fluxheim/examples/privacy.toml at main · valkyoth/fluxheim · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
[server]
listen = ["127.0.0.1:8080"]
trusted_proxies = []

[server.limits]
max_request_header_bytes = "64KiB"
max_uri_bytes = "8KiB"
max_request_headers = 100
max_request_body_bytes = "16MiB"

[server.process]
daemon = false
pid_file = "/run/fluxheim/fluxheim-privacy.pid"
upgrade_sock = "/run/fluxheim/fluxheim-privacy-upgrade.sock"
threads = 1
listener_tasks_per_fd = 1
work_stealing = true
upstream_keepalive_pool_size = 128
max_retries = 16

[admin]
enabled = false
listen = "127.0.0.1:9090"
require_loopback = true

[metrics]
enabled = false
listen = "127.0.0.1:9091"
require_loopback = true

[logging]
level = "info"
format = "json"
target = "stderr"

[logging.file]
enabled = false
append = true

[logging.access]
enabled = false
include_host = false
include_path = false
request_id = false
request_id_header = "x-request-id"

[headers.request]
enabled = true
strip_inbound_client_ip_headers = true
x_forwarded_for = "off"
x_forwarded_host = false
x_forwarded_proto = false
forwarded = false
remove = [
  "cf-connecting-ip",
  "fastly-client-ip",
  "true-client-ip",
  "x-forwarded-for",
  "x-real-ip",
]

[headers.response]
enabled = true
x_content_type_options = "nosniff"
x_frame_options = "DENY"
referrer_policy = "no-referrer"
remove = ["server", "x-powered-by"]

[proxy]
upstreams = ["127.0.0.1:3000"]
upstream_tls = false

[proxy.load_balance]
max_iterations = 256

[proxy.load_balance.health_check]
enabled = false
interval_secs = 1
consecutive_success = 1
consecutive_failure = 1
parallel = false

[tls]
enabled = false
backend = "rustls"

[tls.acme]
enabled = false
default_issuer = "letsencrypt"
challenge = "http-01"

[tls.acme.renewal]
enabled = true
renew_before_secs = 2592000
check_interval_secs = 3600
retry_initial_secs = 300
retry_max_secs = 86400
reload_after_renewal = true
zero_downtime_reload = true

[cache]
enabled = false
image_extensions = ["avif", "gif", "jpeg", "jpg", "png", "svg", "webp"]
methods = ["GET", "HEAD"]
max_object_bytes = "32MiB"

[cache.memory]
enabled = false
max_size_bytes = "1GiB"

[cache.disk]
backend = "filesystem"
enabled = false
max_size_bytes = "10GiB"

[web]
root = "/srv/fluxheim"
index_files = ["index.html"]
deny_dotfiles = true
cache_control = "no-store"