mirror of
https://github.com/openziti/ziti.git
synced 2026-10-12 07:18:36 +00:00
ziti-ci
147 lines
6.6 KiB
YAML
147 lines
6.6 KiB
YAML
v: 3
|
|
|
|
#trace:
|
|
# path: ctrl.trace
|
|
|
|
profile:
|
|
# cpu:
|
|
# path: /home/plorenz/tmp/ctrl.cpu.pprof
|
|
# memory:
|
|
# path: ctrl.memprof
|
|
|
|
db: ${ZITI_DATA}/db/ctrl.db
|
|
|
|
identity:
|
|
cert: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ctrl-client.cert.pem
|
|
server_cert: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ctrl-server.cert.pem
|
|
key: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/private/ctrl.key.pem
|
|
ca: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ca-chain.cert.pem
|
|
|
|
# the endpoint that routers will connect to the controller over.
|
|
ctrl:
|
|
listener: tls:127.0.0.1:6262
|
|
#options:
|
|
# (optional) settings
|
|
# set the maximum number of connect requests that are buffered and waiting to be acknowledged (1 to 5000, default 1000)
|
|
#maxQueuedConnects: 50
|
|
# the maximum number of connects that have begun hello synchronization (1 to 1000, default 16)
|
|
#maxOutstandingConnects: 100
|
|
# the number of milliseconds to wait before a hello synchronization fails and closes the connection (30ms to 60000ms, default: 1000ms)
|
|
#connectTimeoutMs: 3000
|
|
|
|
# the endpoint that management tools connect to the controller over.
|
|
mgmt:
|
|
listener: tls:127.0.0.1:10000
|
|
#options:
|
|
# (optional) settings
|
|
# set the maximum number of connect requests that are buffered and waiting to be acknowledged (1 to 5000, default 1000)
|
|
#maxQueuedConnects: 50
|
|
# the maximum number of connects that have begun hello synchronization (1 to 1000, default 16)
|
|
#maxOutstandingConnects: 100
|
|
# the number of milliseconds to wait before a hello synchronization fails and closes the connection (30ms to 60000ms, default: 1000ms)
|
|
#connectTimeoutMs: 3000
|
|
|
|
metrics:
|
|
#file:
|
|
#path: /tmp/ziti-controller-metrics.log
|
|
#maxsizemb: 100:wq
|
|
# Supported formats: json, plain
|
|
# Defaults to json
|
|
#format: plain
|
|
#influxdb:
|
|
#url: http://localhost:8086
|
|
#database: ziti
|
|
|
|
#events:
|
|
# jsonLogger:
|
|
# subscriptions:
|
|
# - type: fabric.terminators
|
|
# - type: metrics
|
|
# sourceFilter: .*
|
|
# metricFilter: .*egress.*m1_rate*
|
|
# - type: fabric.sessions
|
|
# include:
|
|
# - created
|
|
# - type: edge.sessions
|
|
# include:
|
|
# - created
|
|
# - type: fabric.usage
|
|
# - type: services
|
|
# handler:
|
|
# type: file
|
|
# format: json
|
|
# path: /tmp/ziti-events.log
|
|
|
|
terminator:
|
|
validators:
|
|
edge: edge
|
|
|
|
# xctrl_example
|
|
#
|
|
#example:
|
|
# enabled: false
|
|
# delay: 5
|
|
|
|
# By having an 'edge' section defined, the ziti-controller will attempt to parse the edge configuration. Removing this
|
|
# section, commenting out, or altering the name of the section will cause the edge to not run.
|
|
edge:
|
|
# This section represents the configuration of the Edge API that is served over HTTPS
|
|
api:
|
|
# (required) The interface and port that the Edge API should be served on.
|
|
listener: 127.0.0.1:1280
|
|
# (required) The host/port combination that is reported as publicly accessible for the Edge API
|
|
advertise: 127.0.0.1:1280
|
|
# (optional, defaults to 10) The number of minutes before an Edge API session will timeout. Timeouts are reset by
|
|
# API requests and connections that are maintained to Edge Routers
|
|
sessionTimeoutMinutes: 30
|
|
#(optional, default 90s) Alters how frequently heartbeat and last activity values are persisted
|
|
# activityUpdateInterval: 90s
|
|
#(optional, default 250) The number of API Sessions updated for last activity per transaction
|
|
# activityUpdateBatchSize: 250
|
|
#(optional, defaults to the root identity) An alternate "identity" to use for the Edge API. If this section is not
|
|
# defined the root identity section will be used. This is useful for situations where Edge API will present a
|
|
# publicly signed certificate instead of one generated by a private PKI created by ziti pki create
|
|
# identity:
|
|
# server_cert: edge/tests/pki/ziti-dev-controller01.external.cert.pem
|
|
# server_key: edge/tests/pki/ziti-dev-controller01.external.key.pem
|
|
# ca: edge/tests/pki/ziti-dev-controller01.external.chain.cert.pem
|
|
# (optional, see individual fields for defaults) Sets Edge API HTTP timeout values
|
|
httpTimeouts:
|
|
# (optional, default 5s) readTimeoutMs is the maximum duration for reading the entire request, including the body.
|
|
readTimeoutMs: 5000
|
|
# (optional, default 0) readHeaderTimeoutMs is the amount of time allowed to read request headers.
|
|
# The connection's read deadline is reset after reading the headers. If readHeaderTimeoutMs is zero, the value of
|
|
# readTimeoutMs is used. If both are zero, there is no timeout.
|
|
readHeaderTimeoutMs: 0
|
|
# (optional, default 10000) writeTimeoutMs is the maximum duration before timing out writes of the response.
|
|
writeTimeoutMs: 100000
|
|
# (optional, default 5000) idleTimeoutMs is the maximum amount of time to wait for the next request when keep-alives are enabled
|
|
idleTimeoutMs: 5000
|
|
# This section is used to define option that are used during enrollment of Edge Routers, Ziti Edge Identities.
|
|
enrollment:
|
|
# (required) A Ziti Identity configuration section that specifically makes use of the cert and key fields to define
|
|
# a signing certificate from the PKI that the Ziti environment is using to sign certificates. The signingCert.cert
|
|
# will be added to the /.well-known CA store that is used to bootstrap trust with the Ziti Controller.
|
|
signingCert:
|
|
cert: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/intermediate.cert.pem
|
|
key: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/private/intermediate.key.decrypted.pem
|
|
edgeIdentity:
|
|
# (optional, defaults to 5) The length of time that a Ziti Edge Identity enrollment should remain valid. After
|
|
# this duration, the enrollment will expire and not longer be usable.
|
|
durationMinutes: 5
|
|
edgeRouter:
|
|
# (optional, defaults to 5) The length of time that a Ziti Edge Router enrollment should remain valid. After
|
|
# this duration, the enrollment will expire and not longer be usable.
|
|
durationMinutes: 5
|
|
|
|
# Only specify the persistence config if you want to migrate data from a PG database to the new bbolt datastore
|
|
#
|
|
# persistence:
|
|
# # See documentation:
|
|
# # - https://godoc.org/github.com/lib/pq
|
|
# # - https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING
|
|
# # (required) A Postgres connection string used to connect to a database
|
|
# connectionUrl: postgres://postgres:ztpassword@localhost/postgres?sslmode=disable
|
|
# # (required) The Postgres database name to use
|
|
# dbName: postgres
|