# Config Format Version # # Whenever a breaking change is made to the semantics of this configuration file, the configuration version # expected by the controller will be incremented. When the controller tries to load a configuration file with # an incompatible version, it will abort with a message prompting the operator to seek out the breaking changes # documentation. # v: 3 # Identity # # Define all of the paths to the certificates and key required to establish the controller's identity. # identity: cert: etc/ca/intermediate/certs/ctrl-client.cert.pem server_cert: etc/ca/intermediate/certs/ctrl-server.cert.pem key: etc/ca/intermediate/private/ctrl.key.pem ca: etc/ca/intermediate/certs/ca-chain.cert.pem # Network Configuration # # Configure how the controller will establish and manage the overlay network, and routing operations on top of # the network. # #network: # # routeTimeoutSeconds controls the number of seconds the controller will wait for a route attempt to succeed. # #routeTimeoutSeconds: 10 # # createCircuitRetries controls the number of retries that will be attempted to create a path (and terminate it) # for new circuits. # #createCircuitRetries: 3 # # pendingLinkTimeoutSeconds controls how long we'll wait before creating a new link between routers where # there isn't an established link, but a link request has been sent # #pendingLinkTimeoutSeconds: 10 # # # Defines the period that the controller re-evaluates the performance of all of the circuits # running on the network. # cycleSeconds: 15 # #smart: # # Defines the fractional upper limit of underperforming circuits that are candidates to be re-routed. If # smart routing detects 100 circuits that are underperforming, and `smart.rerouteFraction` is set to `0.02`, # then the upper limit of circuits that will be re-routed in this `cycleSeconds` period will be limited to # 2 (2% of 100). # #rerouteFraction: 0.02 # # Defines the hard upper limit of underperforming circuits that are candidates to be re-routed. If smart # routing detects 100 circuits that are underperforming, and `smart.rerouteCap` is set to `1`, and # `smart.rerouteFraction` is set to `0.02`, then the upper limit of circuits that will be re-routed in this # `cycleSeconds` period will be limited to 1. # #rerouteCap: 4 # Database Location # # Define the path to where the controller's database will be stored. # db: /tmp/devctrl.db #dbTrace: true # Overlay Tracing # # Record message traces of all messages captured on any channel (`ctrl` or `mgmt`) in "dump" format to the # specified path. The `ziti-fabric trace dump` utility will convert this binary dump file into a human-readable # explanation of the messages that were sent and received by the controller. # #trace: # path: ctrl.trace # Profiling # # Enable and configure memory and CPU profiling for the controller. See `go tool pprof` for information on how # to work with this profile data. # #profile: #memory: #path: ctrl.memprof # # Defines the interval at which memory profiling snapshots will be recorded. # #intervalMs: 15 #cpu: #path: ctrl.cpuprof # Control Channel Configuration # # Define the listener for the control (`ctrl`) channel. # ctrl: listener: tls:127.0.0.1:6262 #options: # (optional) settings # set the maximum number of connect requests that are buffered and waiting to be acknowledged (1 to 5000, default 1000) #maxQueuedConnects: 50 # the maximum number of connects that have begun hello synchronization (1 to 1000, default 16) #maxOutstandingConnects: 100 # the number of milliseconds to wait before a hello synchronization fails and closes the connection (30ms to 60000ms, default: 1000ms) #connectTimeoutMs: 3000 # Sets the control channel write timeout. A write timeout will close the control channel, so the router will reconnect #writeTimeout: 15s # A listener address which will be sent to connecting routers in order to change their configured controller # address. If defined, routers will update address configuration to immediately use the new address for future # connections. The value of newListener must be resolvable both via DNS and validate via certificates #newListener: tls:localhost:6262 # Management Channel Configuration # # Define the listener for the management (`mgmt`) channel. # mgmt: listener: tls:127.0.0.1:10000 #options: # (optional) settings # set the maximum number of connect requests that are buffered and waiting to be acknowledged (1 to 5000, default 1000) #maxQueuedConnects: 50 # the maximum number of connects that have begun hello synchronization (1 to 1000, default 16) #maxOutstandingConnects: 100 # the number of milliseconds to wait before a hello synchronization fails and closes the connection (30ms to 60000ms, default: 1000ms) #connectTimeoutMs: 3000 # Metrics Configuration # # Configure any additional handlers for metrics data in the controller. In the current configuration, there is only # an `influxdb` handler, which will store metrics data as InfluxDB series. # # See `github.com/openziti/fabric/metrics` for more information on extending the controller with additional # metrics handlers. # #metrics: #influxdb: #url: http://localhost:8086 #database: ziti # # web - optional # Defines webListeners that will be hosted by the controller. Each webListener can host many APIs and be bound to many # bind points. web: # name - required # Provides a name for this listener, used for logging output. Not required to be unique, but is highly suggested. - name: all-apis-localhost # bindPoints - required # One or more bind points are required. A bind point specifies an interface (interface:port string) that defines # where on the host machine the webListener will listen and the address (host:port) that should be used to # publicly address the webListener(i.e. mydomain.com, localhost, 127.0.0.1). This public address may be used for # incoming address resolution as well as used in responses in the API. bindPoints: #interface - required # A host:port string on which network interface to listen on. 0.0.0.0 will listen on all interfaces - interface: 127.0.0.1:1280 # address - required # The public address that external incoming requests will be able to resolve. Used in request processing and # response content that requires full host:port/path addresses. address: 127.0.0.1:1280 # identity - optional # Allows the webListener to have a specific identity instead of defaulting to the root `identity` section. # identity: # cert: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ctrl-client.cert.pem # server_cert: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ctrl-server.cert.pem # key: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/private/ctrl.key.pem # ca: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ca-chain.cert.pem # options - optional # Allows the specification of webListener level options - mainly dealing with HTTP/TLS settings. These options are # used for all http servers started by the current webListener. options: # idleTimeout - optional, default 5000ms # The maximum amount of idle time in milliseconds allowed for pipelined HTTP requests. Setting this too high # can cause resources on the host to be consumed as clients remain connected and idle. Lowering this value # will cause clients to reconnect on subsequent HTTPs requests. idleTimeout: 5000ms #http timeouts, new # readTimeout - optional, default 5000ms # The maximum amount of time in milliseconds http servers will wait to read the first incoming requests. A higher # value risks consuming resources on the host with clients that are acting bad faith or suffering from high latency # or packet loss. A lower value can risk losing connections to high latency/packet loss clients. readTimeout: 5000ms # writeTimeout - optional, default 10000ms # The total maximum time in milliseconds that the http server will wait for a single requests to be received and # responded too. A higher value can allow long running requests to consume resources on the host. A lower value # can risk ending requests before the server has a chance to respond. writeTimeout: 100000ms # minTLSVersion - optional, default TSL1.2 # The minimum version of TSL to support minTLSVersion: TLS1.2 # maxTLSVersion - optional, default TSL1.3 # The maximum version of TSL to support maxTLSVersion: TLS1.3 # apis - required # Allows one or more APIs to be bound to this webListener apis: # binding - required # Specifies an API to bind to this webListener. Built-in APIs are # - health-checks - binding: health-checks - binding: fabric