# ============================================================
# hash-relay client — remote install template
# ============================================================
# Placeholders {{...}} are replaced by install-client.sh.
# After install, edit /etc/hash-relay/client.toml as needed.
#
# Environment overrides (install-client.sh):
#   SERVER_ADDR, TCP_PORT, QUIC_PORT, CLIENT_ID, TOKEN
#   RUST_LOG — log level (overrides [log].level when set)

# ------------------------------------------------------------
# Logging
# ------------------------------------------------------------
[log]
# Enable file logging (false = console only)
file_enabled = true
# Log directory (absolute path recommended for systemd/procd installs)
log_dir = "/var/log/hash-relay"
# Log file name prefix (e.g. hr-client.2026-02-16.log)
log_name = "hr-client"
# Rotation: "daily" | "hourly" | "never"
rotation = "daily"
# Max rotated log files to keep
max_log_files = 30
# Level: trace | debug | info | warn | error | off
level = "info"
# Timezone offset (optional). Auto-detects system TZ when omitted.
# Recommended on OpenWrt and systems without tzdata, e.g. "+8", "-5", "+05:30"
# timezone = "+8"

[client]
# Relay server hostname or IP
server_addr = "{{SERVER_ADDR}}"
# TCP port (must match server.toml [server].tcp_port)
tcp_port = {{TCP_PORT}}
# QUIC port (must match server.toml [server].quic_port)
quic_port = {{QUIC_PORT}}
# Client identifier for logs and server-side recognition
client_id = "{{CLIENT_ID}}"
# Access token (managed in server client_nodes table / admin API)
token = "{{TOKEN}}"

# ------------------------------------------------------------
# Encryption
# ------------------------------------------------------------
[client.enc]
# Application-layer frame encryption (must match server):
#   0 = off, 1 = AES-GCM, 2 = ChaCha20
frame_encrypt_alg = 0

# TLS verification: insecure = true skips cert validation (testing only)
insecure = true

# For self-signed server certs: copy pin_sha256 from server startup logs
# to improve security beyond insecure = true
# pin_sha256 = "48399C1C3414D07199FAB3CC6F18A8CCF47DBC743776C2360EF138A98A40738E"

# ------------------------------------------------------------
# Connection management
# ------------------------------------------------------------
[client.connection]
# Reconnect interval after disconnect (seconds)
reconnect_interval = 5
# Max reconnect attempts (0 = unlimited)
max_reconnect_attempts = 0
# Heartbeat interval (seconds); keep in sync with server
heartbeat_interval = 60
# Treat as disconnected after this many unanswered heartbeats
heartbeat_timeout_count = 3

# ------------------------------------------------------------
# Local listeners & transport (informational)
# ------------------------------------------------------------
# Local listen ports and transport protocols are NOT configured here.
# After connecting and handshaking, the server pushes port mappings via
# ConfigSync. The client opens local listeners dynamically.
#
# Transport is determined by each mapping's protocol field:
#   - All mappings "tcp"  → TCP tunnel only
#   - All mappings "quic" → QUIC tunnel only
#   - Mixed               → both TCP and QUIC
#
# Example: server pushes listen_port=3333 → pool_host=stratum.pool.com:3333
# Client listens on 0.0.0.0:3333; miners connect to that port.

# ------------------------------------------------------------
# Hardware telemetry (asic-rs miner management API polling)
# ------------------------------------------------------------
# Periodically polls miner admin APIs for relay-connected miners; reports stats to server.
[client.telemetry]
# Master switch
enabled = true
# Polling interval (seconds)
collect_interval_secs = 300

# ------------------------------------------------------------
# Miner admin panel reverse-proxy (Admin Proxy)
# ------------------------------------------------------------
# When the server opens a proxy tunnel, this client dials the miner's web admin
# port on the LAN and relays HTTP/WebSocket bytes over the control channel.
# The server never talks to the miner directly; only this client does.
[client.admin_proxy]
# Master switch; when false, AdminProxyOpen is rejected with an error ack
enabled = true
# Max simultaneous proxy sessions on this client (miner TCP connections held open)
max_sessions = 10
# Close a proxy session after this many seconds without payload in either direction
idle_timeout_secs = 600