/usr/bin/timestamp-server

Timestamp authority service that issues signed timestamps

Usage:
  timestamp-server [command]

Available Commands:
  completion  Generate the autocompletion script for the specified shell
  help        Help about any command
  serve       start http server with configured api
  version     Prints the version

Flags:
      --accepted-policy-oids strings         List of policy OIDs accepted in timestamp requests. If left unset, defaults to a list containing only the default policy OID
      --allow-custom-extensions              Whether to allow and copy custom request extensions into the signed timestamp
      --certificate-chain-path string        Path to PEM-encoded certificate chain certifying the kms-key-resource, tink-key-resource, or file-signer-key-path to act as a timestamping authority
      --cleanup-timeout duration             grace period for which to wait before killing idle connections (default 10m20s)
      --config string                        config file (default is $HOME/.timestamp-server.yaml)
      --default-policy-oid string            Default policy OID to use if none is specified in the request. If left unset, defaults to the PQC policy OID when --experimental-enable-pqc is set, or to the non-PQC policy OID otherwise
      --disable-ntp-monitoring               Disables NTP monitoring. Defaults to false
      --enable-pprof                         enable pprof for profiling on port 6060
      --enforce-intermediate-eku             enforce requirement for intermediate certificates to have timestamping EKU (default true)
      --experimental-enable-pqc              Enable experimental post-quantum signer support
      --file-signer-key-path string          Path to file containing PEM-encoded private key. Supported formats include PKCS#1, PKCS#8, and RFC5915 for EC
      --file-signer-passwd string            Password to decrypt private key
      --graceful-timeout duration            grace period for which to wait before shutting down the server (default 15s)
  -h, --help                                 help for timestamp-server
      --host string                          the IP to listen on (default "localhost")
      --http-ping-only                       serve only /ping in the http server
      --http-request-id-header-name string   name of HTTP Request Header to use as request correlation ID (default "X-Request-Id")
      --include-chain-in-response            Whether to include the issuing chain in the timestamp response when certReq is set in the timestamp request. When false, only the leaf certificate is included in the response.
      --keep-alive duration                  sets the TCP keep-alive timeouts on accepted connections. It prunes dead TCP connections ( e.g. closing laptop mid-download) (default 3m0s)
      --kms-key-resource string              KMS key for signing timestamp responses. Valid options include: [gcpkms://resource, azurekms://resource, hashivault://resource, awskms://resource]
      --listen-limit int                     limit the number of outstanding requests
      --log-type string                      logger type to use (dev/prod) (default "dev")
      --max-header-size byte-size            controls the maximum number of bytes the server will read parsing the request header's keys and values, including the request line. It does not limit the size of the request body (default 1MB)
      --max-request-body-size uint           Maximum allowed size for request bodies in bytes (1MB by default) (default 1048576)
      --ntp-monitoring string                Path to a file configuring ntp monitoring. Uses pkg/ntpmonitor/ntpsync.yaml as the default configuration if none is provided
      --port int                             the port to listen on for insecure connections, defaults to a random value
      --read-timeout duration                maximum duration before timing out read of the request (default 30s)
      --scheme strings                       the listeners to enable, this can be repeated and defaults to the schemes in the swagger spec (default [http])
      --socket-path string                   the unix socket to listen on (default "/var/run/todo-list.sock")
      --timestamp-signer string              Timestamping authority signer. Valid options include: [kms, tink, memory, file]. Memory and file-based signers should only be used for testing (default "memory")
      --timestamp-signer-hash string         Hash algorithm used by the signer. Must match the hash algorithm specified for a KMS or Tink key. Valid options include: [sha256, sha384, sha512]. Ignored for Memory signer. If left unset, defaults to sha512 when --experimental-enable-pqc is set, sha256 otherwise
      --tink-hcvault-token string            Authentication token for Hashicorp Vault API calls
      --tink-key-resource string             KMS key for signing timestamp responses for Tink keysets. Valid options include: [gcp-kms://resource, aws-kms://resource, hcvault://]
      --tink-keyset-path string              Path to KMS-encrypted keyset for Tink, decrypted by tink-key-resource
      --tls-ca string                        the certificate authority certificate file to be used with mutual tls auth
      --tls-certificate string               the certificate file to use for secure connections
      --tls-host string                      the IP to listen on (default "localhost")
      --tls-keep-alive duration              sets the TCP keep-alive timeouts on accepted connections. It prunes dead TCP connections ( e.g. closing laptop mid-download) (default 3m0s)
      --tls-key string                       the private key file to use for secure connections (without passphrase)
      --tls-listen-limit int                 limit the number of outstanding requests
      --tls-port int                         the port to listen on for secure connections, defaults to a random value
      --tls-read-timeout duration            maximum duration before timing out read of the request (default 30s)
      --tls-write-timeout duration           maximum duration before timing out write of the response (default 30s)
      --use-http-201                         use HTTP 201 Created response code instead of HTTP 200 OK for timestamp responses
      --write-timeout duration               maximum duration before timing out write of the response (default 30s)

Use "timestamp-server [command] --help" for more information about a command.