jwt:
  secret: ""
  ttl: 60
  refresh_ttl: 20160
  blacklist_grace: 0
  leeway: 0
  blacklist_sweep_interval: 10m
activation:
  require_activation: true
  activate_mode: auto
  reset_ttl_minutes: 60
  activation_ttl_hours: 72
registration:
  allow_registration: true
  use_register_throttle: true
throttle:
  attempt_limit: 5
  suspension_minutes: 15
  use_throttle: true
password:
  bcrypt_cost: 10
  min_length: 8
api_tokens:
  prefix: usr_
privileged_groups:
  - admin
# Cloudflare Turnstile on POST /login and /register. Empty (the default) adds
# nothing. "open" lets requests pass when Cloudflare is unreachable, "closed"
# refuses them. The turnstile:* middleware comes from the framework (summercms
# v0.3.0 and later); its secret is turnstile.secret (SUMMER_TURNSTILE__SECRET).
turnstile: ""