fluxheim.toml

[server]
listen = ["127.0.0.1:8080"]
# HTTPS listeners are explicit so HTTP and HTTPS are never guessed by port.
# tls_listen = ["127.0.0.1:8443"]
# Only configure direct proxy peers whose forwarded client-IP headers may be
# trusted. Inbound forwarding headers from all other peers are ignored.
trusted_proxies = []

# [server.https_redirect]
# enabled = true
# status = 308
# target_port = 8443

[server.limits]
max_request_header_bytes = "64KiB"
max_uri_bytes = "8KiB"
max_request_headers = 100
max_request_body_bytes = "16MiB"

[server.process]
daemon = false
# error_log = "/run/fluxheim/error.log"
pid_file = "/run/fluxheim/fluxheim.pid"
upgrade_sock = "/run/fluxheim/fluxheim-upgrade.sock"
threads = 1
listener_tasks_per_fd = 1
work_stealing = true
upstream_keepalive_pool_size = 128
max_retries = 16

[admin]
enabled = false
listen = "127.0.0.1:9090"
require_loopback = true
# token_env = "FLUXHEIM_ADMIN_TOKEN"
# token_file = "/run/secrets/fluxheim-admin-token"
# snapshot_store = "/var/lib/fluxheim/snapshots"

[admin.self_healing]
enabled = false
validation_window_secs = 30
health_path = "/_fluxheim/health"
min_successful_checks = 1
max_error_rate_per_mille = 100

[metrics]
enabled = false
listen = "127.0.0.1:9091"
require_loopback = true

[logging]
level = "info"
format = "json"
target = "stderr"

[logging.file]
enabled = false
# path = "/var/log/fluxheim/fluxheim.log"
append = true

[logging.access]
enabled = true
include_host = true
include_path = true
request_id = true
request_id_header = "x-request-id"

[headers.request]
enabled = true
strip_inbound_client_ip_headers = true
x_forwarded_for = "replace"
x_real_ip = true
x_forwarded_host = true
x_forwarded_proto = true
forwarded = false
remove = ["x-powered-by"]

[headers.request.add]
x-proxy-by = "Fluxheim"
x-forwarded-host = "{host}"

[headers.request.append]
via = "fluxheim"

[headers.response]
enabled = true
# HSTS and CSP are intentionally opt-in because they can break local HTTP
# testing or site-specific asset policies when enabled blindly.
# strict_transport_security = "max-age=31536000; includeSubDomains"
# content_security_policy = "default-src 'self'"
x_content_type_options = "nosniff"
x_frame_options = "DENY"
referrer_policy = "no-referrer"
remove = ["x-powered-by"]

[headers.response.add]
cache-control = "public, max-age=60"

[headers.response.append]
vary = ["Accept-Encoding"]

[proxy]
upstreams = ["127.0.0.1:3000"]
# Optional Fluxheim round-robin pool with the load-balancer feature:
# upstreams = ["127.0.0.1:3000", "127.0.0.1:3001"]
upstream_tls = false
# upstream_sni = "origin.example.test"

[proxy.load_balance]
max_iterations = 256

[proxy.load_balance.health_check]
enabled = true
interval_secs = 1
consecutive_success = 1
consecutive_failure = 1
parallel = false

[tls]
enabled = false
backend = "rustls"

# [[tls.certificates]]
# cert_path = "tls/fullchain.pem"
# key_path = "tls/key.pem"

[tls.acme]
enabled = false
# storage = "/var/lib/fluxheim/acme"
# contact_email = "admin@example.test"
default_issuer = "letsencrypt"
challenge = "http-01"

[tls.acme.renewal]
enabled = true
renew_before_secs = 2592000
# renew_after = 2026-06-01T00:00:00Z
check_interval_secs = 3600
retry_initial_secs = 300
retry_max_secs = 86400
reload_after_renewal = true
zero_downtime_reload = true

[cache]
enabled = false
image_extensions = ["avif", "gif", "jpeg", "jpg", "png", "svg", "webp"]
methods = ["GET", "HEAD"]
max_object_bytes = "32MiB"

[cache.memory]
enabled = false
max_size_bytes = "1GiB"

[cache.disk]
backend = "filesystem"
enabled = false
# path = "/var/cache/fluxheim"
max_size_bytes = "10GiB"

[web]
# root = "public"
index_files = ["index.html"]
deny_dotfiles = true
cache_control = "public, max-age=60"