Client configuration reference

config.yaml is the operator's own file, ~/.port49/config.yaml (or the file PORT49_CONFIG names, or --config), laid over the system-wide /etc/port49/config.yaml that the install may ship. Every key is optional, and port49 login takes each key its flags leave out from here. A key in your file replaces the same key in the system file.

Whoever can write these files chooses which broker you trust, so a file, or a directory holding one, that anyone else can write is refused and never read. An unknown key or a second YAML document is refused.

A relative path is resolved from the file's own directory, and ~/ is your home directory (~user is not expanded). A key reference (a value starting pkcs11:, tpm: or secure-enclave:) is carried as written.

Top-level keys

Key	Type	Description
broker	string	The broker to log in to.
broker_ca	string	The CA file that pins the broker's certificate. Read once, and held to the same ownership rule as the config file.
cert	string	Your certificate file, for method: x509.
key	string	Your private key: a file, or a key reference on a hardware token.
method	string	How port49 login authenticates: x509 (default), oidc (a sign-in at your identity provider, for which the broker issues a certificate) or directory (a sign-in by directory password, name and authenticator code).
sign_in_name	string	The name the directory knows you by, offered at the directory sign-in's name prompt. Default: your login name.
oidc_issuer	string	Which identity provider to sign in at, when the broker lists several.
oidc_ca	string	The CA that issued the identity provider's TLS certificate. Unset means the system roots.
oidc_redirect_port	integer	The loopback port the sign-in returns to, 0 to 65535. 0 picks a free one.
broker_crl	string	Whether the broker's certificate is checked against the revocation lists it names, before anything is sent to it: check (default) refuses a revoked certificate and says when a list cannot be obtained, require refuses in that case too, off checks nothing.
touch_key	string	A key reference on the same token as key, whose touch the agent may use.
issued_key_store	string	Where the key of a certificate the broker issues lives: auto, file, tpm, secure_enclave or pkcs11.
issued_key	string	The key reference for issued_key_store: tpm or pkcs11. It starts with pkcs11:, tpm: or secure-enclave:.