# -----------------------

# Kong configuration file

# -----------------------

#

# The commented-out settings shown in this file represent the default values.

#

# This file is read when `kong start` or `kong prepare` are used. Kong

# generates the Nginx configuration with the settings specified in this file.

#

# All environment variables prefixed with `KONG_` and capitalized will override

# the settings specified in this file.

# Example:

# `log_level` setting -> `KONG_LOG_LEVEL` env variable

#

# Boolean values can be specified as `on`/`off` or `true`/`false`.

# Lists must be specified as comma-separated strings.

#

# All comments in this file can be removed safely, including the

# commented-out properties.

# You can verify the integrity of your settings with `kong check <conf>`.

#------------------------------------------------------------------------------

# GENERAL

#------------------------------------------------------------------------------

#prefix = /usr/local/kong/ # Working directory. Equivalent to Nginx's

# prefix path, containing temporary files

# and logs.

# Each Kong process must have a separate

# working directory.

#log_level = notice # Log level of the Nginx server. Logs are

# found at `<prefix>/logs/error.log`.

# See http://nginx.org/en/docs/ngx_core_module.html#error_log for a list

# of accepted values.

#proxy_access_log = logs/access.log # Path for proxy port request access

# logs. Set this value to `off` to

# disable logging proxy requests.

# If this value is a relative path,

# it will be placed under the

# `prefix` location.

#proxy_error_log = logs/error.log # Path for proxy port request error logs.

# The granularity of these logs is adjusted by the `log_level` property.

#proxy_stream_access_log = logs/access.log basic # Path for TCP streams proxy port access logs.

# Set to `off` to disable logging proxy requests.

# If this value is a relative path, it will be placed under the `prefix` location.

# `basic` is defined as `'$remote_addr [$time_local] '

# '$protocol $status $bytes_sent $bytes_received '

# '$session_time'`

#proxy_stream_error_log = logs/error.log # Path for tcp streams proxy port request error

# logs. The granularity of these logs

# is adjusted by the `log_level`

# property.

#admin_access_log = logs/admin_access.log # Path for Admin API request access logs.

# If hybrid mode is enabled and the current node is set

# to be the control plane, then the connection requests

# from data planes are also written to this file with

# server name "kong_cluster_listener".

#

# Set this value to `off` to disable logging Admin API requests.

# If this value is a relative path, it will be placed under the `prefix` location.

#admin_error_log = logs/error.log # Path for Admin API request error logs.

# The granularity of these logs is adjusted by the `log_level` property.

#status_access_log = off # Path for Status API request access logs.

# The default value of `off` implies that logging for this API

# is disabled by default.

# If this value is a relative path, it will be placed under the `prefix` location.

#status_error_log = logs/status_error.log # Path for Status API request error logs.

# The granularity of these logs is adjusted by the `log_level` property.

#vaults = bundled # Comma-separated list of vaults this node should load.

# By default, all the bundled vaults are enabled.

#

# The specified name(s) will be substituted as

# such in the Lua namespace:

# `kong.vaults.{name}.*`.

#opentelemetry_tracing = off # Deprecated: use `tracing_instrumentations` instead.

#tracing_instrumentations = off # Comma-separated list of tracing instrumentations this node should load.

# By default, no instrumentations are enabled.

#

# Valid values for this setting are:

#

# - `off`: do not enable instrumentations.

# - `request`: only enable request-level instrumentations.

# - `all`: enable all the following instrumentations.

# - `db_query`: trace database queries.

# - `dns_query`: trace DNS queries.

# - `router`: trace router execution, including router rebuilding.

# - `http_client`: trace OpenResty HTTP client requests.

# - `balancer`: trace balancer retries.

# - `plugin_rewrite`: trace plugin iterator execution with rewrite phase.

# - `plugin_access`: trace plugin iterator execution with access phase.

# - `plugin_header_filter`: trace plugin iterator execution with header_filter phase.

#

# **Note:** In the current implementation, tracing instrumentations are not enabled in stream mode.

#opentelemetry_tracing_sampling_rate = 1.0 # Deprecated: use `tracing_sampling_rate` instead.

#tracing_sampling_rate = 0.01 # Tracing instrumentation sampling rate.

# Tracer samples a fixed percentage of all spans

# following the sampling rate.

#

# Example: `0.25`, this accounts for 25% of all traces.

#plugins = bundled # Comma-separated list of plugins this node should load.

# By default, only plugins bundled in official distributions

# are loaded via the `bundled` keyword.

#

# Loading a plugin does not enable it by default, but only

# instructs Kong to load its source code and allows

# configuration via the various related Admin API endpoints.

#

# The specified name(s) will be substituted as such in the

# Lua namespace: `kong.plugins.{name}.*`.

#

# When the `off` keyword is specified as the only value,

# no plugins will be loaded.

#

# `bundled` and plugin names can be mixed together, as the

# following examples suggest:

#

# - `plugins = bundled,custom-auth,custom-log`

# will include the bundled plugins plus two custom ones.

# - `plugins = custom-auth,custom-log` will

# *only* include the `custom-auth` and `custom-log` plugins.

# - `plugins = off` will not include any plugins.

#

# **Note:** Kong will not start if some plugins were previously

# configured (i.e. have rows in the database) and are not

# specified in this list. Before disabling a plugin, ensure

# all instances of it are removed before restarting Kong.

#

# **Note:** Limiting the amount of available plugins can

# improve P99 latency when experiencing LRU churning in the

# database cache (i.e. when the configured `mem_cache_size`) is full.

#dedicated_config_processing = on # Enables or disables a special worker

# process for configuration processing. This process

# increases memory usage a little bit while

# allowing to reduce latencies by moving some

# background tasks, such as CP/DP connection

# handling, to an additional worker process specific

# to handling these background tasks.

# Currently this has effect only on data planes.

#pluginserver_names = # Comma-separated list of names for pluginserver

# processes. The actual names are used for

# log messages and to relate the actual settings.

#pluginserver_XXX_socket = <prefix>/<XXX>.socket # Path to the unix socket

# used by the <XXX> pluginserver.

#pluginserver_XXX_start_cmd = /usr/local/bin/<XXX> # Full command (including

# any needed arguments) to

# start the <XXX> pluginserver

#pluginserver_XXX_query_cmd = /usr/local/bin/query_<XXX> # Full command to "query" the

# <XXX> pluginserver. Should

# produce a JSON with the

# dump info of all plugins it

# manages

#port_maps = # With this configuration parameter, you can

# let Kong Gateway know the port from

# which the packets are forwarded to it. This

# is fairly common when running Kong in a

# containerized or virtualized environment.

# For example, `port_maps=80:8000, 443:8443`

# instructs Kong that the port 80 is mapped

# to 8000 (and the port 443 to 8443), where

# 8000 and 8443 are the ports that Kong is

# listening to.

#

# This parameter helps Kong set a proper

# forwarded upstream HTTP request header or to

# get the proper forwarded port with the Kong PDK

# (in case other means determining it has

# failed). It changes routing by a destination

# port to route by a port from which packets

# are forwarded to Kong, and similarly it

# changes the default plugin log serializer to

# use the port according to this mapping

# instead of reporting the port Kong is

# listening to.

#anonymous_reports = on # Send anonymous usage data such as error

# stack traces to help improve Kong.

#proxy_server = # Proxy server defined as a URL. Kong will only use this

# option if a component is explicitly configured

# to use a proxy.

#proxy_server_ssl_verify = off # Toggles server certificate verification if

# `proxy_server` is in HTTPS.

# See the `lua_ssl_trusted_certificate`

# setting to specify a certificate authority.

#error_template_html = # Path to the custom html error template to

# override the default html kong error

# template.

#

# The template may contain up to two `%s`

# placeholders. The first one will expand to

# the error message. The second one will

# expand to the request ID. Both placeholders

# are optional, but recommended.

# Adding more than two placeholders will

# result in a runtime error when trying to

# render the template:

# ```

# <html>

# <body>

# <h1>My custom error template</h1>

# <p>error: %s</p>

# <p>request_id: %s</p>

# </body>

# </html>

# ```

#error_template_json = # Path to the custom json error template to

# override the default json kong error

# template.

#

# Similarly to `error_template_html`, the

# template may contain up to two `%s`

# placeholders for the error message and the

# request ID respectively.

#error_template_xml = # Path to the custom xml error template to

# override the default xml kong error template

#

# Similarly to `error_template_html`, the

# template may contain up to two `%s`

# placeholders for the error message and the

# request ID respectively.

#error_template_plain = # Path to the custom plain error template to

# override the default plain kong error

# template

#

# Similarly to `error_template_html`, the

# template may contain up to two `%s`

# placeholders for the error message and the

# request ID respectively.

#------------------------------------------------------------------------------

# HYBRID MODE

#------------------------------------------------------------------------------

#role = traditional # Use this setting to enable hybrid mode,

# This allows running some Kong nodes in a

# control plane role with a database and

# have them deliver configuration updates

# to other nodes running to DB-less running in

# a data plane role.

#

# Valid values for this setting are:

#

# - `traditional`: do not use hybrid mode.

# - `control_plane`: this node runs in a

# control plane role. It can use a database

# and will deliver configuration updates

# to data plane nodes.

# - `data_plane`: this is a data plane node.

# It runs DB-less and receives configuration

# updates from a control plane node.

#cluster_mtls = shared # Sets the verification method between nodes of the cluster.

#

# Valid values for this setting are:

#

# - `shared`: use a shared certificate/key pair specified with

# the `cluster_cert` and `cluster_cert_key` settings.

# Note that CP and DP nodes must present the same certificate

# to establish mTLS connections.

# - `pki`: use `cluster_ca_cert`, `cluster_server_name`, and

# `cluster_cert` for verification. These are different

# certificates for each DP node, but issued by a cluster-wide

# common CA certificate: `cluster_ca_cert`.

# - `pki_check_cn`: similar to `pki` but additionally checks

# for the common name of the data plane certificate specified

# in `cluster_allowed_common_names`.

#cluster_cert = # Cluster certificate to use

# when establishing secure communication

# between control and data plane nodes.

# You can use the `kong hybrid` command to

# generate the certificate/key pair.

# Under `shared` mode, it must be the same

# for all nodes. Under `pki` mode it

# should be a different certificate for each

# DP node.

#

# The certificate can be configured on this

# property with either of the following values:

# * absolute path to the certificate

# * certificate content

# * base64 encoded certificate content

#cluster_cert_key = # Cluster certificate key to

# use when establishing secure communication

# between control and data plane nodes.

# You can use the `kong hybrid` command to

# generate the certificate/key pair.

# Under `shared` mode, it must be the same

# for all nodes. Under `pki` mode it

# should be a different certificate for each

# DP node.

#

# The certificate key can be configured on this

# property with either of the following values:

# - absolute path to the certificate key

# - certificate key content

# - base64 encoded certificate key content

#cluster_ca_cert = # The trusted CA certificate file in PEM format used for:

# - Control plane to verify data plane's certificate

# - Data plane to verify control plane's certificate

#

# Required on data plane if `cluster_mtls` is set to `pki`.

# If the control plane certificate is issued by a well-known CA,

# set `lua_ssl_trusted_certificate=system` on the data plane and leave this field empty.

#

# This field is ignored if `cluster_mtls` is set to `shared`.

#

# The certificate can be configured on this property with any of the following values:

# - absolute path to the certificate

# - certificate content

# - base64 encoded certificate content

#------------------------------------------------------------------------------

# HYBRID MODE DATA PLANE

#------------------------------------------------------------------------------

#cluster_server_name = # The server name used in the SNI of the TLS

# connection from a DP node to a CP node.

# Must match the Common Name (CN) or Subject

# Alternative Name (SAN) found in the CP

# certificate.

# If `cluster_mtls` is set to

# `shared`, this setting is ignored and

# `kong_clustering` is used.

#cluster_control_plane = # To be used by data plane nodes only:

# address of the control plane node from which

# configuration updates will be fetched,

# in `host:port` format.

#cluster_max_payload = 16777216

# This sets the maximum compressed payload size allowed

# to be sent across from CP to DP in Hybrid mode

# Default is 16MB - 16 * 1024 * 1024.

#cluster_dp_labels = # Comma-separated list of labels for the data plane.

# Labels are key-value pairs that provide additional

# context information for each DP.

# Each label must be configured as a string in the

# format `key:value`.

#

# Labels are only compatible with hybrid mode

# deployments with Kong Konnect (SaaS).

# This configuration doesn't work with

# self-hosted deployments.

#

# Keys and values follow the AIP standards:

# https://kong-aip.netlify.app/aip/129/

#

# Example:

# `deployment:mycloud,region:us-east-1`

#------------------------------------------------------------------------------

# HYBRID MODE CONTROL PLANE

#------------------------------------------------------------------------------

#cluster_listen = 0.0.0.0:8005

# Comma-separated list of addresses and ports on

# which the cluster control plane server should listen

# for data plane connections.

# The cluster communication port of the control plane

# must be accessible by all the data planes

# within the same cluster. This port is mTLS protected

# to ensure end-to-end security and integrity.

#

# This setting has no effect if `role` is not set to

# `control_plane`.

#

# Connections made to this endpoint are logged

# to the same location as Admin API access logs.

# See `admin_access_log` config description for more

# information.

#cluster_data_plane_purge_delay = 1209600

# How many seconds must pass from the time a DP node

# becomes offline to the time its entry gets removed

# from the database, as returned by the

# /clustering/data-planes Admin API endpoint.

#

# This is to prevent the cluster data plane table from

# growing indefinitely. The default is set to

# 14 days. That is, if the CP hasn't heard from a DP for

# 14 days, its entry will be removed.

#cluster_ocsp = off

# Whether to check for revocation status of DP

# certificates using OCSP (Online Certificate Status Protocol).

# If enabled, the DP certificate should contain the

# "Certificate Authority Information Access" extension

# and the OCSP method with URI of which the OCSP responder

# can be reached from CP.

#

# OCSP checks are only performed on CP nodes, it has no

# effect on DP nodes.

#

# Valid values for this setting are:

#

# - `on`: OCSP revocation check is enabled and DP

# must pass the check in order to establish

# connection with CP.

# - `off`: OCSP revocation check is disabled.

# - `optional`: OCSP revocation check will be attempted,

# however, if the required extension is not

# found inside DP-provided certificate

# or communication with the OCSP responder

# failed, then DP is still allowed through.

#cluster_use_proxy = off

# Whether to turn on HTTP CONNECT proxy support for

# hybrid mode connections. `proxy_server` will be used

# for hybrid mode connections if this option is turned on.

#------------------------------------------------------------------------------

# NGINX

#------------------------------------------------------------------------------

#proxy_listen = 0.0.0.0:8000 reuseport backlog=16384, 0.0.0.0:8443 http2 ssl reuseport backlog=16384

# Comma-separated list of addresses and ports on

# which the proxy server should listen for

# HTTP/HTTPS traffic.

# The proxy server is the public entry point of Kong,

# which proxies traffic from your consumers to your

# backend services. This value accepts IPv4, IPv6, and

# hostnames.

#

# Some suffixes can be specified for each pair:

#

# - `ssl` will require that all connections made

# through a particular address/port be made with TLS

# enabled.

# - `http2` will allow for clients to open HTTP/2

# connections to Kong's proxy server.

# - `proxy_protocol` will enable usage of the

# PROXY protocol for a given address/port.

# - `deferred` instructs to use a deferred accept on

# Linux (the `TCP_DEFER_ACCEPT` socket option).

# - `bind` instructs to make a separate bind() call

# for a given address:port pair.

# - `reuseport` instructs to create an individual

# listening socket for each worker process,

# allowing the kernel to better distribute incoming

# connections between worker processes.

# - `backlog=N` sets the maximum length for the queue

# of pending TCP connections. This number should

# not be too small to prevent clients

# seeing "Connection refused" errors when connecting to

# a busy Kong instance.

# **Note:** On Linux, this value is limited by the

# setting of the `net.core.somaxconn` kernel parameter.

# In order for the larger `backlog` set here to take

# effect, it is necessary to raise

# `net.core.somaxconn` at the same time to match or

# exceed the `backlog` number set.

# - `ipv6only=on|off` specifies whether an IPv6 socket listening

# on a wildcard address [::] will accept only IPv6

# connections or both IPv6 and IPv4 connections.

# - `so_keepalive=on|off|[keepidle]:[keepintvl]:[keepcnt]`

# configures the `TCP keepalive` behavior for the listening

# socket. If this parameter is omitted, the operating

# system’s settings will be in effect for the socket. If it

# is set to the value `on`, the `SO_KEEPALIVE` option is turned

# on for the socket. If it is set to the value `off`, the

# `SO_KEEPALIVE` option is turned off for the socket. Some

# operating systems support setting of TCP keepalive parameters

# on a per-socket basis using the `TCP_KEEPIDLE`,` TCP_KEEPINTVL`,

# and `TCP_KEEPCNT` socket options.

#

# This value can be set to `off`, thus disabling

# the HTTP/HTTPS proxy port for this node.

# If `stream_listen` is also set to `off`, this enables

# control plane mode for this node

# (in which all traffic proxying capabilities are

# disabled). This node can then be used only to

# configure a cluster of Kong

# nodes connected to the same datastore.

#

# Example:

# `proxy_listen = 0.0.0.0:443 ssl, 0.0.0.0:444 http2 ssl`

#

# See http://nginx.org/en/docs/http/ngx_http_core_module.html#listen

# for a description of the accepted formats for this

# and other `*_listen` values.

#

# See https://www.nginx.com/resources/admin-guide/proxy-protocol/

# for more details about the `proxy_protocol`

# parameter.

#

# Not all `*_listen` values accept all formats

# specified in nginx's documentation.

#stream_listen = off

# Comma-separated list of addresses and ports on

# which the stream mode should listen.

#

# This value accepts IPv4, IPv6, and hostnames.

# Some suffixes can be specified for each pair:

# - `ssl` will require that all connections made

# through a particular address/port be made with TLS

# enabled.

# - `proxy_protocol` will enable usage of the

# PROXY protocol for a given address/port.

# - `bind` instructs to make a separate bind() call

# for a given address:port pair.

# - `reuseport` instructs to create an individual

# listening socket for each worker process,

# allowing the kernel to better distribute incoming

# connections between worker processes.

# - `backlog=N` sets the maximum length for the queue

# of pending TCP connections. This number should

# not be too small to prevent clients

# seeing "Connection refused" errors when connecting to

# a busy Kong instance.

# **Note:** On Linux, this value is limited by the

# setting of the `net.core.somaxconn` kernel parameter.

# In order for the larger `backlog` set here to take

# effect, it is necessary to raise

# `net.core.somaxconn` at the same time to match or

# exceed the `backlog` number set.

# - `ipv6only=on|off` specifies whether an IPv6 socket listening

# on a wildcard address [::] will accept only IPv6

# connections or both IPv6 and IPv4 connections.

# - `so_keepalive=on|off|[keepidle]:[keepintvl]:[keepcnt]`

# configures the `TCP keepalive` behavior for the listening

# socket. If this parameter is omitted, the operating

# system’s settings will be in effect for the socket. If it

# is set to the value `on`, the `SO_KEEPALIVE` option is turned

# on for the socket. If it is set to the value `off`, the

# `SO_KEEPALIVE` option is turned off for the socket. Some

# operating systems support setting of TCP keepalive parameters

# on a per-socket basis using the` TCP_KEEPIDLE`, `TCP_KEEPINTVL`,

# and `TCP_KEEPCNT` socket options.

#

# Examples:

#

# ```

# stream_listen = 127.0.0.1:7000 reuseport backlog=16384

# stream_listen = 0.0.0.0:989 reuseport backlog=65536, 0.0.0.0:20

# stream_listen = [::1]:1234 backlog=16384

# ```

#

# By default, this value is set to `off`, thus

# disabling the stream proxy port for this node.

# See http://nginx.org/en/docs/stream/ngx_stream_core_module.html#listen

# for a description of the formats that Kong might accept in stream_listen.

#admin_listen = 127.0.0.1:8001 reuseport backlog=16384, 127.0.0.1:8444 http2 ssl reuseport backlog=16384

# Comma-separated list of addresses and ports on

# which the Admin interface should listen.

# The Admin interface is the API allowing you to

# configure and manage Kong.

# Access to this interface should be *restricted*

# to Kong administrators *only*. This value accepts

# IPv4, IPv6, and hostnames.

#

# It is highly recommended to avoid exposing the Admin API to public

# interfaces, by using values such as `0.0.0.0:8001`

#

# See https://docs.konghq.com/gateway/latest/production/running-kong/secure-admin-api/

# for more information about how to secure your Admin API.

#

# Some suffixes can be specified for each pair:

#

# - `ssl` will require that all connections made

# through a particular address/port be made with TLS

# enabled.

# - `http2` will allow for clients to open HTTP/2

# connections to Kong's proxy server.

# - `proxy_protocol` will enable usage of the

# PROXY protocol for a given address/port.

# - `deferred` instructs to use a deferred accept on

# Linux (the `TCP_DEFER_ACCEPT` socket option).

# - `bind` instructs to make a separate bind() call

# for a given address:port pair.

# - `reuseport` instructs to create an individual

# listening socket for each worker process,

# allowing the Kernel to better distribute incoming

# connections between worker processes.

# - `backlog=N` sets the maximum length for the queue

# of pending TCP connections. This number should

# not be too small to prevent clients

# seeing "Connection refused" errors when connecting to

# a busy Kong instance.

# **Note:** On Linux, this value is limited by the

# setting of the `net.core.somaxconn` kernel parameter.

# In order for the larger `backlog` set here to take

# effect, it is necessary to raise

# `net.core.somaxconn` at the same time to match or

# exceed the `backlog` number set.

# - `ipv6only=on|off` specifies whether an IPv6 socket listening

# on a wildcard address [::] will accept only IPv6

# connections or both IPv6 and IPv4 connections.

# - `so_keepalive=on|off|[keepidle]:[keepintvl]:[keepcnt]`

# configures the “TCP keepalive” behavior for the listening

# socket. If this parameter is omitted, the operating

# system’s settings will be in effect for the socket. If it

# is set to the value `on`, the `SO_KEEPALIVE` option is turned

# on for the socket. If it is set to the value `off`, the

# `SO_KEEPALIVE` option is turned off for the socket. Some

# operating systems support setting of TCP keepalive parameters

# on a per-socket basis using the `TCP_KEEPIDLE`, `TCP_KEEPINTVL`,

# and `TCP_KEEPCNT` socket options.

#

# This value can be set to `off`, thus disabling

# the Admin interface for this node, enabling a

# data plane mode (without configuration

# capabilities) pulling its configuration changes

# from the database.

#

# Example: `admin_listen = 127.0.0.1:8444 http2 ssl`

#status_listen = 127.0.0.1:8007 reuseport backlog=16384

# Comma-separated list of addresses and ports on

# which the Status API should listen.

# The Status API is a read-only endpoint

# allowing monitoring tools to retrieve metrics,

# healthiness, and other non-sensitive information

# of the current Kong node.

#

# The following suffix can be specified for each pair:

#

# - `ssl` will require that all connections made

# through a particular address/port be made with TLS

# enabled.

# - `http2` will allow for clients to open HTTP/2

# connections to Kong's Status API server.

# - `proxy_protocol` will enable usage of the PROXY protocol.

#

# This value can be set to `off`, disabling

# the Status API for this node.

#

# Example: `status_listen = 0.0.0.0:8100 ssl http2`

#nginx_user = kong kong # Defines user and group credentials used by

# worker processes. If group is omitted, a

# group whose name equals that of user is

# used.

#

# Example: `nginx_user = nginx www`

#

# **Note**: If the `kong` user and the `kong`

# group are not available, the default user

# and group credentials will be

# `nobody nobody`.

#nginx_worker_processes = auto # Determines the number of worker processes

# spawned by Nginx.

#

# See http://nginx.org/en/docs/ngx_core_module.html#worker_processes

# for detailed usage of the equivalent Nginx

# directive and a description of accepted

# values.

#nginx_daemon = on # Determines whether Nginx will run as a daemon

# or as a foreground process. Mainly useful

# for development or when running Kong inside

# a Docker environment.

#

# See http://nginx.org/en/docs/ngx_core_module.html#daemon.

#mem_cache_size = 128m # Size of each of the two shared memory caches

# for traditional mode database entities

# and runtime data, `kong_core_cache` and

# `kong_cache`.

#

# The accepted units are `k` and `m`, with a minimum

# recommended value of a few MBs.

#

# **Note**: As this option controls the size of two

# different cache zones, the total memory Kong

# uses to cache entities might be double this value.

# The created zones are shared by all worker

# processes and do not become larger when more

# workers are used.

#ssl_cipher_suite = intermediate # Defines the TLS ciphers served by Nginx.

# Accepted values are `modern`,

# `intermediate`, `old`, `fips` or `custom`.

# If you want to enable TLSv1.1, this value has to be `old`.

#

# See https://wiki.mozilla.org/Security/Server_Side_TLS

# for detailed descriptions of each cipher

# suite. `fips` cipher suites are as described in

# https://wiki.openssl.org/index.php/FIPS_mode_and_TLS.

#ssl_ciphers = # Defines a custom list of TLS ciphers to be

# served by Nginx. This list must conform to

# the pattern defined by `openssl ciphers`.

# This value is ignored if `ssl_cipher_suite`

# is not `custom`.

# If you use DHE ciphers, you must also

# configure the `ssl_dhparam` parameter.

#ssl_protocols = TLSv1.2 TLSv1.3

# Enables the specified protocols for

# client-side connections. The set of

# supported protocol versions also depends

# on the version of OpenSSL Kong was built

# with. This value is ignored if

# `ssl_cipher_suite` is not `custom`.

# If you want to enable TLSv1.1, you should

# set `ssl_cipher_suite` to `old`.

#

# See http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols

#ssl_prefer_server_ciphers = on # Specifies that server ciphers should be

# preferred over client ciphers when using

# the SSLv3 and TLS protocols. This value is

# ignored if `ssl_cipher_suite` is not `custom`.

#

# See http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers

#ssl_dhparam = # Defines DH parameters for DHE ciphers from the

# predefined groups: `ffdhe2048`, `ffdhe3072`,

# `ffdhe4096`, `ffdhe6144`, `ffdhe8192`,

# from the absolute path to a parameters file, or

# directly from the parameters content.

#

# This value is ignored if `ssl_cipher_suite`

# is `modern` or `intermediate`. The reason is

# that `modern` has no ciphers that need this,

# and `intermediate` uses `ffdhe2048`.

#

# See http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam

#ssl_session_tickets = on # Enables or disables session resumption through

# TLS session tickets. This has no impact when

# used with TLSv1.3.

#

# Kong enables this by default for performance

# reasons, but it has security implications:

# https://github.com/mozilla/server-side-tls/issues/135

#

# See http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_tickets

#ssl_session_timeout = 1d # Specifies a time during which a client may

# reuse the session parameters. See the rationale:

# https://github.com/mozilla/server-side-tls/issues/198

#

# See http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_timeout

#ssl_session_cache_size = 10m # Sets the size of the caches that store session parameters.

#

# See https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache

#ssl_cert = # Comma-separated list of certificates for `proxy_listen` values with TLS enabled.

#

# If more than one certificate is specified, it can be used to provide

# alternate types of certificates (for example, ECC certificates) that will be served

# to clients that support them. Note that to properly serve using ECC certificates,

# it is recommended to also set `ssl_cipher_suite` to

# `modern` or `intermediate`.

#

# Unless this option is explicitly set, Kong will auto-generate

# a pair of default certificates (RSA + ECC) the first time it starts up and use

# them for serving TLS requests.

#

# Certificates can be configured on this property with any of the following

# values:

# - absolute path to the certificate

# - certificate content

# - base64 encoded certificate content

#ssl_cert_key = # Comma-separated list of keys for `proxy_listen` values with TLS enabled.

#

# If more than one certificate was specified for `ssl_cert`, then this

# option should contain the corresponding key for all certificates

# provided in the same order.

#

# Unless this option is explicitly set, Kong will auto-generate

# a pair of default private keys (RSA + ECC) the first time it starts up and use

# them for serving TLS requests.

#

# Keys can be configured on this property with any of the following

# values:

# - absolute path to the certificate key

# - certificate key content

# - base64 encoded certificate key content

#client_ssl = off # Determines if Nginx should attempt to send client-side

# TLS certificates and perform Mutual TLS Authentication

# with upstream service when proxying requests.

#client_ssl_cert = # If `client_ssl` is enabled, the client certificate

# for the `proxy_ssl_certificate` directive.

#

# This value can be overwritten dynamically with the `client_certificate`

# attribute of the `Service` object.

#

# The certificate can be configured on this property with any of the following

# values:

# - absolute path to the certificate

# - certificate content

# - base64 encoded certificate content

#client_ssl_cert_key = # If `client_ssl` is enabled, the client TLS key

# for the `proxy_ssl_certificate_key` directive.

#

# This value can be overwritten dynamically with the `client_certificate`

# attribute of the `Service` object.

#

# The certificate key can be configured on this property with any of the following

# values:

# - absolute path to the certificate key

# - certificate key content

# - base64 encoded certificate key content

#admin_ssl_cert = # Comma-separated list of certificates for `admin_listen` values with TLS enabled.

#

# See docs for `ssl_cert` for detailed usage.

#admin_ssl_cert_key = # Comma-separated list of keys for `admin_listen` values with TLS enabled.

#

# See docs for `ssl_cert_key` for detailed usage.

#status_ssl_cert = # Comma-separated list of certificates for `status_listen` values with TLS enabled.

#

# See docs for `ssl_cert` for detailed usage.

#status_ssl_cert_key = # Comma-separated list of keys for `status_listen` values with TLS enabled.

#

# See docs for `ssl_cert_key` for detailed usage.

#debug_ssl_cert = # Comma-separated list of certificates for `debug_listen` values with TLS enabled.

#

# See docs for `ssl_cert` for detailed usage.

#debug_ssl_cert_key = # Comma-separated list of keys for `debug_listen` values with TLS enabled.

#

# See docs for `ssl_cert_key` for detailed usage.

#headers = server_tokens, latency_tokens, X-Kong-Request-Id

# Comma-separated list of headers Kong should

# inject in client responses.

#

# Accepted values are:

# - `Server`: Injects `Server: kong/x.y.z`

# on Kong-produced responses (e.g., Admin

# API, rejected requests from auth plugin).

# - `Via`: Injects `Via: kong/x.y.z` for

# successfully proxied requests.

# - `X-Kong-Proxy-Latency`: Time taken

# (in milliseconds) by Kong to process

# a request and run all plugins before

# proxying the request upstream.

# - `X-Kong-Response-Latency`: Time taken

# (in milliseconds) by Kong to produce

# a response in case of, e.g., a plugin

# short-circuiting the request, or in

# case of an error.

# - `X-Kong-Upstream-Latency`: Time taken

# (in milliseconds) by the upstream

# service to send response headers.

# - `X-Kong-Admin-Latency`: Time taken

# (in milliseconds) by Kong to process

# an Admin API request.

# - `X-Kong-Upstream-Status`: The HTTP status

# code returned by the upstream service.

# This is particularly useful for clients to

# distinguish upstream statuses if the

# response is rewritten by a plugin.

# - `X-Kong-Request-Id`: Unique identifier of

# the request.

# - `server_tokens`: Same as specifying both

# `Server` and `Via`.

# - `latency_tokens`: Same as specifying

# `X-Kong-Proxy-Latency`,

# `X-Kong-Response-Latency`,

# `X-Kong-Admin-Latency`, and

# `X-Kong-Upstream-Latency`.

#

# In addition to these, this value can be set

# to `off`, which prevents Kong from injecting

# any of the above headers. Note that this

# does not prevent plugins from injecting

# headers of their own.

#

# Example: `headers = via, latency_tokens`

#headers_upstream = X-Kong-Request-Id

# Comma-separated list of headers Kong should

# inject in requests to upstream.

#

# At this time, the only accepted value is:

# - `X-Kong-Request-Id`: Unique identifier of

# the request.

#

# In addition, this value can be set

# to `off`, which prevents Kong from injecting

# the above header. Note that this

# does not prevent plugins from injecting

# headers of their own.

#trusted_ips = # Defines trusted IP address blocks that are

# known to send correct `X-Forwarded-*`

# headers.

# Requests from trusted IPs make Kong forward

# their `X-Forwarded-*` headers upstream.

# Non-trusted requests make Kong insert its

# own `X-Forwarded-*` headers.

#

# This property also sets the

# `set_real_ip_from` directive(s) in the Nginx

# configuration. It accepts the same type of

# values (CIDR blocks) but as a

# comma-separated list.

#

# To trust *all* IPs, set this value to

# `0.0.0.0/0,::/0`.

#

# If the special value `unix:` is specified,

# all UNIX-domain sockets will be trusted.

#

# See http://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from

# for examples of accepted values.

#real_ip_header = X-Real-IP # Defines the request header field whose value

# will be used to replace the client address.

# This value sets the `ngx_http_realip_module`

# directive of the same name in the Nginx

# configuration.

#

# If this value receives `proxy_protocol`:

#

# - at least one of the `proxy_listen` entries

# must have the `proxy_protocol` flag

# enabled.

# - the `proxy_protocol` parameter will be

# appended to the `listen` directive of the

# Nginx template.

#

# See http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header

# for a description of this directive.

#real_ip_recursive = off # This value sets the `ngx_http_realip_module`

# directive of the same name in the Nginx

# configuration.

#

# See http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_recursive

# for a description of this directive.

#error_default_type = text/plain # Default MIME type to use when the request

# `Accept` header is missing and Nginx

# is returning an error for the request.

# Accepted values are `text/plain`,

# `text/html`, `application/json`, and

# `application/xml`.

#upstream_keepalive_pool_size = 512 # Sets the default size of the upstream

# keepalive connection pools.

# Upstream keepalive connection pools

# are segmented by the `dst ip/dst

# port/SNI` attributes of a connection.

# A value of `0` will disable upstream

# keepalive connections by default, forcing

# each upstream request to open a new

# connection.

#upstream_keepalive_max_requests = 10000 # Sets the default maximum number of

# requests that can be proxied upstream

# through one keepalive connection.

# After the maximum number of requests

# is reached, the connection will be

# closed.

# A value of `0` will disable this

# behavior, and a keepalive connection

# can be used to proxy an indefinite