controls/cf_serverd.cf

Table of contents

This is where body server control is defined. body server control is where various settings related to cf-serverd can be tuned.

server bodies

control

Prototype: control

Description: Control attributes for cf-serverd

Implementation:

 code
body server control
{
      # List of hosts that may connect (change the ACL in def.cf)
      allowconnects         => { "127.0.0.1" , "::1", @(def.acl) };

      # Out of them, which ones should be allowed to have more than one
      # connection established at the same time?
      allowallconnects      => { "127.0.0.1" , "::1", @(def.acl) };

      # Out of the hosts in allowconnects, trust new keys only from the
      # following ones.  SEE COMMENTS IN def.cf
      trustkeysfrom         => { @(def.trustkeysfrom) };

      ## List of the hosts not using the latest protocol that we'll accept connections from
      ## (absence of this option or empty list means allow none)
      allowlegacyconnects   => { @(def.control_server_allowlegacyconnects) };

      # Maximum number of concurrent connections.
      # Suggested value >= total number of hosts
      maxconnections        => "$(def.control_server_maxconnections)";

      # Allow connections from nodes which are out-of-sync
      denybadclocks         => "false";

    control_server_allowtlsversion_defined::

      # Minimum required version of TLS. Set to "1.0" if you need clients
      # running CFEngine in a version lower than 3.7.0 to connect.
      #
      # Example:
      # allowtlsversion => "1.0";

      allowtlsversion => "$(default:def.control_server_allowtlsversion)"; # See also: tls_min_version in body common control

    control_server_allowciphers_defined::
      # List of ciphers the server accepts. For Syntax help see man page for
      # "openssl-ciphers" (man:openssl-ciphers(1ssl)). The 'TLS_'-prefixed
      # ciphers are for TLS 1.3 and later.
      #
      # Example setting:
      # allowciphers          => "AES256-GCM-SHA384:AES256-SHA:TLS_AES_256_GCM_SHA384";

      allowciphers          => "$(default:def.control_server_allowciphers)"; # See also: tls_ciphers in body common control

    enterprise_edition.client_initiated_reporting_enabled::

      # How often cf-serverd should try to establish a reverse tunnel for report
      # collection

      call_collect_interval => "$(def.control_server_call_collect_interval)";

      # The time in seconds that a collect-call tunnel will remain open for hub
      # to complete report transfer.
        collect_window => "$(def.control_server_collect_window)";

    any::
      # The remote user accounts which are allowed to initiate cf-agent via
      # cf-runagent.

      allowusers => { @(def.control_server_allowusers) };

    windows::
      cfruncommand => "$(sys.cf_agent) -I -D cf_runagent_initiated -f \"$(sys.update_policy_path)\"  &
                       $(sys.cf_agent) -I -D cf_runagent_initiated";

    !windows::

      # In 3.10 the quotation is properly closed when EOF is reached. It is left
      # open so that arguments (like -K and --remote-bundles) can be appended.
      # 3.10.x does not automatically append -I -Dcfruncommand

        cfruncommand => "$(def.cf_runagent_shell) -c \'
                           $(sys.cf_agent) -I -D cf_runagent_initiated -f $(sys.update_policy_path)  ;
                           $(sys.cf_agent) -I -D cf_runagent_initiated";

    # Use bindtointerface to specify interface to bind to, the default is :: +
    # 0.0.0.0/0 if IPV6 is supported or 0.0.0.0/0 if IPV6 is not supported. On
    # Windows, binding to :: means only IPV6 connections will be accepted.
    # !windows::
    #   bindtointerface => "::";
}

server bundles

mpf_default_access_rules

Prototype: mpf_default_access_rules

Description: Defines access to common resources