mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-04 19:12:46 +08:00
MichaelandPaul Gottschling
6c58a9ecd9
* [docs] Add documentation for static and dynamic ui_config * Fix indentation * Add newline * Apply suggestions from code review Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com> --------- Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
141 lines
6.1 KiB
YAML
141 lines
6.1 KiB
YAML
# This section configures the 'proxy service'
|
|
proxy_service:
|
|
# Turns 'proxy' role on. Default is 'yes'
|
|
enabled: yes
|
|
|
|
# ProxyProtocol enables support for HAProxy proxy protocol version 1 when
|
|
# it is turned 'on'.
|
|
# Verify whether the service is in front of a trusted load balancer.
|
|
# The default value is 'on'.
|
|
proxy_protocol: on
|
|
|
|
# SSH forwarding/proxy address. Command line (CLI) clients always begin
|
|
# their SSH sessions by connecting to this port
|
|
#
|
|
# If not set, behavior depends on the config file version:
|
|
#
|
|
# v2 and above: listener is not created, SSH is multiplexed on web_listen_addr
|
|
# v1: defaults to 0.0.0.0:3023
|
|
listen_addr: 0.0.0.0:3023
|
|
|
|
# Reverse tunnel listening address. An auth server (CA) can establish an
|
|
# outbound (from behind the firewall) connection to this address.
|
|
# This will allow users of the outside CA to connect to
|
|
# behind-the-firewall nodes.
|
|
#
|
|
# If not set, behavior depends on the config file version:
|
|
#
|
|
# v2 and above: listener is not created, reverse tunnel traffic is multiplexed on web_listen_addr
|
|
# v1: defaults to 0.0.0.0:3024
|
|
tunnel_listen_addr: 0.0.0.0:3024
|
|
|
|
# Proxy Peering listening address. Teleport Proxy Services will advertise this address
|
|
# for dialing agents in Proxy Peering mode.
|
|
peer_listen_addr: 0.0.0.0:3021
|
|
|
|
# The HTTPS listen address to serve the Web UI and authenticate users.
|
|
# Handles the PostgreSQL proxy if Database Access is enabled.
|
|
web_listen_addr: 0.0.0.0:3080
|
|
|
|
# The DNS name of the proxy HTTPS endpoint as accessible by cluster users.
|
|
# Defaults to the proxy's hostname if not specified. If running multiple
|
|
# proxies behind a load balancer, this name must point to the load balancer
|
|
# If application access is enabled, public_addr is used to write correct
|
|
# redirects
|
|
# (https://goteleport.com/docs/application-access/guides/connecting-apps/#start-authproxy-service).
|
|
# If database access is enabled, Database clients will connect to the Proxy
|
|
# over this hostname
|
|
# (https://goteleport.com/docs/database-access/architecture/#database-client-to-proxy).
|
|
public_addr: proxy.example.com:3080
|
|
|
|
# The DNS name of the proxy SSH endpoint as accessible by cluster clients.
|
|
# Defaults to the proxy's hostname if not specified. If running multiple
|
|
# proxies behind a load balancer, this name must point to the load
|
|
# balancer.
|
|
# Use a TCP load balancer because this port uses SSH protocol.
|
|
ssh_public_addr: proxy.example.com:3023
|
|
|
|
# The DNS name of the tunnel SSH endpoint as accessible by trusted clusters
|
|
# and nodes joining the cluster via Teleport IoT/node tunneling.
|
|
# Defaults to the proxy's hostname if not specified. If running multiple
|
|
# proxies behind a load balancer, this name must point to the load
|
|
# balancer. Use a TCP load balancer because this port uses SSH protocol.
|
|
tunnel_public_addr: proxy.example.com:3024
|
|
|
|
# TLS certificate for the HTTPS connection. Configuring these properly is
|
|
# critical for Teleport security.
|
|
https_keypairs:
|
|
- key_file: /var/lib/teleport/webproxy_key.pem
|
|
cert_file: /var/lib/teleport/webproxy_cert.pem
|
|
- key_file: /etc/letsencrypt/live/*.teleport.example.com/privkey.pem
|
|
cert_file: /etc/letsencrypt/live/*.teleport.example.com/fullchain.pem
|
|
|
|
# Interval between attempts to reload the certificate key pairs.
|
|
# If one of the key pairs fails to load, then no key pair is reloaded.
|
|
# If set to 0 (the default), then periodic reloading is disabled.
|
|
# To use this feature correctly, certificate files should be updated atomically.
|
|
https_keypairs_reload_interval: 1h
|
|
|
|
# Kubernetes proxy listen address.
|
|
#
|
|
# If not set, behavior depends on the config file version:
|
|
#
|
|
# v2 and above: listener is not created, Kubernetes traffic is multiplexed on web_listen_addr
|
|
# v1: defaults to 0.0.0.0:3026
|
|
kube_listen_addr: 0.0.0.0:3026
|
|
# optional: set a different public address for kubernetes access
|
|
kube_public_addr: kube.example.com:3026
|
|
|
|
# MySQL proxy listen address.
|
|
#
|
|
# If not set, behavior depends on the config file version:
|
|
#
|
|
# v2 and above: listener is not created, MySQL traffic is multiplexed on web_listen_addr
|
|
# v1: defaults to 0.0.0.0:3036
|
|
mysql_listen_addr: "0.0.0.0:3036"
|
|
|
|
# Postgres Proxy listener address. If provided, proxy will use a separate
|
|
# listener
|
|
# instead of multiplexing Postgres protocol on web_listener_addr.
|
|
# postgres_listen_addr: "0.0.0.0:5432"
|
|
|
|
# Mongo Proxy listener address. If provided, proxy will use a separate
|
|
# listener instead of multiplexing Mongo protocol on web_listener_addr.
|
|
# mongo_listen_addr: "0.0.0.0:27017"
|
|
|
|
# Address advertised to MySQL clients. If not set, public_addr is used.
|
|
mysql_public_addr: "mysql.teleport.example.com:3306"
|
|
|
|
# Address advertised to PostgresSQL clients. If not set, public_addr is
|
|
# used.
|
|
postgres_public_addr: "postgres.teleport.example.com:443"
|
|
|
|
# Address advertised to Mongo clients. If not set, public_addr is used.
|
|
mongo_public_addr: "mongo.teleport.example.com:443"
|
|
|
|
# Get an automatic certificate from Letsencrypt.org using ACME via
|
|
# TLS_ALPN-01 challenge.
|
|
# When using ACME, the 'proxy_service' must be publicly accessible over
|
|
# port 443.
|
|
# Also set using the CLI command:
|
|
# 'teleport configure --acme --acme-email=email@example.com \
|
|
# --cluster-name=tele.example.com -o file'
|
|
#acme:
|
|
# enabled: yes
|
|
# email: user@example.com
|
|
|
|
# Identity provider configuration. Provides detailed configuration for
|
|
# Teleport's identity providers. At present, only SAML is supported.
|
|
idp:
|
|
# SAML identity provider configuration.
|
|
saml:
|
|
# Turns the SAML identity provider on. Defaults is 'yes'.
|
|
enabled: yes
|
|
|
|
# Configuration options for the Web UI served by the Proxy Service.
|
|
ui_config:
|
|
# The amount of scrollback in the terminal. Scrollback is the amount of
|
|
# rows that are retained when lines are scrolled beyond the initial
|
|
# viewport. Does not apply to session recording view.
|
|
scrollback_length: 1000
|