# Configuration

## CLI arguments

### `listen`

| Argument | Default | Description |
| -------- | ------- | ----------- |
| `--listen` | `0.0.0.0:4180` | HTTPS listener bind address |
| `--advertise` | derived from `--listen` | Public address in auto-generated connection keys |
| `--connection-key` | none | Reusable key (env: `RUSTUNNEL_KEY`) |
| `--socks` | none | Server-side SOCKS5 proxy address |
| `--cert` | "" | Server certificate path |
| `--key` | "" | Server private key path |
| `--ca-cert` | "" | CA certificate path |
| `--auth-token` | "" | Auth token value |
| `--auth-token-file` | none | Auth token file path |
| `--insecure-skip-tls-verify` | false | Skip client cert verification |

### `connect`

| Argument | Default | Description |
| -------- | ------- | ----------- |
| `CONNECTION_KEY` | none | Positional connection key |
| `--target` | from key | Listener address |
| `--connection-key` | none | Key via flag (env: `RUSTUNNEL_KEY`) |
| `--socks` | `127.0.0.1:1180` | Local SOCKS5 proxy address |
| `--cert` | "" | Client certificate path |
| `--key` | "" | Client private key path |
| `--ca-cert` | "" | CA certificate path |
| `--auth-token` | "" | Auth token value |
| `--auth-token-file` | none | Auth token file path |
| `--insecure-skip-tls-verify` | false | Skip server cert verification |

### `generate`

| Argument | Default | Description |
| -------- | ------- | ----------- |
| `--out` | `.` | Output directory |
| `--ca-name` | `rustunnel-ca` | CA common name |
| `--server-name` | `rustunnel-server` | Server common name |
| `--client-name` | `rustunnel-client` | Client common name |

### `keygen`

| Argument | Default | Description |
| -------- | ------- | ----------- |
| `--target` | `127.0.0.1:4180` | Listener address embedded in key |
| `--ca-name` | `rustunnel-ca` | CA common name |
| `--server-name` | `rustunnel-server` | Server common name |
| `--client-name` | `rustunnel-client` | Client common name |

## Environment variables

- `RUST_LOG` — tracing filter (e.g., `debug`, `trace`)
- `RUSTUNNEL_KEY` — connection key for `listen` and `connect`

## Config file format

`config.json` (generated by `rustunnel generate`):

```json
{
  "listen_address": "0.0.0.0",
  "listen_port": 4180,
  "socks_address": "127.0.0.1",
  "socks_port": 1180,
  "ca_cert_path": "ca.pem",
  "server_cert_path": "server.crt",
  "server_key_path": "server.key",
  "client_cert_path": "client.crt",
  "client_key_path": "client.key",
  "auth_token_path": "token.txt"
}
```

## Key source files

| File | Purpose |
| ---- | ------- |
| `src/cli.rs` | clap argument definitions and defaults |
| `src/config.rs` | `Config` struct for JSON serialization |