#Master config file, must be in /etc/radsecproxy or proxy's current directory
#	All possible config options are listed below
#
# You must specify at least one of TLSCACertificateFile or TLSCACertificatePath
# for TLS to work. We always verify peer certificate (both client and server)
#TLSCACertificateFile    /etc/cacerts/CA.pem
TLSCACertificatePath	/etc/cacerts

# You must specify the below for TLS, we will always present our certificate
TLSCertificateFile	/etc/hostcertkey/host.example.com.pem
TLSCertificateKeyFile	/etc/hostcertkey/host.example.com.key.pem
# Optionally specify password if key is encrypted (not very secure)
TLSCertificateKeyPassword	follow the white rabbit

# You can optionally specify addresses and ports to listen on
#	Max one of each, below are just multiple examples
#ListenUDP		*:1814
#listenUDP		localhost
#listenTCP		10.10.10.10:2084
#ListenTCP		[2001:700:1:7:215:f2ff:fe35:307d]:2084
# Optional log level. 3 is default, 1 is less, 4 is more
#LogLevel		3
#Optional LogDestinatinon, else stderr used for logging
# Logging to file
#LogDestination		file:///tmp/rp.log
# Or logging with Syslog. LOG_DAEMON used if facility not specified
# The supported facilities are LOG_DAEMON, LOG_MAIL, LOG_USER and
# LOG_LOCAL0, ..., LOG_LOCAL7
#LogDestination         x-syslog://
#LogDestination         x-syslog://log_local2

#Now we configure clients, servers and realms. Note that these and
#also the lines above may be in any order, except that a realm
#can only be configured to use a server that is previously configured.

#Also note that case insensitive regexp is used for realms, matching
#the entire username string. The matching is done in the order the
#realms are specified, using the first match found. Some examples are
#"@example\.com$", "\.com$", ".*" and "^[a-z].*@example\.com$".
#To treat local users separately you might try first specifying "@"
#and after that ".*".

client 2001:db8::1 {
	type	tls
	secret	verysecret
}
client 127.0.0.1 {
	type	udp
	secret	secret
}
client radius.example.com {
	type TLS
# secret is optional for TLS
}

server 127.0.0.1 {
	type	UDP
	secret	secret
}
realm	@eduroam\.cc$ {
	server	127.0.0.1
}

server 2001:db8::1 {
	type	TLS
	port	2283
# secret is optional for TLS
}
server radius.example.com {
	type	tls
	secret	verysecret
}

realm @example\.com$ {
	server 2001:db8::1
}
realm \.com$ {
	server 2001:db8::1
}
realm .* {
	server radius.example.com
}