# frps.toml — VPS control server (Native mTLS tunnel · V1).
#
# Install target on the VPS: /etc/relay/frp/frps.toml   (chmod 600, owned frp:frp).
# This is a TEMPLATE with PLACEHOLDERS ONLY — NO REAL SECRETS are committed.
#
#   auth.token: replace <FRP_TOKEN> with `openssl rand -hex 32`, stored in /etc/relay/secrets.env
#               (0600). The token is NOT the sole gate — control-channel mTLS below is required too,
#               so a leaked token alone cannot register a subdomain (PLAN R3 / V1b, Model A).
#
# Both ports are LOOPBACK-only (nginx stream terminates/routes :443 → these; they must stay absent
# from the Aliyun security group — PLAN P-B).

bindAddr = "127.0.0.1"
bindPort = 7000            # control channel  (SNI frp.terminal.yaojia.wang → here, TLS passthrough)
vhostHTTPPort = 7080       # vhost HTTP        (nginx :8470 proxies verified requests here by Host)

auth.method = "token"
auth.token = "<FRP_TOKEN>"

subDomainHost = "terminal.yaojia.wang"

# --- control-channel mTLS: token is NOT the sole gate (per-host frp-client CA) ---
transport.tls.force = true
transport.tls.certFile      = "/etc/relay/frp-tls/frps-ctrl.cert.pem"      # frps control SERVER cert (V1)
transport.tls.keyFile       = "/etc/relay/frp-tls/frps-ctrl.key.pem"       # (0600)
transport.tls.trustedCaFile = "/etc/relay/frp-client-ca/frp-client-ca.cert.pem"  # verifies each host's frpc cert

log.to = "/var/log/frp/frps.log"
log.level = "info"