# Minimal mtg configuration for the SNI-router setup.
#
# 1. Generate a secret:  mtg generate-secret --hex <your.domain>
# 2. Paste it into the `secret` field below.
# 3. Set DOMAIN=<your.domain> in .env (HAProxy + Caddy pick it up).

secret = "PASTE_YOUR_SECRET_HERE"
bind-to = "[::]:3128"

# HAProxy in front sends PROXY protocol v2 headers so mtg can see the
# real client IP.  Keep this in sync with haproxy.cfg (`send-proxy-v2`).
proxy-protocol-listener = true

[defense.anti-replay]
enabled = true
max-size = "1mib"
error-rate = 0.001