blindjoin.toml.example

[network]
bitcoin_network = "signet"
bitcoin_rpc_url = "http://127.0.0.1:38332"
bitcoin_rpc_user = "blindjoin"
bitcoin_rpc_pass = "blindjoin"

[coordinator]
denomination_sats = 1000000       # 0.01 BTC
min_participants = 3
max_participants = 20
round_timeout_input_reg_secs = 60
round_timeout_output_reg_secs = 60
round_timeout_signing_secs = 30
blame_ban_duration_secs = 3600      # 1 hour
fee_rate_sat_per_vbyte = 2
listen_addr = "0.0.0.0:8080"

# --- Public-endpoint hardening (v1.2 Phase 8) -----------------------------
# All four knobs below are validated at startup. Out-of-range values fail
# fast with an actionable error message rather than panicking under load.

# Per-route rate limit on read endpoints (`/info`, `/round/tx`). Requests
# beyond this rate return HTTP 429 with a Retry-After header and a JSON
# envelope `{"error":{"code":"RATE_LIMITED",...}}`. Valid range: 1..=60_000.
rate_limit_info_per_min = 60

# Per-route rate limit on write endpoints (`/round/input`, `/round/output`,
# `/round/sign`). Same 429 + Retry-After behavior as reads. Valid range:
# 1..=60_000.
rate_limit_writes_per_min = 30

# Uniform per-handler deadline. Handlers that exceed this duration return
# HTTP 408. Protects worker slots from slow clients. Valid range: >= 1.
request_timeout_secs = 30

# Cap on concurrent Tor hidden-service streams the coordinator will serve.
# Excess connections park at the accept loop until a permit is released.
# Only applies in tor_mode = true; clearnet mode is unbounded by design.
# Valid range: >= 1.
max_concurrent_connections = 256

[discovery]
# Path to the coordinator's Ed25519 PKARR keypair.
# This key is the coordinator's stable Mainline DHT identity.
# Clients discover the coordinator using this public key — do not lose or rotate it.
# In Docker: this file lives inside the coordinator-keys named volume.
# chmod 600 this file when running outside Docker.
pkarr_key_file = "coordinator_pkarr.key"

# Re-publish the PKARR record to Mainline DHT every N seconds (default: 300 = 5 min).
# Matches the DHT TTL. Do not reduce below 60 to avoid relay rate limits.
heartbeat_interval_secs = 300

# Publicly reachable coordinator address, published in the PKARR record.
# Phase 4 (clearnet): your server's IP:port or hostname:port.
# Phase 5 (Tor): your .onion address (e.g. "abc123xyz.onion").
coordinator_public_addr = "127.0.0.1:8080"

# --- v1.4 multi-script BIP-322 allowlist ----------------------------------
# Top-level [bip] section. Validated at startup: an all-false combination,
# or an `output_script_type` whose matching `allow_*` flag is false, cause
# the coordinator to refuse to start. Defaults accept all three script
# types. Env-var overrides use the BLINDJOIN__BIP__* path (lowercase
# "true" / "false" strings only — "0" / "1" do NOT deserialize as bool
# through the config crate's env source).
#
# Disabling a script type takes effect at validate-utxo time: registrations
# for that type are rejected with UnsupportedScriptType, and the type is
# omitted from the coordinator's `/info` and PKARR advertisements so v1.4
# clients fail-fast at discovery (before opening a Tor circuit).
[bip]
allow_p2wpkh = true               # BIP-84 native segwit
allow_p2tr = true                 # BIP-86 single-key Taproot (keypath only)
allow_p2sh_p2wpkh = true          # BIP-49 wrapped segwit

# Script type the coordinator uses for round outputs (mixed inputs, single
# output type per round per design). Wire form is lowercase kebab-case:
# "p2wpkh" / "p2tr" / "p2sh-p2wpkh". MUST match an enabled allow_* flag.
output_script_type = "p2wpkh"