# Will secure login cookies with `Secure` context, enable HTTS and HTTP->HTTPS redirect
requireHttps = false

# Key (all waltid-crypto supported) to sign login token - has to be key allowing signing (private key)
signingKey = {"type": "jwk", "jwk": {"kty": "OKP", "d": "z8Lk85rAtfv2RJN_cD_-9nqHHwKTlTQ5_I53LcsHjC4", "use": "sig", "crv": "Ed25519", "x": "Ew76rQJ9gPHCOBOwJlf__Il5IjgSAc3bQ_a8psd-F3E", "alg": "EdDSA"}}

# Key (all waltid-crypto supported) to verify incoming login tokens - public key is ok.
verificationKey = {"type": "jwk", "jwk": {"kty": "OKP", "d": "z8Lk85rAtfv2RJN_cD_-9nqHHwKTlTQ5_I53LcsHjC4", "use": "sig", "crv": "Ed25519", "x": "Ew76rQJ9gPHCOBOwJlf__Il5IjgSAc3bQ_a8psd-F3E", "alg": "EdDSA"}}

# Provide pepper to use for additional password salting (unique string for your deployment,
# has to be shared between instances).
pepper = "waltid"

# Hash algorithm to use for passwords for signing.
# You can choose from algorithms like: ARGON2, PBKDF2, PBKDF2_COMPRESSED, BCRYPT, SCRYPT, BALLON_HASHING, MESSAGE_DIGEST, NONE
hashAlgorithm = ARGON2

# Configure the Auth Flow (refer to: waltid-ktor-authnz)
authFlow = {
    method: web3
    expiration: "7d" # optional: Set expiration time for login tokens, e.g. a week
    ok: true # Auth flow ends successfuly with this step
}

cookieDomain = null

# If you previously used other (older) password hash algorithms, you
# can use this function to migrate old hashes to new hash algorithms. This
# works at login-time: When a user logs in with a password that uses a hash algorithm
# on this list, the password will be re-hashed in the specified replacement algorithm.
# If null is used as hash algorithm selector, all algorithms expect for the target
# algorithm will be converted automatically.
hashMigrations = {
    MESSAGE_DIGEST: ARGON2 # E.g.: Convert all the MD5 hashes to Argon2 hashes
}
