bifrost-proxy/configs/server-config.example.yaml at master · rennerdo30/bifrost-proxy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
# Bifrost Server Configuration Example
# This file contains the configuration for the Bifrost proxy server.

server:
  http:
    listen: ":7080"           # Address to listen on for HTTP connections
    read_timeout: "30s"       # timeout for reading the entire request
    write_timeout: "30s"      # timeout for writing the response
    idle_timeout: "60s"       # timeout for keep-alive connections
  socks5:
    listen: ":7180"           # Address to listen on for SOCKS5 connections
  graceful_period: "30s"      # Time to wait for active connections to finish on shutdown

# Backend definitions
# Backends are upstream proxy servers or tunnels (WireGuard, Direct, etc.)
backends:
  # Direct connection (no tunnel)
  - name: direct
    type: direct
    enabled: true

  # WireGuard tunnel example
  # - name: wg-tunnel
  #   type: wireguard
  #   enabled: true
  #   config:
  #     private_key: "YOUR_PRIVATE_KEY_BASE64"
  #     address: "10.0.0.2/24"
  #     dns: ["1.1.1.1"]
  #     mtu: 1420
  #     peer:
  #       public_key: "PEER_PUBLIC_KEY_BASE64"
  #       endpoint: "vpn.example.com:51820"
  #       allowed_ips: ["0.0.0.0/0"]
  #       persistent_keepalive: 25

# Routing rules
# Determine which backend to use based on domain matching.
routes:
  # Default route - all traffic through the direct backend
  - domains: ["*"]
    backend: direct
    priority: 1

# Authentication settings
auth:
  providers:
    - name: default
      type: none              # Auth plugin type (none, native, system, ldap, oauth, jwt, apikey, ...)
      enabled: true
      priority: 1

# Rate limiting
# Control the flow of incoming requests.
rate_limit:
  enabled: false              # Enable rate limiting
  requests_per_second: 100    # Sustained rate limit
  burst_size: 200             # Maximum burst size
  per_ip: true                # Rate limit per IP address
  per_user: false             # Rate limit per authenticated user
  # bandwidth:
  #   enabled: true
  #   upload: "10Mbps"         # Upload limit
  #   download: "100Mbps"      # Download limit

# Access control
# Restrict client IPs with allow/deny lists.
access_control:
  whitelist: []               # Allowed IPs/CIDRs (empty = allow all)
  blacklist: []               # Denied IPs/CIDRs (always blocked)

# Access logging
# Log all connections handled by the server.
access_log:
  enabled: true               # Enable access logging
  format: json                # Log format (json, apache)
  output: stdout              # Output destination (stdout, stderr, or file path)

# Metrics
# Expose server metrics in Prometheus format.
metrics:
  enabled: true               # Enable metrics collection
  listen: ":7090"             # Address to listen on for metrics scraper
  path: "/metrics"            # URL path for metrics

# Application logging
# Configure server's own diagnostic logs.
logging:
  level: info                 # Log level (debug, info, warn, error)
  format: text                # Log format (json, text)
  output: stdout              # Output destination

# Web UI (Management interface)
web_ui:
  enabled: false              # Enable management dashboard
  listen: ":7081"             # Address to listen on for the Web UI

# REST API
# Programmatic management of the server.
api:
  enabled: true               # Enable REST API
  listen: ":7082"             # Address to listen on for the API
  # token: "your-api-token"   # Optional API authentication token

# Mesh coordinator
# Serves the /api/v1/mesh/* discovery endpoints that mesh clients register with.
mesh:
  enabled: true               # Mount the coordinator routes (false removes them)
  # state_path: "/var/lib/bifrost/mesh-state.json"
                              # Persist networks and peers across restarts.
                              # Unset means in-memory only: every network and
                              # peer registration is lost when the server
                              # restarts. Requires a restart to change.

# Automatic updates
# Periodically check GitHub releases for a newer version and log a notice.
# The server never installs an update on its own; use `bifrost-server update
# install` for that.
auto_update:
  enabled: false              # Enable the background update checker
  check_interval: "24h"       # How often to check (minimum 1h)
  channel: "stable"           # stable or prerelease