Ceryx logo
Menu
View as Markdown

Route settings

The settings each route can have, their defaults, and how they change the way Ceryx serves it.

Every route has a source, a target and these settings. Set them when you create a route, or change some of them later with update a route, which keeps the ones you leave out.

Setting Default Description
mode proxy proxy forwards requests to the target. redirect sends clients to the target with a 301 redirect. See Proxy and redirect modes.
enforce_https false Redirect plain HTTP requests to HTTPS with a 301. New routes take CERYX_ROUTE_SETTINGS_DEFAULT_ENFORCE_HTTPS when it's set.
certificate_path null Path of a certificate file inside the container to serve for this hostname.
key_path null Path of the private key for certificate_path.
mtls_require_client_certificate false Only allow clients with a certificate signed by mtls_trusted_ca. Requires enforce_https. New routes take CERYX_ROUTE_SETTINGS_DEFAULT_MTLS_REQUIRE_CLIENT_CERTIFICATE when it's set.
mtls_trusted_ca null Path of the CA bundle inside the container that client certificates must be signed by. When null, Ceryx uses CERYX_MTLS_DEFAULT_TRUSTED_CA.
mtls_verify_depth null Maximum number of intermediate certificates between a client certificate and the CA. When null, Ceryx uses CERYX_MTLS_DEFAULT_VERIFY_DEPTH, or OpenSSL's limit.

Sources

A route's source is the hostname it serves, such as app.example.com. Ceryx matches hostnames exactly, so example.com and www.example.com need a route each.

The source $wildcard is the catch-all route. It serves every hostname without a route of its own, and those hostnames use its settings.

Targets

A route's target is where Ceryx proxies or redirects requests to, such as http://app:8000. The request's path and query string are added to it. See Targets.

Validation

Ceryx rejects a route with 400 when:

  • source or target is missing.
  • mtls_require_client_certificate is true without enforce_https.
  • mtls_require_client_certificate is true without a CA, from mtls_trusted_ca or CERYX_MTLS_DEFAULT_TRUSTED_CA.
  • mtls_trusted_ca isn't a readable file inside the container.
  • mtls_verify_depth isn't a whole number of 0 or more.
Esc

Type to search the docs.