host = "127.0.0.1"
port = 11434
max_loaded_models = 1
keep_alive = "5m"

# Server
host             = "127.0.0.1"
port             = 11434
max_loaded_models = 1
keep_alive       = "5m"      # "0" = unload immediately, "-1" = never
num_thread       = 8
flash_attention  = false
num_parallel     = 1         # Concurrent inference slots
use_mlock        = false

# GPU
gpu {
  gpu_layers   = -1          # -1 = all layers on GPU, 0 = CPU only
  main_gpu     = 0
  tensor_split = []          # e.g. [0.7, 0.3] for 2 GPUs
}

# TEE privacy protection
tee_mode                = false
redact_logs             = false
suppress_token_metrics  = false
model_hashes            = {}   # {"model:tag" = "sha256:abc..."}

# Encrypted model loading
model_key_source  = null       # {file = "/path/key.hex"} or {env = "MY_KEY"}
key_provider      = "static"   # "static" or "rotating"
in_memory_decrypt = false      # Decrypt in mlock-pinned RAM, never touch disk

# Rate limiting
rate_limit_rps          = 0    # 0 = unlimited
max_concurrent_requests = 0    # 0 = unlimited

# Transport
tls_port   = null              # TLS port (requires tls feature)
ra_tls     = false             # Embed attestation in TLS cert
vsock_port = null              # Vsock port (Linux only, requires vsock feature)

tee_mode   = true
redact_logs = true

model_hashes = {
  "llama3.2:3b" = "sha256:a1b2c3d4e5f6..."
}

# Optional: encrypted model weights
model_key_source = { env = "MODEL_DECRYPT_KEY" }
in_memory_decrypt = true

# Optional: RA-TLS
tls_port = 11443
ra_tls   = true