---
layout: docs
page_title: Worker - Configuration
sidebar_title: worker
description: |-
  The worker stanza configures worker-specific parameters.
---

# `worker` Stanza

The `worker` stanza configures Boundary worker-specific parameters.

```hcl
worker {
  name = "example-worker"
  description = "An example worker"
  address = 127.0.0.1
  public_addr = "5.1.23.198"
}
```

- `name` - Specifies a unique name of this worker within the Boundary worker
cluster.

- `description` - Specifies a friendly description of this worker.

- `address` - Specifies the IP address for the worker listener to bind on. Defaults to
127.0.0.1:9202 if not specified. If address is specified but only an IP address is given, the port will default to 9202.

- `public_addr` - Specifies the public host or IP address (and optionally port)
at which the worker can be reached _by clients for proxying_. This defaults to
the address of the listener marked for `proxy` purpose. This is especially
useful for cloud environments that do not bind a publicly accessible IP to a NIC
on the host directly, such as an Amazon EIP.

- `controllers` - A list of hosts/IP addresses and optionally ports for reaching
controllers. The port will default to :9201 if not specified.

## KMS Configuration

Workers require a KMS block designated for `worker-auth`. This is the KMS configuration for
authentication between the workers and controllers and must be present. Example (not safe for production!):

```hcl 
  kms "aead" {
	purpose = "worker-auth"
	aead_type = "aes-gcm"
	key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ="
	key_id = "global_worker-auth"
}
```

This configuration must be the same for the worker-auth configuration for the controller if you're 
running the controller and worker as separate servers.

And optionally, a KMS stanza for configuration encryption purpose:

```hcl
# Configuration encryption block: decrypts sensitive values in the 
# configuration file. See `boundary config [encrypt|decrypt] -h`.
kms "aead" {
  purpose   = "config"`
  aead_type = "aes-gcm"
  key       = "7xtkEoS5EXPbgynwd+dDLHopaCqK8cq0Rpep4eooaTs="
}
```

Boundary supports many kinds of KMS integrations. For a complete guide to all available
KMS types, see our [KMS documentation](/docs/configuration/kms). 

# Complete Configuration Example

```hcl
listener "tcp" {
	purpose = "proxy"
	tls_disable = true
}

worker {
  # Name attr must be unique across workers
  name = "demo-worker-1"
  description = "A default worker created demonstration"
  address = 127.0.0.1

  # Workers must be able to reach controllers on :9202
  controllers = [
    "10.0.0.1",
    "10.0.0.2",
    "10.0.0.3",
  ]

  public_addr = "myhost.mycompany.com"
}

# must be same key as used on controller config
kms "aead" {
	purpose = "worker-auth"
	aead_type = "aes-gcm"
	key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ="
	key_id = "global_worker-auth"
}
```