# Example config file for dingo
# No settings are required. Uncomment a setting only to override its in-code
# default.
#
# Keep a local copy that holds credentials (token registry headers, API keys)
# outside the repository, or name it dingo.yaml, which git ignores. Key files
# (*.skey, *.key, *.pem), .env and credentials.json are ignored too. Production
# key paths are never embedded in the binary; set them with shelleyVrfKey,
# shelleyKesKey and shelleyOperationalCertificate.

# Public bind address for the Dingo server
# CLI: --bind-addr
# bindAddr: "0.0.0.0"

# Path to the Cardano node configuration file
#
# Can be overridden with the config environment variable
# CLI: --cardano-config
# cardanoConfig: "./config/cardano/preview/config.json"

# Longest a node-to-client LocalStateQuery session may hold one acquired
# ledger snapshot. A snapshot past this age is closed, and the session's next
# query reopens one at the same block. If that block was rolled back, or has
# fallen behind a retention floor, while the snapshot was closed, the query
# fails and the client's connection is closed. Each held snapshot pins a
# database read transaction.
# Default: "5m"
# CLI: --local-state-query-view-max-lifetime
# Env: DINGO_LOCAL_STATE_QUERY_VIEW_MAX_LIFETIME
# localStateQueryViewMaxLifetime: "5m"

# Global data directory for both blob and metadata storage plugins.
# Can be overridden with CARDANO_DATABASE_PATH or --data-dir.
# databasePath: ".dingo"

# Compiled-in plugin selection and provider configuration.
# plugins:
  # storage:
    # blob:
      # provider: "badger"
      # config:
        # Optional Badger data directory. When unset, databasePath applies.
        # dataDir: ".dingo"
    # metadata:
      # provider: "sqlite"
      # config:
        # Optional SQLite data directory. When unset, databasePath applies.
        # dataDir: ".dingo"
        # Space reclaim is disabled by default. If auto_vacuum is not already
        # INCREMENTAL, its first run converts the database with one full
        # VACUUM, which pauses SQLite writers for the whole rewrite; later
        # runs release free pages in short steps.
        # vacuumIntervalSeconds: 86400
    # PostgreSQL metadata alternative (replace the metadata block above):
    # metadata:
    #   provider: "postgres"
    #   config:
    #     host: "localhost"
    #     port: 5432
    #     user: "postgres"
    #     database: "postgres"
    #     sslMode: "require"
    #     timeZone: "UTC"
    #     # Both bound a single statement/lock wait server-side; zero (the
    #     # default) leaves Postgres's own default -- no limit -- in
    #     # effect. Values are milliseconds, matching Postgres's own GUC
    #     # units. The mysql provider has the same two fields plus
    #     # readTimeout/writeTimeout, but lockTimeout there is whole
    #     # seconds (innodb_lock_wait_timeout's native unit) -- see
    #     # DATABASE.md.
    #     statementTimeout: "30s"
    #     lockTimeout: "10s"
  # mempool:
    # "fifo" preserves successful-admission order. "dag" additionally indexes
    # transaction dependencies and uses deterministic topological ordering.
    # "default" remains a compatibility alias for "fifo".
    # provider: "fifo"
    # config:
      # Mempool capacity in bytes. A pending transaction counts its CBOR plus
      # the CBOR of the decoded outputs the pool keeps for it. Left commented
      # out so the run-mode default
      # applies: 1048576 (1 MiB) for standard modes, 26214400 (25 MiB) for the
      # leios run mode. An explicit value here overrides both defaults, so a
      # leios node would silently run with the smaller capacity — uncomment
      # only to pin a specific size for every run mode.
      # capacity: 1048576
      # FIFO begins oldest-first eviction here. DAG never evicts and applies
      # TxSubmission backpressure as it approaches rejectionWatermark.
      # evictionWatermark: 0
      # rejectionWatermark: 1.0
  # api:
    # blockfrost:
      # provider: "builtin"
      # config:
        # port: 3000
        # Per-provider override of the shared api.tls default below
        # (uncomment to use). Any field left unset here inherits the
        # corresponding api.tls field; mode: disabled explicitly keeps this
        # provider plaintext.
        # tls:
        #   mode: server
        #   certFilePath: "/run/secrets/blockfrost.crt"
        #   keyFilePath: "/run/secrets/blockfrost.key"
    # kupo:
      # provider: "builtin"
      # config:
        # port: 1442
    # mesh:
      # provider: "builtin"
      # config:
        # port: 8080
    # utxorpc:
      # provider: "builtin"
      # config:
        # port: 9090
    # mcp:
      # Built-in Model Context Protocol (MCP) server for AI agent integration.
      # SQL tools require plugins.storage.metadata.provider: "sqlite".
      # Port 0 skips MCP startup; set 8088 to enable it on loopback.
      # MCP is opt-in because authentication is unset by default.
      # provider: "builtin"
      # config:
        # port: 0

# Shared optional TLS default for every selected plugins.api.* provider
# (Blockfrost, Kupo, Mesh, UTxO RPC, MCP). Each field resolves independently:
# plugins.api.<name>.config.tls overrides a field for that provider only
# (see the commented example above). Leaving this section out keeps the API
# listeners plaintext. Blockfrost, Kupo, Mesh, and UTxO RPC use the root bindAddr,
# whose default is 0.0.0.0. MCP defaults to its own host: 127.0.0.1.
# CORS remains operator-chosen through corsAllowedOrigins; MCP ignores "*".
#
# api:
#   tls:
#     # "disabled" (default) or "server".
#     mode: server
#     certFilePath: "/run/secrets/api.crt"
#     keyFilePath: "/run/secrets/api.key"
# Path to the UNIX domain socket file used by the server
# CLI: --socket-path
# socketPath: "dingo.socket"

# Name of the Cardano network
# CLI: --network
# network: "preview"

# Logging output configuration
# format: "text" (default, human-readable) or "json" (machine-parseable,
#         for ELK/Loki ingestion)
# level:  "debug", "info" (default), "warn", or "error".
#         The --debug flag overrides this to "debug".
# Env: DINGO_LOGGING_FORMAT, DINGO_LOGGING_LEVEL
# logging:
  # format: text
  # level: info

# TLS certificate file path. Also used by Bark (bark/) when barkPort is set.
#
# For the built-in UTxO RPC listener specifically, this is a compatibility
# default equivalent to setting plugins.api.utxorpc.config.tls (mode: server,
# this certFilePath/keyFilePath) -- it is not promoted to Blockfrost or Mesh,
# since doing so would silently switch a previously plaintext listener to
# TLS on upgrade. To secure Blockfrost and/or Mesh (or to override UTxO
# RPC's own certificate independently of this shared one), use the top-level
# api.tls section or each provider's own plugins.api.<name>.config.tls --
# see the "api:" section above and README.md's "API TLS". TLS is optional;
# a complete certificate/key pair is required only when TLS is enabled.
#
# Can be overridden with the TLS_CERT_FILE_PATH environment variable
# tlsCertFilePath: ""

# TLS private key file path, paired with tlsCertFilePath above.
#
# Can be overridden with the TLS_KEY_FILE_PATH environment variable
# tlsKeyFilePath: ""

# Path to the topology configuration file for Cardano node
# topology: ""

# TCP port to bind for Prometheus metrics endpoint. 0 disables the listener.
# CLI: --metrics-port
# metricsPort: 12798

# Address for the Prometheus listener. This is deliberately independent of
# bindAddr and stays on loopback by default. Set a wildcard or remote-reachable
# address only when scrapers need it; the environment variable takes precedence
# over this setting.
# CLI: --metrics-bind-addr  Env: DINGO_METRICS_BIND_ADDR
# metricsBindAddr: "127.0.0.1"

# Optional Bearer token required by the Prometheus listener. Prefer the
# environment variable so the token does not live in a shared config file.
# There is no CLI flag because arguments may be visible to other users.
# Remote traffic remains plain HTTP. Require a TLS reverse proxy or an
# authenticated encrypted tunnel to protect the token in transit; use network
# isolation as an additional access control.
# Env: DINGO_METRICS_AUTH_TOKEN
# metricsAuthToken: ""

# TCP port for the liveness/readiness probe listener. 0 disables it.
# Binds bindAddr, like the relay listener: a kubelet or
# load-balancer probe reaches the container from
# outside, so loopback would fail those closed.
#
#   GET /health, GET /healthz  -> liveness. 200 whenever the process is up
#     and serving, independent of sync state, unless the slot clock ticked
#     and then stayed silent for five minutes (a wedged event loop; a clock
#     paused behind the era-history horizon is not silent). This is
#     what the container HEALTHCHECK probes: an orchestrator answers an
#     unhealthy container by replacing it, and a node in initial sync is
#     legitimately not useful for hours without needing to be killed.
#   GET /readyz                -> readiness. 200 only once the chain tip is
#     within healthReadyGapSlots of the wall-clock slot and the database
#     answers; for a block producer also only while the forger is running and
#     its operational certificate is loaded and inside its KES window. 503
#     while syncing, bootstrapping, restoring, or when the tip has frozen. Use
#     it for a Kubernetes readinessProbe or a load-balancer target check,
#     where failing drains traffic instead of restarting the node.
#
# Kubernetes (healthPort 12799):
#   livenessProbe:  { httpGet: { path: /healthz, port: 12799 } }
#   readinessProbe: { httpGet: { path: /readyz,  port: 12799 } }
#
# Both bodies are JSON carrying the readiness verdict, a reason, and the
# observed tip gap.
# CLI: --health-port  Env: DINGO_HEALTH_PORT
# healthPort: 12799

# How far the chain tip may trail the wall-clock slot while /readyz still
# reports ready. Matches forgeStaleGapThresholdSlots: both answer "has this
# node stopped following the chain?", and a readiness probe that flapped
# more readily than the forger's own staleness gate would evict a node the
# forger still considers current. 0 takes the default.
# CLI: --health-ready-gap-slots  Env: DINGO_HEALTH_READY_GAP_SLOTS
# healthReadyGapSlots: 1000

# TCP port to bind for pprof debug endpoints (heap, profile, goroutine, etc).
# 0 disables. Operators opt in; never enable in production by default — debug
# endpoints expose internal state and run on a separate listener from metrics.
# CLI: --debug-port  Env: DINGO_DEBUG_PORT
# debugPort: 0

# Address for the unauthenticated pprof listener. This is deliberately
# independent of bindAddr and privateBindAddr and stays on loopback by default.
# Set a wildcard address only when an external network control protects it.
# CLI: --debug-bind-addr  Env: DINGO_DEBUG_BIND_ADDR
# debugBindAddr: "127.0.0.1"

# Enable OpenTelemetry tracing. Disabled by default: with no collector
# listening, the OTLP exporter logs noisy connection errors. When enabled,
# spans are sent via OTLP HTTP; configure the destination with the standard
# OTEL_EXPORTER_OTLP_* env vars documented for
# go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp.
# CLI: --tracing  Env: DINGO_TRACING_ENABLED
# tracing: false

# Export traces to stdout instead of OTLP. Requires tracing to also be
# enabled. Mostly useful for local debugging.
# CLI: --tracing-stdout  Env: DINGO_TRACING_STDOUT
# tracingStdout: false

# OTLP HTTP collector URL for spans, for example http://localhost:4318.
# Setting it enables tracing. Empty leaves tracing to the tracing setting and
# the destination to the OTEL_EXPORTER_OTLP_* env vars.
# CLI: --tracing-endpoint  Env: DINGO_TRACING_ENDPOINT
# tracingEndpoint: ""

# service.name resource attribute on exported spans.
# CLI: --tracing-service-name  Env: DINGO_TRACING_SERVICE_NAME
# tracingServiceName: dingo

# Fraction of new traces sampled, from 0 to 1.
# CLI: --tracing-sample-ratio  Env: DINGO_TRACING_SAMPLE_RATIO
# tracingSampleRatio: 1

# Internal/private address to bind for listening for Ouroboros NtC
# privateBindAddr: "127.0.0.1"

# TCP port to bind for listening for Ouroboros NtC
# CLI: --private-port
# privatePort: 3002

# TCP port to bind for listening for Ouroboros NtN
#
# Can be overridden with the port environment variable
# CLI: --port
# relayPort: 3001

# Storage mode controls how much data is persisted.
# - "core": Only consensus data (UTxOs, certs, pools, pparams). Suitable for
#   block producers and relay nodes. Only MCP can serve API requests in core mode.
# - "api": Core data plus full transaction metadata (witnesses, scripts, datums,
#   redeemers). APIs with nonzero configured ports start; MCP is opt-in.
#
# Storage mode also controls how long per-account reward history is kept: in
# "core" mode, per-account reward rows (reward_account_output) are pruned to
# the same trailing 4-epoch window as the rest of the reward-calculation
# snapshot state; in "api" mode they are retained for the life of the
# database so the Blockfrost account reward-history endpoint
# (GET /accounts/{stake_address}/rewards) can answer for any epoch, at the
# cost of unbounded growth in that table. See DATABASE.md's "Snapshot and
# Reward-State Retention" section for detail.
#
# Can be overridden with DINGO_STORAGE_MODE
# CLI: --storage-mode
# storageMode: "core"

# API ports are configured under plugins.api above. Set a port to 0 to
# disable that API. Other APIs remain inactive outside API storage mode; MCP supports both modes.

# Base URL of a remote Bark archive server. When set, this node keeps using
# its configured local blob plugin but wraps it with Bark archive fallback for
# expired or missing historical blocks.
# Can be overridden with DINGO_BARK_BASE_URL
# CLI: --bark-url
# barkBaseUrl: ""

# Allow Bark block downloads from private, loopback, and other special-use
# addresses, for example an S3-compatible store such as MinIO on a private
# network. Download origins must still be barkBaseUrl or a
# barkBlockDownloadHosts entry, use HTTPS, and pass the same checks on every
# redirect; ambient proxy settings stay ignored.
# Can be overridden with DINGO_BARK_BLOCK_DOWNLOAD_ALLOW_PRIVATE_ADDRESSES
# CLI: --bark-block-download-allow-private-addresses
# barkBlockDownloadAllowPrivateAddresses: false

# TCP port bind for listening for Bark RPC calls. Enable this on archive nodes.
# Can be overridden with DINGO_BARK_PORT
# CLI: --bark-port
# barkPort: 0

# Interface Bark binds to. Left empty (the default), Bark binds to all
# interfaces UNLESS the database lifecycle service or remote node lifecycle
# service is enabled, in which case it defaults to loopback-only (127.0.0.1)
# instead. Exposing either service's destructive RPCs beyond the local host is
# an explicit, deliberate choice an operator must opt into here. Bind address
# is a network control independent of
# barkClientCaFilePath below (the identity control) -- narrowing this is
# defense in depth, not a substitute for configuring a client CA.
# Can be overridden with DINGO_BARK_HOST
# CLI: --bark-host
# barkHost: ""

# PEM CA bundle Bark verifies client certificates (mTLS) against. Required
# whenever the database lifecycle service is enabled (barkPort set alongside
# databaseLifecycle.snapshotDir below): every DatabaseService RPC requires a
# certificate verified against this CA. ArchiveService remains public.
# Also required when barkLifecycleEnabled is true.
# Also requires tlsCertFilePath/tlsKeyFilePath above to be set. dingoctl's
# --client-cert/--client-key/--ca-cert flags are the client side of this.
# Can be overridden with DINGO_BARK_CLIENT_CA_FILE_PATH
# CLI: --bark-client-ca-file-path
# barkClientCaFilePath: ""

# Maximum ArchiveService FetchBlock requests Bark serves at once. ArchiveService
# takes no client credentials, so this and the per-request reference cap bound
# the storage work anyone who can reach the listener can cause; a request over
# the limit is refused rather than queued. 0 selects the default of 16.
# Can be overridden with DINGO_BARK_ARCHIVE_MAX_CONCURRENT_FETCHES
# CLI: --bark-archive-max-concurrent-fetches
# barkArchiveMaxConcurrentFetches: 0

# SHA-256 fingerprints of client certificate DER bytes authorized to invoke
# destructive DatabaseService RPCs (CreateSnapshot, DeleteSnapshot,
# VerifySnapshot, Restore, Truncate, CancelOperation). Hex is matched
# case-insensitively and may contain colons. At least one is required whenever
# the database lifecycle service is enabled; a CA-valid certificate not in this
# list may use read-only DatabaseService RPCs but receives PERMISSION_DENIED for
# destructive ones.
# Can be overridden with DINGO_BARK_OPERATOR_CERTIFICATE_FINGERPRINTS
# CLI: --bark-operator-certificate-fingerprints
# barkOperatorCertificateFingerprints: []

# Explicitly enable Bark's remote LifecycleService (Stop, Restart, GetStatus).
# Disabled by default and independent of the DatabaseService policy above.
# Requires barkPort, barkClientCaFilePath, tlsCertFilePath/tlsKeyFilePath, and
# barkLifecycleOperatorCertificateFingerprints.
# Can be overridden with DINGO_BARK_LIFECYCLE_ENABLED
# CLI: --bark-lifecycle-enabled
# barkLifecycleEnabled: false

# SHA-256 fingerprints of client certificate DER bytes authorized to invoke
# LifecycleService Stop and Restart. GetStatus requires a certificate verified
# against barkClientCaFilePath but does not require membership in this list.
# These credentials are intentionally separate from DatabaseService operators.
# Can be overridden with DINGO_BARK_LIFECYCLE_OPERATOR_CERTIFICATE_FINGERPRINTS
# CLI: --bark-lifecycle-operator-certificate-fingerprints
# barkLifecycleOperatorCertificateFingerprints: []

# Local immutable block history expiry. When enabled, Dingo replaces block CBOR
# older than the ledger-derived stability window with an expired-history marker
# while retaining local indexes and metadata. Bark fallback is optional.
# historyExpiry:
  # Can be overridden with DINGO_HISTORY_EXPIRY_ENABLED
  # CLI: --history-expiry-enabled
  # enabled: false
  # Can be overridden with DINGO_HISTORY_EXPIRY_FREQUENCY
  # CLI: --history-expiry-frequency
  # frequency: 1h

# Optional CIP-26 off-chain token registry sync (API storage mode only).
# When enabled, Dingo periodically pulls the community token registry and
# populates the `metadata` field of GET /api/v0/assets/{asset} with each
# token's name, ticker, decimals, description, and URL. Wallets can then show
# readable token names without a per-asset lookup against a remote metadata
# server -- which would reveal which assets the user holds. The sync is
# holdings-agnostic: every node pulls the same complete registry.
#
# Disabled by default because the mainnet registry is a roughly 240MB
# download. Subsequent syncs send a conditional request, so an unchanged
# registry costs no download at all.
# tokenRegistry:
  # Can be overridden with DINGO_TOKEN_REGISTRY_ENABLED
  # CLI: --token-registry-enabled
  # enabled: false
  # Registry tarball URL. Empty selects by network: the Cardano Foundation
  # registry for mainnet, the IOG testnet registry otherwise. Set this to
  # point at a mirror.
  # Can be overridden with DINGO_TOKEN_REGISTRY_SOURCE_URL
  # CLI: --token-registry-source-url
  # sourceUrl: ""
  # Signed manifest URL. Required when enabled. The manifest authenticates
  # the snapshot URL, exact compressed size, BLAKE2b-256 digest, and monotonic
  # sequence. HTTPS is required for the manifest, snapshot, and every redirect.
  # Can be overridden with DINGO_TOKEN_REGISTRY_MANIFEST_URL
  # CLI: --token-registry-manifest-url
  # manifestUrl: ""
  # Hex-encoded Ed25519 public key trusted to sign manifests. Required when
  # enabled. Key rotation is an explicit configuration change.
  # Can be overridden with DINGO_TOKEN_REGISTRY_TRUSTED_MANIFEST_KEY
  # CLI: --token-registry-trusted-manifest-key
  # trustedManifestKey: ""
  # How often the registry is re-checked. Each check is a conditional
  # request, so an unchanged registry costs no download. Values below one
  # minute are raised to it: polling a source that serves a roughly 240MB
  # artifact faster than that is abusive rather than useful.
  # Can be overridden with DINGO_TOKEN_REGISTRY_INTERVAL
  # CLI: --token-registry-interval
  # interval: 6h
  # Budget for the whole download, not one request round trip.
  # Can be overridden with DINGO_TOKEN_REGISTRY_REQUEST_TIMEOUT
  # CLI: --token-registry-request-timeout
  # requestTimeout: 15m
  # HTTP user agent sent with the registry request. Empty uses the default.
  # Can be overridden with DINGO_TOKEN_REGISTRY_USER_AGENT
  # CLI: --token-registry-user-agent
  # userAgent: ""
  # Extra HTTP headers sent with every registry request, for a mirror that
  # needs authentication. The values are credentials: they are redacted from
  # logged configuration, require HTTPS except on loopback, and are not sent
  # to another origin after a redirect.
  # There is no CLI flag, since arguments are visible in the process list.
  # Can be overridden with DINGO_TOKEN_REGISTRY_HEADER_SECRETS
  # (comma-separated name:value pairs, split at the first colon)
  # headerSecrets:
  #   Authorization: "Bearer <token>"
  # Cap on the compressed registry download. 0 uses the default (768MB).
  # Can be overridden with DINGO_TOKEN_REGISTRY_MAX_BYTES
  # CLI: --token-registry-max-bytes
  # maxBytes: 0
  # Cap on all decompressed tar content. 0 uses the default (2GB).
  # Can be overridden with DINGO_TOKEN_REGISTRY_MAX_DECOMPRESSED_BYTES
  # CLI: --token-registry-max-decompressed-bytes
  # maxDecompressedBytes: 0
  # Cap on a single registry mapping document. 0 uses the default (4MB).
  # Can be overridden with DINGO_TOKEN_REGISTRY_MAX_ENTRY_BYTES
  # CLI: --token-registry-max-entry-bytes
  # maxEntryBytes: 0
  # Cap on all tar entries, including non-mapping files. 0 uses the default
  # (100000).
  # Can be overridden with DINGO_TOKEN_REGISTRY_MAX_ARCHIVE_ENTRIES
  # CLI: --token-registry-max-archive-entries
  # maxArchiveEntries: 0
  # Cap on parsed mappings and database row-upsert work. 0 uses the default
  # (50000).
  # Can be overridden with DINGO_TOKEN_REGISTRY_MAX_ACCEPTED_ENTRIES
  # CLI: --token-registry-max-accepted-entries
  # maxAcceptedEntries: 0
  # Cap on retained mapping payload in each database batch. 0 uses the
  # default (64MB).
  # Can be overridden with DINGO_TOKEN_REGISTRY_MAX_BATCH_BYTES
  # CLI: --token-registry-max-batch-bytes
  # maxBatchBytes: 0
  # Persist base64 token logos. Logos are roughly 90% of registry bytes and
  # most consumers only need name/ticker/decimals, so this is off by default.
  # Can be overridden with DINGO_TOKEN_REGISTRY_STORE_LOGOS
  # CLI: --token-registry-store-logos
  # storeLogos: false
  # Allow syncing from private, loopback, and link-local addresses. Leave
  # false for the default SSRF guard; set true only for a local mirror.
  # Can be overridden with DINGO_TOKEN_REGISTRY_ALLOW_PRIVATE_ADDRESSES
  # CLI: --token-registry-allow-private-addresses
  # allowPrivateAddresses: false
  # Permit a valid signed manifest below the currently stored sequence.
  # Accepting it lowers the stored sequence. Leave false except for an
  # intentional publisher rollback.
  # Can be overridden with DINGO_TOKEN_REGISTRY_ALLOW_ROLLBACK
  # CLI: --token-registry-allow-rollback
  # allowRollback: false

# Optional in-process Koios reward-parity observer (dingo #3098). When
# enabled, Dingo subscribes an observer to its own epoch.transition EventBus
# event and validates each newly closed epoch's committed reward state
# directly against Koios reference data as the node advances -- no separate
# koios-parity CLI process or second synced copy of the database required.
# This is a one-off validation aid for preview/preprod, not a permanent
# subsystem; leave disabled for normal node operation. See
# internal/koiosparity and ARCHITECTURE.md's "Koios Parity Tracker" section.
# koiosParity:
  # Can be overridden with DINGO_KOIOS_PARITY_ENABLED
  # CLI: --koios-parity-enabled
  # enabled: false
  # Koios network to validate against: preview or preprod. Empty defaults to
  # this node's own `network` setting.
  # Can be overridden with DINGO_KOIOS_PARITY_NETWORK
  # CLI: --koios-parity-network
  # network: ""
  # Can be overridden with DINGO_KOIOS_PARITY_CACHE_PATH
  # CLI: --koios-parity-cache-path
  # cachePath: ""
  # Can be overridden with DINGO_KOIOS_PARITY_API_KEY
  # CLI: --koios-parity-api-key
  # apiKey: ""
  # Koios v1 API root override, for a self-hosted or mirrored instance.
  # Empty selects the public host for the network above. A custom host is not
  # subject to the public tier's burst cap, since that ceiling describes
  # koios.rest's own published tiers.
  # Can be overridden with DINGO_KOIOS_PARITY_BASE_URL
  # CLI: --koios-parity-base-url
  # baseUrl: ""
  # Allow a plain-HTTP baseUrl. The API key is attached as a Bearer token to
  # every request, so cleartext transport exposes it, and tampered reference
  # data can make a parity comparison report a false PASS. Local dev/test only.
  # Can be overridden with DINGO_KOIOS_PARITY_ALLOW_INSECURE_HTTP
  # CLI: --koios-parity-allow-insecure-http
  # allowInsecureHttp: false
  # Allow a private, loopback, or special-use baseUrl. Leave false for the
  # default outbound request guard; set true only for an intentionally local
  # or private self-hosted Koios deployment.
  # Can be overridden with DINGO_KOIOS_PARITY_ALLOW_PRIVATE_ADDRESSES
  # CLI: --koios-parity-allow-private-addresses
  # allowPrivateAddresses: false
  # Stop/cancel the node on the first Koios/tool error or non-pass parity
  # result instead of logging it and continuing normal operation. An epoch
  # whose only significant mismatches are reference_lag (Koios has not caught
  # up yet) is logged and recorded but never stops the node.
  # Can be overridden with DINGO_KOIOS_PARITY_STRICT
  # CLI: --koios-parity-strict
  # strict: true
  # Can be overridden with DINGO_KOIOS_PARITY_GRACE_HOURS
  # CLI: --koios-parity-grace-hours
  # graceHours: 24

# ---
# Deployment pattern examples (uncomment one block):
#
# Relay node (core storage, API ports ignored):
#   storageMode: "core"
#   blockProducer: false
#
# Data node (all APIs start on defaults automatically):
#   storageMode: "api"
#   # Override individual ports under plugins.api, or set a port to 0 to
#   # disable that API.
#   # With storageMode: "api", leave mode-sensitive Badger settings unset to keep:
#   #   blockCacheSize: 268435456
#   #   indexCacheSize: 0
#   #   compression: true
#
# Validator / block producer (core storage, API ports ignored):
#   storageMode: "core"
#   blockProducer: true
#   shelleyVrfKey: "/keys/vrf.skey"
#   shelleyKesKey: "/keys/kes.skey"
#   shelleyOperationalCertificate: "/keys/opcert.cert"
#   # With storageMode: "core", Badger blob defaults switch to mmap-only:
#   #   blockCacheSize: 0
#   #   indexCacheSize: 0
#   #   compression: false
#   # You can still override them under plugins.storage.blob.config.
#   # Optional forging tolerances (0 = defaults)
#   forgeSyncToleranceSlots: 0
#   forgeStaleGapThresholdSlots: 0
#
# Archive node (full immutable block history in object storage, Bark enabled):
#   storageMode: "core"
#   plugins:
#     storage:
#       blob:
#         provider: "s3" # or "gcs"
#         config:
#           bucket: "dingo-archive"
#           region: "us-east-1"
#           prefix: "preview"
#   barkPort: 9091
#
# History-expiry node (local blobs plus remote archive fallback):
#   storageMode: "core"
#   plugins:
#     storage:
#       blob:
#         provider: "badger"
#         config: {}
#   historyExpiry:
#     enabled: true
#     frequency: 1h
#   barkBaseUrl: "http://archive.example.internal:9091"
#
# Dev mode (isolated, forge blocks, no outbound):
#   runMode: "dev"
# ---

# Ignore prior chain history and start from current tip (default: false)
# This is experimental and may break — use with caution
# intersectTip: false

# Mempool capacity and watermarks are configured under plugins.mempool.

# Fraction of mempool capacity at which Dingo starts evicting older
# transactions to make room for new ones. 0 disables eviction.
# Default: 0 (disabled).
# CLI: --eviction-watermark  Env: DINGO_MEMPOOL_EVICTION_WATERMARK
# evictionWatermark: 0

# Fraction of mempool capacity at which Dingo rejects new transactions.
# Default: 1.0 (full configured admission capacity).
# CLI: --rejection-watermark  Env: DINGO_MEMPOOL_REJECTION_WATERMARK
# rejectionWatermark: 1.0

# Forging tolerances (0 = defaults)
# forgeSyncToleranceSlots controls how far the local chain can lag the upstream
# tip before forging is skipped. forgeStaleGapThresholdSlots controls when to
# log an error if the chain tip is far ahead of the slot clock.
# forgeSyncToleranceSlots: 0
# forgeStaleGapThresholdSlots: 0

# validateForgedBlock re-validates a locally-forged block (header crypto,
# body hash, per-tx ledger rules including Plutus phase-2 evaluation)
# before it is adopted and diffused, catching a bug that would otherwise
# forge and diffuse an invalid block. Enabled by default (fail closed).
# This re-validation runs synchronously inside the forging deadline with
# no separate time budget, so on a block producer with heavy Plutus
# traffic it adds real latency to every forged block; set to false only
# if that cost is unacceptable and the risk of forging an invalid block
# is understood and accepted.
# CLI: --validate-forged-block  Env: DINGO_VALIDATE_FORGED_BLOCK
# validateForgedBlock: true

# Application-wide operational mode for a bare dingo invocation:
# "serve" (default), "load", "dev", or "leios"
# - serve: Full node with network connectivity (default)
# - load: Batch import from ImmutableDB (requires immutableDbPath)
# - dev: Development mode (forge blocks, disable outbound, skip topology)
# - leios: Full node with experimental Leios/Dijkstra protocol support
# Explicit subcommands select their own effective operation; for example,
# "dingo sync" runs in sync mode. Node role, storage, API, and validation
# settings do not select a run mode.
#
# Can be overridden with the DINGO_RUN_MODE environment variable
# CLI: --run-mode
# runMode: "serve"

# Experimental startup era. Empty follows the genesis protocol version.
# Set to "dijkstra" only for Dijkstra/Leios test networks.
#
# Can be overridden with the DINGO_START_ERA environment variable
# CLI: --start-era
# startEra: ""

# Leios voting (experimental, leios runMode only)
#
# leiosVoteSigningKeyFile is the path to a Cardano text-envelope BLS12-381
# vote signing key generated by `cardano-cli dijkstra node key-gen-BLS`.
# Legacy raw hex 32-byte scalar files are also accepted; the file must not
# be group/other readable.
# When set on a block producer whose pool is a member of the epoch's
# stake-truncated voting committee, the node signs and emits one Leios
# vote per observed endorser block.
#
# The signing key must match the pool's proof-of-possession-verified on-chain
# registration. A pool without a usable on-chain key is keyless and cannot emit
# a vote or contribute verified stake to a certificate. Static voter-key
# overrides are intentionally unsupported in reference-compatible mode.
#
# Can be overridden with DINGO_LEIOS_VOTE_SIGNING_KEY_FILE.
# leiosVoteSigningKeyFile: "/keys/leios-vote.skey"

# Optional retention for persisted Leios endorser-block history used by
# leios-fetch to serve historical blocks after the in-memory cache expires.
# Zero or unset retains all history. Positive values must be at least the
# network stability window, ceil(3k/f) slots. A positive value keeps records from the
# highest persisted endorser-block slot back through this many slots; older
# manifests and transaction bodies are pruned at startup and hourly. This does
# not remove already-applied ledger state, but historical serving and a later
# rollback/replay that needs pruned data then depend on a connected peer.
# Hourly sweeps list manifests to find the highest persisted slot, then scan
# the shared Leios prefix for deletion candidates. Object stores pay both
# listing costs plus per-key delete requests.
# Can be overridden with DINGO_LEIOS_PERSISTENCE_RETENTION_SLOTS.
# leiosPersistenceRetentionSlots: 0

# Path to ImmutableDB for batch import (used when runMode is "load")
# Can also be provided as argument to 'dingo load' command
# An https:// value, or http:// on loopback for local development, names a
# remote ImmutableDB root serving NNNNN.chunk, NNNNN.primary, NNNNN.secondary
# and tip.json; chunks download into <databasePath>/immutable-download and load
# as they arrive in order. Non-loopback HTTP and private or special-use HTTPS
# destinations are rejected, including after redirects and DNS resolution.
#
# Can be overridden with the DINGO_IMMUTABLE_DB_PATH environment variable
# CLI: --immutable-db-path
# immutableDbPath: ""

# Validate historical blocks during ledger processing (default: true).
# Set false only when intentionally syncing from a non-genesis intersection
# whose source does not provide the complete historical state.
# validateHistorical: true

# Decode blocks in the chainsync replay loop with a small parallel worker
# pool instead of one at a time (default: false). Not consensus-affecting --
# only changes how CBOR decode work is scheduled, not validation or apply
# behavior. See ARCHITECTURE.md ("Block Processing Pipeline").
#
# Can be overridden with the DINGO_BLOCK_PIPELINE_ENABLED environment variable
# CLI: --block-pipeline-enabled
# blockPipelineEnabled: false

# Also validate VRF/KES and OpCert crypto during block-pipeline replay with a
# parallel worker pool (default: false). Requires blockPipelineEnabled.
# Admission-time crypto remains authoritative because persisted chain blocks
# are available to downstream readers before replay reaches this stage. The
# replay check follows the serial path's historical, Mithril, and epoch-nonce
# availability gates. See ARCHITECTURE.md ("Block Processing Pipeline").
#
# Can be overridden with the DINGO_BLOCK_PIPELINE_VALIDATE_ENABLED
# environment variable
# CLI: --block-pipeline-validate-enabled
# blockPipelineValidateEnabled: false

# Prefetch the next block's input UTxOs on a separate goroutine from a
# read-only transaction while the current block applies (default: false).
# Not consensus-affecting. Inputs spent by earlier blocks of the same
# block-apply chunk are never served from the prefetch, and any input it
# misses is read as without the flag.
#
# Can be overridden with the DINGO_LEDGER_PREFETCH_AHEAD_ENABLED
# environment variable
# CLI: --ledger-prefetch-ahead-enabled
# ledgerPrefetchAheadEnabled: false

# In core storage mode, write the accumulated deltas of blocks that are not
# validated with multi-row batched inserts instead of one statement group per
# row (default: false), as API storage mode already does. Validated blocks,
# Leios endorser-block applies, and batches applied with closure context keep
# the per-transaction path in every storage mode. Not
# consensus-affecting -- the stored state is identical either way. See
# ARCHITECTURE.md ("Block Processing Pipeline").
#
# Can be overridden with the DINGO_LEDGER_APPLY_ROW_BATCHING_ENABLED
# environment variable
# CLI: --ledger-apply-row-batching-enabled
# ledgerApplyRowBatchingEnabled: false

# While the header is far from the peer tip, start blockfetch once one
# blockfetch range (500) of headers is queued instead of waiting for four
# ranges (2000). The header queue capacity is unchanged (default: false). Not
# consensus-affecting.
#
# Can be overridden with the DINGO_BLOCKFETCH_LOW_WATERMARK_ENABLED
# environment variable
# CLI: --blockfetch-low-watermark-enabled
# blockfetchLowWatermarkEnabled: false

# Error out (instead of silently skipping) when a consumed UTxO cannot be
# found or recovered for a block past the recorded Mithril sync boundary.
# A non-genesis chainsync intersection without a Mithril snapshot may set this
# false when pre-intersect UTxOs are intentionally absent. (default: true)
#
# Can be overridden with the CARDANO_STRICT_UTXO_VALIDATION environment variable
# CLI: --strict-utxo-validation
# strictUtxoValidation: true

# Skip the startup consistency check between reward_live_stake and the live
# UTxO/account set (default: false, i.e. the check runs).
#
# The check scans the entire live UTxO table on every startup, whether or not
# anything actually needs repairing, so on a mainnet-scale database it costs
# as much as a full rebuild each time the node starts. Advanced/diagnostic use
# only: skipping is safe when the database is already known to be consistent,
# such as repeated restarts while investigating an unrelated issue. It is
# unsafe to leave enabled permanently, because this check is what catches a
# stale or pre-migration reward_live_stake table.
#
# This does not disable the stake-snapshot provenance check that runs in the
# same startup step. That one is a pair of indexed existence probes whose cost
# does not scale with the UTxO set, and it fails closed on a database whose
# consensus stake snapshots came from an older accounting version, so it
# always runs.
#
# Can be overridden with the CARDANO_SKIP_REWARD_LIVE_STAKE_BACKFILL_CHECK
# environment variable
# CLI: --skip-reward-live-stake-backfill-check
# skipRewardLiveStakeBackfillCheck: false

# Peer targets - target number of peers in each state
# Known, established, and active peer targets are goals, not hard limits.
# A positive root target limits newly selected public roots; local roots remain.
# Use 0 for default values, -1 for unlimited
# Default: known=150, established=50, active=20, root=60
#
# Target number of known (cold) peers
# CLI: --target-known-peers
# targetNumberOfKnownPeers: 0
# Target number of established (warm) peers
# CLI: --target-established-peers
# targetNumberOfEstablishedPeers: 0
# Target number of active (hot) peers
# CLI: --target-active-peers
# targetNumberOfActivePeers: 0
# Target number of root peers selected from topology
# CLI: --target-root-peers
# targetNumberOfRootPeers: 0

# Per-source quotas for active peers
# These specify how active peer slots are distributed by source.
# Use 0 for default values.
# Default: topology=3, gossip=12, ledger=5
#
# Active peer slots for topology sources (local + public roots)
# activePeersTopologyQuota: 0
# Active peer slots for gossip sources
# activePeersGossipQuota: 0
# Active peer slots for ledger sources
# activePeersLedgerQuota: 0

# Inbound peer governance budget (phase 1)
# These define explicit operator intent for inbound peers as a governed source.
# Current behavior remains conservative; these values are surfaced in metrics and
# quota/status output to make inbound policy visible.
#
# Target number of inbound peers to keep in warm state.
# CLI: --inbound-warm-target
# inboundWarmTarget: 0
# Quota for inbound peers in hot state.
# CLI: --inbound-hot-quota
# inboundHotQuota: 0
# Minimum tenure before inbound peers are eligible for hot promotion.
# CLI: --inbound-min-tenure
# inboundMinTenure: 0s
# Minimum score threshold for inbound hot promotion.
# CLI: --inbound-hot-score-threshold
# inboundHotScoreThreshold: 0
# Future prune grace window for inbound peers.
# CLI: --inbound-prune-after
# inboundPruneAfter: 0s
# Future duplex policy knob for inbound peers.
# CLI: --inbound-duplex-only-for-hot
# inboundDuplexOnlyForHot: false
# Future cooldown knob for inbound peer governance actions.
# CLI: --inbound-cooldown
# inboundCooldown: 0s

# Genesis bootstrap configuration
# Used only for from-origin sync. Default behavior keeps this enabled and
# exits Genesis mode automatically near the best known peer tip.
# genesisBootstrap:
  # Enable/disable Genesis bootstrap mode (default: true).
  # enabled: true
  # Override the Genesis comparison window in slots.
  # 0 auto-derives the window from genesis params (3k/f).
  # windowSlots: 0
  # Minimum diversity groups to prefer while promoting peers during bootstrap.
  # 0 uses the peer-governor default.
  # promotionMinDiversityGroups: 0
  # Independent peers that must report the same recent blocks before a fast
  # (shallow) block source may drive Genesis-mode chain selection. This is the
  # Ouroboros Genesis trust control for biased fast-sync sources such as the
  # Genesis Sync Accelerator: an uncorroborated or divergent fast source is
  # denied selection and stalls rather than steering the local chain. Pair it
  # with a trustable localRoots peer plus a ledger peer snapshot in the topology
  # file. 0 disables corroboration (density-only Genesis selection).
  # corroborationPeers: 0
  # Genesis Limit on Patience: while Genesis selection is active, disconnect a
  # ChainSync peer that delivers its advertised progress more slowly than
  # limitOnPatienceRate headers per second, beyond a limitOnPatienceCapacity
  # token allowance. Each header that raises the peer's block number earns one
  # token. 0 selects the defaults (1000 tokens, 5 per second).
  # limitOnPatienceEnabled: true
  # limitOnPatienceCapacity: 0
  # limitOnPatienceRate: 0

# Midnight indexer configuration
# Indexing requires BOTH enabled: true AND API storage mode; either alone is
# not enough. The gRPC server is a separate, explicit opt-in and also requires
# API storage mode. It can serve persisted Midnight rows without running the
# indexer. Plaintext and TLS are supported; use tlsCertFilePath/tlsKeyFilePath
# when TLS transport is desired.
# CLI: --midnight-enabled, --midnight-server-enabled,
#   --midnight-reflection-enabled,
#   --midnight-port, --midnight-host
# Env: DINGO_MIDNIGHT_ENABLED, DINGO_MIDNIGHT_SERVER_ENABLED,
#   DINGO_MIDNIGHT_REFLECTION_ENABLED,
#   DINGO_MIDNIGHT_PORT, DINGO_MIDNIGHT_HOST
# Midnight chain addresses and policy-ID/asset-name constants are YAML only.
# midnight:
  # Enable the Midnight indexer. Default: false.
  # enabled: false
  # Enable the Midnight gRPC server. Default: false.
  # serverEnabled: false
  # Expose gRPC service discovery. Requires serverEnabled. Default: false.
  # reflectionEnabled: false
  # gRPC listen port. Must be non-zero when serverEnabled is true.
  # port: 50051
  # gRPC listen address. Plaintext is supported.
  # host: "127.0.0.1"
  # Midnight network constants. Known network defaults are applied when
  # available; set these explicitly for custom networks or overrides.
  # cnightPolicyId: ""
  # cnightAssetName: ""
  # mappingValidatorAddress: ""
  # Auth token policy ID (28-byte / 56 hex char). When set, only tokens minted
  # under this exact policy are accepted as registration auth tokens.
  # authTokenPolicyId: ""
  # authTokenAssetName: ""
  # committeeCandidateAddress: ""
  # technicalCommitteeAddress: ""
  # technicalCommitteePolicyId: ""
  # councilAddress: ""
  # councilPolicyId: ""
  # permissionedCandidatePolicy: ""

# Cache configuration for tiered CBOR cache system
# This controls the in-memory caching of UTxO and transaction CBOR data
# cache:
  # Number of entries in the hot UTxO cache (LFU eviction)
  # Default: 50000
  # CLI: --cache-hot-utxo-entries
  # hotUtxoEntries: 50000
  # Number of entries in the hot transaction cache (LFU eviction)
  # Default: 10000
  # hotTxEntries: 10000
  # Maximum memory in bytes for hot transaction cache
  # Default: 268435456 (256 MB)
  # hotTxMaxBytes: 268435456
  # Number of blocks to keep in the block LRU cache
  # Default: 500
  # CLI: --cache-block-lru-entries
  # blockLruEntries: 500
  # Number of recent blocks to warm up on startup
  # Default: 1000
  # warmupBlocks: 1000
  # Wait for cache warmup to complete before serving requests
  # Default: true
  # CLI: --cache-warmup-sync
  # warmupSync: true

# Multi-client ChainSync (header synchronization) configuration
# chainsync:
  # Maximum number of concurrent ChainSync client connections
  # Default: 0 (automatic: at least 3, and one per local-root access point)
  # CLI: --chainsync-max-clients  Env: DINGO_CHAINSYNC_MAX_CLIENTS
  # maxClients: 0
  # Duration with no activity after which a ChainSync client is
  # considered stalled and eligible for failover/recycling
  # Default: "2m"
  # CLI: --chainsync-stall-timeout  Env: DINGO_CHAINSYNC_STALL_TIMEOUT
  # stallTimeout: "2m"
  # Header-sync strategy: how headers from multiple eligible peers drive
  # ledger ingress.
  # - "primary":     a single active peer drives ingress, failing over to
  #                  another eligible peer when it stalls or disconnects
  #                  (default; preserves prior behavior).
  # - "parallel":    every eligible peer may supply headers concurrently;
  #                  duplicates are deduplicated before ledger ingress so a
  #                  header never enters ledger processing twice.
  # - "round-robin": a single ingress-driving peer that rotates across the
  #                  eligible peers over time.
  # Default: "primary"
  # CLI: --chainsync-strategy  Env: DINGO_CHAINSYNC_STRATEGY
  # strategy: "primary"

# Mithril snapshot bootstrap configuration
# Use 'dingo mithril sync' or 'dingo sync --mithril' to bootstrap from a snapshot
# CLI: --mithril-enabled, --mithril-verify-certs
# mithril:
  # Enable Mithril integration (default: true)
  # enabled: true
  # Override aggregator URL (auto-detected from network if empty)
  # Supported networks: mainnet, preprod, preview
  # aggregatorUrl: ""
  # Allow the aggregator URL and snapshot artifact locations to use plain
  # HTTP instead of HTTPS. Default: false. This is an explicit escape
  # hatch for local development and tests against a plaintext aggregator;
  # do not enable it in production.
  # allowInsecureHttp: false
  # Mithril artifact backend: "v2" (default) restores from incremental
  # per-immutable-file archives verified against the certified merkle
  # root; "v1" uses the legacy full snapshot tarballs (being phased
  # out upstream)
  # CLI: --mithril-backend
  # backend: "v2"
  # Optional exact artifact identity for a fresh bootstrap: a v1 snapshot
  # digest or v2 Cardano database artifact hash. It is rejected for catch-up
  # runs and cannot override an interrupted import's durable pin.
  # CLI: --mithril-pinned-digest  Env: DINGO_MITHRIL_PINNED_DIGEST
  # pinnedDigest: ""
  # Directory for downloading snapshot archives
  # If empty, a randomized temporary directory is created automatically
  # downloadDir: ""
  # Maximum idle time waiting for snapshot headers or body bytes before retrying
  # Empty uses the built-in default. A negative duration disables idle detection.
  # CLI: --mithril-download-idle-timeout
  # downloadIdleTimeout: ""
  # Consecutive idle retries allowed without additional downloaded bytes
  # 0 uses the built-in default
  # CLI: --mithril-download-max-idle-retries
  # downloadMaxIdleRetries: 0
  # Compressed size limit in bytes for each downloaded Mithril object
  # 0 uses built-in limits sized per archive type. A positive value replaces
  # them for every object; raising it lowers immutable download concurrency.
  # CLI: --mithril-download-max-bytes  Env: DINGO_MITHRIL_DOWNLOAD_MAX_BYTES
  # downloadMaxBytes: 0
  # Remove temporary files after loading completes
  # Default: true
  # cleanupAfterLoad: true
  # Verify STM certificates back to the pinned Mithril genesis key from the
  # selected Cardano network config. Set false only for an unverified bootstrap.
  # Default: true
  # verifyCertificates: true
  # Snapshot production and serving: 'dingo mithril snapshot create --db-dir
  # <cardano-node db>' writes a Mithril snapshot artifact to artifactStore, and
  # 'dingo mithril serve' serves those artifacts on bindAddr and server.port.
  # Artifact reads are public. Aggregator registration and registration closure
  # require a bearer token; non-loopback aggregator binds require TLS.
  # A public origin is required by 'dingo mithril serve' and is embedded in
  # snapshot download locations. Use HTTPS except for an HTTP loopback origin.
  # server:
    # Port for 'dingo mithril serve' (default: 8081)
    # CLI: --mithril-server-port
    # port: 8081
    # Public HTTPS origin used in snapshot download locations. Plain HTTP is
    # accepted only for loopback. Forwarded headers are not used to build URLs.
    # CLI: --mithril-server-public-base-url
    # Env: DINGO_MITHRIL_SERVER_PUBLIC_BASE_URL
    # publicBaseUrl: "https://snapshots.example.org"
    # Where artifacts are kept and served from: a directory, or s3://bucket/prefix
    # or gcs://bucket/prefix (requires a build with dingo_extra_plugins)
    # CLI: --mithril-server-artifact-store
    # artifactStore: ""
    # Redirect archive requests to this base URL (plus the object key) instead of
    # streaming them; for a remote store whose objects are publicly readable
    # CLI: --mithril-server-redirect-base-url
    # redirectBaseUrl: ""
    # Newest snapshots kept after 'snapshot create' (0 keeps all)
    # CLI: --mithril-server-keep-snapshots
    # keepSnapshots: 0
    # Ed25519 key (Mithril JSON-hex format) signing the ancillary manifest
    # CLI: --mithril-server-ancillary-signing-key-file
    # ancillarySigningKeyFile: ""
    # Serve HTTPS with the shared tlsCertFilePath and tlsKeyFilePath (default: false)
    # CLI: --mithril-server-tls-enabled
    # tlsEnabled: false
    # Aggregator: certify stored snapshots from registered signers' signatures.
    # 'dingo mithril serve' mounts the registration and signature endpoints.
    # aggregator:
      # Mount the aggregator endpoints (default: false)
      # CLI: --mithril-aggregator-enabled
      # enabled: false
      # Epoch signers register for; the genesis certificate is issued at epoch-1
      # CLI: --mithril-aggregator-epoch
      # epoch: 0
      # STM parameters: quorum of lottery indices, lottery size, win probability
      # CLI: --mithril-aggregator-k, --mithril-aggregator-m, --mithril-aggregator-phi-f
      # k: 0
      # m: 0
      # phiF: 0
      # Ed25519 genesis signing key file (Mithril JSON-hex format)
      # CLI: --mithril-aggregator-genesis-signing-key-file
      # genesisSigningKeyFile: ""
      # File containing at least 32 random bytes for signer registration and
      # registration closure.
      # CLI: --mithril-aggregator-operator-token-file
      # operatorTokenFile: ""

# ---
# CIP-23 minimum pool margin / minimum variable fee (experimental, consensus-affecting)
#
# Sets a floor on the pool margin (variable fee): a pool's effective margin in
# the staking-reward split becomes max(pool.margin, minPoolMargin), and pool
# registration certificates below the floor are rejected. Reward-account
# registration and eligibility still apply: some or all of a pool allocation
# can return to reserves when omitted by the reward prefilter, or go to treasury
# when calculated for an account that cannot receive it. Expressed in basis
# points (150 = 1.5%), range 0..10000. This changes the ledger reward calculation
# and certificate validation, so it MUST only be enabled (nonzero) on a network
# where every node also enables the same value (a devnet or custom network).
# Enabling it off-consensus, e.g. on mainnet or the public testnets, will fork
# this node. It takes effect only in the Dijkstra era and later. Disabled by
# default.
#
# CLI: --min-pool-margin
# Env: DINGO_MIN_POOL_MARGIN
# minPoolMargin: 0        # basis points, 0..10000 (150 = 1.5%); 0 disables

# ---
# Experimental pre-Dijkstra CIP-50 override (consensus-affecting)
#
# Adds the leverage cap to the staking-reward formula: a pool's
# reward-eligible stake is capped at L times its pledge, so a zero-pledge pool
# earns nothing and an over-leveraged pool plateaus. This changes the ledger
# reward calculation, so it MUST only be enabled on a network where every node
# also enables it (a devnet or custom network). Enabling it off-consensus, e.g.
# on mainnet or the public testnets, will fork this node off the network. It is
# disabled by default. In Dijkstra, the enacted maxPledgeLeverage protocol
# parameter is authoritative and this setting is ignored.
#
# CLI: --pledge-leverage-enabled / --pledge-leverage
# Env: DINGO_PLEDGE_LEVERAGE_ENABLED / DINGO_PLEDGE_LEVERAGE
# pledgeLeverageEnabled: false
# pledgeLeverage: 100        # L; integer in [1, 10000]

# ---
# CIP-0163 full-pot reward distribution (experimental, consensus-affecting)
#
# Distributes the available reward pot (after the treasury tax) across pool
# totals instead of returning the saturation, pledge-influence, and performance
# residual to reserves. The per-pool base rewards are scaled up with the
# largest-remainder method so the pool totals sum to the available pot exactly;
# the treasury tax is still taken first, and account eligibility plus per-pool
# leader/member handling can still route some or all of a pool's allocation to
# treasury or reserves, so not every lovelace necessarily reaches a delegator.
# This changes the ledger reward calculation, so it can only be enabled without
# the unsafe override on a devnet or custom network where every node enables it.
# Enabling it off-consensus, e.g. on mainnet or the public testnets, will fork
# this node off the network. Standard networks require the explicit unsafe
# override below. It is disabled by default.
#
# CLI: --full-pot-rewards-enabled / --unsafe-full-pot-rewards-on-standard-networks
# Env: DINGO_FULL_POT_REWARDS_ENABLED / DINGO_UNSAFE_FULL_POT_REWARDS_ON_STANDARD_NETWORKS
# fullPotRewardsEnabled: false
# unsafeFullPotRewardsOnStandardNetworks: false

# ---
# CIP-0163 reward-account inactivity expiry (experimental, consensus-affecting)
#
# When enabled, a reward account that performs no witnessing action (reward
# withdrawal, (re)delegation to a pool or DRep, stake-key (de)registration) for
# delegatorInactivity epochs is treated as expired and ignored for pool leader
# election, reward crediting, and governance tallying until it witnesses again.
# This changes the ledger rules, so it MUST only be enabled on a network where
# every node also enables it (a devnet or custom network). Enabling it
# off-consensus, e.g. on mainnet or the public testnets, will fork this node off
# the network. It is disabled by default.
#
# Mithril bootstrap ('dingo mithril sync') is NOT supported with this enabled:
# reward-account expiration state is absent from Mithril ledger snapshots and
# cannot be reconstructed after import, so a CIP-0163 node must sync from
# genesis. The sync command and node startup both refuse the combination.
#
# CLI: --delegator-inactivity-enabled / --delegator-inactivity
# Env: DINGO_DELEGATOR_INACTIVITY_ENABLED / DINGO_DELEGATOR_INACTIVITY
# delegatorInactivityEnabled: false
# delegatorInactivity: 90        # epochs; integer in [1, 10000]

# ---
# Database lifecycle: automatic epoch-boundary snapshots, config for the
# `dingo database snapshot|restore|truncate` CLI commands, and — when
# bark is enabled (barkPort > 0) — the base directory bark's
# DatabaseService CreateSnapshot/Restore RPCs use.
# SQLite only: keep planner statistics current with PRAGMA optimize, run
# before block processing starts and after each epoch rollover. A database
# synced from genesis otherwise never has statistics and some queries scan most
# of a large table. The first run on a large database can take minutes; later
# runs are near-free. Escape hatch only.
# Default: true
# CLI: --planner-stats-refresh-enabled  Env: DINGO_PLANNER_STATS_REFRESH_ENABLED
# plannerStatsRefreshEnabled: true

# databaseLifecycle:
  # Capture automatic database snapshots at epoch boundaries. Unsupported
  # when the primary blob provider is s3 or gcs: their remote-object backup
  # walk can hold the commit barrier for an unbounded duration. Manual
  # `dingo database snapshot` remains available in that configuration.
  # Default: false
  # CLI: --db-snapshot-enabled
  # snapshotEnabled: false
  # Local filesystem directory automatic and bark-triggered snapshots are
  # written under (one subdirectory per snapshot). Required if
  # snapshotEnabled is true, and required for bark's DatabaseService to be
  # mounted at all (it's silently skipped, leaving only bark's Archive
  # service, if this is empty). Every snapshot is always written here,
  # regardless of whether snapshotCloudDestination is also set. Setting
  # this alongside barkPort also requires barkClientCaFilePath,
  # barkOperatorCertificateFingerprints, and tlsCertFilePath/tlsKeyFilePath
  # above -- Dingo refuses to start otherwise, since DatabaseService must not
  # be mounted without both authentication and operator authorization.
  #
  # Docker image note: the container always runs as a non-root user with a
  # pinned UID:GID of 1000:1000 (see Dockerfile) and never chowns anything
  # at startup. /data/db is chowned to 1000:1000 at image build time, so a
  # snapshotDir left under /data/db works with no extra steps. A
  # snapshotDir bind-mounted from a separate host directory must be
  # pre-chowned to 1000:1000 on the host before mounting, or dingo will
  # fail to start with a clear "not writable" error instead of a raw
  # filesystem permission error surfacing later during a snapshot attempt.
  # CLI: --db-snapshot-dir
  # snapshotDir: ""
  # Optional cloud destination to additionally mirror every snapshot to,
  # as a URI: s3://bucket/prefix or gcs://bucket/prefix. The local copy
  # under snapshotDir is always kept — this is a mirror, not a
  # replacement — and requires the dingo_extra_plugins build tag.
  # Credentials come from the AWS SDK default credential chain / Google
  # Application Default Credentials; there is no explicit key/secret
  # config here. Restore also accepts this same URI form as its source.
  # CLI: --db-snapshot-cloud-destination
  # snapshotCloudDestination: ""
  # Additional path segment appended after snapshotCloudDestination and
  # before each snapshot's own ID (e.g. epoch-<N> for automatic snapshots).
  # Automatic epoch-boundary snapshots use a deterministic name, so if
  # multiple nodes share the same snapshotCloudDestination (e.g. a shared
  # disaster-recovery bucket), set this to a distinct value per node —
  # otherwise their uploads race each other at the same remote key and can
  # corrupt each other's snapshots. Leave unset for a single node.
  # CLI: --db-snapshot-cloud-destination-prefix
  # snapshotCloudDestinationPrefix: ""
  # Number of automatic snapshots to retain before pruning older ones
  # 0 keeps all of them
  # CLI: --db-snapshot-retention
  # snapshotRetention: 0
  # Capture an automatic snapshot every N epoch boundaries instead of
  # every single one
  # CLI: --db-snapshot-every-n-epochs
  # snapshotEveryNEpochs: 1
  # File holding a shared secret (at least 16 bytes) that authenticates
  # snapshot manifests. Snapshots are signed with it and a restore refuses a
  # manifest that does not verify, so someone who can write to the cloud
  # destination cannot substitute payloads. It is required when a cloud
  # destination is configured, and every node that restores another node's
  # snapshots must use the same secret. Local-only snapshots and restores
  # may use the unkeyed checksum only when this setting is unset.
  # Can be overridden with DINGO_DB_LIFECYCLE_SNAPSHOT_TRUST_KEY_FILE
  # CLI: --db-snapshot-trust-key-file
  # snapshotTrustKeyFile: ""
  # Cancel a snapshot (manual or automatic) still holding the commit
  # barrier after this long; commits resume and the partial snapshot is
  # removed. Default: 30s. Set to 0s for no bound.
  # CLI: --db-snapshot-max-commit-pause
  # snapshotMaxCommitPause: 30s