# Flags for rest-server, appended to `--path /var/lib/rest-server` in the unit.
#
# --append-only is on by default and worth keeping: without it a client that can
# write to the repository can also delete from it, so a compromised machine can
# destroy the backups it made. Pruning then has to happen from the server side,
# with the service stopped.
#
# Authentication is an .htpasswd file in the data directory. Create it before
# starting the service, or no client can log in:
#
#     htpasswd -B -c /var/lib/rest-server/.htpasswd <user>
#     chown rest-server: /var/lib/rest-server/.htpasswd
#
# Other flags worth knowing: --private-repos (a user may only reach /<user>/),
# --prometheus (metrics on /metrics), --max-size BYTES (a quota), --no-auth
# (do not, unless something else is doing the authenticating).
#
# TLS is not enabled here. Terminate it in a reverse proxy, or add
# --tls --tls-cert /path/cert.pem --tls-key /path/key.pem and give the service
# read access to both.
REST_SERVER_OPTIONS=--append-only
