mirror of
https://github.com/openziti/ziti.git
synced 2026-10-12 15:28:05 +00:00
Paul Lorenz
137 lines
5.6 KiB
YAML
137 lines
5.6 KiB
YAML
v: 3
|
|
|
|
# (required) The certificates, ca chains, and private key used to represent this routers identity
|
|
#
|
|
# If the 'edge" section is enabled and enrollment is run, the files in this section will be written to with the results.
|
|
# The "key" value can be provided through any of the support private key engines (file, etc.).
|
|
#
|
|
# If the 'key' value is a file and that file exists; it is expected to a pre-generated private key. It will be used for
|
|
# the enrollment process and it will back the certificates generated during enrollment. If the file does not exist, it
|
|
# will be generated.
|
|
#
|
|
# The 'cert', 'server_cert', and 'ca' files will be overwritten with the results of the enrollment process.
|
|
#
|
|
# When running the ziti-router the files/values in this section will be read and used. The 'cert' value will be used
|
|
# as the client certificate to connect to the controller. The 'server_cert' is used for all servers/listeners. The
|
|
# 'ca' value is used to populate an internally Trusted CA pool.
|
|
identity:
|
|
cert: ${ZITI_DATA}/edge-router-client.cert.pem
|
|
server_cert: ${ZITI_DATA}/edge-router-server.cert.pem
|
|
key: ${ZITI_DATA}/edge-router.key.pem
|
|
ca: ${ZITI_DATA}/edge-router-ca-chain.cert.pem
|
|
|
|
#trace:
|
|
# path: 001.trace
|
|
|
|
#profile:
|
|
# memory:
|
|
# path: 001.memprof
|
|
# cpu:
|
|
# path: 001.cpuprof
|
|
|
|
ctrl:
|
|
endpoint: tls:127.0.0.1:6262
|
|
|
|
link:
|
|
dialers:
|
|
- binding: transport
|
|
|
|
healthChecks:
|
|
ctrlPingCheck:
|
|
# How often to ping the controller over the control channel. Defaults to 30 seconds
|
|
interval: 30s
|
|
# When to timeout the ping. Defaults to 15 seconds
|
|
timeout: 15s
|
|
# How long to wait before pinging the controller. Defaults to 15 seconds
|
|
initialDelay: 15s
|
|
|
|
metrics:
|
|
reportInterval: 15s
|
|
messageQueueSize: 10
|
|
|
|
# By having an 'edge' section defined, the ziti-router will attempt to parse the edge configuration. Removing this
|
|
# section, commenting out, or altering the name of the section will cause the router to no longer operate as an Edge
|
|
# Router.
|
|
edge:
|
|
# (optional) Determines the rate at which API session heartbeats are sent for connected SDK clients (default: 60)
|
|
heartbeatIntervalSeconds: 60
|
|
# (required) Information used to generate the initial registration CSR. For documentation on these fields please
|
|
# refer to the openssl documentation. These values MUST be supplied and have no defaults.
|
|
csr:
|
|
country: US
|
|
province: NC
|
|
locality: Charlotte
|
|
organization: NetFoundry
|
|
organizationalUnit: Ziti
|
|
|
|
# (required) SANs that this router's certs should contain. At least one IP or DNS SAN should be defined that matches
|
|
# the edge listeners "advertise" value from the "listeners" section.
|
|
sans:
|
|
dns:
|
|
- "localhost"
|
|
- "test-network"
|
|
- "test-network.localhost"
|
|
- "ziti-dev-ingress01"
|
|
email:
|
|
- "admin@example.com"
|
|
ip:
|
|
- "127.0.0.1"
|
|
uri:
|
|
- "ziti://ziti-dev-router01/made/up/example"
|
|
|
|
# (optional) Configuration specific to the controller's API that is proxied through this process. If not defined
|
|
# the API Proxy will not run.
|
|
apiProxy:
|
|
# (required) The interface and port that the Edge API should be served on.
|
|
listener: 0.0.0.0:1080
|
|
# (required) The hostname and port combination to the ziti-controller hosted Edge API
|
|
upstream: 127.0.0.1:1280
|
|
|
|
dialers:
|
|
- binding: udp
|
|
- binding: transport
|
|
|
|
listeners:
|
|
- binding: edge
|
|
address: tls:0.0.0.0:3022
|
|
options:
|
|
# (required) The public hostname and port combination that Ziti SDKs should connect on. Previously this was in the chanIngress section.
|
|
advertise: 127.0.0.1:3022
|
|
# (optional) settings
|
|
# set the maximum number of connect requests that are buffered and waiting to be acknowledged (1 to 5000, default 1000)
|
|
#maxQueuedConnects: 50
|
|
# the maximum number of connects that have begun hello synchronization (1 to 1000, default 16)
|
|
#maxOutstandingConnects: 100
|
|
# the number of milliseconds to wait before a hello synchronization fails and closes the connection (30ms to 60000ms, default: 1000ms)
|
|
#connectTimeoutMs: 3000
|
|
# how long to wait before timing out when looking up api-sessions after client connect. Default 5 seconds.
|
|
#lookupApiSessionTimeout: 5s
|
|
- binding: transport
|
|
address: tls:0.0.0.0:7099
|
|
|
|
web:
|
|
# name - required
|
|
# Provides a name for this listener, used for logging output. Not required to be unique, but is highly suggested.
|
|
- name: health-check
|
|
# bindPoints - required
|
|
# One or more bind points are required. A bind point specifies an interface (interface:port string) that defines
|
|
# where on the host machine the webListener will listen and the address (host:port) that should be used to
|
|
# publicly address the webListener(i.e. mydomain.com, localhost, 127.0.0.1). This public address may be used for
|
|
# incoming address resolution as well as used in responses in the API.
|
|
bindPoints:
|
|
#interface - required
|
|
# A host:port string on which network interface to listen on. 0.0.0.0 will listen on all interfaces
|
|
- interface: 127.0.0.1:8081
|
|
# address - required
|
|
# The public address that external incoming requests will be able to resolve. Used in request processing and
|
|
# response content that requires full host:port/path addresses.
|
|
address: 127.0.0.1:8081
|
|
# apis - required
|
|
# Allows one or more APIs to be bound to this webListener
|
|
apis:
|
|
# binding - required
|
|
# Specifies an API to bind to this webListener. Built-in APIs are
|
|
# - health-checks
|
|
- binding: health-checks
|
|
|