# dsh-remote-access-proxy — profile-layer configuration example (DSH 0.1.7+)
#
# DSH 0.1.7 removed `settings.yaml`. A plugin's configuration now lives in the
# active profile's own `cordis.patch.yml`, addressed by the profile entry id —
# here `remote-access-proxy`, the row this bundle declares.
#
# You normally do NOT need this file: open the Plugins page (sidebar →
# Plugins), open the `dsh-remote-access-proxy` bundle, open the
# `remote-access-proxy` row and use its 配置 page. That writes the same rows
# into `data/profiles/<profile>/cordis.patch.yml` for you.
#
# Merge only the keys you want to pin — a key left out keeps the bundle layer's
# value and then the schema default. Rows are addressed by id, so this user
# layer overrides the bundle's row wholesale for the keys it states.
#
# `secretPath` and the internal `cookieValue` signing secret are generated and written back on first start
# when left empty; there is no need to fill them in.

- id: remote-access-proxy
  config:
    enabled: true
    # 端口；代理固定监听本机所有网卡（IPv4 + IPv6）
    listenPort: 40443
    # 允许连接的客户端地址：IP、网段（CIDR）或 a-b 范围，逗号/空格分隔；
    # 留空 = 不限制。本机回环始终允许。
    allowFrom: 192.168.0.0/16, 100.64.0.0/10
    # 可选访问密码；留空 = 只靠随机路径
    password: ""
    # 随机门禁路径（4–32 位字母数字、连字符或下划线；留空自动生成）
    secretPath: CHANGE_ME_RANDOM_PATH
    # 上游 DSH 本体。留空 / 0 = 自动跟随当前实例（启动时读 webServer 实际绑定的
    # 端口，再退到 webStartup；桌面端启动器传 --port 0，真实端口只在 webServer 上）；
    # 显式值优先。
    upstreamHost: ""
    upstreamPort: 0
    # TLS：true 时用自签 pfx（浏览器需接受一次证书警告）；false = 明文 http
    tlsEnabled: true
    tlsPfxPath: .\data\certs\local-proxy.pfx
    tlsPassphrase: CHANGE_ME_PFX_PASSPHRASE
    # access.log 轮转：写入将超过 logMaxBytes 就先轮转，保留 logKeep 份旧文件
    # （access.log.1…N）；0 = 不轮转 / 不留历史。默认 1048576 字节、3 份。
    logMaxBytes: 1048576
    logKeep: 3
    # 检查更新：启动几秒后和之后每 12 小时读一次 GitHub 上的 vX.Y.Z tag，
    # 有新版本时在配置页提示（只提示，不自动安装）。false = 不联网检查。
    updateCheck: true