listen_addr: "127.0.0.1:8080"
# To enable SOCKS5, use "127.0.0.1:1080" or another non-conflicting address.
socks5_listen_addr: null
connect_timeout_ms: 10000
socks5_handshake_timeout_ms: 10000
upstream_timeout_ms: 30000

telemetry:
  service_name: "hermes"
  log_filter: "info"
  resource_attributes:
    deployment.environment.name: "development"
  otlp:
    endpoint: "http://127.0.0.1:4318"
    timeout_ms: 10000
    headers: {}
    traces:
      # Set an endpoint here to override the common OTLP endpoint.
      sample_ratio: 1.0
    metrics:
      export_interval_ms: 60000
      temporality: "cumulative"
    logs: {}

acl:
  default_action: deny
  users: {}
  rules:
    - name: localhost
      action: allow
      networks: ["127.0.0.1/32", "::1/128"]

# To require Basic authentication, generate a hash with
# `cargo run -- hash-password`, then configure a user and rule:
#
# acl:
#   default_action: deny
#   users:
#     alice:
#       password_hash: "$hermes-sha256$v=1$..."
#   rules:
#     - name: alice
#       action: allow
#       users: ["alice"]
#
# Add destination domains to any rule to allow only those destinations:
#
#     - name: localhost-approved-domains
#       action: allow
#       networks: ["127.0.0.1/32", "::1/128"]
#       domains: ["example.com", "*.rust-lang.org"]
#       ports: [80, 443]
#
# `*.example.com` matches subdomains but not `example.com` itself. Domain
# patterns never match IP literals, and domain blacklists do not block direct
# connections to destination IP addresses. `ports` restricts destination ports;
# plain HTTP defaults to 80 when no port is specified.