From 3cd8340ea42b5eef5e8ed6e0e4e2d49669d2d6ed Mon Sep 17 00:00:00 2001
From: Nikolay Govorov <me@govorov.online>
Date: Sat, 4 Apr 2026 09:42:04 +0100
Subject: Update configs

---
 cmd/mirumd/main.go | 16 ----------------
 pkg/mirumd.yaml    | 23 ++++++++++++++++++-----
 2 files changed, 18 insertions(+), 21 deletions(-)

diff --git a/cmd/mirumd/main.go b/cmd/mirumd/main.go
index 77f1643..c737932 100644
--- a/cmd/mirumd/main.go
+++ b/cmd/mirumd/main.go
@@ -13,8 +13,6 @@ import (
 	"net"
 	"net/http"
 	"os"
-	"os/user"
-	"strconv"
 	"time"
 
 	"connectrpc.com/connect"
@@ -418,20 +416,6 @@ func listeners(cfg *config) (grpcLn, webLn, adminLn net.Listener, err error) {
 		}
 	}()
 
-	grp, err := user.LookupGroup("workerd")
-	if err != nil {
-		return nil, nil, nil, fmt.Errorf("lookup group workerd: %w", err)
-	}
-
-	gid, err := strconv.Atoi(grp.Gid)
-	if err != nil {
-		return nil, nil, nil, fmt.Errorf("parse gid: %w", err)
-	}
-
-	if err = os.Chown(cfg.AdminSocket, 0, gid); err != nil {
-		return nil, nil, nil, fmt.Errorf("chown admin socket: %w", err)
-	}
-
 	if err = os.Chmod(cfg.AdminSocket, 0o660); err != nil {
 		return nil, nil, nil, fmt.Errorf("chmod admin socket: %w", err)
 	}
diff --git a/pkg/mirumd.yaml b/pkg/mirumd.yaml
index 411892e..4828d9b 100644
--- a/pkg/mirumd.yaml
+++ b/pkg/mirumd.yaml
@@ -4,11 +4,24 @@
 # Ignored when the corresponding systemd socket activation fd is present.
 # See mirumd.socket for details (FileDescriptorName=grpc / web).
 grpc_addr: :2026
-www_addr: :3000
-tls_cert: ""
-tls_key: ""
+web_addr: :3000
+admin_socket: /run/mirumd/admin.sock
+database_uri: ""
 webhook_secret: ""
 token: ""
 pepper: ""
-database_uri: ""
-admin_socket: /run/mirumd/admin.sock
+
+grpc_tls:
+  cert: ""
+  key: ""
+
+# Optional — omit or leave empty to disable TLS on the web listener.
+# web_tls:
+#   cert: ""
+#   key: ""
+
+# CIDR list of trusted reverse proxies for X-Forwarded-For resolution.
+# Empty = trust RemoteAddr only (safe default).
+trusted_proxies:
+  - 127.0.0.0/8
+  - ::1/128
-- 
Gilti