install: add sanitized svxreflector.conf.example, reference it from INSTALL.md

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-26 23:10:03 +02:00
parent 25b481e2ae
commit 886e11e3d5
2 changed files with 136 additions and 0 deletions
@@ -0,0 +1,131 @@
+# Example svxreflector.conf as used together with SvxPortal (layout of a live reflector).
+# All secrets are CHANGEME, hostnames are my.domain.com / peer.domain.com. Adjust to your site.
+# The web admin pages read this file to find CERT_PKI_DIR and to manage [USERS]/[PASSWORDS].
+#
+###################################################################
+#
+# Configuration file for the SvxReflector SvxLink conference node
+#
+###################################################################
+
+[GLOBAL]
+#CFG_DIR=svxreflector.d
+TIMESTAMP_FORMAT="%c"
+LISTEN_PORT=5300
+LOCAL_PREFIX=240
+#SQL_TIMEOUT=600
+#SQL_TIMEOUT_BLOCKTIME=60
+#CODECS=OPUS
+TG_FOR_V1_CLIENTS=999
+#RANDOM_QSY_RANGE=12399:100
+HTTP_SRV_PORT=8099
+COMMAND_PTY=/dev/shm/reflector_ctrl
+#ACCEPT_CALLSIGN="[A-Z0-9][A-Z]{0,2}\\d[A-Z0-9]{0,3}[A-Z](?:-[A-Z0-9]{1,3})?"
+#REJECT_CALLSIGN=""
+#ACCEPT_CERT_EMAIL="\\w+(?:[-._+]\\w+)*@\\w+(?:\\.\\w+)*"
+CERT_PKI_DIR=/etc/svxlink/pki
+CERT_CA_BUNDLE=/etc/svxlink/pki/ca-bundle.crt
+CERT_CA_KEYS_DIR=/etc/svxlink/pki/private/
+CERT_CA_PENDING_CSRS_DIR=/etc/svxlink/pki/pending_csrs/
+CERT_CA_CSRS_DIR=/etc/svxlink/pki/csrs/
+CERT_CA_CERTS_DIR=/etc/svxlink/pki/certs/
+#CERT_CA_HOOK=/usr/share/svxlink/ca-hook.py
+
+[ROOT_CA]
+KEYFILE=/etc/svxlink/pki/private/svxreflector_root_ca.key
+CRTFILE=/etc/svxlink/pki/certs/svxreflector_root_ca.crt
+COMMON_NAME=SvxReflector Root MYCALL
+ORG_UNIT=SvxLink
+ORG=MYCALL
+LOCALITY=Mytown
+STATE=Mystate
+COUNTRY=SE
+EMAIL_ADDRESS=admin@my.domain.com
+
+[ISSUING_CA]
+KEYFILE=/etc/svxlink/pki/private/svxreflector_issuing_ca.key
+CSRFILE=/etc/svxlink/pki/csrs/svxreflector_issuing_ca.csr
+CRTFILE=/etc/svxlink/pki/certs/svxreflector_issuing_ca.crt
+COMMON_NAME=SvxReflector Issuing CA MYCALL
+ORG_UNIT=SvxLink
+ORG=MYCALL
+LOCALITY=Mytown
+STATE=Mystate
+COUNTRY=SE
+EMAIL_ADDRESS=admin@my.domain.com
+
+[SERVER_CERT]
+KEYFILE=/etc/svxlink/pki/private/SvxReflector_Server_Cert_MYCALL.key
+CSRFILE=/etc/svxlink/pki/csrs/SvxReflector_Server_Cert_MYCALL.csr
+CRTFILE=/etc/svxlink/pki/certs/SvxReflector_Server_Cert_MYCALL.crt
+COMMON_NAME=my.domain.com
+ORG_UNIT=SvxLink
+ORG=MYCALL
+LOCALITY=Mytown
+STATE=Mystate
+COUNTRY=SE
+SUBJECT_ALT_NAME=DNS:my.domain.com,IP:192.0.2.1
+EMAIL_ADDRESS=admin@my.domain.com
+
+# [USERS] maps a node callsign to a password-group name; [PASSWORDS] holds the
+# group's secret. SvxPortal's "svxreflector-users" helper adds entries of the
+# form CALL=CALL here (one group per node). Several nodes may share one group.
+[USERS]
+MYCALL-AC=MYCALL-AC
+MYCALL-DMR=MYCALL-DMR
+#SM0ABC-1=MyNodes
+#SM0ABC-2=MyNodes
+#SM3XYZ=SM3XYZ
+MYCALL-T=MYCALL
+
+[PASSWORDS]
+MYCALL-AC="CHANGEME"
+MYCALL-DMR="CHANGEME"
+MYCALL="CHANGEME"
+#MyNodes="Change this key now!"
+#SM3XYZ="A strong password"
+
+#[TG#9999]
+#AUTO_QSY_AFTER=300
+#ALLOW=S[A-M]\\\\d.*|LA8PV
+#SHOW_ACTIVITY=0
+
+# Reflector-to-reflector trunking (optional).
+[ReflectorTrunk]
+GatewayId=SE-MYCALL
+Port=5500
+Peers=PEER1
+
+[TrunkPeer#PEER1]
+Host=peer.domain.com
+Port=5500
+TGRule=^.*$
+Retransmit=0
+ActiveFilter=0
+Key=CHANGEME
+TrunkType=A
+TrunkTypeSend=A
+Qualify=1
+
+# Satellite trunks (e.g. a DMR bridge or an Asterisk/AllStar PBX). One SECRET_<id> per satellite.
+[SATELLITE]
+LISTEN_PORT=5403
+SECRET_dmr=CHANGEME
+SECRET_pbx=CHANGEME
+
+###################################################################
+# MQTT status publishing (used by the node control pages in SvxPortal).
+[MQTT]
+HOST=127.0.0.1
+PORT=1883
+USERNAME=svxreflector
+PASSWORD=CHANGEME
+TOPIC_PREFIX=svxreflector/mycall
+STATUS_INTERVAL=30000
+
+#[TRUNK_OTHER]
+#HOST=other.domain.com
+#PORT=5403
+#SECRET=CHANGEME
+#REMOTE_PREFIX=310
+#ALLOW_TGS=24016