[server]
# Use the VPS WireGuard address in production. Never use 0.0.0.0.
listen = "10.10.0.1:9105"

[auth]
mode = "token"
token_file = "/etc/vps-agent/credentials/control-plane.token"

[limits]
max_concurrent_requests = 32
request_timeout_seconds = 5
max_body_bytes = 65536
read_requests_per_second = 10.0
write_requests_per_second = 2.0
burst = 20.0
command_timeout_seconds = 4

[services]
allowed = ["nginx", "fail2ban", "wg-quick@wg0"]

[firewall]
management_enabled = false
rollback_timeout_seconds = 60
max_snapshots = 5

[logging]
level = "info"

[telemetry]
connections_enabled = true
process_info_enabled = true

[logs]
# Requires read access to journald. Keep units narrowly allow-listed.
enabled = false
allowed_units = ["vps-agent.service", "nginx.service"]
max_entries_per_request = 200
max_message_bytes = 16384

[tls]
enabled = false
certificate_file = ""
private_key_file = ""