核心配置

配置简介

bfe.conf是BFE的核心配置

配置描述

服务基础配置

配置项描述
Server.HttpPortInteger
HTTP监听端口
默认值8080
Server.HttpsPortInteger
HTTPS(TLS)监听端口
默认值8443
Server.MonitorPortInteger
Monitor监听端口
默认值8421
Server.MaxCpusInteger
最大使用CPU核数; 0代表使用所有CPU核
默认值0
Server.Layer4LoadBalancerString
四层负载均衡器类型(PROXY/NONE)
默认值NONE
Server.TlsHandshakeTimeoutInteger
TLS握手超时时间，单位为秒
默认值30
Server.ClientReadTimeoutInteger
读客户端超时时间，单位为秒
默认值60
Server.ClientWriteTimeoutInteger
写客户端超时时间，单位为秒
默认值60
Server.GracefulShutdownTimeoutInteger
优雅退出超时时间，单位为秒，最大300秒
默认值10
Server.KeepAliveEnabledBoolean
与用户端连接是否启用HTTP KeepAlive
默认值True
Server.MaxHeaderBytesInteger
请求头部的最大长度，单位为Byte
默认值1048576
Server.MaxHeaderUriBytesInteger
请求头部URI的最大长度，单位为Byte
默认值8192
Server.HostRuleConfString
租户域名表配置文件路径
默认值server_data_conf/host_rule.data
Server.VipRuleConfString
租户VIP表配置文件路径
默认值server_data_conf/vip_rule.data
Server.RouteRuleConfString
转发规则配置文件路径
默认值server_data_conf/route_rule.data
Server.ClusterConfString
后端集群相关配置文件路径
默认值server_data_conf/cluster_conf.data
Server.GslbConfString
子集群级别负载均衡配置文件(GSLB)路径
默认值cluster_conf/gslb.data
Server.ClusterTableConfString
实例级别负载均衡配置文件路径
默认值cluster_conf/cluster_table.data
Server.NameConfString
名字与实例映射表配置文件路径
默认值server_data_conf/name_conf.data
Server.ModulesString
启用的模块列表; 启用多个模块请增加多行Modules配置，参见配置示例
默认值空
Server.MonitorIntervalInteger
Monitor数据统计周期，单位为秒
默认值20
Server.DebugServHttpBoolean
是否开启反向代理模块调试日志
默认值False
Server.DebugBfeRouteBoolean
是否开启流量路由模块调试日志
默认值False
Server.DebugBalBoolean
是否开启负载均衡模块调试日志
默认值False
Server.DebugHealthCheckBoolean
是否开启健康检查模块调试日志
默认值False

TLS基础配置

配置项描述
HttpsBasic.ServerCertConfString
服务端证书与密钥的配置文件路径
默认值tls_conf/server_cert_conf.data
HttpsBasic.TlsRuleConfString
TLS协议参数配置文件路径
默认值tls_conf/tls_rule_conf.data
HttpsBasic.CipherSuitesString
启用的加密套件列表; 启用多个套件请增加多行cipherSuites配置，详见示例
默认值TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
HttpsBasic.CurvePreferencesString
启用的ECC椭圆曲线，详见示例
默认值CurveP256
HttpsBasic.EnableSslv2ClientHelloBoolean
针对SSLv3协议，启用对SSLv2格式ClientHello的兼容
默认值True
HttpsBasic.ClientCABaseDirString
客户端根CA证书基目录; 注意：证书文件后缀约定必须是 “.crt”
默认值tls_conf/client_ca
SessionCache.SessionCacheDisabledBoolean
是否禁用TLS Session Cache机制
默认值False
SessionCache.ServersString
Cache服务的访问地址
默认值无
SessionCache.KeyPrefixString
缓存key前缀
默认值bfe
SessionCache.ConnectTimeoutInteger
连接Cache服务的超时时间, 单位毫秒
默认值50
SessionCache.ReadTimeoutInteger
读取Cache服务的超时时间, 单位毫秒
默认值50
SessionCache.WriteTimeoutInteger
写入Cache服务的超时时间, 单位毫秒
默认值50
SessionCache.MaxIdleInteger
与Cache服务的最大空闲长连接数
默认值20
SessionCache.SessionExpireInteger
存储在Cache服务中会话信息的过期时间, 单位秒
默认值3600
SessionTicket.SessionTicketsDisabledBoolean
是否禁用TLS Session Ticket
默认值True
SessionTicket.SessionTicketKeyFileString
Session Ticket Key配置文件路径
默认值tls_conf/session_ticket_key.data

配置示例

  1. [Server]
  2. # listen port for http request
  3. HttpPort = 8080
  4. # listen port for https request
  5. HttpsPort = 8443
  6. # listen port for monitor request
  7. MonitorPort = 8421
  9. # max number of CPUs to use (0 to use all CPUs)
  10. MaxCpus = 0
  12. # type of layer-4 load balancer (PROXY/NONE)
  13. #
  14. # Note:
  15. # - PROXY: layer-4 balancer talking the proxy protocol
  16. #          eg. F5 BigIP/Citrix ADC
  17. # - NONE: layer-4 balancer disabled
  18. Layer4LoadBalancer = ""
  20. # tls handshake timeout, in seconds
  21. TlsHandshakeTimeout = 30
  23. # read timeout, in seconds
  24. ClientReadTimeout = 60
  26. # write timeout, in seconds
  27. ClientWriteTimeout = 60
  29. # if false, client connection is shutdown disregard of http headers
  30. KeepAliveEnabled = true
  32. # timeout for graceful shutdown (maximum 300 sec)
  33. GracefulShutdownTimeout = 10
  35. # max header length in bytes in request
  36. MaxHeaderBytes = 1048576
  38. # max URI(in header) length in bytes in request
  39. MaxHeaderUriBytes = 8192
  41. # routing related conf
  42. HostRuleConf = server_data_conf/host_rule.data
  43. VipRuleConf = server_data_conf/vip_rule.data
  44. RouteRuleConf = server_data_conf/route_rule.data
  45. ClusterConf = server_data_conf/cluster_conf.data
  47. # load balancing related conf
  48. GslbConf = cluster_conf/gslb.data
  49. ClusterTableConf = cluster_conf/cluster_table.data
  51. # naming related conf
  52. NameConf = server_data_conf/name_conf.data
  54. # moduels enabled
  55. Modules = mod_trust_clientip
  56. Modules = mod_block
  57. Modules = mod_header
  58. Modules = mod_rewrite
  59. Modules = mod_redirect
  60. Modules = mod_logid
  62. # interval for get diff of proxy-state
  63. MonitorInterval = 20
  65. # debug flags
  66. DebugServHttp = false
  67. DebugBfeRoute = false
  68. DebugBal = false
  69. DebugHealthCheck = false
  71. [HttpsBasic]
  72. # tls cert conf
  73. ServerCertConf = tls_conf/server_cert_conf.data
  75. # tls rule
  76. TlsRuleConf = tls_conf/tls_rule_conf.data
  78. # supported cipherSuites preference settings
  79. #
  80. # ciphersuites implemented in golang:
  81. #     TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
  82. #     TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
  83. #     TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  84. #     TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  85. #     TLS_ECDHE_RSA_WITH_RC4_128_SHA
  86. #     TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
  87. #     TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
  88. #     TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
  89. #     TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
  90. #     TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
  91. #     TLS_RSA_WITH_RC4_128_SHA
  92. #     TLS_RSA_WITH_AES_128_CBC_SHA
  93. #     TLS_RSA_WITH_AES_256_CBC_SHA
  94. #     TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
  95. #     TLS_RSA_WITH_3DES_EDE_CBC_SHA
  96. #
  97. # Note:
  98. # -. Equivalent cipher suites (cipher suites with same priority in server side):
  99. #    CipherSuites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
  100. #    CipherSuites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
  101. #
  102. CipherSuites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
  103. CipherSuites=TLS_ECDHE_RSA_WITH_RC4_128_SHA
  104. CipherSuites=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
  105. CipherSuites=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
  106. CipherSuites=TLS_RSA_WITH_RC4_128_SHA
  107. CipherSuites=TLS_RSA_WITH_AES_128_CBC_SHA
  108. CipherSuites=TLS_RSA_WITH_AES_256_CBC_SHA
  110. # supported curve perference settings
  111. #
  112. # curves implemented in golang: 
  113. #     CurveP256 
  114. #     CurveP384 
  115. #     CurveP521
  116. #
  117. # Note:
  118. # - Do not use CurveP384/CurveP521 which is with poor performance
  119. #
  120. CurvePreferences=CurveP256
  122. # support Sslv2 ClientHello for compatible with ancient 
  123. # TLS capable clients (mozilla 5, java 5/6, openssl 0.9.8 etc)
  124. EnableSslv2ClientHello = true
  126. # base directory of client ca certificates
  127. # Note: filename suffix of ca certificate file should be ".crt"
  128. ClientCABaseDir = tls_conf/client_ca
  130. [SessionCache]
  131. # disable tls session cache or not
  132. SessionCacheDisabled = true
  134. # address of cache server
  135. Servers = "example.redis.cluster"
  137. # prefix for cache key
  138. KeyPrefix = "bfe"
  140. # connection params (ms)
  141. ConnectTimeout = 50
  142. ReadTimeout = 50
  143. WriteTimeout = 50
  145. # max idle connections in connection pool
  146. MaxIdle = 20
  148. # expire time for tls session state (second)
  149. SessionExpire = 3600
  151. [SessionTicket]
  152. # disable tls session ticket or not
  153. SessionTicketsDisabled = true
  154. # session ticket key
  155. SessionTicketKeyFile = tls_conf/session_ticket_key.data