content: # Example config
  
  # The wallet must be able to reach the server at this URL
  public_url = 'http://localhost:8001/'
  
  issuer_trust_anchors = ["MII..."] # CAs for issuer certificates
  wua_issuer_pubkey = ""            # Public key of the WUA issuer
  
  # Files containing SD-JWT Type Metadata documents
  metadata = ["com_example_pid_metadata.json", "com_example_address_metadata.json"]
  
  [storage]
  url = 'postgres://postgres:postgres@localhost:5432/pid_issuer' # or 'memory://'
  
  [wallet_server]
  ip = '127.0.0.1'
  port = 8001
  
  # Optional, for securing private keys
  [hsm]
  library_path = "/path/to/hsm.so"
  user_pin = "12345678"
  max_sessions = 3
  max_session_lifetime_in_sec = 900
  
  [recovery_code]
  # Minimally 32 bytes. Generate with e.g. `openssl rand 32 | xxd -p -c64`
  secret_key = "fb34c5a3e40a818197ed866e4a38dafcf2158bd1fda2cbe1ff22e40e77b4f4f9"
  secret_key_type = "software"                                                    # or `hsm`
  
  [digid]
  bsn_privkey = ""
  
  [digid.http_config]
  # This is the base URL for the DigiD OIDC discovery host.
  base_url = "https://localhost:8006"
  # The TLS pinning trust anchors used for any OIDC HTTP request made, including
  # those sent to URLs that are the result of discovery. Note that these could be
  # on a different host than the base_url above, although this is likely to be
  # the same host in practice.
  trust_anchors = [""]
  
  [attestation_settings."com.example.pid"]
  valid_days = 365
  copies_per_format = { "mso_mdoc" = 4, "dc+sd-jwt" = 4 }
  attestation_qualification = "QEAA"                      # QEAA, PuB-EAA or EAA (default)
  private_key_type = "hsm"
  private_key = "pid_issuer_key"                          # label for the private key in the HSM
  certificate = "MIJ..."
  
  [attestation_settings."com.example.address"]
  valid_days = 365
  copies_per_format = { "mso_mdoc" = 4, "dc+sd-jwt" = 4 }
  private_key_type = "software"
  private_key = "MIG..."                                  # DER-encoded private key
  certificate = "MIJ..."
  