rustls_proxy

A layer-4 TLS reverse proxy server based on Rustls.

The following common keys are supported:

• shared_logger

• listen_in_worker

• tcp_sock_speed_limit

• ingress_network_filter

• tcp_copy_buffer_size

• tcp_copy_yield_size

• tcp_misc_opts

• tls_ticketer

• task_idle_check_interval

• task_idle_max_count

• flush_task_log_on_created

• flush_task_log_on_connected

• task_log_flush_interval

• extra_metrics_tags

listen

optional, type: tcp listen

Set the listening socket configuration for this server.

The instance count setting will be ignored if listen_in_worker is correctly enabled.

default: not set

client_hello_recv_timeout

optional, type: humanize duration

Set the timeout for receiving the initial ClientHello bytes.

default: 10s

spawn_task_unconstrained

optional, type: bool

Set whether task futures should be spawned with Tokio’s unconstrained mode.

default: false

virtual_hosts

required, type: host matched object <host>

Set the virtual-host list, matched by SNI host rules.

If not set, all requests will be handled.

Example:

hosts:
  name: bench
  exact_match: bench.example.net
  cert_pairs:
    certificate: bench.example.net-ec256.crt
    private_key: bench.example.net-ec256.key
  backends:
    - http

default: not set

Host

This section describes the configuration for a Rustls virtual host.

name

required, type: metric node name

Set the virtual-host name.

default: not set

cert_pairs

optional, type: tls cert pair or seq

Set certificate and private-key pairs for the TLS endpoint.

If not set, TLS protocol will be disabled.

default: not set

enable_client_auth

optional, type: bool

Set whether to require client authentication.

default: disabled

no_session_ticket

optional, type: bool

Disable TLS session tickets for stateless session resumption.

default: false

Added in version 0.3.3.

no_session_cache

optional, type: bool

Disable the TLS session cache for stateful session resumption.

default: false

Added in version 0.3.3.

ca_certificate

optional, type: tls certificates

Set the CA certificates used for client authentication. If not set, the system default CA bundle is used.

default: not set

accept_timeout

optional, type: humanize duration

Set the timeout for completing the full TLS handshake.

default: 10s

request_rate_limit

optional, type: rate limit quota

Set the request rate limit.

default: no limit

request_max_alive

optional, type: usize, alias: request_alive_max

Set the maximum number of concurrent live requests at the virtual-host level.

If not set, the effective limit is unbounded up to usize::MAX.

default: no limit

tcp_sock_speed_limit

optional, type: tcp socket speed limit

Set the speed limit for each TCP socket.

This will overwrite the server level tcp_sock_speed_limit.

default: not set

task_idle_max_count

optional, type: usize

Close the task after this many consecutive idle-check results return IDLE.

This will overwrite the server level task_idle_max_count.

default: not set

backends

required, type: alpn matched object <backend>

Set the backend list, matched by ALPN rules.

Example:

• A single ALPN value:

  backends:
    protocol: HTTP/1.1
    backend: foo
  

• Two single ALPN values:

  backends:
    - protocol: HTTP/1.1
      backend: foo
    - protocol: H2
      backend: bar
  

• No ALPN value:

  backends:
    - foo
  

default: not set

Backend

This is the backend entry used in host backends.

It may be a map with the following key:

backend

required, type: metric node name

Set the backend name to use.

It can also be written as a metric node name value when needed.