# Copyright (C) 2018-present MongoDB, Inc.
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the Server Side Public License, version 1,
# as published by MongoDB, Inc.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# Server Side Public License for more details.
#
# You should have received a copy of the Server Side Public License
# along with this program. If not, see
# <http://www.mongodb.com/licensing/server-side-public-license>.
#
# As a special exception, the copyright holders give permission to link the
# code of portions of this program with the OpenSSL library under certain
# conditions as described in each individual source file and distribute
# linked combinations including the program with the OpenSSL library. You
# must comply with the Server Side Public License in all respects for
# all of the code used other than as permitted herein. If you modify file(s)
# with this exception, you may extend this exception to your version of the
# file(s), but you are not obligated to do so. If you do not wish to do so,
# delete this exception statement from your version. If you delete this
# exception statement from all source files in the program, then also delete
# it in the license file.
#

global:
  cpp_namespace: "mongo"
  cpp_includes:
    - "mongo/util/net/ssl_options.h"
    - "mongo/util/net/ssl_parameters.h"

server_parameters:
  opensslDiffieHellmanParameters:
    description: "OpenSSL Diffie-Hellman parameters"
    set_at: startup
    cpp_varname: "sslGlobalParams.sslPEMTempDHParam"
  suppressNoTLSPeerCertificateWarning:
    description: "Do not display a warning when client fails to send a TLS certificate"
    set_at: startup
    cpp_varname: "sslGlobalParams.suppressNoTLSPeerCertificateWarning"
  tlsWithholdClientCertificate:
    deprecated_name: "sslWithholdClientCertificate"
    description: "Do not send a client certificate when establishing intra-cluster connections"
    set_at: startup
    cpp_varname: "sslGlobalParams.tlsWithholdClientCertificate"

  opensslCipherConfig:
    description: "Cipher configuration string for OpenSSL based TLS connections"
    set_at: startup
    cpp_varname: "sslGlobalParams.sslCipherConfig"
    validator:
      callback: "validateOpensslCipherConfig"

  disableNonTLSConnectionLogging:
    deprecated_name: "disableNonSSLConnectionLogging"
    description: "Suppress logging of warnings when non-SSL connections are accepted in preferSSL mode"
    set_at: startup
    cpp_varname: "sslGlobalParams.disableNonSSLConnectionLogging"
    validator:
      callback: "validateDisableNonTLSConnectionLogging"
    on_update: "onUpdateDisableNonTLSConnectionLogging"

  sslMode:
    description: "Transition from allowSSL to preferSSL, or from preferSSL to requireSSL"
    set_at: runtime
    cpp_class: SSLModeServerParameter

  tlsMode:
    description: "Transition from allowTLS to preferTLS, or from preferTLS to requireTLS"
    set_at: runtime
    cpp_class: TLSModeServerParameter

  clusterAuthMode:
    description: "Transition from sendKeyFile to sendX509, or sendX509 to x509 clusterAuthModes"
    set_at: runtime
    cpp_class: ClusterAuthModeServerParameter

  tlsX509ClusterAuthDNOverride:
    description: "Distinguished name to use for cluster membership"
    set_at: [startup, runtime]
    cpp_class: ClusterMemberDNOverride