c05fa66096
Co-authored-by: Robin Beck <stellarsquall@users.noreply.github.com> Co-authored-by: XingLu Wang <95828202+xingluw@users.noreply.github.com> Co-authored-by: Loann Le <84412881+taoism4504@users.noreply.github.com> Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com> Co-authored-by: irenarindos <irena.rindos@gmail.com> Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com> Co-authored-by: Louis Ruch <louisruch@gmail.com> Co-authored-by: XingLu Wang <xinglu.wang@hashicorp.com> Co-authored-by: XingLu Wang <95828202+xingluw@users.noreply.github.com>
84 lines
3.2 KiB
Plaintext
84 lines
3.2 KiB
Plaintext
---
|
||
layout: docs
|
||
page_title: Overview/Top-Level Parameters
|
||
description: Boundary configuration reference.
|
||
---
|
||
|
||
# Configuration
|
||
|
||
[listener]: /docs/configuration/listener
|
||
[controller]: /docs/configuration/controller
|
||
[worker]: /docs/configuration/worker
|
||
[kms]: /docs/configuration/kms
|
||
[plugins]: /docs/configuration/plugins
|
||
|
||
Outside of development mode, Boundary controllers and workers are configured
|
||
using a file. The format of this file is
|
||
[HCL](https://github.com/hashicorp/hcl). In this section you'll find
|
||
configuration block examples for Boundary controllers and workers.
|
||
|
||
After the configuration is written, use the `-config` flag to specify a local
|
||
path to the file.
|
||
|
||
## Parameters
|
||
|
||
- [`controller`](/docs/configuration/controller): Controller specific
|
||
configuration. If present, `boundary server` will start a Controller subprocess.
|
||
|
||
- [`worker`](/docs/configuration/worker): Worker specific configuration. If
|
||
present, `boundary server` will start a Worker subprocess.
|
||
|
||
- [`listener`](/docs/configuration/listener): Configures the listeners on which
|
||
Boundary serves traffic (API, cluster, and proxy).
|
||
|
||
Controllers must have at least two listener blocks defined: one marked for
|
||
`api` purpose and the other marked for `cluster` purpose.
|
||
|
||
Workers will have only one listener, marked for `proxy` purpose.
|
||
|
||
Optionally, the `ops` purpose listener block serves as a higher-level listener
|
||
where Boundary's operational endpoints live (eg: /health).
|
||
|
||
|
||
- [`kms`](/docs/configuration/kms): Configures KMS blocks [for various
|
||
purposes](/docs/concepts/security/data-encryption).
|
||
|
||
- [`plugins`](/docs/configuration/plugins): Configures options for plugins.
|
||
|
||
- `disable_mlock` `(bool: false)` – Disables the server from executing the
|
||
`mlock` syscall, which prevents memory from being swapped to disk. This is
|
||
fine for local development and testing; in production, it is not recommended
|
||
unless the systems running Boundary only use encrypted swap or do not use swap
|
||
at all. Boundary only supports memory locking on UNIX-like systems that
|
||
support the mlock() syscall (Linux, FreeBSD, etc).
|
||
|
||
On Linux, to give the Boundary executable the ability to use the `mlock`
|
||
syscall without running the process as root, run:
|
||
|
||
```shell
|
||
sudo setcap cap_ipc_lock=+ep $(readlink -f $(which boundary))
|
||
```
|
||
|
||
If you use a Linux distribution with a modern version of systemd, you can add
|
||
the following directive to the "[Service]" configuration section:
|
||
|
||
```ini
|
||
LimitMEMLOCK=infinity
|
||
```
|
||
|
||
- `log_level` `(string: "info")` – (Deprecated: this is being phased out in
|
||
favor of observability and is currently only used as a backup if eventing
|
||
fails.) Specifies the log level to use; overridden by CLI and env var
|
||
parameters. Supported log levels: Trace, Debug, Error, Warn, Info.
|
||
|
||
- `log_format` `(string: "")` – (Deprecated: this is being phased out in favor
|
||
of observability and is currently only used as a backup if eventing fails.)
|
||
Specifies the log format to use; overridden by CLI and env var parameters.
|
||
Supported log formats: `"standard"`, `"json"`.
|
||
|
||
## Example Configurations
|
||
|
||
For complete example configurations see the sections for
|
||
[controller](/docs/configuration/controller) and
|
||
[worker](/docs/configuration/worker).
|