@@ -15,10 +15,15 @@ usage() {
1515Usage: $( basename " $0 " )
1616
1717Logging (override .env/defaults):
18+ -x, --xlog SPEC folly XLOG config for moqx's own components, passed as
19+ --logging=SPEC. Primary logging (moqx standardizes on XLOG).
20+ The -v/-L/-m flags below tune the underlying QUIC/HTTP stack (mvfst/proxygen/
21+ fizz), which still logs via glog — kept until that stack moves to folly XLOG:
1822 -v, --verbose N GLOG_v (0=off, 1-4 increasing detail)
1923 -L, --log-level N GLOG_minloglevel (0=INFO 1=WARN 2=ERR 3=FATAL)
20- -m, --vmodule SPEC GLOG_vmodule (e.g. MoQSession=4,MoQForwarder=3)
21- -x, --xlog SPEC folly XLOG config (passed as --logging=SPEC)
24+ -m, --vmodule SPEC GLOG_vmodule — per-source-file glog VLOG for the stack
25+ (e.g. Acceptor=4,SSLContextManager=2). moqx/moxygen
26+ components log via XLOG: use -x for those, not -m.
2227
2328Relay tuning (templated into the config; CLI > .env > default):
2429 --threads N IO worker threads, must be >= 1 (default 4)
@@ -38,6 +43,8 @@ Listener (templated into the config; CLI > .env > default):
3843 --moqt-versions LIST advertised MoQT drafts in server-preference order,
3944 e.g. 16,14,18 (default 16,14,18; first listed wins).
4045 Pass a single value (e.g. 18) to pin one draft.
46+ --bind ADDR bind address for the listener + admin (default 127.0.0.1;
47+ use :: or 0.0.0.0 to accept remote clients, e.g. cross-box bench)
4148 --port N UDP listen port (default 4433)
4249 --admin-port N admin HTTP port (default 8000)
4350 --endpoint PATH WebTransport endpoint path (default /moq-relay)
@@ -56,7 +63,9 @@ Execution:
5663 Bare flag auto-detects libjemalloc.so.2.
5764 --check-sysctl report current vs recommended UDP/network sysctls
5865 (with the commands to raise them) and exit
59- --no-sudo run without sudo (cert files must be user-readable)
66+ --sudo run the relay under sudo (only needed to read a
67+ root-owned key, e.g. letsencrypt's 0600 privkey;
68+ default is no sudo)
6069 -n, --dry-run print resolved env + command, don't exec
6170 -h, --help this help
6271
@@ -65,7 +74,7 @@ Environment overrides (via .env or shell):
6574 MOQX_VERBOSE, MOQX_LOG_LEVEL, GLOG_vmodule, MOQX_JEMALLOC
6675 MOQX_THREADS, MOQX_UDP_BUFFER, MOQX_RECV_PKTS, MOQX_SEND_PKTS, MOQX_CC,
6776 MOQX_LOCAL_FWD, MOQX_CACHE, MOQX_BPF_STEERING, MOQX_IGNORE_PATH_MTU,
68- MOQX_RELAY_THREAD, MOQX_STACK, MOQX_MOQT_VERSIONS, MOQX_PORT, MOQX_ADMIN_PORT, MOQX_ENDPOINT,
77+ MOQX_RELAY_THREAD, MOQX_STACK, MOQX_MOQT_VERSIONS, MOQX_BIND_ADDR, MOQX_PORT, MOQX_ADMIN_PORT, MOQX_ENDPOINT,
6978 MOQX_INSECURE, MOQX_CERT, MOQX_KEY, MOQX_MAX_TRACKS, MOQX_MAX_GROUPS,
7079 MOQX_RELAY_ID, MOQX_RESOLVED_CONFIG (env-only; no CLI flag)
7180
@@ -74,7 +83,8 @@ Examples:
7483 $0 --threads 8 --udp-buffer 16777216 # 8 IO threads, 16 MB socket buffer
7584 $0 --recv-pkts 256 -j # Alan's recv loop + jemalloc
7685 $0 --check-sysctl # audit kernel UDP buffers, then exit
77- $0 --subcmd validate-config --no-sudo # just validate the config
86+ $0 --subcmd validate-config # just validate the config
87+ DOMAIN=relay.example.com $0 --sudo # real TLS, root-owned letsencrypt key
7888 $0 -n # show what would run
7989EOF
8090}
@@ -128,7 +138,7 @@ CLI_JEMALLOC="" # "" = unset; "auto" or explicit path
128138CLI_THREADS=" " " " " " " " " "
129139CLI_LOCAL_FWD=" " " " " " " " # tri-state booleans
130140CLI_IGNORE_PMTU=" " " " # tri-state booleans
131- CLI_STACK=" " " " " " " " " " " " " "
141+ CLI_STACK=" " " " CLI_BIND= " " CLI_PORT=" " " " " " " " " "
132142CHECK_SYSCTL=0 DRY_RUN=0
133143PASSTHRU=()
134144
@@ -153,6 +163,7 @@ while (($#)); do
153163 --bpf-steering) CLI_BPF=true; shift ;;
154164 --quic-stack) CLI_STACK=" $2 " ; shift 2 ;;
155165 --moqt-versions) CLI_MOQT_VERSIONS=" $2 " ; shift 2 ;;
166+ --bind) CLI_BIND=" $2 " ; shift 2 ;;
156167 --port) CLI_PORT=" $2 " ; shift 2 ;;
157168 --admin-port) CLI_ADMIN_PORT=" $2 " ; shift 2 ;;
158169 --endpoint) CLI_ENDPOINT=" $2 " ; shift 2 ;;
@@ -168,7 +179,7 @@ while (($#)); do
168179 if [[ -n " ${2:- } " && " $2 " != -* ]]; then CLI_JEMALLOC=" $2 " ; shift 2
169180 else CLI_JEMALLOC=" auto" ; shift ; fi ;;
170181 --check-sysctl) CHECK_SYSCTL=1; shift ;;
171- --no- sudo) CLI_USE_SUDO=0 ; shift ;;
182+ --sudo) CLI_USE_SUDO=1 ; shift ;;
172183 -n|--dry-run) DRY_RUN=1; shift ;;
173184 -h|--help) usage; exit 0 ;;
174185 --) shift ; PASSTHRU+=(" $@ " ; break ;;
@@ -226,6 +237,9 @@ case "$MOQX_STACK" in mvfst|picoquic) ;; *) echo "invalid --quic-stack: $MOQX_ST
226237# server-preference order — the relay picks the first listed version the client
227238# also supports. Default offers d16, d14, then d18 as a fallback.
228239export MOQX_MOQT_VERSIONS=" $( norm_versions " ${CLI_MOQT_VERSIONS:- ${MOQX_MOQT_VERSIONS:- 16,14,18} } " ) "
240+ # Bind address for the listener + admin. Local-safe default (127.0.0.1); set
241+ # :: / 0.0.0.0 (e.g. via perf-test.sh or --bind) to accept remote clients.
242+ export MOQX_BIND_ADDR=" ${CLI_BIND:- ${MOQX_BIND_ADDR:- 127.0.0.1} } "
229243export MOQX_PORT=" ${CLI_PORT:- ${MOQX_PORT:- 4433} } "
230244export MOQX_ADMIN_PORT=" ${CLI_ADMIN_PORT:- ${MOQX_ADMIN_PORT:- 8000} } "
231245export MOQX_ENDPOINT=" ${CLI_ENDPOINT:- ${MOQX_ENDPOINT:-/ moq-relay} } "
@@ -268,11 +282,17 @@ RESOLVED_CONFIG="${MOQX_RESOLVED_CONFIG:-/tmp/moqx-resolved.yaml}"
268282envsubst < " $CONFIG_TEMPLATE " > " $RESOLVED_CONFIG "
269283
270284# ── GLOG — map MOQX_* → GLOG_* (matches docker/entrypoint.sh convention) ─
285+ # TODO(folly-xlog): drop this block once the QUIC/HTTP stack (mvfst/proxygen/
286+ # fizz) logging moves to folly XLOG and glog leaves the link. Load-bearing
287+ # until then — it's the only knob for stack-level diagnostics.
271288export GLOG_logtostderr=1
272289export GLOG_colorlogtostderr=1
273290export GLOG_minloglevel=" ${CLI_LOG_LEVEL:- ${MOQX_LOG_LEVEL:- 0} } "
274291export GLOG_v=" ${CLI_VERBOSE:- ${MOQX_VERBOSE:- 0} } "
275- export GLOG_vmodule=" ${CLI_VMODULE:- ${GLOG_vmodule:- MoqxRelay=3,MoQSession=3,MoQForwarder=3,MoqxCache=2} } "
292+ # Default empty: GLOG_v already sets global stack VLOG; vmodule only targets
293+ # specific stack source files (glog VLOG). The old default named moqx/moxygen
294+ # components, which log via folly XLOG (-x), so it filtered nothing.
295+ export GLOG_vmodule=" ${CLI_VMODULE:- ${GLOG_vmodule:- } } "
276296
277297# ── jemalloc resolution (CLI > env) ──────────────────────────────────────
278298JEMALLOC_REQ=" ${CLI_JEMALLOC:- ${MOQX_JEMALLOC:- } } "
301321
302322# ── Run ──────────────────────────────────────────────────────────────────
303323SUBCMD=" ${CLI_SUBCMD:- ${MOQX_SUBCMD:- serve} } "
304- USE_SUDO=" ${CLI_USE_SUDO:- ${MOQX_USE_SUDO:- 1 } } "
324+ USE_SUDO=" ${CLI_USE_SUDO:- ${MOQX_USE_SUDO:- 0 } } "
305325CMD=(" $MOQX_BIN " " $SUBCMD " " $RESOLVED_CONFIG " " ${PASSTHRU[@]} "
306326
307327if (( DRY_RUN )) ; then
308328 echo " # relay knobs (templated into config)"
309- echo " relay_id=$MOQX_RELAY_ID stack=$MOQX_STACK moqt_versions=$MOQX_MOQT_VERSIONS port=$MOQX_PORT admin_port=$MOQX_ADMIN_PORT endpoint=$MOQX_ENDPOINT insecure=$MOQX_INSECURE "
329+ echo " relay_id=$MOQX_RELAY_ID stack=$MOQX_STACK moqt_versions=$MOQX_MOQT_VERSIONS bind= $MOQX_BIND_ADDR port=$MOQX_PORT admin_port=$MOQX_ADMIN_PORT endpoint=$MOQX_ENDPOINT insecure=$MOQX_INSECURE "
310330 echo " resolved_config=$RESOLVED_CONFIG "
311331 echo " threads=$MOQX_THREADS relay_thread=$MOQX_RELAY_THREAD local_fwd=$MOQX_LOCAL_FWD bpf_steering=$MOQX_BPF_STEERING cache=$MOQX_CACHE "
312332 echo " cc=$MOQX_CC send_pkts=$MOQX_SEND_PKTS recv_pkts=$MOQX_RECV_PKTS udp_buffer=$MOQX_UDP_BUFFER ignore_path_mtu=$MOQX_IGNORE_PATH_MTU "
@@ -341,6 +361,10 @@ if [[ "$SUBCMD" == serve && "$MOQX_INSECURE" == false ]]; then
341361 for f in " $MOQX_CERT " " $MOQX_KEY " ; do
342362 " ${probe[@]} " " $f " 2> /dev/null || {
343363 echo " error: TLS cert/key not readable: $f " >&2
364+ if [[ -e " $f " ; then
365+ echo " - file exists but isn't readable as $( id -un) " >&2
366+ echo " letsencrypt's 0600 privkey), re-run with --sudo" >&2
367+ fi
344368 echo " - check DOMAIN spelling — it names the /etc/letsencrypt/live/<dir>, not the served host" >&2
345369 echo " (a wildcard *.example.com cert lives under the 'example.com' dir)" >&2
346370 echo " - or pass --cert/--key explicitly, or --insecure for the built-in dev cert" >&2
0 commit comments