StellaOps:
  Crypto:
    Registry:
      ActiveProfile: cn-soft
      PreferredProviders:
        - cn.sm.remote.http
        - cn.sm.soft
      Profiles:
        cn-soft:
          PreferredProviders:
            - cn.sm.remote.http
            - cn.sm.soft
    SmSoft:
      RequireEnvironmentGate: true
      # Optional seed keys (PKCS#8 DER/PEM)
      Keys: []
    SmRemote:
      BaseAddress: http://sm-remote:56080
      SkipProbe: false
      Keys:
        - KeyId: sm2-remote-default
          RemoteKeyId: sm2-remote-default
    # Note: This SM profile is software-only (non-certified). Set SM_SOFT_ALLOWED=1 to enable.