ziti/etc/ctrl3.yml

# Config Format Version
#
# Whenever a breaking change is made to the semantics of this configuration file, the configuration version
# expected by the controller will be incremented. When the controller tries to load a configuration file with
# an incompatible version, it will abort with a message prompting the operator to seek out the breaking changes
# documentation.
#
v: 3

# Identity
#
# Define all of the paths to the certificates and key required to establish the controller's identity.
#
identity:
  cert:                 etc/ca/intermediate/certs/ctrl-client.cert.pem
  server_cert:          etc/ca/intermediate/certs/ctrl-server.cert.pem
  key:                  etc/ca/intermediate/private/ctrl.key.pem
  ca:                   etc/ca/intermediate/certs/ca-chain.cert.pem

trustDomain: usedForLegacyNonHaNetworksWithoutSpiffeIdsInCerts

cluster:
  advertiseAddress: tcp:localhost:1382
  bindAddress: tcp:0.0.0.0:1382
  dataDir: /home/plorenz/work/var/data3/

# Network Configuration
#
# Configure how the controller will establish and manage the overlay network, and routing operations on top of
# the network.
#
#network:
  #
  # routeTimeoutSeconds controls the number of seconds the controller will wait for a route attempt to succeed.
  #
  #routeTimeoutSeconds:  10
  #
  # createCircuitRetries controls the number of retries that will be attempted to create a path (and terminate it)
  # for new circuits.
  #
  #createCircuitRetries: 3  
  # 
  # pendingLinkTimeoutSeconds controls how long we'll wait before creating a new link between routers where
  # there isn't an established link, but a link request has been sent
  #
  #pendingLinkTimeoutSeconds: 10
  # 
  #
  # Defines the period that the controller re-evaluates the performance of all of the circuits
  # running on the network.
  #
  cycleSeconds:         15
  #
  #smart:
    #
    # Defines the fractional upper limit of underperforming circuits that are candidates to be re-routed. If 
    # smart routing detects 100 circuits that are underperforming, and `smart.rerouteFraction` is set to `0.02`,
    # then the upper limit of circuits that will be re-routed in this `cycleSeconds` period will be limited to 
    # 2 (2% of 100). 
    #
    #rerouteFraction:    0.02
    # 
    # Defines the hard upper limit of underperforming circuits that are candidates to be re-routed. If smart 
    # routing detects 100 circuits that are underperforming, and `smart.rerouteCap` is set to `1`, and 
    # `smart.rerouteFraction` is set to `0.02`, then the upper limit of circuits that will be re-routed in this 
    # `cycleSeconds` period will be limited to 1.
    #
    #rerouteCap:         4  

# Database Location
#
# Define the path to where the controller's database will be stored.
#
db:                     /tmp/devctrl.db
#dbTrace:		true

# Overlay Tracing
#
# Record message traces of all messages captured on any channel (`ctrl` or `mgmt`) in "dump" format to the
# specified path. The `ziti-fabric trace dump` utility will convert this binary dump file into a human-readable
# explanation of the messages that were sent and received by the controller.
#
#trace:
#  path:                 ctrl.trace

# Profiling
#
# Enable and configure memory and CPU profiling for the controller. See `go tool pprof` for information on how 
# to work with this profile data.
#
#profile:
  #memory:
    #path:                ctrl.memprof
    #
    # Defines the interval at which memory profiling snapshots will be recorded.
    #
    #intervalMs:          15 
  #cpu:
    #path:                ctrl.cpuprof

# Control Channel Configuration
#
# Define the listener for the control (`ctrl`) channel.
# 
ctrl:
  listener:             tls:127.0.0.1:6264
    #options:
      # (optional) settings
      # set the maximum number of connect requests that are buffered and waiting to be acknowledged (1 to 5000, default 1000)
      #maxQueuedConnects:      50
      # the maximum number of connects that have  begun hello synchronization (1 to 1000, default 16)
      #maxOutstandingConnects: 100
      # the number of milliseconds to wait before a hello synchronization fails and closes the connection (30ms to 60000ms, default: 1000ms)
      #connectTimeoutMs:       3000
      # Sets the control channel write timeout. A write timeout will close the control channel, so the router will reconnect
      #writeTimeout: 15s
      # A listener address which will be sent to connecting routers in order to change their configured controller
      # address. If defined, routers will update address configuration to immediately use the new address for future
      # connections. The value of newListener must be resolvable both via DNS and validate via certificates
      #newListener: tls:localhost:6262

# Management Channel Configuration
#
# Define the listener for the management (`mgmt`) channel.
#
mgmt:
  listener:             tls:127.0.0.1:10002
    #options:
      # (optional) settings
      # set the maximum number of connect requests that are buffered and waiting to be acknowledged (1 to 5000, default 1000)
      #maxQueuedConnects:      50
      # the maximum number of connects that have  begun hello synchronization (1 to 1000, default 16)
      #maxOutstandingConnects: 100
      # the number of milliseconds to wait before a hello synchronization fails and closes the connection (30ms to 60000ms, default: 1000ms)
      #connectTimeoutMs:       3000

# Metrics Configuration
#
# Configure any additional handlers for metrics data in the controller. In the current configuration, there is only
# an `influxdb` handler, which will store metrics data as InfluxDB series.
#
# See `github.com/openziti/fabric/metrics` for more information on extending the controller with additional
# metrics handlers.
#
#metrics:
  #influxdb:
    #url:                http://localhost:8086
    #database:           ziti
    #
    

# web - optional
# Defines webListeners that will be hosted by the controller. Each webListener can host many APIs and be bound to many
# bind points.
web:
  # name - required
  # Provides a name for this listener, used for logging output. Not required to be unique, but is highly suggested.
  - name: all-apis-localhost
    # bindPoints - required
    # One or more bind points are required. A bind point specifies an interface (interface:port string) that defines
    # where on the host machine the webListener will listen and the address (host:port) that should be used to
    # publicly address the webListener(i.e. mydomain.com, localhost, 127.0.0.1). This public address may be used for
    # incoming address resolution as well as used in responses in the API.
    bindPoints:
      #interface - required
      # A host:port string on which network interface to listen on. 0.0.0.0 will listen on all interfaces
      - interface: 127.0.0.1:1282
        # address - required
        # The public address that external incoming requests will be able to resolve. Used in request processing and
        # response content that requires full host:port/path addresses.
        address: 127.0.0.1:1282
    # identity - optional
    # Allows the webListener to have a specific identity instead of defaulting to the root `identity` section.
    #    identity:
    #      cert:                 ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ctrl-client.cert.pem
    #      server_cert:          ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ctrl-server.cert.pem
    #      key:                  ${ZITI_SOURCE}/ziti/etc/ca/intermediate/private/ctrl.key.pem
    #      ca:                   ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ca-chain.cert.pem
    # options - optional
    # Allows the specification of webListener level options - mainly dealing with HTTP/TLS settings. These options are
    # used for all http servers started by the current webListener.
    options:
      # idleTimeout - optional, default 5000ms
      # The maximum amount of idle time in milliseconds allowed for pipelined HTTP requests. Setting this too high
      # can cause resources on the host to be consumed as clients remain connected and idle. Lowering this value
      # will cause clients to reconnect on subsequent HTTPs requests.
      idleTimeout: 5000ms  #http timeouts, new
      # readTimeout - optional, default 5000ms
      # The maximum amount of time in milliseconds http servers will wait to read the first incoming requests. A higher
      # value risks consuming resources on the host with clients that are acting bad faith or suffering from high latency
      # or packet loss. A lower value can risk losing connections to high latency/packet loss clients.
      readTimeout: 5000ms
      # writeTimeout - optional, default 10000ms
      # The total maximum time in milliseconds that the http server will wait for a single requests to be received and
      # responded too. A higher value can allow long running requests to consume resources on the host. A lower value
      # can risk ending requests before the server has a chance to respond.
      writeTimeout: 100000ms
      # minTLSVersion - optional, default TSL1.2
      # The minimum version of TSL to support
      minTLSVersion: TLS1.2
      # maxTLSVersion - optional, default TSL1.3
      # The maximum version of TSL to support
      maxTLSVersion: TLS1.3
    # apis - required
    # Allows one or more APIs to be bound to this webListener
    apis:
      # binding - required
      # Specifies an API to bind to this webListener. Built-in APIs are
      #   - health-checks
      - binding: health-checks
      - binding: fabric