## Example

The following sections describe the config format in detail. But first an example which shows the various features. The configuration below, loads two modules called 'my-module' and 'nss'. The user settings override some aspects of the system settings.

Global configuration file: `/usr/local/etc/pkcs11/pkcs11.conf`

    # This setting controls whether to load user configuration from the
    # ~/.config/pkcs11 directory. Possible values:
    #    none: No user configuration
    #    merge: Merge the user config over the system configuration (default)
    #    only: Only user configuration, ignore system configuration
    user-config: merge

One module configuration file per module: `/usr/local/etc/pkcs11/modules/my-module`

    # This setting controls the actual module library to load. This config file
    # might be installed by the package that installs this module library. This
    # is not an absolute path name. Relative path names are loaded from the
    # $(libdir)/pkcs11 directory by default.
    module: my-pkcs11-module.so

    # This controls whether the module is required to successfully initialize. If 'yes', then
    # a failure to load or initialize this module will result in a p11-kit system failure.
    critical: no

User configuration file: `~/.config/pkcs11/pkcs11.conf`

    # This is an empty file. Files that do not exist are treated as empty.

User configuration file: `~/.config/pkcs11/modules/my-module`

    # Merge with the settings in the system my-module config file. In this case
    # a developer has overridden to load a different module for my-module instead.
    module: /home/user/src/custom-module/my-module.so

User configuration file: `~/.config/pkcs11/modules/nss`

    # Load the NSS libsoftokn.so.3 PKCS#11 library as a module. Note that we pass
    # some custom non-standard initialization arguments, as NSS expects.
    module: /usr/lib/libsoftokn3.so
    x-init-reserved: configdir='sql:/home/test/.pki/nssdb' certPrefix='' keyPrefix='' secmod='socmod.db'
    critical: yes