jwt:
  secret: ""
  ttl: 60
  refresh_ttl: 20160
  blacklist_grace: 0
  leeway: 0
  blacklist_sweep_interval: 10m
  # On: POST /login, /register (when it signs the account in) and
  # /activate-by-code set the HttpOnly session cookie from auth.cookie.* and
  # leave token out of the body. A POST /refresh carried by that cookie
  # rewrites it either way. Keep auth.cookie.name token or auth_token.
  token_cookie: false
activation:
  require_activation: true
  activate_mode: auto
  reset_ttl_minutes: 60
  activation_ttl_hours: 72
registration:
  allow_registration: true
  use_register_throttle: true
throttle:
  attempt_limit: 5
  suspension_minutes: 15
  use_throttle: true
password:
  bcrypt_cost: 10
  min_length: 8
  # false leaves POST /login, /forgot-password and /reset-password
  # unregistered, so they 404 like any unknown path; /register and the other
  # routes stay. Read at boot (a change needs a restart). Takes true or false.
  public_routes: true
api_tokens:
  prefix: usr_
privileged_groups:
  - admin
# Cloudflare Turnstile on POST /login and /register. Empty (the default) adds
# nothing. "open" lets requests pass when Cloudflare is unreachable, "closed"
# refuses them. The turnstile:* middleware comes from the framework (summercms
# v0.3.0 and later); its secret is turnstile.secret (SUMMER_TURNSTILE__SECRET).
turnstile: ""
# The site this plugin's links point to (the account link page
# /link-admin?code=...). Empty falls back to app.url.
frontend_url: ""
backend_links:
  # How long a link request an administrator starts on My account stays
  # usable (a Go duration). The code is one-shot.
  request_ttl: 10m