You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on May 27, 2019. It is now read-only.
| <aname="worker-processes"></a>deis-router |RC|[router.deis.io/nginx.workerProcesses](#worker-processes)|`"auto"` (number of CPU cores) | Number of worker processes to start. |
250
-
| <aname="worker-connections"></a>deis-router |RC|[router.deis.io/nginx.workerConnections](#worker-connections)|`"768"`| Maximum number of simultaneous connections that can be opened by a worker process. |
251
-
| <aname="traffic-status-zone-size"></a>deis-router |RC|[router.deis.io/nginx.trafficStatusZoneSize](#traffic-status-zone-size)|`"1m"`| Size of a shared memory zone for storing stats collected by the Nginx [VTS module](https://github.com/vozlt/nginx-module-vts#vhost_traffic_status_zone) expressed in bytes (no suffix), kilobytes (suffixes `k` and `K`), or megabytes (suffixes `m` and `M`). |
252
-
| <aname="default-timeout"></a>deis-router |RC|[router.deis.io/nginx.defaultTimeout](#default-timeout)|`"1300s"`| Default timeout value expressed in units `ms`, `s`, `m`, `h`, `d`, `w`, `M`, or `y`. Should be longer than the front-facing load balancer's idle timeout. |
253
-
| <aname="server-name-hash-max-size"></a>deis-router |RC|[router.deis.io/nginx.serverNameHashMaxSize](#server-name-hash-max-size)|`"512"`| nginx `server_names_hash_max_size` setting expressed in bytes (no suffix), kilobytes (suffixes `k` and `K`), or megabytes (suffixes `m` and `M`). |
254
-
| <aname="server-name-hash-bucket-size"></a>deis-router |RC|[router.deis.io/nginx.serverNameHashBucketSize](#server-name-hash-bucket-size)|`"64"`| nginx `server_names_hash_bucket_size` setting expressed in bytes (no suffix), kilobytes (suffixes `k` and `K`), or megabytes (suffixes `m` and `M`). |
255
-
| <aname="gzip-enabled"></a>deis-router |RC|[router.deis.io/nginx.gzip.enabled](#gzip-enabled)|`"true"`| Whether to enable gzip compression. |
| <aname="body-size"></a>deis-router |RC|[router.deis.io/nginx.bodySize](#body-size)|`"1m"`| nginx `client_max_body_size` setting expressed in bytes (no suffix), kilobytes (suffixes `k` and `K`), or megabytes (suffixes `m` and `M`). |
264
-
| <aname="proxy-real-ip-cidrs"></a>deis-router |RC|[router.deis.io/nginx.proxyRealIpCidrs](#proxy-real-ip-cidrs)|`"10.0.0.0/8"`| Comma-delimited list of IP/CIDRs that define trusted addresses that are known to send correct replacement addresses. These map to multiple nginx `set_real_ip_from` directives. |
265
-
| <aname="error-log-level"></a>deis-router |RC|[router.deis.io/nginx.errorLogLevel](#error-log-level)|`"error"`| Log level used in the nginx `error_log` setting (valid values are: `debug`, `info`, `notice`, `warn`, `error`, `crit`, `alert`, and `emerg`). |
266
-
| <aname="platform-domain"></a>deis-router |RC|[router.deis.io/nginx.platformDomain](#platform-domain)| N/A | This defines the router's platform domain. Any domains added to a routable application _not_ containing the `.` character will be assumed to be subdomains of this platform domain. Thus, for example, a platform domain of `example.com` coupled with a routable app counting `foo` among its domains will result in router configuration that routes traffic for `foo.example.com` to that application. |
267
-
| <aname="use-proxy-protocol"></a>deis-router |RC|[router.deis.io/nginx.useProxyProtocol](#use-proxy-protocol)|`"false"`| PROXY is a simple protocol supported by nginx, HAProxy, Amazon ELB, and others. It provides a method to obtain information about a request's originating IP address from an external (to Kubernetes) load balancer in front of the router. Enabling this option allows the router to select the originating IP from the HTTP `X-Forwarded-For` header. |
268
-
| <aname="enforce-whitelists"></a>deis-router |RC|[router.deis.io/nginx.enforceWhitelists](#enforce-whitelists)|`"false"`| Whether to _require_ application-level whitelists that explicitly enumerate allowed clients by IP / CIDR range. With this enabled, each app will drop _all_ requests unless a whitelist has been defined. |
269
-
| <aname="default-whitelist"></a>deis-router |RC|[router.deis.io/nginx.defaultWhitelist](#default-whitelist)| N/A | A default (router-wide) whitelist expressed as a comma-delimited list of addresses (using IP or CIDR notation). Application-specific whitelists can either extend or override this default. |
270
-
| <aname="whitelist-mode"></a>deis-router |RC|[router.deis.io/nginx.whitelistMode](#whitelist-mode)|`"extend"`| Whether application-specific whitelists should extend or override the router-wide default whitelist (if defined). Valid values are `"extend"` and `"override"`. |
271
-
| <aname="http2-enabled"></a>deis-router |RC|[router.deis.io/nginx.http2Enabled](#http2-enabled)|`"true"`| Whether to enable HTTP2 for apps on the SSL ports. |
272
-
| <aname="ssl-enforce"></a>deis-router |RC|[router.deis.io/nginx.ssl.enforce](#ssl-enforce)|`"false"`| Whether to respond with a 301 for all HTTP requests with a permanent redirect to the HTTPS equivalent address. |
| <a name="ssl-ciphers"></a>deis-router | RC | [router.deis.io/nginx.ssl.ciphers](#ssl-ciphers) | `"ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS"` | nginx `ssl_ciphers`. The default ciphers are taken from the intermediate compatibility section in the [Mozilla Wiki on Security/Server Side TLS](https://wiki.mozilla.org/Security/Server_Side_TLS). If the value is set to the empty string, OpenSSL's default ciphers are used. In _all_ cases, server side cipher preferences (order matters) are used. |
| <aname="ssl-session-timeout"></a>deis-router |RC|[router.deis.io/nginx.ssl.sessionTimeout](#ssl-session-timeout)|`"10m"`| nginx `ssl_session_timeout` expressed in units `ms`, `s`, `m`, `h`, `d`, `w`, `M`, or `y`. |
277
-
| <aname="ssl-use-session-tickets"></a>deis-router |RC|[router.deis.io/nginx.ssl.useSessionTickets](#ssl-use-session-tickets)|`"true"`| Whether to use [TLS session tickets](http://tools.ietf.org/html/rfc5077) for session resumption without server-side state. |
278
-
| <aname="ssl-buffer-size"></a>deis-router |RC|[router.deis.io/nginx.ssl.bufferSize](#ssl-buffer-size)|`"4k"`| nginx `ssl_buffer_size` setting expressed in bytes (no suffix), kilobytes (suffixes `k` and `K`), or megabytes (suffixes `m` and `M`). |
279
-
| <aname="ssl-hsts-enabled"></a>deis-router |RC|[router.deis.io/nginx.ssl.hsts.enabled](#ssl-hsts-enabled)|`"false"`| Whether to use HTTP Strict Transport Security. |
280
-
| <aname="ssl-hsts-max-age"></a>deis-router |RC|[router.deis.io/nginx.ssl.hsts.maxAge](#ssl-hsts-max-age)|`"10886400"`| Maximum number of seconds user agents should observe HSTS rewrites. |
281
-
| <aname="ssl-hsts-include-sub-domains"></a>deis-router |RC|[router.deis.io/nginx.ssl.hsts.includeSubDomains](#ssl-hsts-include-sub-domains)|`"false"`| Whether to enforce HSTS for subsequent requests to all subdomains of the original request. |
282
-
| <aname="ssl-hsts-preload"></a>deis-router |RC|[router.deis.io/nginx.ssl.hsts.preload](#ssl-hsts-preload)|`"false"`| Whether to allow the domain to be included in the HSTS preload list. |
249
+
| <aname="worker-processes"></a>deis-router |deployment|[router.deis.io/nginx.workerProcesses](#worker-processes)|`"auto"` (number of CPU cores) | Number of worker processes to start. |
250
+
| <aname="worker-connections"></a>deis-router |deployment|[router.deis.io/nginx.workerConnections](#worker-connections)|`"768"`| Maximum number of simultaneous connections that can be opened by a worker process. |
251
+
| <aname="traffic-status-zone-size"></a>deis-router |deployment|[router.deis.io/nginx.trafficStatusZoneSize](#traffic-status-zone-size)|`"1m"`| Size of a shared memory zone for storing stats collected by the Nginx [VTS module](https://github.com/vozlt/nginx-module-vts#vhost_traffic_status_zone) expressed in bytes (no suffix), kilobytes (suffixes `k` and `K`), or megabytes (suffixes `m` and `M`). |
252
+
| <aname="default-timeout"></a>deis-router |deployment|[router.deis.io/nginx.defaultTimeout](#default-timeout)|`"1300s"`| Default timeout value expressed in units `ms`, `s`, `m`, `h`, `d`, `w`, `M`, or `y`. Should be longer than the front-facing load balancer's idle timeout. |
253
+
| <aname="server-name-hash-max-size"></a>deis-router |deployment|[router.deis.io/nginx.serverNameHashMaxSize](#server-name-hash-max-size)|`"512"`| nginx `server_names_hash_max_size` setting expressed in bytes (no suffix), kilobytes (suffixes `k` and `K`), or megabytes (suffixes `m` and `M`). |
254
+
| <aname="server-name-hash-bucket-size"></a>deis-router |deployment|[router.deis.io/nginx.serverNameHashBucketSize](#server-name-hash-bucket-size)|`"64"`| nginx `server_names_hash_bucket_size` setting expressed in bytes (no suffix), kilobytes (suffixes `k` and `K`), or megabytes (suffixes `m` and `M`). |
255
+
| <aname="gzip-enabled"></a>deis-router |deployment|[router.deis.io/nginx.gzip.enabled](#gzip-enabled)|`"true"`| Whether to enable gzip compression. |
| <aname="body-size"></a>deis-router |deployment|[router.deis.io/nginx.bodySize](#body-size)|`"1m"`| nginx `client_max_body_size` setting expressed in bytes (no suffix), kilobytes (suffixes `k` and `K`), or megabytes (suffixes `m` and `M`). |
264
+
| <aname="proxy-real-ip-cidrs"></a>deis-router |deployment|[router.deis.io/nginx.proxyRealIpCidrs](#proxy-real-ip-cidrs)|`"10.0.0.0/8"`| Comma-delimited list of IP/CIDRs that define trusted addresses that are known to send correct replacement addresses. These map to multiple nginx `set_real_ip_from` directives. |
265
+
| <aname="error-log-level"></a>deis-router |deployment|[router.deis.io/nginx.errorLogLevel](#error-log-level)|`"error"`| Log level used in the nginx `error_log` setting (valid values are: `debug`, `info`, `notice`, `warn`, `error`, `crit`, `alert`, and `emerg`). |
266
+
| <aname="platform-domain"></a>deis-router |deployment|[router.deis.io/nginx.platformDomain](#platform-domain)| N/A | This defines the router's platform domain. Any domains added to a routable application _not_ containing the `.` character will be assumed to be subdomains of this platform domain. Thus, for example, a platform domain of `example.com` coupled with a routable app counting `foo` among its domains will result in router configuration that routes traffic for `foo.example.com` to that application. |
267
+
| <aname="use-proxy-protocol"></a>deis-router |deployment|[router.deis.io/nginx.useProxyProtocol](#use-proxy-protocol)|`"false"`| PROXY is a simple protocol supported by nginx, HAProxy, Amazon ELB, and others. It provides a method to obtain information about a request's originating IP address from an external (to Kubernetes) load balancer in front of the router. Enabling this option allows the router to select the originating IP from the HTTP `X-Forwarded-For` header. |
268
+
| <aname="enforce-whitelists"></a>deis-router |deployment|[router.deis.io/nginx.enforceWhitelists](#enforce-whitelists)|`"false"`| Whether to _require_ application-level whitelists that explicitly enumerate allowed clients by IP / CIDR range. With this enabled, each app will drop _all_ requests unless a whitelist has been defined. |
269
+
| <aname="default-whitelist"></a>deis-router |deployment|[router.deis.io/nginx.defaultWhitelist](#default-whitelist)| N/A | A default (router-wide) whitelist expressed as a comma-delimited list of addresses (using IP or CIDR notation). Application-specific whitelists can either extend or override this default. |
270
+
| <aname="whitelist-mode"></a>deis-router |deployment|[router.deis.io/nginx.whitelistMode](#whitelist-mode)|`"extend"`| Whether application-specific whitelists should extend or override the router-wide default whitelist (if defined). Valid values are `"extend"` and `"override"`. |
271
+
| <aname="http2-enabled"></a>deis-router |deployment|[router.deis.io/nginx.http2Enabled](#http2-enabled)|`"true"`| Whether to enable HTTP2 for apps on the SSL ports. |
272
+
| <aname="ssl-enforce"></a>deis-router |deployment|[router.deis.io/nginx.ssl.enforce](#ssl-enforce)|`"false"`| Whether to respond with a 301 for all HTTP requests with a permanent redirect to the HTTPS equivalent address. |
| <a name="ssl-ciphers"></a>deis-router | deployment | [router.deis.io/nginx.ssl.ciphers](#ssl-ciphers) | `"ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS"` | nginx `ssl_ciphers`. The default ciphers are taken from the intermediate compatibility section in the [Mozilla Wiki on Security/Server Side TLS](https://wiki.mozilla.org/Security/Server_Side_TLS). If the value is set to the empty string, OpenSSL's default ciphers are used. In _all_ cases, server side cipher preferences (order matters) are used. |
| <aname="ssl-session-timeout"></a>deis-router |deployment|[router.deis.io/nginx.ssl.sessionTimeout](#ssl-session-timeout)|`"10m"`| nginx `ssl_session_timeout` expressed in units `ms`, `s`, `m`, `h`, `d`, `w`, `M`, or `y`. |
277
+
| <aname="ssl-use-session-tickets"></a>deis-router |deployment|[router.deis.io/nginx.ssl.useSessionTickets](#ssl-use-session-tickets)|`"true"`| Whether to use [TLS session tickets](http://tools.ietf.org/html/rfc5077) for session resumption without server-side state. |
278
+
| <aname="ssl-buffer-size"></a>deis-router |deployment|[router.deis.io/nginx.ssl.bufferSize](#ssl-buffer-size)|`"4k"`| nginx `ssl_buffer_size` setting expressed in bytes (no suffix), kilobytes (suffixes `k` and `K`), or megabytes (suffixes `m` and `M`). |
279
+
| <aname="ssl-hsts-enabled"></a>deis-router |deployment|[router.deis.io/nginx.ssl.hsts.enabled](#ssl-hsts-enabled)|`"false"`| Whether to use HTTP Strict Transport Security. |
280
+
| <aname="ssl-hsts-max-age"></a>deis-router |deployment|[router.deis.io/nginx.ssl.hsts.maxAge](#ssl-hsts-max-age)|`"10886400"`| Maximum number of seconds user agents should observe HSTS rewrites. |
281
+
| <aname="ssl-hsts-include-sub-domains"></a>deis-router |deployment|[router.deis.io/nginx.ssl.hsts.includeSubDomains](#ssl-hsts-include-sub-domains)|`"false"`| Whether to enforce HSTS for subsequent requests to all subdomains of the original request. |
282
+
| <aname="ssl-hsts-preload"></a>deis-router |deployment|[router.deis.io/nginx.ssl.hsts.preload](#ssl-hsts-preload)|`"false"`| Whether to allow the domain to be included in the HSTS preload list. |
283
283
| <aname="builder-connect-timeout"></a>deis-builder | service |[router.deis.io/nginx.connectTimeout](#builder-connect-timeout)|`"10s"`| nginx `proxy_connect_timeout` setting expressed in units `ms`, `s`, `m`, `h`, `d`, `w`, `M`, or `y`. |
284
284
| <aname="builder-tcp-timeout"></a>deis-builder | service |[router.deis.io/nginx.tcpTimeout](#builder-tcp-timeout)|`"1200s"`| nginx `proxy_timeout` setting expressed in units `ms`, `s`, `m`, `h`, `d`, `w`, `M`, or `y`. |
285
285
| <aname="app-domains"></a>routable application | service |[router.deis.io/domains](#app-domains)| N/A | Comma-delimited list of domains for which traffic should be routed to the application. These may be fully qualified (e.g. `foo.example.com`) or, if not containing any `.` character, will be considered subdomains of the router's domain, if that is defined. |
0 commit comments