refactor: move server settings from rc.conf to config file

Remove ca-key and listen tunables from rc.d script and add them to
the sample YAML config instead. The rc.d script now only handles
process management (config path, user, logfile). Server behavior
is configured in one place.

Author: brianm

contrib/freebsd/README.md

@@ -56,10 +56,10 @@ pkg add ./epithet-*.pkg
 | `epithet_server_enable` | `NO` | Enable the server service |
 | `epithet_server_config` | `/usr/local/etc/epithet/server.yaml` | Config file path |
 | `epithet_server_user` | `epithet` | User to run as |
-| `epithet_server_cakey` | `/usr/local/etc/epithet/ca.key` | CA private key path |
-| `epithet_server_listen` | `127.0.0.1:8080` | Listen address |
 | `epithet_server_logfile` | `/var/log/epithet_server.log` | Log file path |
 
+Server settings like `listen` and `ca-key` are configured in the YAML config file, not in `rc.conf`.
+
 ## Troubleshooting
 
 Check if the service is running:

contrib/freebsd/rc.d/epithet_server

@@ -12,10 +12,6 @@
 #                                 Default: /usr/local/etc/epithet/server.yaml
 # epithet_server_user (str):      User to run as.
 #                                 Default: epithet
-# epithet_server_cakey (path):    Path to CA private key.
-#                                 Default: /usr/local/etc/epithet/ca.key
-# epithet_server_listen (str):    Listen address.
-#                                 Default: :8080
 # epithet_server_logfile (path):  Path to log file.
 #                                 Default: /var/log/epithet_server.log
 
@@ -29,13 +25,11 @@ load_rc_config $name
 : ${epithet_server_enable:="NO"}
 : ${epithet_server_config:="/usr/local/etc/epithet/server.yaml"}
 : ${epithet_server_user:="epithet"}
-: ${epithet_server_cakey:="/usr/local/etc/epithet/ca.key"}
-: ${epithet_server_listen:="127.0.0.1:8080"}
 : ${epithet_server_logfile:="/var/log/epithet_server.log"}
 
 pidfile="/var/run/${name}.pid"
 procname="/usr/local/bin/epithet"
 command="/usr/sbin/daemon"
-command_args="-f -P ${pidfile} -u ${epithet_server_user} ${procname} --config ${epithet_server_config} --log-file ${epithet_server_logfile} server --ca-key ${epithet_server_cakey} --listen ${epithet_server_listen}"
+command_args="-f -P ${pidfile} -u ${epithet_server_user} ${procname} --config ${epithet_server_config} --log-file ${epithet_server_logfile} server"
 
 run_rc_command "$1"

contrib/freebsd/server.yaml.sample

@@ -5,6 +5,11 @@
 # The 'epithet server' command runs both CA and policy as supervised
 # subprocesses behind a single port.
 
+# Server settings
+server:
+  listen: "127.0.0.1:8080"
+  ca-key: "/usr/local/etc/epithet/ca.key"
+
 # Policy server configuration
 policy:
   oidc: