#
# Copyright 2017-2018 Amazon.com, Inc. and its affiliates. All Rights Reserved.
#
# Licensed under the MIT License. See the LICENSE accompanying this file
# for the specific language governing permissions and limitations under
# the License.
#

[DEFAULT]
logging_level = INFO
logging_max_bytes = 1048576
logging_file_count = 10
# mode for /var/run/efs and subdirectories in octal
state_file_dir_mode = 750

[mount]
dns_name_format = {az_id}.{fs_id}.s3files.{region}.{dns_name_suffix}
dns_name_suffix = on.aws
#The region of the file system when mounting from on-premises or cross region.
#region = us-east-1
#Uncomment the below option to save all stunnel logs for a file system to the same file
#stunnel_logs_file = /var/log/amazon/efs/{fs_id}.stunnel.log
stunnel_cafile = /etc/amazon/efs/efs-utils.crt

# Validate the certificate hostname on mount. This option is not supported by certain stunnel versions.
stunnel_check_cert_hostname = true

# Use OCSP to check certificate validity. This option is not supported by certain stunnel versions.
stunnel_check_cert_validity = false

# Set to true to use FIPS-mode for stunnel. Enabling this will change the AWS SDK client to use FIPS as well.
fips_mode_enabled = false

# Define the port range that the TLS tunnel will choose from
port_range_lower_bound = 20049
port_range_upper_bound = 21049

# Optimize read_ahead_kb for Linux 5.4+
optimize_readahead = true

# By default, we enable the feature to fallback to mount with mount target ip address when dns name cannot be resolved
fall_back_to_mount_target_ip_address_enabled = true

# By default, we use IMDSv2 to get the instance metadata, set this to true if you want to disable IMDSv2 usage
disable_fetch_ec2_metadata_token = false

# By default, we enable efs-utils to retry failed mount.nfs command that due to (1) connection reset by peer (2) the
# mount.nfs is not finished within 'retry_nfs_mount_command_timeout_sec'. If the retry count is set as N, initial N - 1
# mount attempts will timeout if the command does not finish within 'retry_nfs_mount_command_timeout_sec' sec.
# The last mount attempt will keep the existing behavior of mount.nfs.
#
retry_nfs_mount_command = true
retry_nfs_mount_command_count = 3
retry_nfs_mount_command_timeout_sec = 15

[mount.cn-north-1]
dns_name_suffix = amazonaws.com.cn


[mount.cn-northwest-1]
dns_name_suffix = amazonaws.com.cn


[mount.eu-isoe-west-1]
dns_name_suffix = cloud.adc-e.uk
stunnel_cafile = /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

[mount.eusc-de-east-1]
dns_name_suffix = amazonaws.eu
stunnel_cafile = /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

[mount.us-iso-east-1]
dns_name_suffix = c2s.ic.gov
stunnel_cafile = /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

[mount.us-iso-west-1]
dns_name_suffix = c2s.ic.gov
stunnel_cafile = /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

[mount.us-isob-east-1]
dns_name_suffix = sc2s.sgov.gov
stunnel_cafile = /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

[mount.us-isob-west-1]
dns_name_suffix = sc2s.sgov.gov
stunnel_cafile = /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

[mount.us-isof-east-1]
dns_name_suffix = csp.hci.ic.gov
stunnel_cafile = /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

[mount.us-isof-south-1]
dns_name_suffix = csp.hci.ic.gov
stunnel_cafile = /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

# Note: mount-watchdog settings are configured in /etc/amazon/efs/efs-utils.conf
# The watchdog process monitors all mount types and reads its configuration from that file.

[proxy]
proxy_logging_level = INFO
proxy_logging_max_bytes = 1048576
proxy_logging_file_count = 10

# CloudWatch metric emission from proxy, set to false to disable / opt-out
metrics_enabled = true

# Readbypass parameters, Uncomment the below options if you want override default value
# read_bypass_denylist_size = 10000
# read_bypass_denylist_ttl_seconds = 300
# readahead_cache_enabled = true
# s3_read_chunk_size_bytes = 1048576
# readahead_cache_init_memory_size_mb = 10
# readahead_cache_max_memory_size_mb = 1024
# readahead_init_window_size_bytes = 8388608
# readahead_max_window_size_bytes = 8388608
# readahead_cache_eviction_interval_ms = 500
# readahead_cache_target_utilization_percent = 80
# read_bypass_max_in_flight_s3_bytes = 268435456

[cloudwatch-log]
enabled = true
log_group_name = /aws/efs/utils

# Possible values are : 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653
# Comment this config to prevent log deletion
retention_in_days = 14