controls/cf_serverd.cf

Table of contents

This is where body server control is defined. body server control is where various settings related to cf-serverd can be tuned.

server bodies

control

Prototype: control

Description: Control attributes for cf-serverd

Implementation:

body server control
{
  # List of hosts that may connect (change the ACL in def.cf)
  allowconnects => { @(default:def.control_server_allowconnects_derived) };

  # Out of them, which ones should be allowed to have more than one
  # connection established at the same time?
  allowallconnects => {
    @(default:def.control_server_allowallconnects_derived)
  };

  # Out of the hosts in allowconnects, trust new keys only from the
  # following ones.  SEE COMMENTS IN def.cf
  trustkeysfrom => { @(def.trustkeysfrom) };

  ## List of the hosts not using the latest protocol that we'll accept connections from
  ## (absence of this option or empty list means allow none)
  allowlegacyconnects => { @(def.control_server_allowlegacyconnects) };

  # Maximum number of concurrent connections.
  # Suggested value >= total number of hosts
  maxconnections => "$(def.control_server_maxconnections)";

  # Allow connections from nodes which are out-of-sync
  denybadclocks => "false";

  control_server_allowtlsversion_defined::
    # Minimum required version of TLS. Set to "1.0" if you need clients
    # running CFEngine in a version lower than 3.7.0 to connect.
    #
    # Example:
    # allowtlsversion => "1.0";
    # See also: tls_min_version in body common control
    allowtlsversion => "$(default:def.control_server_allowtlsversion)";

  control_server_allowciphers_defined::
    # List of ciphers the server accepts. For Syntax help see man page for
    # "openssl-ciphers" (man:openssl-ciphers(1ssl)). The 'TLS_'-prefixed
    # ciphers are for TLS 1.3 and later.
    #
    # Example setting:
    # allowciphers          => "AES256-GCM-SHA384:AES256-SHA:TLS_AES_256_GCM_SHA384";
    # See also: tls_ciphers in body common control
    allowciphers => "$(default:def.control_server_allowciphers)";

  enterprise_edition.client_initiated_reporting_enabled::
    # How often cf-serverd should try to establish a reverse tunnel for report
    # collection
    call_collect_interval => "$(def.control_server_call_collect_interval)";

    # The time in seconds that a collect-call tunnel will remain open for hub
    # to complete report transfer.
    collect_window => "$(def.control_server_collect_window)";

  any::
    # The remote user accounts which are allowed to initiate cf-agent via
    # cf-runagent.
    allowusers => { @(def.control_server_allowusers) };

  # In 3.10 the quotation is properly closed when EOF is reached. It is left
  # open so that arguments (like -K and --remote-bundles) can be appended.
  # 3.10.x does not automatically append -I -Dcfruncommand
  windows::
    # /s removes the first and last quote characters and aids in specifying paths with surrounding quotes
    cfruncommand => "$(def.cf_runagent_shell) /s /c \"
                           $(sys.cf_agent) -I -D cf_runagent_initiated -f $(sys.update_policy_path)  &
                           $(sys.cf_agent) -I -D cf_runagent_initiated";

  !windows::
    cfruncommand => "$(def.cf_runagent_shell) -c \'
                           $(sys.cf_agent) -I -D cf_runagent_initiated -f $(sys.update_policy_path)  ;
                           $(sys.cf_agent) -I -D cf_runagent_initiated";

    # Use bindtointerface to specify interface to bind to, the default is :: +
    # 0.0.0.0/0 if IPV6 is supported or 0.0.0.0/0 if IPV6 is not supported. On
    # Windows, binding to :: means only IPV6 connections will be accepted.
    # !windows::
    #   bindtointerface => "::";
}

server bundles

mpf_default_access_rules

Prototype: mpf_default_access_rules

Description: Defines access to common resources