# Configuration for nginx-ech-publish.
#
# After every successful key rotation, nginx-ech-rotate.service runs
# nginx-ech-publish to republish the new ECHConfigList in the HTTPS DNS
# record. Without that, the record goes stale on the first rotation: clients
# still connect (they self-heal from the returned retry-config) but no first
# visit ever gets ECH on the first handshake.
#
# With no provider set, nginx-ech-publish exits without doing anything.

# Which DNS provider script to run, by name. Providers are drop-in
# executables under the nginx-ech-publish libexec directory, so more can be
# added without touching the dispatcher. Shipped providers: cloudflare
#
# ECH_PUBLISH_PROVIDER="cloudflare"
ECH_PUBLISH_PROVIDER=""

# Provider zone identifier. For Cloudflare this is the Zone ID shown on the
# domain's overview page.
ECH_ZONE_ID=""

# FQDN of the HTTPS record to publish, i.e. the ECH-enabled ("inner") name
# clients actually visit - not the ECH_PUBLIC_NAME cover name.
ECH_RECORD_NAME=""

# The alpn= SvcParam advertised alongside ech=.
ECH_ALPN="h3,h2"

# Record TTL in seconds. Keep it comfortably below the rotation interval and
# note ECH_RETAIN in /etc/default/nginx-ech-rotate keeps older keys loaded,
# so cached records keep decrypting while this TTL runs out.
ECH_TTL=300

# Provider credentials file. The cloudflare provider reads certbot's
# dns-cloudflare ini format (dns_cloudflare_email / dns_cloudflare_api_key),
# so an existing certbot credential file is reused rather than copied.
ECH_PUBLISH_CREDENTIALS=/root/.cloudflare.ini
