Docker Config Values
This file lists the configurable Docker Values for the Corsha Gatekeeper. Default values have been provided where applicable. Deploying this Docker Config is described in the How to Install Corsha Gatekeeper guide.
Configurable Docker Config Values
Corsha Protected APIs
Corsha Gatekeeper parameters configure the core functionality of the Corsha Gatekeeper.
The Corsha Gatekeeper can proxy downstream client requests to multiple upstream services. Each Gatekeeper can be configured by assigning the following proxy values under the proxies key. Examples can be found in the How to Install Corsha Gatekeeper guide.
| Name | Description | Value |
|---|---|---|
http.listenPort | The port for the Gatekeeper to listen on | "" |
http.observeOnlyMode.enabled | Whether the Gatekeeper is deployed in Observe Only mode | false |
http.tlsTermination.enabled | Enable TLS Termination. This will cause the Gatekeeper to decrypt incoming https traffic | false |
http.proxies[].name | Name of the Corsha-protected service | "" |
http.proxies[].domain | The domain signifies the host that the Corsha Gatekeeper will match to route client requests. Do not add ports or protocols to this value | "" |
http.proxies[].upstream.host | Hostname of the upstream Corsha-protected service | "" |
http.proxies[].upstream.port | Port of the upstream Corsha-protected service | "" |
http.proxies[].upstream.protocol | Protocol of the upstream Corsha-protected service. Options: HTTP, HTTPS, or TCP | "" |
http.proxies[].tls.cert | Path to the PEM-encoded signing certificate for TLS | "" |
http.proxies[].tls.key | Path to the PEM-encoded key for the signing certificate for ingress to the Gatekeeper | "" |
http.proxies[].rewriteRedirect.enabled | Enable the ability to modify URLs in a response's Redirect Headers. Only allowed for HTTP upstreams. | false |
http.proxies[].rewriteRedirect.redirect | Redirect path to be replaced for rewriteRedirect. This should include the protocol and the full path to be redirected. | "" |
http.proxies[].rewriteRedirect.replacement | Replacement path to replace redirect for rewriteRedirect. This should include the protocol and the full path to be replaced. | "" |
http.proxies[].requestTimeout | Sets how long the Corsha Gatekeeper waits for a response from the upstream service. You can use short formats like 30s (seconds) and 5m (minutes). If not specified, the default is 15 seconds; set to zero to disable timeout. | "" |
http.credPassThrough.enabled | Enables passing the X-Corsha-Cred header to downstream services. | false |
http.allowHttp10.enabled | Allow downstream HTTP 1.0 clients to connect. | false |
http.allowHttp10.defaultHost | The default Host header value for HTTP/1.0 requests if it is empty. The Corsha Gatekeeper does not support HTTP/1.0 without a Host header. This is a no-op if http.allowHttp10.enabled: false. | "" |
Trusted CAs
This configuration defines a bundle of CA certificates to expand the trust.
| Name | Description | Value |
|---|---|---|
trustedCAs | The path to a bundle of PEM-encoded CA certs used to extend trust | "" |
Corsha Auth Server
These parameters contain the required values to connect to the Corsha Authentication Server.
| Name | Description | Value |
|---|---|---|
authserver.host | Auth Server host where cred-checking occurs | "" |
authserver.port | Auth Server port where cred-checking occurs | "" |
authserver.tls.cert | Path to the PEM-encoded TLS signing certificate | "" |
authserver.tls.key | Path to the PEM-encoded TLS key for the signing certificate | "" |
authserver.timeout | Timeout when performing authentication checks | 30s |
Corsha Protected OPC UA TCP Protocol Parameters
| Name | Description | Value |
|---|---|---|
opcuaTcp.listenPort | The port the Corsha Gatekeeper listens for OPC UA TCP traffic | 4841 |
opcuaTcp.upstream.host | Hostname of the upstream Corsha-protected service | "" |
opcuaTcp.upstream.port | Port of the upstream Corsha-protected service | "" |
opcuaTcp.upstream.protocol | Protocol of the upstream Corsha-protected service. Options: OPCUATCP | "" |
opcuaTcp.tlsTermination.enabled | Enables TLS termination at the Gatekeeper OPC UA TCP listenport. If enabled, both opcuaTcp.tls.cert and opcuaTcp.tls.key will be used as server certificates. | false |
opcuaTcp.tls.cert | Path to the PEM-encoded TLS signing certificate | "" |
opcuaTcp.tls.key | Path to the PEM-encoded TLS key for the signing certificate | "" |