abrown38andClaude Opus 5.5
3c0808591f
Subnets served per interface, pools, reservations, options at three levels, leases in SQLite saved before the ACK, ping and decline conflict checks, validated changes with history and undo, users and tokens, an audit log, a Kea importer, a sandboxed systemd unit and Debian packages. Tested with real udhcpc and dhcpcd clients in Docker (scripts/e2e.sh). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2.1 KiB
2.1 KiB
Configuration file
/etc/steward/steward.yaml says how stewardd runs. The DHCP
configuration (subnets, pools, reservations, options) isn't here; it is
in the database, changed with the CLI or the web UI.
stewardd config --example prints a commented file with the defaults.
Every setting is optional; unknown settings are an error. stewardd reads
the file when it starts.
| Setting | Default | |
|---|---|---|
listen |
["127.0.0.1:8067"] |
addresses of the web UI and API (host:port). Keep them on localhost or a management network |
tls.cert_file, tls.key_file |
none | serve HTTPS with this certificate; stewardd rereads it when the file changes, or on systemctl reload steward |
trusted_proxies |
[] |
addresses or prefixes of reverse proxies whose X-Forwarded-For and X-Forwarded-Proto are believed |
socket |
/run/steward/steward.sock |
the local API socket; "" turns it off |
database |
/var/lib/steward/steward.db |
the SQLite database: configuration, leases, history, users, audit log |
log.level |
info |
debug (every HTTP request), info, warn or error |
log.format |
text |
text or json |
session.lifetime |
12h |
how long a web UI login lasts |
session.idle_timeout |
2h |
logged out after this long without use |
session.cookie_secure |
auto |
auto (secure over HTTPS), always or never |
backup.dir |
/var/backups/steward |
where stewardd backup writes |
backup.retention |
30d |
backups older than this are deleted… |
backup.keep_at_least |
7 |
…keeping at least this many |
Durations are written 15s, 12h or 30d.
HTTPS
Over plain HTTP, passwords and tokens cross the network in the clear; stewardd warns when it listens on a non-loopback address without TLS. Give it a certificate:
listen: ["10.0.10.2:8067"]
tls:
cert_file: /etc/steward/tls/fullchain.pem
key_file: /etc/steward/tls/privkey.pem
Or keep it on 127.0.0.1 behind a reverse proxy that terminates TLS, and
list the proxy in trusted_proxies. Ports below 1024 work too: the unit
grants CAP_NET_BIND_SERVICE for DHCP's port 67.