable
allow_insecure_seed = false          # true only for private test networks

[quorum]
window_secs = 600
min_asns = 3
min_dissent_asns = 2
asn_db = "/var/lib/keepword/ip2asn-combined.tsv"   # from iptoasn.com
min_observers = 2
trust_self_reported = false          # true only for test networks

[anchor]
calendars = [
  "https://a.pool.opentimestamps.org",
  "https://b.pool.opentimestamps.org",
  "https://a.pool.eternitywall.com",
]
esplora_url = "https://blockstream.info/api"   # "" to disable
interval_secs = 3600

# Per-site normalization rules. They apply to the host and its subdomains,
# and are committed to in every attestation's normalizer profile.
[[rules]]
host = "example-news.de"
remove = [".live-ticker", "#comments", ".reading-time"]
root = "article.story"