# Route settings

The settings each route can have, their defaults, and how they change the way Ceryx serves it.

Every route has a `source`, a `target` and these settings. Set them when you [create a route](/docs/api/routes#create-or-replace-a-route), or change some of them later with [update a route](/docs/api/routes#update-a-route), which keeps the ones you leave out.

| Setting | Default | Description |
| --- | --- | --- |
| `mode` | `proxy` | `proxy` forwards requests to the target. `redirect` sends clients to the target with a `301` redirect. See [Proxy and redirect modes](/docs/concepts/routing#proxy-and-redirect-modes). |
| `enforce_https` | `false` | Redirect plain HTTP requests to HTTPS with a `301`. New routes take `CERYX_ROUTE_SETTINGS_DEFAULT_ENFORCE_HTTPS` when it's set. |
| `certificate_path` | `null` | Path of a certificate file inside the container to serve for this hostname. |
| `key_path` | `null` | Path of the private key for `certificate_path`. |
| `mtls_require_client_certificate` | `false` | Only allow clients with a certificate signed by `mtls_trusted_ca`. Requires `enforce_https`. New routes take `CERYX_ROUTE_SETTINGS_DEFAULT_MTLS_REQUIRE_CLIENT_CERTIFICATE` when it's set. |
| `mtls_trusted_ca` | `null` | Path of the CA bundle inside the container that client certificates must be signed by. When `null`, Ceryx uses `CERYX_MTLS_DEFAULT_TRUSTED_CA`. |
| `mtls_verify_depth` | `null` | Maximum number of intermediate certificates between a client certificate and the CA. When `null`, Ceryx uses `CERYX_MTLS_DEFAULT_VERIFY_DEPTH`, or OpenSSL's limit. |

## Sources

A route's `source` is the hostname it serves, such as `app.example.com`. Ceryx matches hostnames exactly, so `example.com` and `www.example.com` need a route each.

The source `$wildcard` is the catch-all route. It serves every hostname without a route of its own, and those hostnames use its settings.

## Targets

A route's `target` is where Ceryx proxies or redirects requests to, such as `http://app:8000`. The request's path and query string are added to it. See [Targets](/docs/concepts/routing#targets).

## Validation

Ceryx rejects a route with `400` when:

- `source` or `target` is missing.
- `mtls_require_client_certificate` is `true` without `enforce_https`.
- `mtls_require_client_certificate` is `true` without a CA, from `mtls_trusted_ca` or `CERYX_MTLS_DEFAULT_TRUSTED_CA`.
- `mtls_trusted_ca` isn't a readable file inside the container.
- `mtls_verify_depth` isn't a whole number of 0 or more.