116 lines
4.8 KiB
Plaintext
116 lines
4.8 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Connect - Built-in Proxy
|
|
sidebar_title: Built-in Proxy
|
|
description: Consul Connect comes with a built-in proxy for testing and development.
|
|
---
|
|
|
|
# Built-In Proxy Options
|
|
|
|
Consul comes with a built-in L4 proxy for testing and development with Consul
|
|
Connect.
|
|
|
|
~> **Note:** [Envoy](/docs/connect/proxies/envoy) should be used for production deployments, or when [layer 7 traffic management](/docs/connect/l7-traffic-management) features are needed.
|
|
|
|
## Getting Started
|
|
|
|
To get started with the built-in proxy and see a working example you can follow the [Getting Started](https://learn.hashicorp.com/consul/getting-started/connect) guide.
|
|
|
|
## Proxy Config Key Reference
|
|
|
|
Below is a complete example of all the configuration options available
|
|
for the built-in proxy.
|
|
|
|
```javascript
|
|
{
|
|
"service": {
|
|
...
|
|
"connect": {
|
|
"proxy": {
|
|
"config": {
|
|
"bind_address": "0.0.0.0",
|
|
"bind_port": 20000,
|
|
"tcp_check_address": "192.168.0.1",
|
|
"disable_tcp_check": false,
|
|
"local_service_address": "127.0.0.1:1234",
|
|
"local_connect_timeout_ms": 1000,
|
|
"handshake_timeout_ms": 10000,
|
|
"upstreams": [...]
|
|
},
|
|
"upstreams": [
|
|
{
|
|
...
|
|
"config": {
|
|
"connect_timeout_ms": 1000
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
```
|
|
|
|
All fields are optional with a sane default.
|
|
|
|
- <a name="bind_address"></a>
|
|
<a href="#bind_address">`bind_address`</a> - The address the proxy will bind it's
|
|
_public_ mTLS listener to. It defaults to the same address the agent binds to.
|
|
|
|
- <a name="bind_port"></a>
|
|
<a href="#bind_port">`bind_port`</a> - The port the proxy will bind it's _public_
|
|
mTLS listener to. If not provided, the agent will attempt to assign one from its
|
|
[configured proxy port range](/docs/agent/options#proxy_min_port) if available.
|
|
By default the range is [20000, 20255] and the port is selected at random from
|
|
that range.
|
|
|
|
- <a name="tcp_check_address"></a>
|
|
<a href="#tcp_check_address">`tcp_check_address`</a> - The address the agent will
|
|
run a [TCP health check](/docs/agent/checks) against. By default this is the same
|
|
as the proxy's [bind address](#bind_address) except if the bind*address is `0.0.0.0`
|
|
or `[::]` in which case this defaults to `127.0.0.1` and assumes the agent can
|
|
dial the proxy over loopback. For more complex configurations where agent and proxy
|
|
communicate over a bridge for example, this configuration can be used to specify
|
|
a different \_address* (but not port) for the agent to use for health checks if
|
|
it can't talk to the proxy over localhost or it's publicly advertised port. The
|
|
check always uses the same port that the proxy is bound to.
|
|
|
|
- <a name="disable_tcp_check"></a>
|
|
<a href="#disable_tcp_check">`disable_tcp_check`</a> - If true, this disables a
|
|
TCP check being setup for the proxy. Default is false.
|
|
|
|
- <a name="local_service_address"></a>
|
|
<a href="#local_service_address">`local_service_address`</a> - The `[address]:port`
|
|
that the proxy should use to connect to the local application instance. By default
|
|
it assumes `127.0.0.1` as the address and takes the port from the service definition's
|
|
`port` field. Note that allowing the application to listen on any non-loopback
|
|
address may expose it externally and bypass Connect's access enforcement. It may
|
|
be useful though to allow non-standard loopback addresses or where an alternative
|
|
known-private IP is available for example when using internal networking between
|
|
containers.
|
|
|
|
- <a name="local_connect_timeout_ms"></a>
|
|
<a href="#local_connect_timeout_ms">`local_connect_timeout_ms`</a> - The number
|
|
of milliseconds the proxy will wait to establish a connection to the _local application_
|
|
before giving up. Defaults to `1000` or 1 second.
|
|
|
|
- <a name="handshake_timeout_ms"></a>
|
|
<a href="#handshake_timeout_ms">`handshake_timeout_ms`</a> - The number of milliseconds
|
|
the proxy will wait for _incoming_ mTLS connections to complete the TLS handshake.
|
|
Defaults to `10000` or 10 seconds.
|
|
|
|
- <a name="upstreams"></a>
|
|
<a href="#upstreams">`upstreams`</a> - **Deprecated** Upstreams are now specified
|
|
in the `connect.proxy` definition. Upstreams specified in the opaque config map
|
|
here will continue to work for compatibility but it's strongly recommended that
|
|
you move to using the higher level [upstream configuration](/docs/connect/registration/service-registration#upstream-configuration-reference).
|
|
|
|
## Proxy Upstream Config Key Reference
|
|
|
|
All fields are optional with a sane default.
|
|
|
|
- <a name="connect_timeout_ms"></a>
|
|
<a href="#connect_timeout_ms">`connect_timeout_ms`</a> - The number of milliseconds
|
|
the proxy will wait to establish a TLS connection to the discovered upstream instance
|
|
before giving up. Defaults to `10000` or 10 seconds.
|