17.16. donau.conf(5)#
17.16.1. Name#
donau.conf - Donau configuration file
17.16.2. Description#
The configuration file is line-oriented. Blank lines and whitespace at the
beginning and end of a line are ignored. Comments start with #
or %
in the first column (after any beginning-of-line whitespace) and go to the end
of the line.
The file is split into sections. Every section begins with [SECTIONNAME]
and contains a number of options of the form OPTION=VALUE
. There may be
whitespace around the =
(equal sign). Section names and options are
case-insensitive.
The values, however, are case-sensitive. In particular, boolean values are
one of YES
or NO
. Values can include whitespace by surrounding the
entire value with "
(double quote). Note, however, that there are no
escape characters in such strings; all characters between the double quotes
(including other double quotes) are taken verbatim.
Values that represent a time duration are represented as a series
of one or more NUMBER UNIT
pairs, e.g. 60 s
, 4 weeks 1 day
,
5 years 2 minutes
.
Values that represent an amount are in the usual amount syntax:
CURRENCY:VALUE.FRACTION
, e.g. EUR:1.50
.
The FRACTION
portion may extend up to 8 places.
Values that represent filenames can begin with a /bin/sh
-like variable
reference. This can be simple, such as $TMPDIR/foo
, or complex, such as
${TMPDIR:-${TMP:-/tmp}}/foo
. The variables are expanded either using
key-values from the [PATHS]
section (see below) or from the environment
(getenv()
). The values from [PATHS]
take precedence over those from
the environment. If the variable name is found in neither [PATHS]
nor the
environment, a warning is printed and the value is left unchanged. Variables (including those from the environment) are expanded recursively, so if FOO=$BAR
and BAR=buzz
then the result is FOO=buzz
. Recursion is bounded to at most 128 levels to avoid undefined behavior for mutually recursive expansions like if BAR=$FOO
in the example above.
The [PATHS]
section is special in that it contains paths that can be
referenced using $
in other configuration values that specify
filenames. Note that configuration options that are not specifically
retrieved by the application as filenames will not see “$”-expressions
expanded. To expand $
-expressions when using taler-config
, you must pass
the -f
command-line option.
The system automatically pre-populates the [PATHS]
section with a few values
at run-time (in addition to the values that are in the actual configuration
file and automatically overwriting those values if they are present).
These automatically generated values refer to installation properties
from GNU autoconf. The
values are usually dependent on an INSTALL_PREFIX
which is determined by
the --prefix
option given to configure. The canonical values are:
LIBEXECDIR = $INSTALL_PREFIX/taler/libexec/
DOCDIR = $INSTALL_PREFIX/share/doc/taler/
ICONDIR = $INSTALL_PREFIX/share/icons/
LOCALEDIR = $INSTALL_PREFIX/share/locale/
PREFIX = $INSTALL_PREFIX/
BINDIR = $INSTALL_PREFIX/bin/
LIBDIR = $INSTALL_PREFIX/lib/taler/
DATADIR = $INSTALL_PREFIX/share/taler/
Note that on some platforms, the given paths may differ depending on how the system was compiled or installed, the above are just the canonical locations of the various resources. These automatically generated values are never written to disk.
Files containing default values for many of the options described below
are installed under $DONAU_PREFIX/share/donau/config.d/
.
The configuration file given with -c to Donau binaries
overrides these defaults.
A configuration file may include another, by using the @INLINE@
directive,
for example, in main.conf
, you could write @INLINE@ sub.conf
to
include the entirety of sub.conf
at that point in main.conf
.
Be extra careful when using donau-config -V VALUE
to change configuration
values: it will destroy all uses of @INLINE@
and furthermore remove all
comments from the configuration file!
17.16.2.1. GLOBAL OPTIONS#
The “[PATHS]” section is special in that it contains paths that can be referenced using “$” in other configuration values that specify filenames. For Taler exchange, it commonly contains the following paths:
- DONAU_HOME
Home directory of the user, usually “${HOME}”. Can be overwritten by testcases by setting ${DONAU_TEST_HOME}.
- DONAU_DATA_HOME
Where should Taler store its long-term data. Usually “${DONAU_HOME}/.local/share/donau/”.
- DONAU_CONFIG_HOME
Where is the Taler configuration kept. Usually “${DONAU_HOME}/.config/donau/”.
- DONAU_CACHE_HOME
Where should Taler store cached data. Usually “${DONAU_HOME}/.cache/donau/”.
- DONAU_RUNTIME_DIR
Where should Taler store system runtime data (like UNIX domain sockets). Usually “${TMP}/donau-runtime”.
17.16.2.2. DONAU OPTIONS#
The following options are from the “[donau]” section and used by most Donau components.
- ADMIN_BEARER_TOKEN
Bearer access token used to access the REST API to manage charities. Should begin with “secret-token:”.
- CURRENCY
Name of the currency, e.g. “EUR” for Euro.
- DB
Plugin to use for the database, e.g. “postgres”.
- SERVE
Should the HTTP server listen on a UNIX domain socket (set option to “unix”), or on a TCP socket (set option to “tcp”), or be activated via systemd (set option to “systemd”).
- UNIXPATH
Path to listen on if we “SERVE” is set to “unix”.
- UNIXPATH_MODE
Access permission mask to use for the “UNIXPATH”.
- PORT
Port on which the HTTP server listens, e.g. 8080.
- BIND_TO
Hostname to which the exchange HTTP server should be bound to, e.g. “localhost”.
- BASE_URL
The base URL under which the exchange can be reached. Added to wire transfers to enable tracking by merchants. Used by the KYC logic when interacting with OAuth 2.0.
- TERMS_DIR
Directory where the terms of service of the exchange operator can be fund. The directory must contain sub-directories for every supported language, using the two-character language code in lower case, e.g. “en/” or “fr/”. Each subdirectory must then contain files with the terms of service in various formats. The basename of the file of the current policy must be specified under
TERMS_ETAG
. The extension defines the mime type. Supported extensions include “html”, “htm”, “txt”, “pdf”, “jpg”, “jpeg”, “png” and “gif”. For example, using aTERMS_ETAG
of “0”, the structure could be the following:$TERMS_DIR/en/0.pdf
$TERMS_DIR/en/0.html
$TERMS_DIR/en/0.txt
$TERMS_DIR/fr/0.pdf
$TERMS_DIR/fr/0.html
$TERMS_DIR/de/0.txt
- TERMS_ETAG
Basename of the file(s) in the
TERMS_DIR
with the current terms of service. The value is also used for the “Etag” in the HTTP request to control caching. Whenever the terms of service change, theTERMS_ETAG
MUST also change, and old values MUST NOT be repeated. For example, the date or version number of the terms of service SHOULD be used for the Etag. If there are minor (e.g. spelling) fixes to the terms of service, theTERMS_ETAG
probably SHOULD NOT be changed. However, whenever users must approve the new terms, theTERMS_ETAG
MUST change.- PRIVACY_DIR
Works the same as
TERMS_DIR
, just for the privacy policy.- PRIVACY_ETAG
Works the same as
TERMS_ETAG
, just for the privacy policy.
17.16.2.3. DONAU RSA CRYPTO HELPER OPTIONS#
The following options must be in the section “[donau-secmod-rsa]”.
- LOOKAHEAD_SIGN
How long do we generate denomination and signing keys ahead of time?
- OVERLAP_DURATION
Must be set to zero.
- SM_PRIV_KEY
Where should the security module store its long-term private key?
- KEY_DIR
Where should the security module store the private keys it manages?
- UNIXPATH
On which path should the security module listen for signing requests?
Note that the donau-secmod-rsa also evaluates the [doco_*]
configuration sections described below.
17.16.2.4. DONAU CS CRYPTO HELPER OPTIONS#
The following options must be in the section “[donau-secmod-cs]”.
- LOOKAHEAD_SIGN
How long do we generate denomination and signing keys ahead of time?
- OVERLAP_DURATION
Must be set to zero.
- SM_PRIV_KEY
Where should the security module store its long-term private key?
- KEY_DIR
Where should the security module store the private keys it manages?
- UNIXPATH
On which path should the security module listen for signing requests?
Note that the donau-secmod-cs also evaluates the [doco_*]
configuration sections described below.
17.16.2.5. DONAU EDDSA CRYPTO HELPER OPTIONS#
The following options must be in the section “[donau-secmod-eddsa]”.
- LOOKAHEAD_SIGN
How long do we generate denomination and signing keys ahead of time?
- OVERLAP_DURATION
How much should validity periods for coins overlap? Should be long enough to avoid problems with wallets picking one key and then due to network latency another key being valid. The
DURATION_WITHDRAW
period must be longer than this value.- DURATION
For how long should EdDSA keys be valid for signing?
- SM_PRIV_KEY
Where should the security module store its long-term private key?
- KEY_DIR
Where should the security module store the private keys it manages?
- UNIXPATH
On which path should the security module listen for signing requests?
17.16.2.6. DONAU POSTGRES BACKEND DATABASE OPTIONS#
The following options must be in section “[donaudb-postgres]” if the “postgres” plugin was selected for the database.
- CONFIG
How to access the database, e.g. “postgres:///donau” to use the “donau” database. Testcases use “donaucheck”.
17.16.2.7. EXCHANGE COIN OPTIONS#
The following options must be in sections starting with "[coin_]"
and are
largely used by taler-exchange-httpd to determine the meta data for the
denomination keys. Some of the options are used by the
taler-exchange-secmod-rsa to determine which RSA keys to create (and of
what key length). Note that the section names must match, so this part of the
configuration MUST be shared between the RSA helper and the exchange.
Configuration values MUST NOT be changed in a running setup. Instead, if
parameters for a denomination type are to change, a fresh section name should
be introduced (and the existing section should be deleted).
- VALUE
Value of the coin, e.g. “EUR:1.50” for 1 Euro and 50 Cents (per coin).
- DURATION_WITHDRAW
How long should the same key be used for clients to withdraw coins of this value?
- DURATION_SPEND
How long do clients have to spend these coins?
- DURATION_LEGAL
How long does the exchange have to keep records for this denomination?
- FEE_WITHDRAW
What fee is charged for withdrawal?
- FEE_DEPOSIT
What fee is charged for depositing?
- FEE_REFRESH
What fee is charged for refreshing?
- FEE_REFUND
What fee is charged for refunds? When a coin is refunded, the deposit fee is returned. Instead, the refund fee is charged to the customer.
- CIPHER
What cryptosystem should be used? Must be set to either “CS” or “RSA”. The respective crypto-helper will then generate the keys for this denomination.
- RSA_KEYSIZE
What is the RSA keysize modulos (in bits)? Only used if “CIPHER=RSA”.
- AGE_RESTRICTED
Setting this option to
YES
marks the denomination as age restricted (default isNO
). For this option to be accepted the extension for age restriction MUST be enabled.
17.16.2.8. DONAU DONATION CONFIRMATION UNIT OPTIONS#
The following options must be in sections starting with "[doco_]"
and are
largely used by donau-httpd to determine the meta data for the donation
units. Some of the options are used by the donau-secmod-rsa to determine
which RSA keys to create (and of what key length). Note that the section
names must match, so this part of the configuration MUST be shared between the
RSA helper and the Donau. Configuration values MUST NOT be changed in a
running setup. Instead, if parameters for a denomination type are to change, a
fresh section name should be introduced (and the existing section should be
deleted).
- VALUE
Value of the coin, e.g. “EUR:1.50” for 1 Euro and 50 Cents (per donation unit receipt).
- DURATION_WITHDRAW
How long should the same key be used for clients to withdraw coins of this value? Must be set to 1 year.
- DURATION_SPEND
How long do clients have to turn in the donation receipts. Should be set to a multiple of years.
- DURATION_LEGAL
How long does the Donau have to keep records for this denomination? Should be set to a multiple of years.
- CIPHER
What cryptosystem should be used? Must be set to either “CS” or “RSA”. The respective crypto-helper will then generate the keys for this denomination.
- RSA_KEYSIZE
What is the RSA keysize modulos (in bits)? Only used if “CIPHER=RSA”.
17.16.3. SEE ALSO#
donau-dbinit(1), donau-httpd(1)
17.16.4. BUGS#
Report bugs by using https://bugs.taler.net/ or by sending electronic mail to <taler@gnu.org>.