v: 3 #trace: # path: ctrl.trace profile: # cpu: # path: /home/plorenz/tmp/ctrl.cpu.pprof # memory: # path: ctrl.memprof db: ${ZITI_DATA}/db/ctrl.db identity: cert: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ctrl-client.cert.pem server_cert: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ctrl-server.cert.pem key: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/private/ctrl.key.pem ca: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ca-chain.cert.pem # the endpoint that routers will connect to the controller over. ctrl: listener: tls:127.0.0.1:6262 #options: # (optional) settings # set the maximum number of connect requests that are buffered and waiting to be acknowledged (1 to 5000, default 1000) #maxQueuedConnects: 50 # the maximum number of connects that have begun hello synchronization (1 to 1000, default 16) #maxOutstandingConnects: 100 # the number of milliseconds to wait before a hello synchronization fails and closes the connection (30ms to 60000ms, default: 1000ms) #connectTimeoutMs: 3000 # the endpoint that management tools connect to the controller over. mgmt: listener: tls:127.0.0.1:10000 #options: # (optional) settings # set the maximum number of connect requests that are buffered and waiting to be acknowledged (1 to 5000, default 1000) #maxQueuedConnects: 50 # the maximum number of connects that have begun hello synchronization (1 to 1000, default 16) #maxOutstandingConnects: 100 # the number of milliseconds to wait before a hello synchronization fails and closes the connection (30ms to 60000ms, default: 1000ms) #connectTimeoutMs: 3000 metrics: #file: #path: /tmp/ziti-controller-metrics.log #maxsizemb: 100:wq # Supported formats: json, plain # Defaults to json #format: plain #influxdb: #url: http://localhost:8086 #database: ziti #events: # jsonLogger: # subscriptions: # - type: fabric.terminators # - type: metrics # sourceFilter: .* # metricFilter: .*egress.*m1_rate* # - type: fabric.sessions # include: # - created # - type: edge.sessions # include: # - created # - type: fabric.usage # - type: services # handler: # type: file # format: json # path: /tmp/ziti-events.log terminator: validators: edge: edge # xctrl_example # #example: # enabled: false # delay: 5 # By having an 'edge' section defined, the ziti-controller will attempt to parse the edge configuration. Removing this # section, commenting out, or altering the name of the section will cause the edge to not run. edge: # This section represents the configuration of the Edge API that is served over HTTPS api: # (required) The interface and port that the Edge API should be served on. listener: 127.0.0.1:1280 # (required) The host/port combination that is reported as publicly accessible for the Edge API advertise: 127.0.0.1:1280 # (optional, defaults to 10) The number of minutes before an Edge API session will timeout. Timeouts are reset by # API requests and connections that are maintained to Edge Routers sessionTimeoutMinutes: 30 #(optional, default 90s) Alters how frequently heartbeat and last activity values are persisted # activityUpdateInterval: 90s #(optional, default 250) The number of API Sessions updated for last activity per transaction # activityUpdateBatchSize: 250 #(optional, defaults to the root identity) An alternate "identity" to use for the Edge API. If this section is not # defined the root identity section will be used. This is useful for situations where Edge API will present a # publicly signed certificate instead of one generated by a private PKI created by ziti pki create # identity: # server_cert: edge/tests/pki/ziti-dev-controller01.external.cert.pem # server_key: edge/tests/pki/ziti-dev-controller01.external.key.pem # ca: edge/tests/pki/ziti-dev-controller01.external.chain.cert.pem # (optional, see individual fields for defaults) Sets Edge API HTTP timeout values httpTimeouts: # (optional, default 5s) readTimeoutMs is the maximum duration for reading the entire request, including the body. readTimeoutMs: 5000 # (optional, default 0) readHeaderTimeoutMs is the amount of time allowed to read request headers. # The connection's read deadline is reset after reading the headers. If readHeaderTimeoutMs is zero, the value of # readTimeoutMs is used. If both are zero, there is no timeout. readHeaderTimeoutMs: 0 # (optional, default 10000) writeTimeoutMs is the maximum duration before timing out writes of the response. writeTimeoutMs: 100000 # (optional, default 5000) idleTimeoutMs is the maximum amount of time to wait for the next request when keep-alives are enabled idleTimeoutMs: 5000 # This section is used to define option that are used during enrollment of Edge Routers, Ziti Edge Identities. enrollment: # (required) A Ziti Identity configuration section that specifically makes use of the cert and key fields to define # a signing certificate from the PKI that the Ziti environment is using to sign certificates. The signingCert.cert # will be added to the /.well-known CA store that is used to bootstrap trust with the Ziti Controller. signingCert: cert: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/intermediate.cert.pem key: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/private/intermediate.key.decrypted.pem edgeIdentity: # (optional, defaults to 5) The length of time that a Ziti Edge Identity enrollment should remain valid. After # this duration, the enrollment will expire and not longer be usable. durationMinutes: 5 edgeRouter: # (optional, defaults to 5) The length of time that a Ziti Edge Router enrollment should remain valid. After # this duration, the enrollment will expire and not longer be usable. durationMinutes: 5 # Only specify the persistence config if you want to migrate data from a PG database to the new bbolt datastore # # persistence: # # See documentation: # # - https://godoc.org/github.com/lib/pq # # - https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING # # (required) A Postgres connection string used to connect to a database # connectionUrl: postgres://postgres:ztpassword@localhost/postgres?sslmode=disable # # (required) The Postgres database name to use # dbName: postgres