# ADN DMR Peer Server - example configuration (YAML at project root)
# Copy to adn-server.yaml and set real secrets there (never commit adn-server.yaml).

GLOBAL:
  PING_TIME: 10
  MAX_MISSED: 3
  USE_ACL: true
  REG_ACL: PERMIT:ALL
  SUB_ACL: DENY:1
  TGID_TS1_ACL: PERMIT:ALL
  TGID_TS2_ACL: PERMIT:ALL
  GEN_STAT_BRIDGES: true
  SERVER_ID: 73010
  VALIDATE_SERVER_IDS: true
  URL_SECURITY: "<set-in-adn-server.yaml>"
  PORT_SECURITY: "<set-in-adn-server.yaml>"
  PASS_SECURITY: "<set-in-adn-server.yaml>"
  USERS_PASS: user_passwords.json
  HASH_ENCRYPT: encryption_key.secret
  # Talker Alias (HBP DMRA): see docs/en/server/user-guide/talker-alias.md
  TALKER_ALIAS: false
  TALKER_ALIAS_MODE: both
  TALKER_ALIAS_FORMAT: "{callsign} {fname}"
  # utf8 (Motorola), iso8 (Hytera), 7bit; both vendors by default
  TALKER_ALIAS_TEXT_FORMAT: "utf8,iso8"

REPORTS:
  REPORT: true
  REPORT_INTERVAL: 60
  REPORT_PORT: 4321
  REPORT_CLIENTS: "127.0.0.1"
  # Optional MQTT (disabled unless explicitly enabled).
  # MQTT:
  #   ENABLED: true
  #   URL: mqtt://127.0.0.1:1883
  #   # Auth: USERNAME/PASSWORD here, or mqtt://user:pass@host:1883 in URL (YAML overrides URL).
  #   USERNAME: "<set-in-adn-server.yaml>"
  #   PASSWORD: "<set-in-adn-server.yaml>"
  #   # TLS (mqtts://): optional CA bundle for broker verification
  #   CAFILE: ""
  #   TOPIC_PREFIX: adn/73010
  #   QOS: 0
  #   Wire: state (retained), voice_event (live)

LOGGER:
  # ENABLED: false   # omit or true = normal; false = no console/file logs (NullHandler)
  LOG_FILE: /var/log/adn-server/adn-server.log
  LOG_HANDLERS: file-timed
  LOG_LEVEL: INFO
  LOG_NAME: adn-server

ALIASES:
  TRY_DOWNLOAD: true
  PATH: ./
  PEER_FILE: peer_ids.json
  SUBSCRIBER_FILE: subscriber_ids.json
  TGID_FILE: talkgroup_ids.json
  PEER_URL: https://servers.adn.systems/peer_ids.json
  SUBSCRIBER_URL: https://servers.adn.systems/subscriber_ids.json
  TGID_URL: https://servers.adn.systems/talkgroup_ids.json
  LOCAL_SUBSCRIBER_FILE: local_subcriber_ids.json
  STALE_DAYS: 1
  SUB_MAP_FILE: ""
  SERVER_ID_URL: https://servers.adn.systems/server_ids.tsv
  SERVER_ID_FILE: server_ids.tsv
  CHECKSUM_URL: https://servers.adn.systems/file_checksums.json
  CHECKSUM_FILE: file_checksums.json
  KEYS_FILE: keys.json

# Integrated hotspot proxy (always enabled). Hotspots use PROXY.LISTEN_PORT only.
PROXY:
  LISTEN_PORT: 62031
  LISTEN_IP: ""
  TARGET_SYSTEM: SYSTEM
  TIMEOUT: 30
  DEBUG: false
  CLIENT_INFO: true
  BLACK_LIST: []
  IP_BLACK_LIST: {}

# MariaDB (required): dynamic TG persistence + optional self-service (Clients table).
DATABASE:
  DB_SERVER: localhost
  DB_USERNAME: hbmon
  DB_PASSWORD: "<set-in-adn-server.yaml>"
  DB_NAME: hbmon
  DB_PORT: 3306

# Self-service: uses DATABASE for MariaDB; PBKDF2 must match adn-monitor.yaml.
SELF_SERVICE:
  USE_SELFSERVICE: true
  PBKDF2_SALT: "ADN"
  PBKDF2_ITERATIONS: 2000

# SYSTEM is inject-only (no PORT / GENERATOR on proxy target — use MAX_PEERS).
SYSTEMS:
  SYSTEM:
    MODE: MASTER
    ENABLED: true
    REPEAT: true
    MAX_PEERS: 102
    EXPORT_AMBE: false
    PASSPHRASE: "<set-in-adn-server.yaml>"
    GROUP_HANGTIME: 15
    USE_ACL: true
    REG_ACL: DENY:1
    SUB_ACL: DENY:1
    TGID_TS1_ACL: PERMIT:ALL
    TGID_TS2_ACL: PERMIT:ALL
    DEFAULT_UA_TIMER: 60
    SINGLE_MODE: false
    VOICE_IDENT: false
    TS1_STATIC: ""
    TS2_STATIC: ""
    DEFAULT_REFLECTOR: 0
    ANNOUNCEMENT_LANGUAGE: es_ES
    ALLOW_UNREG_ID: false
    PROXY_CONTROL: false
    OVERRIDE_IDENT_TG: ""

  D-APRS:
    MODE: MASTER
    ENABLED: true
    REPEAT: false
    MAX_PEERS: 2
    EXPORT_AMBE: false
    IP: ""
    PORT: 52555
    PASSPHRASE: "<set-in-adn-server.yaml>"
    GROUP_HANGTIME: 0
    USE_ACL: true
    REG_ACL: DENY:1
    SUB_ACL: DENY:1
    TGID_TS1_ACL: PERMIT:ALL
    TGID_TS2_ACL: PERMIT:ALL
    DEFAULT_UA_TIMER: 10
    SINGLE_MODE: false
    VOICE_IDENT: false
    TS1_STATIC: ""
    TS2_STATIC: ""
    DEFAULT_REFLECTOR: 0
    ANNOUNCEMENT_LANGUAGE: es_ES
    GENERATOR: 2
    ALLOW_UNREG_ID: true
    PROXY_CONTROL: false
    OVERRIDE_IDENT_TG: ""

  ECHO:
    MODE: MASTER
    ENABLED: true
    REPEAT: true
    MAX_PEERS: 1
    EXPORT_AMBE: false
    IP: 127.0.0.1
    PORT: 54917
    PASSPHRASE: "<set-in-adn-server.yaml>"
    GROUP_HANGTIME: 5
    USE_ACL: true
    REG_ACL: DENY:1
    SUB_ACL: DENY:1
    TGID_TS1_ACL: DENY:ALL
    TGID_TS2_ACL: PERMIT:9990
    DEFAULT_UA_TIMER: 1
    SINGLE_MODE: true
    VOICE_IDENT: false
    TS1_STATIC: ""
    TS2_STATIC: "9990"
    DEFAULT_REFLECTOR: 0
    ANNOUNCEMENT_LANGUAGE: en_GB
    GENERATOR: 0
    ALLOW_UNREG_ID: true
    PROXY_CONTROL: false
    OVERRIDE_IDENT_TG: ""

  # OpenBridge: use DMRE embedded version 5 ("OpenBridge v5") + ENHANCED_OBP on all ADN Systems peers.
  OBP-TEST:
    MODE: OPENBRIDGE
    ENABLED: false
    IP: ""
    PORT: 62044
    NETWORK_ID: 1
    PASSPHRASE: "<set-in-adn-server.yaml>"
    TARGET_IP: ""
    TARGET_PORT: 62044
    USE_ACL: true
    SUB_ACL: DENY:1
    TGID_ACL: DENY:0-82,92-199,800-899,9990-9999,730999
    RELAX_CHECKS: true
    ENHANCED_OBP: true   # BCSQ/BCKA + loop control — recommended true for ADN mesh
    PROTO_VER: 5         # DMRE v5 (89-byte BLAKE2b); match remote peer