.. _configuration_server_usual_tls_port:

usual_tls_port
==============

.. versionadded:: 1.7.29
.. versionchanged:: renamed to usual_tls_port since 1.13.3

This server exposes an usual OpenSSL based TLS listening port in front of another local server.

The following common keys are supported:

* :ref:`listen_in_worker <conf_server_common_listen_in_worker>`
* :ref:`tls ticketer <conf_server_common_tls_ticketer>`
* :ref:`ingress_network_filter <conf_server_common_ingress_network_filter>`

listen
------

**required**, **type**: :external+values:ref:`tcp listen <conf_value_tcp_listen>`

Listening configuration for this server.

The instance count setting will be ignored if *listen_in_worker* is correctly enabled.

tls_server
----------

**required**, **type**: :external+values:ref:`openssl server config <conf_value_openssl_server_config>`

Enables TLS on the listening socket using OpenSSL and configures the TLS
parameters.

server
------

**required**, **type**: str

Name of the next server to which accepted connections are forwarded.

The next server must be able to accept TLS connections.

Example:

.. code-block:: yaml

   - name: usual-front
     type: usual_tls_port
     listen: 0.0.0.0:8443
     tls:
       cert_pairs:
         certificate: server.crt
         private_key: server.key
     server: plain_tls_backend

proxy_protocol
--------------

**optional**, **type**: :external+values:ref:`proxy protocol version <conf_value_proxy_protocol_version>`

PROXY Protocol version expected on incoming TCP connections.

If set, connections with no matched PROXY Protocol message will be dropped.

The TLS handshake with the client will happen after we receive the PROXY Protocol message.

.. note:: The ``ingress_network_filter`` option on this server always applies to
   the real socket client address.

**default**: not set, which means PROXY protocol won't be used

proxy_protocol_read_timeout
---------------------------

**optional**, **type**: :external+values:ref:`humanize duration <conf_value_humanize_duration>`

Timeout for reading a complete PROXY Protocol message.

**default**: 5s