tcp listener

출처: HashiCorp Boundary docs

The TCP listener configures Boundary to listen on a TCP address/port.

listener "tcp" {
  purpose = "api"
  address = "127.0.0.1:9200"
}

The listener stanza may be specified more than once to make Boundary listen on multiple interfaces; however, only one listener marked for cluster purpose is allowed.

Listener's custom response headers

Boundary supports defining custom HTTP response headers for all requests on any Boundary controller. Headers are defined based on the returned status code. For example, you can define a list of custom response headers for the 200 status code, and another list of custom response headers for the 307 status code, and so on. You can also define headers based on the hundred-level status code. For example, a list of headers applied to the 4xx code will be applied to 400, 401, 404, and all other 400-level status codes. The more specific the status, the higher priority it has. Default headers are overwritten by hundred-level headers, which are overwritten by status-specific headers.

There are two different config parameters that define headers: custom_api_response_headers and custom_ui_response_headers. API headers apply to API endpoints, currently all paths starting with /v1/. UI headers apply to all other paths. This allows for configuring headers specifically for serving content to a web browser, such as CSP headers.

tcp listener parameters

Refer to the following sections for tcp listener parameters.

General parameters

custom_api_response_headers parameters

custom_ui_response_headers parameters

TLS

The tls parameters are valid for api and ops listeners. The cluster and proxy connections use their own ephemeral TLS stacks. For more information, refer to TLS in Boundary.

tcp listener examples

Refer to the following sections for examples of tcp listeners.

Configure TLS

This example shows enabling a TLS listener.

listener "tcp" {
  purpose = "api"
  tls_cert_file = "/etc/certs/Boundary.crt"
  tls_key_file  = "/etc/certs/Boundary.key"
}

Configure custom http response headers

This example shows configuring custom http response headers. Operators can configure "custom_api_response_headers" and "custom_ui_response_headers" sub-stanzas in the listener stanza to set custom http headers that are appropriate to their applications. Examples of such headers are "Strict-Transport-Security" and "Content-Security-Policy" which are known HTTP headers, and could be configured to harden the security of an application communicating with the Boundary endpoints. Note that vulnerability scans often examine such security related HTTP headers. In addition, you can configure application-specific custom headers. For example, "X-Custom-Header" has been configured in the example below.

listener "tcp" {
  custom_api_response_headers {
    "default" = {
      "Strict-Transport-Security" = ["max-age=31536000; includeSubDomains"],
      "X-Custom-Header" = ["Custom Header Default Value"],
    },
    "2xx" = {
      "X-Custom-Header" = ["Custom Header Value 1", "Custom Header Value 2"],
    },
    "301" = {
      "Strict-Transport-Security" = ["max-age=31536000"],
    },
  }
  custom_ui_response_headers {
    "default" = {
      "Strict-Transport-Security" = ["max-age=31536000; includeSubDomains"],
      "Content-Security-Policy" = ["default-src 'none'; script-src 'self' 'wasm-unsafe-eval'; frame-src 'self'; font-src 'self'; connect-src 'self'; img-src 'self' data:; style-src 'self'; media-src 'self'; manifest-src 'self'; style-src-attr 'self'; frame-ancestors 'self'"],
      "X-Custom-Header" = ["Custom Header Default Value"],
    },
    "2xx" = {
      "X-Custom-Header" = ["Custom Header Value 1", "Custom Header Value 2"],
    },
    "301" = {
      "Strict-Transport-Security" = ["max-age=31536000"],
      "Content-Security-Policy" = ["default-src 'none'; script-src 'none'; connect-src 'none'"],
    },
  }
}

Note that Boundary requires script-src 'wasm-unsafe-eval' for playback of session recordings.

In situations where a header is defined under several status code subsections, Boundary returns the header matching the most specific response code. For example, with the config example below, a 307 response would return 307 Custom header value, while a 306 would return 3xx Custom header value.

listener "tcp" {
  custom_api_response_headers {
    "default" = {
       "X-Custom-Header" = ["default Custom header value"]
    },
    "3xx" = {
       "X-Custom-Header" = ["3xx Custom header value"]
    },
    "307" = {
       "X-Custom-Header" = ["307 Custom header value"]
    }
  }
}

There may also be situations where default or collective status headers have been defined, but you do not want them returned for a specific status code. You can unset headers at any level by defining the headers as an empty list.

listener "tcp" {
  custom_api_response_headers {
    "default" = {
       "X-Custom-Header" = ["default Custom header value"]
    },
    "3xx" = {
       "X-Custom-Header" = ["3xx Custom header value"]
    },
    "307" = {
        // Do not return this header for 307 responses
       "X-Custom-Header" = []
    }
  }
}

Listen on multiple interfaces

This example shows Boundary listening on a private interface, as well as localhost.

listener "tcp" {
  purpose = "api"
  address = "127.0.0.1:9200"
}

listener "tcp" {
  purpose = "cluster"
  address = "10.0.0.5:9201"
}

Edit this page on GitHub