config

package
v2.0.2 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 27, 2026 License: Apache-2.0 Imports: 34 Imported by: 0

Documentation

Index

Constants

View Source
const (
	DefaultProfileMemoryInterval             = 15 * time.Second
	DefaultHealthChecksBoltCheckInterval     = 30 * time.Second
	DefaultHealthChecksBoltCheckTimeout      = 20 * time.Second
	DefaultHealthChecksBoltCheckInitialDelay = 30 * time.Second

	DefaultRaftCommandHandlerMaxQueueSize = 250

	// DefaultTlsHandshakeRateLimiterEnabled is whether the tls handshake rate limiter is enabled by default
	DefaultTlsHandshakeRateLimiterEnabled = false

	// TlsHandshakeRateLimiterMinSizeValue is the minimum size that can be configured for the tls handshake rate limiter
	// window range
	TlsHandshakeRateLimiterMinSizeValue = 5

	// TlsHandshakeRateLimiterMaxSizeValue is the maximum size that can be configured for the tls handshake rate limiter
	// window range
	TlsHandshakeRateLimiterMaxSizeValue = 10000

	// TlsHandshakeRateLimiterMetricOutstandingCount is the name of the metric tracking how many tasks are in process
	TlsHandshakeRateLimiterMetricOutstandingCount = "tls_handshake_limiter.in_process"

	// TlsHandshakeRateLimiterMetricCurrentWindowSize is the name of the metric tracking the current window size
	TlsHandshakeRateLimiterMetricCurrentWindowSize = "tls_handshake_limiter.window_size"

	// TlsHandshakeRateLimiterMetricWorkTimer is the name of the metric tracking how long successful tasks are taking to complete
	TlsHandshakeRateLimiterMetricWorkTimer = "tls_handshake_limiter.work_timer"

	// DefaultTlsHandshakeRateLimiterMaxWindow is the default max size for the tls handshake rate limiter
	DefaultTlsHandshakeRateLimiterMaxWindow = 2500

	MinRouterDataModelLogSize                = 10
	DefaultRouterDataModelLogSize            = 10000
	DefaultRouterDataModelListenerBufferSize = 1000

	DefaultRaftSnapshotInterval  = 2 * time.Minute
	DefaultRaftSnapshotThreshold = 500
	DefaultRaftTrailingLogs      = 500

	RaftRateLimiterQueueSizeMetricName  = "raft.rate_limiter.queue_size"
	RaftRateLimiterWorkTimerMetricName  = "raft.rate_limiter.work_timer"
	RaftRateLimiterWindowSizeMetricName = "raft.rate_limiter.window_size"

	BackgroundQueueMinSize = 10
	BackgroundQueueMaxSize = math.MaxUint32 >> 2

	DefaultBackgroundQueueEnabled      = true
	DefaultBackgroundQueueSize         = 1000
	DefaultBackgroundQueueDropWhenFull = false
	DefaultBackgroundQueueThreshold    = 50 * time.Millisecond

	DefaultConnectEventsQueueSize uint32 = 5
	DefaultConnectEventsIdleTime         = 30 * time.Second

	// DefaultCtrlDialer* constants define the default values for the ctrl channel dialer configuration.
	DefaultCtrlDialerEnabled            = false
	DefaultCtrlDialerDialDelay          = 30 * time.Second
	DefaultCtrlDialerMinRetryInterval   = time.Second
	DefaultCtrlDialerMaxRetryInterval   = 5 * time.Minute
	DefaultCtrlDialerRetryBackoffFactor = 1.5
	DefaultCtrlDialerFastFailureWindow  = 5 * time.Second
	DefaultCtrlDialerQueueSize          = uint32(32)
	DefaultCtrlDialerMaxWorkers         = uint32(10)
)
View Source
const (
	DefaultEdgeApiActivityUpdateBatchSize = 250
	DefaultEdgeAPIActivityUpdateInterval  = 90 * time.Second
	MaxEdgeAPIActivityUpdateBatchSize     = 10000
	MinEdgeAPIActivityUpdateBatchSize     = 1
	MaxEdgeAPIActivityUpdateInterval      = 10 * time.Minute
	MinEdgeAPIActivityUpdateInterval      = time.Millisecond

	DefaultEdgeSessionTimeout = 30 * time.Minute
	MinEdgeSessionTimeout     = 1 * time.Minute

	MinEdgeEnrollmentDuration     = 5 * time.Minute
	DefaultEdgeEnrollmentDuration = 180 * time.Minute

	DefaultHttpIdleTimeout       = 5000 * time.Millisecond
	DefaultHttpReadTimeout       = 5000 * time.Millisecond
	DefaultHttpReadHeaderTimeout = 5000 * time.Millisecond
	DefaultHttpWriteTimeout      = 100000 * time.Millisecond

	DefaultTotpDomain = "openziti.io"

	DefaultAuthRateLimiterEnabled = true
	DefaultAuthRateLimiterMaxSize = 250
	DefaultAuthRateLimiterMinSize = 5

	AuthRateLimiterMinSizeValue = 5
	AuthRateLimiterMaxSizeValue = 1000

	DefaultIdentityOnlineStatusScanInterval = time.Minute
	MinIdentityOnlineStatusScanInterval     = time.Second

	DefaultIdentityOnlineStatusUnknownTimeout = 5 * time.Minute
	DefaultIdentityOnlineStatusSource         = IdentityStatusSourceHybrid
)
View Source
const (
	DefaultOptionsCreateCircuitRetries      = 2
	DefaultOptionsCycleSeconds              = 60
	DefaultOptionsInitialLinkLatency        = 65 * time.Second
	DefaultOptionsPendingLinkTimeout        = 10 * time.Second
	DefaultOptionsMetricsReportInterval     = time.Minute
	DefaultOptionsMinRouterCost             = 10
	DefaultOptionsRouterConnectChurnLimit   = time.Minute
	DefaultOptionsRouterMessagingMaxWorkers = 100
	DefaultOptionsRouterMessagingQueueSize  = 100
	DefaultOptionsRouteTimeout              = 10 * time.Second

	DefaultOptionsSmartRerouteCap          = 4
	DefaultOptionsSmartRerouteFraction     = 0.02
	DefaultOptionsSmartRerouteMinCostDelta = 15

	OptionsRouterCommMaxQueueSize = 1_000_000
	OptionsRouterCommMaxWorkers   = 10_000
)

Variables

This section is empty.

Functions

func CalculateCaPems

func CalculateCaPems(caPems *bytes.Buffer) *bytes.Buffer

CalculateCaPems takes the supplied caPems buffer as a set of PEM Certificates separated by new lines. Duplicate certificates are removed, and the result is returned as a bytes.Buffer of PEM Certificates separated by new lines.

func GetSpiffeIdFromCert

func GetSpiffeIdFromCert(cert *x509.Certificate) (*url.URL, error)

GetSpiffeIdFromCert will search a x509 certificate for a trust domain encoded as a spiffe:// URI SAN. Each certificate must contain 0 or 1 spiffe:// URI SAN. The first SPIFFE id looking up the chain is returned. If no SPIFFE id is encountered, nil is returned. Errors are returned for parsing and processing errors only.

func GetSpiffeIdFromCertChain

func GetSpiffeIdFromCertChain(certs []*x509.Certificate) (*url.URL, error)

GetSpiffeIdFromCertChain cycles through a slice of certificates that goes from leaf up CAs. Each certificate must contain 0 or 1 spiffe:// URI SAN. The first encountered SPIFFE id looking up the chain back to the root CA is returned. If no SPIFFE id is encountered, nil is returned. Errors are returned for parsing and processing errors only.

func GetSpiffeIdFromIdentity

func GetSpiffeIdFromIdentity(id identity.Identity) (*url.URL, error)

GetSpiffeIdFromIdentity will search an Identity for a trust domain encoded as a spiffe:// URI SAN starting from the server cert and up its signing chain. Each certificate must contain 0 or 1 spiffe:// URI SAN. The first SPIFFE id looking up the chain back to the root CA is returned. If no SPIFFE id is encountered, nil is returned. Errors are returned for parsing and processing errors only.

func GetSpiffeIdFromTlsCertChain

func GetSpiffeIdFromTlsCertChain(tlsCerts []*tls.Certificate) (*url.URL, error)

GetSpiffeIdFromTlsCertChain will search a tls certificate chain for a trust domain encoded as a spiffe:// URI SAN. Each certificate must contain 0 or 1 spiffe:// URI SAN. The first SPIFFE id looking up the chain is returned. If no SPIFFE id is encountered, nil is returned. Errors are returned for parsing and processing errors only.

func ValidateSpiffeId

func ValidateSpiffeId(id *identity.TokenId, spiffeId *url.URL) error

Types

type Api

type Api struct {
	SessionTimeout          time.Duration
	ActivityUpdateBatchSize int
	ActivityUpdateInterval  time.Duration

	Listener               string
	Address                string
	IdentityCaPem          []byte
	HttpTimeouts           HttpTimeouts
	DisableOidcAutoBinding bool
}

type CertValidatingIdentity

type CertValidatingIdentity struct {
	identity.Identity
}

func (*CertValidatingIdentity) ClientTLSConfig

func (self *CertValidatingIdentity) ClientTLSConfig() *tls.Config

func (*CertValidatingIdentity) ServerTLSConfig

func (self *CertValidatingIdentity) ServerTLSConfig() *tls.Config

func (*CertValidatingIdentity) VerifyConnection

func (self *CertValidatingIdentity) VerifyConnection(state tls.ConnectionState) error

type Config

type Config struct {
	Id                     *identity.TokenId
	SpiffeIdTrustDomain    *url.URL
	AdditionalTrustDomains []*url.URL

	Raft    *RaftConfig
	Network *NetworkConfig
	Edge    *EdgeConfig
	Db      boltz.Db
	Trace   struct {
		Handler *channel.TraceHandler
	}
	Profile struct {
		Memory struct {
			Path     string
			Interval time.Duration
		}
		CPU struct {
			Path string
		}
	}
	Ctrl struct {
		Listener transport.Address
		Options  *CtrlOptions
		Dialer   CtrlDialerConfig
	}
	HealthChecks struct {
		BoltCheck struct {
			Interval     time.Duration
			Timeout      time.Duration
			InitialDelay time.Duration
		}
	}
	RouterDataModel common.RouterDataModelConfig

	Command struct {
		RateLimiter command.RateLimiterConfig
		Background  struct {
			Enabled        bool
			QueueSize      uint32
			DropWhenFull   bool
			DelayThreshold time.Duration
		}
	}

	TlsHandshakeRateLimiter command.AdaptiveRateLimitTrackerConfig

	ConnectEventsConfig ConnectEventsConfig

	Src map[interface{}]interface{}
}

func LoadConfig

func LoadConfig(path string) (*Config, error)

func (*Config) Configure

func (config *Config) Configure(sub config.Subconfig) error

func (*Config) IsRaftEnabled

func (self *Config) IsRaftEnabled() bool

func (*Config) ToJson

func (self *Config) ToJson() (string, error)

type ConnectEventsConfig

type ConnectEventsConfig struct {
	// QueueSize is the size of the work queue for each per-router pool.
	QueueSize uint32
	// IdleTime is how long a pool worker can be idle before exiting.
	IdleTime time.Duration
}

ConnectEventsConfig configures the per-router goroutine pools used to process identity connect/disconnect events. Each router gets its own single-worker pool to ensure events from the same router are processed in order.

type CtrlDialerConfig

type CtrlDialerConfig struct {
	Enabled            bool
	Groups             []string
	DialDelay          time.Duration
	MinRetryInterval   time.Duration
	MaxRetryInterval   time.Duration
	RetryBackoffFactor float64
	FastFailureWindow  time.Duration
	QueueSize          uint32
	MaxWorkers         uint32
}

CtrlDialerConfig controls how the controller dials ctrl channel listeners advertised by routers.

type CtrlOptions

type CtrlOptions struct {
	*channel.Options
	NewListener            *transport.Address
	AdvertiseAddress       *transport.Address
	RouterHeartbeatOptions *channel.HeartbeatOptions
	PeerHeartbeatOptions   *channel.HeartbeatOptions
}

CtrlOptions extends channel.Options to include support for additional, non-channel specific options (e.g. NewListener)

type EdgeConfig

type EdgeConfig struct {
	Enabled              bool
	Api                  Api
	Oidc                 Oidc
	Enrollment           Enrollment
	IdentityStatusConfig IdentityStatusConfig

	Totp            Totp
	AuthRateLimiter command.AdaptiveRateLimiterConfig

	DisablePostureChecks bool
	// contains filtered or unexported fields
}

func LoadEdgeConfigFromMap

func LoadEdgeConfigFromMap(configMap map[interface{}]interface{}) (*EdgeConfig, error)

func NewEdgeConfig

func NewEdgeConfig() *EdgeConfig

func (*EdgeConfig) AddCaPems

func (c *EdgeConfig) AddCaPems(caPems []byte)

AddCaPems adds a byte array of certificates to the current buffered list of CAs. The certificates should be in PEM format separated by new lines. RefreshCas should be called after all calls to AddCaPems are completed.

func (*EdgeConfig) CaCerts

func (c *EdgeConfig) CaCerts() []*x509.Certificate

func (*EdgeConfig) CaCertsPool

func (c *EdgeConfig) CaCertsPool() *x509.CertPool

func (*EdgeConfig) CaPems

func (c *EdgeConfig) CaPems() []byte

func (*EdgeConfig) RefreshCas

func (c *EdgeConfig) RefreshCas()

func (*EdgeConfig) SessionTimeoutDuration

func (c *EdgeConfig) SessionTimeoutDuration() time.Duration

type Enrollment

type Enrollment struct {
	SigningCert       identity.Identity
	SigningCertConfig identity.Config
	SigningCertCaPem  []byte
	EdgeIdentity      EnrollmentOption
	EdgeRouter        EnrollmentOption
}

type EnrollmentOption

type EnrollmentOption struct {
	Duration time.Duration
}

type HttpTimeouts

type HttpTimeouts struct {
	ReadTimeoutDuration       time.Duration
	ReadHeaderTimeoutDuration time.Duration
	WriteTimeoutDuration      time.Duration
	IdleTimeoutsDuration      time.Duration
}

func DefaultHttpTimeouts

func DefaultHttpTimeouts() *HttpTimeouts

type IdentityStatusConfig

type IdentityStatusConfig struct {
	Source         IdentityStatusSource
	ScanInterval   time.Duration
	UnknownTimeout time.Duration
}

type IdentityStatusSource

type IdentityStatusSource uint32
const (
	IdentityStatusSourceHeartbeats    IdentityStatusSource = 1
	IdentityStatusSourceConnectEvents IdentityStatusSource = 2
	IdentityStatusSourceHybrid        IdentityStatusSource = 3
)

type NetworkConfig

type NetworkConfig struct {
	CreateCircuitRetries    uint32
	CycleSeconds            uint32
	InitialLinkLatency      time.Duration
	IntervalAgeThreshold    time.Duration
	MetricsReportInterval   time.Duration
	MinRouterCost           uint16
	PendingLinkTimeout      time.Duration
	RouteTimeout            time.Duration
	RouterConnectChurnLimit time.Duration
	RouterComm              struct {
		QueueSize  uint32
		MaxWorkers uint32
	}
	Smart struct {
		RerouteFraction float32
		RerouteCap      uint32
		MinCostDelta    uint32
	}
}

func DefaultNetworkConfig

func DefaultNetworkConfig() *NetworkConfig

func LoadNetworkConfig

func LoadNetworkConfig(src map[interface{}]interface{}) (*NetworkConfig, error)

type Oidc

type Oidc struct {
	AccessTokenDuration  time.Duration
	RefreshTokenDuration time.Duration
	IdTokenDuration      time.Duration

	// RevocationMinTokenLifetime skips revocation for refresh tokens that expire
	// within this duration. Unset (zero) means always revoke. Must be less than
	// 50% of RefreshTokenDuration if set.
	RevocationMinTokenLifetime time.Duration

	// RevocationBucketInterval is the bucket window for batching refresh-token
	// revocations before flushing them through raft.
	RevocationBucketInterval time.Duration

	// RevocationBucketMaxSize is the maximum number of revocations per raft
	// log entry / DB transaction when flushing.
	RevocationBucketMaxSize int

	// RevocationMaxQueued is the maximum number of revocations that can
	// accumulate in memory before new ones are dropped.
	RevocationMaxQueued int

	// RevocationEnforcerFrequency is how often the controller purges expired
	// revocation records from the database.
	RevocationEnforcerFrequency time.Duration
}

func (*Oidc) MaxTokenDuration added in v2.0.1

func (o *Oidc) MaxTokenDuration() time.Duration

MaxTokenDuration returns the longest of the configured refresh, access, and id token durations. Revocations are set to expire after this so they outlive any token they target.

type RaftConfig

type RaftConfig struct {
	Recover               bool
	DataDir               string
	RestartSelf           bool
	AdvertiseAddress      transport.Address
	CommandHandlerOptions struct {
		MaxQueueSize uint16
	}

	SnapshotInterval  time.Duration
	SnapshotThreshold uint32
	TrailingLogs      uint32
	MaxAppendEntries  *uint32

	ElectionTimeout    time.Duration
	CommitTimeout      *time.Duration
	HeartbeatTimeout   time.Duration
	LeaderLeaseTimeout time.Duration

	LogLevel *string
	Logger   hclog.Logger

	WarnWhenLeaderlessFor time.Duration

	ApplyTimeout    time.Duration
	PreferredLeader bool
	RateLimiter     command.AdaptiveRateLimitTrackerConfig
}

type Totp

type Totp struct {
	Hostname string
}

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL