nghttpx: Use raw-string iteral to output help
This commit is contained in:
Tatsuhiro Tsujikawa
parent
e4dacb2f6f
commit
8ccb6e463d
611
src/shrpx.cc
611
src/shrpx.cc
|
|
@ -467,8 +467,8 @@ void print_version(std::ostream& out)
|
|||
namespace {
|
||||
void print_usage(std::ostream& out)
|
||||
{
|
||||
out << "Usage: nghttpx [OPTIONS]... [<PRIVATE_KEY> <CERT>]\n"
|
||||
<< "A reverse proxy for HTTP/2, HTTP/1 and SPDY." << std::endl;
|
||||
out << R"(Usage: nghttpx [OPTIONS]... [<PRIVATE_KEY> <CERT>]
|
||||
A reverse proxy for HTTP/2, HTTP/1 and SPDY.)" << std::endl;
|
||||
}
|
||||
} // namespace
|
||||
|
||||
|
|
@ -476,313 +476,308 @@ namespace {
|
|||
void print_help(std::ostream& out)
|
||||
{
|
||||
print_usage(out);
|
||||
out << "\n"
|
||||
<< " <PRIVATE_KEY> Set path to server's private key. Required\n"
|
||||
<< " unless -p, --client or --frontend-no-tls\n"
|
||||
<< " are given.\n"
|
||||
<< " <CERT> Set path to server's certificate. Required\n"
|
||||
<< " unless -p, --client or --frontend-no-tls\n"
|
||||
<< " are given.\n"
|
||||
<< "Options:\n"
|
||||
<< " The options are categorized into several groups.\n"
|
||||
<< "\n"
|
||||
<< "Connections:\n"
|
||||
<< " -b, --backend=<HOST,PORT>\n"
|
||||
<< " Set backend host and port.\n"
|
||||
<< " Default: '"
|
||||
out << R"(
|
||||
<PRIVATE_KEY> Set path to server's private key. Required
|
||||
unless -p, --client or --frontend-no-tls are
|
||||
given.
|
||||
<CERT> Set path to server's certificate. Required
|
||||
unless -p, --client or --frontend-no-tls are
|
||||
given.
|
||||
Options:
|
||||
The options are categorized into several groups.
|
||||
|
||||
Connections:
|
||||
-b, --backend=<HOST,PORT>
|
||||
Set backend host and port.
|
||||
Default: ')"
|
||||
<< get_config()->downstream_host << ","
|
||||
<< get_config()->downstream_port << "'\n"
|
||||
<< " -f, --frontend=<HOST,PORT>\n"
|
||||
<< " Set frontend host and port.\n"
|
||||
<< " Default: '"
|
||||
<< get_config()->host << "," << get_config()->port << "'\n"
|
||||
<< " --backlog=<NUM> Set listen backlog size. If -1 is given,\n"
|
||||
<< " libevent will choose suitable value.\n"
|
||||
<< " Default: "
|
||||
<< get_config()->backlog << "\n"
|
||||
<< " --backend-ipv4 Resolve backend hostname to IPv4 address\n"
|
||||
<< " only.\n"
|
||||
<< " --backend-ipv6 Resolve backend hostname to IPv6 address\n"
|
||||
<< " only.\n"
|
||||
<< "\n"
|
||||
<< "Performance:\n"
|
||||
<< " -n, --workers=<CORES>\n"
|
||||
<< " Set the number of worker threads.\n"
|
||||
<< " Default: "
|
||||
<< get_config()->num_worker << "\n"
|
||||
<< " --read-rate=<RATE> Set maximum average read rate on frontend\n"
|
||||
<< " connection. Setting 0 to this option means\n"
|
||||
<< " read rate is unlimited.\n"
|
||||
<< " Default: "
|
||||
<< get_config()->read_rate << "\n"
|
||||
<< " --read-burst=<SIZE>\n"
|
||||
<< " Set maximum read burst size on frontend\n"
|
||||
<< " connection. Setting 0 to this option means\n"
|
||||
<< " read burst size is unlimited.\n"
|
||||
<< " Default: "
|
||||
<< get_config()->read_burst << "\n"
|
||||
<< " --write-rate=<RATE>\n"
|
||||
<< " Set maximum average write rate on frontend\n"
|
||||
<< " connection. Setting 0 to this option means\n"
|
||||
<< " write rate is unlimited.\n"
|
||||
<< " Default: "
|
||||
<< get_config()->write_rate << "\n"
|
||||
<< " --write-burst=<SIZE>\n"
|
||||
<< " Set maximum write burst size on frontend\n"
|
||||
<< " connection. Setting 0 to this option means\n"
|
||||
<< " write burst size is unlimited.\n"
|
||||
<< " Default: "
|
||||
<< get_config()->write_burst << "\n"
|
||||
<< " --worker-read-rate=<RATE>\n"
|
||||
<< " Set maximum average read rate on frontend\n"
|
||||
<< " connection per worker. Setting 0 to this\n"
|
||||
<< " option means read rate is unlimited.\n"
|
||||
<< " Default: "
|
||||
<< get_config()->worker_read_rate << "\n"
|
||||
<< " --worker-read-burst=<SIZE>\n"
|
||||
<< " Set maximum read burst size on frontend\n"
|
||||
<< " connection per worker. Setting 0 to this\n"
|
||||
<< " option means read burst size is unlimited.\n"
|
||||
<< " Default: "
|
||||
<< get_config()->worker_read_burst << "\n"
|
||||
<< " --worker-write-rate=<RATE>\n"
|
||||
<< " Set maximum average write rate on frontend\n"
|
||||
<< " connection per worker. Setting 0 to this\n"
|
||||
<< " option means write rate is unlimited.\n"
|
||||
<< " Default: "
|
||||
<< get_config()->worker_write_rate << "\n"
|
||||
<< " --worker-write-burst=<SIZE>\n"
|
||||
<< " Set maximum write burst size on frontend\n"
|
||||
<< " connection per worker. Setting 0 to this\n"
|
||||
<< " option means write burst size is unlimited.\n"
|
||||
<< " Default: "
|
||||
<< get_config()->worker_write_burst << "\n"
|
||||
<< "\n"
|
||||
<< "Timeout:\n"
|
||||
<< " --frontend-http2-read-timeout=<SEC>\n"
|
||||
<< " Specify read timeout for HTTP/2.0 and SPDY frontend\n"
|
||||
<< " connection. Default: "
|
||||
<< get_config()->http2_upstream_read_timeout.tv_sec << "\n"
|
||||
<< " --frontend-read-timeout=<SEC>\n"
|
||||
<< " Specify read timeout for HTTP/1.1 frontend\n"
|
||||
<< " connection. Default: "
|
||||
<< get_config()->upstream_read_timeout.tv_sec << "\n"
|
||||
<< " --frontend-write-timeout=<SEC>\n"
|
||||
<< " Specify write timeout for all frontends.\n"
|
||||
<< " connection. Default: "
|
||||
<< get_config()->upstream_write_timeout.tv_sec << "\n"
|
||||
<< " --backend-read-timeout=<SEC>\n"
|
||||
<< " Specify read timeout for backend connection.\n"
|
||||
<< " Default: "
|
||||
<< get_config()->downstream_read_timeout.tv_sec << "\n"
|
||||
<< " --backend-write-timeout=<SEC>\n"
|
||||
<< " Specify write timeout for backend\n"
|
||||
<< " connection. Default: "
|
||||
<< get_config()->downstream_write_timeout.tv_sec << "\n"
|
||||
<< " --backend-keep-alive-timeout=<SEC>\n"
|
||||
<< " Specify keep-alive timeout for backend\n"
|
||||
<< " connection. Default: "
|
||||
<< get_config()->downstream_idle_read_timeout.tv_sec << "\n"
|
||||
<< " --backend-http-proxy-uri=<URI>\n"
|
||||
<< " Specify proxy URI in the form\n"
|
||||
<< " http://[<USER>:<PASS>@]<PROXY>:<PORT>. If\n"
|
||||
<< " a proxy requires authentication, specify\n"
|
||||
<< " <USER> and <PASS>. Note that they must be\n"
|
||||
<< " properly percent-encoded. This proxy is used\n"
|
||||
<< " when the backend connection is HTTP/2.0. First,\n"
|
||||
<< " make a CONNECT request to the proxy and\n"
|
||||
<< " it connects to the backend on behalf of\n"
|
||||
<< " nghttpx. This forms tunnel. After that, nghttpx\n"
|
||||
<< " performs SSL/TLS handshake with the\n"
|
||||
<< " downstream through the tunnel. The timeouts\n"
|
||||
<< " when connecting and making CONNECT request\n"
|
||||
<< " can be specified by --backend-read-timeout\n"
|
||||
<< " and --backend-write-timeout options.\n"
|
||||
<< "\n"
|
||||
<< "SSL/TLS:\n"
|
||||
<< " --ciphers=<SUITE> Set allowed cipher list. The format of the\n"
|
||||
<< " string is described in OpenSSL ciphers(1).\n"
|
||||
<< " If this option is used, --honor-cipher-order\n"
|
||||
<< " is implicitly enabled.\n"
|
||||
<< " --honor-cipher-order\n"
|
||||
<< " Honor server cipher order, giving the\n"
|
||||
<< " ability to mitigate BEAST attacks.\n"
|
||||
<< " -k, --insecure Don't verify backend server's certificate\n"
|
||||
<< " if -p, --client or --http2-bridge are given\n"
|
||||
<< " and --backend-no-tls is not given\n"
|
||||
<< " --cacert=<PATH> Set path to trusted CA certificate file\n"
|
||||
<< " if -p, --client or --http2-bridge are given\n"
|
||||
<< " and --backend-no-tls is not given\n"
|
||||
<< " The file must be in PEM format. It can\n"
|
||||
<< " contain multiple certificates. If the\n"
|
||||
<< " linked OpenSSL is configured to load system\n"
|
||||
<< " wide certificates, they are loaded\n"
|
||||
<< " at startup regardless of this option.\n"
|
||||
<< " --private-key-passwd-file=<FILEPATH>\n"
|
||||
<< " Path to file that contains password for the\n"
|
||||
<< " server's private key. If none is given and\n"
|
||||
<< " the private key is password protected it'll\n"
|
||||
<< " be requested interactively.\n"
|
||||
<< " --subcert=<KEYPATH>:<CERTPATH>\n"
|
||||
<< " Specify additional certificate and private\n"
|
||||
<< " key file. nghttpx will choose certificates\n"
|
||||
<< " based on the hostname indicated by client\n"
|
||||
<< " using TLS SNI extension. This option can be\n"
|
||||
<< " used multiple times.\n"
|
||||
<< " --backend-tls-sni-field=<HOST>\n"
|
||||
<< " Explicitly set the content of the TLS SNI\n"
|
||||
<< " extension. This will default to the backend\n"
|
||||
<< " HOST name.\n"
|
||||
<< " --dh-param-file=<PATH>\n"
|
||||
<< " Path to file that contains DH parameters in\n"
|
||||
<< " PEM format. Without this option, DHE cipher\n"
|
||||
<< " suites are not available.\n"
|
||||
<< " --npn-list=<LIST> Comma delimited list of NPN/ALPN protocol sorted\n"
|
||||
<< " in the order of preference. That means\n"
|
||||
<< " most desirable protocol comes first.\n"
|
||||
<< " The parameter must be delimited by a single\n"
|
||||
<< " comma only and any white spaces are treated\n"
|
||||
<< " as a part of protocol string.\n"
|
||||
<< " Default: " << DEFAULT_NPN_LIST << "\n"
|
||||
<< " --verify-client Require and verify client certificate.\n"
|
||||
<< " --verify-client-cacert=<PATH>\n"
|
||||
<< " Path to file that contains CA certificates\n"
|
||||
<< " to verify client certificate.\n"
|
||||
<< " The file must be in PEM format. It can\n"
|
||||
<< " contain multiple certificates.\n"
|
||||
<< " --client-private-key-file=<PATH>\n"
|
||||
<< " Path to file that contains client private\n"
|
||||
<< " key used in backend client authentication.\n"
|
||||
<< " --client-cert-file=<PATH>\n"
|
||||
<< " Path to file that contains client\n"
|
||||
<< " certificate used in backend client\n"
|
||||
<< " authentication.\n"
|
||||
<< " --tls-proto-list=<LIST>\n"
|
||||
<< " Comma delimited list of SSL/TLS protocol to\n"
|
||||
<< " be enabled.\n"
|
||||
<< " The following protocols are available:\n"
|
||||
<< " TLSv1.2, TLSv1.1, TLSv1.0, SSLv3\n"
|
||||
<< " The name matching is done in case-insensitive\n"
|
||||
<< " manner.\n"
|
||||
<< " The parameter must be delimited by a single\n"
|
||||
<< " comma only and any white spaces are treated\n"
|
||||
<< " as a part of protocol string.\n"
|
||||
<< " Default: " << DEFAULT_TLS_PROTO_LIST << "\n"
|
||||
<< "\n"
|
||||
<< "HTTP/2.0 and SPDY:\n"
|
||||
<< " -c, --http2-max-concurrent-streams=<NUM>\n"
|
||||
<< " Set the maximum number of the concurrent\n"
|
||||
<< " streams in one HTTP/2.0 and SPDY session.\n"
|
||||
<< " Default: "
|
||||
<< get_config()->http2_max_concurrent_streams << "\n"
|
||||
<< " --frontend-http2-window-bits=<N>\n"
|
||||
<< " Sets the per-stream initial window size of HTTP/2.0\n"
|
||||
<< " SPDY frontend connection. For HTTP/2.0, the size is\n"
|
||||
<< " 2**<N>-1. For SPDY, the size is 2**<N>\n"
|
||||
<< " Default: "
|
||||
<< get_config()->http2_upstream_window_bits << "\n"
|
||||
<< " --frontend-http2-connection-window-bits=<N>\n"
|
||||
<< " Sets the per-connection window size of HTTP/2.0 and\n"
|
||||
<< " SPDY frontend connection. For HTTP/2.0, the size is\n"
|
||||
<< " 2**<N>-1. For SPDY, the size is 2**<N>.\n"
|
||||
<< " Default: "
|
||||
<< get_config()->http2_upstream_connection_window_bits << "\n"
|
||||
<< " --frontend-no-tls Disable SSL/TLS on frontend connections.\n"
|
||||
<< " --backend-http2-window-bits=<N>\n"
|
||||
<< " Sets the initial window size of HTTP/2.0 backend\n"
|
||||
<< " connection to 2**<N>-1.\n"
|
||||
<< " Default: "
|
||||
<< get_config()->http2_downstream_window_bits << "\n"
|
||||
<< " --backend-http2-connection-window-bits=<N>\n"
|
||||
<< " Sets the per-connection window size of HTTP/2.0\n"
|
||||
<< " backend connection to 2**<N>-1.\n"
|
||||
<< " Default: "
|
||||
<< get_config()->http2_downstream_connection_window_bits << "\n"
|
||||
<< " --backend-no-tls Disable SSL/TLS on backend connections.\n"
|
||||
<< " --http2-no-cookie-crumbling\n"
|
||||
<< " Don't crumble cookie header field.\n"
|
||||
<< " --padding=<N> Add at most <N> bytes to a HTTP/2 frame payload\n"
|
||||
<< " as padding.\n"
|
||||
<< " Specify 0 to disable padding. This option is\n"
|
||||
<< " meant for debugging purpose and not intended\n"
|
||||
<< " to enhance protocol security.\n"
|
||||
<< "\n"
|
||||
<< "Mode:\n"
|
||||
<< " (default mode) Accept HTTP/2.0, SPDY and HTTP/1.1 over\n"
|
||||
<< " SSL/TLS. If --frontend-no-tls is used,\n"
|
||||
<< " accept HTTP/2.0 and HTTP/1.1. The incoming\n"
|
||||
<< " HTTP/1.1 connection can be upgraded to\n"
|
||||
<< " HTTP/2.0 through HTTP Upgrade.\n"
|
||||
<< " The protocol to the backend is HTTP/1.1.\n"
|
||||
<< " -s, --http2-proxy Like default mode, but enable secure proxy mode.\n"
|
||||
<< " --http2-bridge Like default mode, but communicate with the\n"
|
||||
<< " backend in HTTP/2.0 over SSL/TLS. Thus the\n"
|
||||
<< " incoming all connections are converted\n"
|
||||
<< " to HTTP/2.0 connection and relayed to\n"
|
||||
<< " the backend. See --backend-http-proxy-uri\n"
|
||||
<< " option if you are behind the proxy and want\n"
|
||||
<< " to connect to the outside HTTP/2.0 proxy.\n"
|
||||
<< " --client Accept HTTP/2.0 and HTTP/1.1 without SSL/TLS.\n"
|
||||
<< " The incoming HTTP/1.1 connection can be\n"
|
||||
<< " upgraded to HTTP/2.0 connection through\n"
|
||||
<< " HTTP Upgrade.\n"
|
||||
<< " The protocol to the backend is HTTP/2.0.\n"
|
||||
<< " To use nghttpx as a forward proxy, use -p\n"
|
||||
<< " option instead.\n"
|
||||
<< " -p, --client-proxy Like --client option, but it also requires\n"
|
||||
<< " the request path from frontend must be\n"
|
||||
<< " an absolute URI, suitable for use as a\n"
|
||||
<< " forward proxy.\n"
|
||||
<< "\n"
|
||||
<< "Logging:\n"
|
||||
<< " -L, --log-level=<LEVEL>\n"
|
||||
<< " Set the severity level of log output.\n"
|
||||
<< " INFO, WARNING, ERROR and FATAL.\n"
|
||||
<< " Default: WARNING\n"
|
||||
<< " --accesslog Print simple accesslog to stderr.\n"
|
||||
<< " --syslog Send log messages to syslog.\n"
|
||||
<< " --syslog-facility=<FACILITY>\n"
|
||||
<< " Set syslog facility.\n"
|
||||
<< " Default: "
|
||||
<< str_syslog_facility(get_config()->syslog_facility) << "\n"
|
||||
<< "\n"
|
||||
<< "Misc:\n"
|
||||
<< " --add-x-forwarded-for\n"
|
||||
<< " Append X-Forwarded-For header field to the\n"
|
||||
<< " downstream request.\n"
|
||||
<< " --no-via Don't append to Via header field. If Via\n"
|
||||
<< " header field is received, it is left\n"
|
||||
<< " unaltered.\n"
|
||||
<< " --frontend-http2-dump-request-header=<PATH>\n"
|
||||
<< " Dumps request headers received by HTTP/2.0\n"
|
||||
<< " frontend to the file denoted in PATH.\n"
|
||||
<< " The output is done in HTTP/1 header field\n"
|
||||
<< " format and each header block is followed by\n"
|
||||
<< " an empty line.\n"
|
||||
<< " This option is not thread safe and MUST NOT\n"
|
||||
<< " be used with option -n=N, where N >= 2.\n"
|
||||
<< " --frontend-http2-dump-response-header=<PATH>\n"
|
||||
<< " Dumps response headers sent from HTTP/2.0\n"
|
||||
<< " frontend to the file denoted in PATH.\n"
|
||||
<< " The output is done in HTTP/1 header field\n"
|
||||
<< " format and each header block is followed by\n"
|
||||
<< " an empty line.\n"
|
||||
<< " This option is not thread safe and MUST NOT\n"
|
||||
<< " be used with option -n=N, where N >= 2.\n"
|
||||
<< " -o, --frontend-frame-debug\n"
|
||||
<< " Print HTTP/2 frames in frontend to stderr.\n"
|
||||
<< " This option is not thread safe and MUST NOT\n"
|
||||
<< " be used with option -n=N, where N >= 2.\n"
|
||||
<< " -D, --daemon Run in a background. If -D is used, the\n"
|
||||
<< " current working directory is changed to '/'.\n"
|
||||
<< " --pid-file=<PATH> Set path to save PID of this program.\n"
|
||||
<< " --user=<USER> Run this program as USER. This option is\n"
|
||||
<< " intended to be used to drop root privileges.\n"
|
||||
<< " --conf=<PATH> Load configuration from PATH.\n"
|
||||
<< " Default: "
|
||||
<< get_config()->conf_path << "\n"
|
||||
<< " -v, --version Print version and exit.\n"
|
||||
<< " -h, --help Print this help and exit.\n"
|
||||
<< get_config()->downstream_port << R"('
|
||||
-f, --frontend=<HOST,PORT>
|
||||
Set frontend host and port.
|
||||
Default: ')"
|
||||
<< get_config()->host << "," << get_config()->port << R"('
|
||||
--backlog=<NUM> Set listen backlog size. If -1 is given,
|
||||
libevent will choose suitable value.
|
||||
Default: )"
|
||||
<< get_config()->backlog << R"(
|
||||
--backend-ipv4 Resolve backend hostname to IPv4 address only.
|
||||
--backend-ipv6 Resolve backend hostname to IPv6 address only.
|
||||
|
||||
Performance:
|
||||
-n, --workers=<CORES>
|
||||
Set the number of worker threads.
|
||||
Default: )"
|
||||
<< get_config()->num_worker << R"(
|
||||
--read-rate=<RATE>
|
||||
Set maximum average read rate on frontend
|
||||
connection. Setting 0 to this option means read
|
||||
rate is unlimited.
|
||||
Default: )"
|
||||
<< get_config()->read_rate << R"(
|
||||
--read-burst=<SIZE>
|
||||
Set maximum read burst size on frontend
|
||||
connection. Setting 0 to this option means read
|
||||
burst size is unlimited.
|
||||
Default: )"
|
||||
<< get_config()->read_burst << R"(
|
||||
--write-rate=<RATE>
|
||||
Set maximum average write rate on frontend
|
||||
connection. Setting 0 to this option means write
|
||||
rate is unlimited.
|
||||
Default: )"
|
||||
<< get_config()->write_rate << R"(
|
||||
--write-burst=<SIZE>
|
||||
Set maximum write burst size on frontend
|
||||
connection. Setting 0 to this option means write
|
||||
burst size is unlimited.
|
||||
Default: )"
|
||||
<< get_config()->write_burst << R"(
|
||||
--worker-read-rate=<RATE>
|
||||
Set maximum average read rate on frontend
|
||||
connection per worker. Setting 0 to this option
|
||||
means read rate is unlimited.
|
||||
Default: )"
|
||||
<< get_config()->worker_read_rate << R"(
|
||||
--worker-read-burst=<SIZE>
|
||||
Set maximum read burst size on frontend
|
||||
connection per worker. Setting 0 to this option
|
||||
means read burst size is unlimited.
|
||||
Default: )"
|
||||
<< get_config()->worker_read_burst << R"(
|
||||
--worker-write-rate=<RATE>
|
||||
Set maximum average write rate on frontend
|
||||
connection per worker. Setting 0 to this option
|
||||
means write rate is unlimited.
|
||||
Default: )"
|
||||
<< get_config()->worker_write_rate << R"(
|
||||
--worker-write-burst=<SIZE>
|
||||
Set maximum write burst size on frontend
|
||||
connection per worker. Setting 0 to this option
|
||||
means write burst size is unlimited.
|
||||
Default: )"
|
||||
<< get_config()->worker_write_burst << R"(
|
||||
|
||||
Timeout:
|
||||
--frontend-http2-read-timeout=<SEC>
|
||||
Specify read timeout for HTTP/2 and SPDY frontend
|
||||
connection.
|
||||
Default: )"
|
||||
<< get_config()->http2_upstream_read_timeout.tv_sec << R"(
|
||||
--frontend-read-timeout=<SEC>
|
||||
Specify read timeout for HTTP/1.1 frontend
|
||||
connection.
|
||||
Default: )"
|
||||
<< get_config()->upstream_read_timeout.tv_sec << R"(
|
||||
--frontend-write-timeout=<SEC>
|
||||
Specify write timeout for all frontend
|
||||
connections.
|
||||
Default: )"
|
||||
<< get_config()->upstream_write_timeout.tv_sec << R"(
|
||||
--backend-read-timeout=<SEC>
|
||||
Specify read timeout for backend connection.
|
||||
Default: )"
|
||||
<< get_config()->downstream_read_timeout.tv_sec << R"(
|
||||
--backend-write-timeout=<SEC>
|
||||
Specify write timeout for backend connection.
|
||||
Default: )"
|
||||
<< get_config()->downstream_write_timeout.tv_sec << R"(
|
||||
--backend-keep-alive-timeout=<SEC>
|
||||
Specify keep-alive timeout for backend
|
||||
connection.
|
||||
Default: )"
|
||||
<< get_config()->downstream_idle_read_timeout.tv_sec << R"(
|
||||
--backend-http-proxy-uri=<URI>
|
||||
Specify proxy URI in the form
|
||||
http://[<USER>:<PASS>@]<PROXY>:<PORT>. If a
|
||||
proxy requires authentication, specify <USER> and
|
||||
<PASS>. Note that they must be properly
|
||||
percent-encoded. This proxy is used when the
|
||||
backend connection is HTTP/2. First, make a
|
||||
CONNECT request to the proxy and it connects to
|
||||
the backend on behalf of nghttpx. This forms
|
||||
tunnel. After that, nghttpx performs SSL/TLS
|
||||
handshake with the downstream through the tunnel.
|
||||
The timeouts when connecting and making CONNECT
|
||||
request can be specified by
|
||||
--backend-read-timeout and
|
||||
--backend-write-timeout options.
|
||||
|
||||
SSL/TLS:
|
||||
--ciphers=<SUITE> Set allowed cipher list. The format of the
|
||||
string is described in OpenSSL ciphers(1). If
|
||||
this option is used, --honor-cipher-order is
|
||||
implicitly enabled.
|
||||
--honor-cipher-order
|
||||
Honor server cipher order, giving the ability to
|
||||
mitigate BEAST attacks.
|
||||
-k, --insecure
|
||||
Don't verify backend server's certificate if -p,
|
||||
--client or --http2-bridge are given and
|
||||
--backend-no-tls is not given.
|
||||
--cacert=<PATH> Set path to trusted CA certificate file if -p,
|
||||
--client or --http2-bridge are given and
|
||||
--backend-no-tls is not given. The file must be
|
||||
in PEM format. It can contain multiple
|
||||
certificates. If the linked OpenSSL is
|
||||
configured to load system wide certificates, they
|
||||
are loaded at startup regardless of this option.
|
||||
--private-key-passwd-file=<FILEPATH>
|
||||
Path to file that contains password for the
|
||||
server's private key. If none is given and the
|
||||
private key is password protected it'll be
|
||||
requested interactively.
|
||||
--subcert=<KEYPATH>:<CERTPATH>
|
||||
Specify additional certificate and private key
|
||||
file. nghttpx will choose certificates based on
|
||||
the hostname indicated by client using TLS SNI
|
||||
extension. This option can be used multiple
|
||||
times.
|
||||
--backend-tls-sni-field=<HOST>
|
||||
Explicitly set the content of the TLS SNI
|
||||
extension. This will default to the backend HOST
|
||||
name.
|
||||
--dh-param-file=<PATH>
|
||||
Path to file that contains DH parameters in PEM
|
||||
format. Without this option, DHE cipher suites
|
||||
are not available.
|
||||
--npn-list=<LIST> Comma delimited list of NPN/ALPN protocol sorted
|
||||
in the order of preference. That means most
|
||||
desirable protocol comes first. The parameter
|
||||
must be delimited by a single comma only and any
|
||||
white spaces are treated as a part of protocol
|
||||
string.
|
||||
Default: )" << DEFAULT_NPN_LIST << R"(
|
||||
--verify-client Require and verify client certificate.
|
||||
--verify-client-cacert=<PATH>
|
||||
Path to file that contains CA certificates to
|
||||
verify client certificate. The file must be in
|
||||
PEM format. It can contain multiple
|
||||
certificates.
|
||||
--client-private-key-file=<PATH>
|
||||
Path to file that contains client private key
|
||||
used in backend client authentication.
|
||||
--client-cert-file=<PATH>
|
||||
Path to file that contains client certificate
|
||||
used in backend client authentication.
|
||||
--tls-proto-list=<LIST>
|
||||
Comma delimited list of SSL/TLS protocol to be
|
||||
enabled. The following protocols are available:
|
||||
TLSv1.2, TLSv1.1, TLSv1.0 and SSLv3. The name
|
||||
matching is done in case-insensitive manner. The
|
||||
parameter must be delimited by a single comma
|
||||
only and any white spaces are treated as a part
|
||||
of protocol string.
|
||||
Default: )" << DEFAULT_TLS_PROTO_LIST << R"(
|
||||
|
||||
HTTP/2 and SPDY:
|
||||
-c, --http2-max-concurrent-streams=<NUM>
|
||||
Set the maximum number of the concurrent streams
|
||||
in one HTTP/2 and SPDY session.
|
||||
Default: )"
|
||||
<< get_config()->http2_max_concurrent_streams << R"(
|
||||
--frontend-http2-window-bits=<N>
|
||||
Sets the per-stream initial window size of HTTP/2
|
||||
SPDY frontend connection. For HTTP/2, the size
|
||||
is 2**<N>-1. For SPDY, the size is 2**<N>.
|
||||
Default: )"
|
||||
<< get_config()->http2_upstream_window_bits << R"(
|
||||
--frontend-http2-connection-window-bits=<N>
|
||||
Sets the per-connection window size of HTTP/2 and
|
||||
SPDY frontend connection. For HTTP/2, the size
|
||||
is 2**<N>-1. For SPDY, the size is 2**<N>.
|
||||
Default: )"
|
||||
<< get_config()->http2_upstream_connection_window_bits << R"(
|
||||
--frontend-no-tls Disable SSL/TLS on frontend connections.
|
||||
--backend-http2-window-bits=<N>
|
||||
Sets the initial window size of HTTP/2 backend
|
||||
connection to 2**<N>-1.
|
||||
Default: )"
|
||||
<< get_config()->http2_downstream_window_bits << R"(
|
||||
--backend-http2-connection-window-bits=<N>
|
||||
Sets the per-connection window size of HTTP/2
|
||||
backend connection to 2**<N>-1.
|
||||
Default: )"
|
||||
<< get_config()->http2_downstream_connection_window_bits << R"(
|
||||
--backend-no-tls Disable SSL/TLS on backend connections.
|
||||
--http2-no-cookie-crumbling
|
||||
Don't crumble cookie header field.
|
||||
--padding=<N> Add at most <N> bytes to a HTTP/2 frame payload
|
||||
as padding. Specify 0 to disable padding. This
|
||||
option is meant for debugging purpose and not
|
||||
intended to enhance protocol security.
|
||||
|
||||
Mode:
|
||||
(default mode) Accept HTTP/2, SPDY and HTTP/1.1 over SSL/TLS.
|
||||
If --frontend-no-tls is used, accept HTTP/2 and
|
||||
HTTP/1.1. The incoming HTTP/1.1 connection can
|
||||
be upgraded to HTTP/2 through HTTP Upgrade. The
|
||||
protocol to the backend is HTTP/1.1.
|
||||
-s, --http2-proxy Like default mode, but enable secure proxy mode.
|
||||
--http2-bridge Like default mode, but communicate with the
|
||||
backend in HTTP/2 over SSL/TLS. Thus the
|
||||
incoming all connections are converted to HTTP/2
|
||||
connection and relayed to the backend. See
|
||||
--backend-http-proxy-uri option if you are behind
|
||||
the proxy and want to connect to the outside
|
||||
HTTP/2 proxy.
|
||||
--client Accept HTTP/2 and HTTP/1.1 without SSL/TLS. The
|
||||
incoming HTTP/1.1 connection can be upgraded to
|
||||
HTTP/2 connection through HTTP Upgrade. The
|
||||
protocol to the backend is HTTP/2. To use
|
||||
nghttpx as a forward proxy, use -p option
|
||||
instead.
|
||||
-p, --client-proxy
|
||||
Like --client option, but it also requires the
|
||||
request path from frontend must be an absolute
|
||||
URI, suitable for use as a forward proxy.
|
||||
|
||||
Logging:
|
||||
-L, --log-level=<LEVEL>
|
||||
Set the severity level of log output. <LEVEL>
|
||||
must be one of INFO, WARNING, ERROR and FATAL.
|
||||
Default: WARNING
|
||||
--accesslog Print simple accesslog to stderr.
|
||||
--syslog Send log messages to syslog.
|
||||
--syslog-facility=<FACILITY>
|
||||
Set syslog facility to <FACILITY>.
|
||||
Default: )"
|
||||
<< str_syslog_facility(get_config()->syslog_facility) << R"(
|
||||
|
||||
Misc:
|
||||
--add-x-forwarded-for
|
||||
Append X-Forwarded-For header field to the
|
||||
downstream request.
|
||||
--no-via Don't append to Via header field. If Via header
|
||||
field is received, it is left unaltered.
|
||||
--frontend-http2-dump-request-header=<PATH>
|
||||
Dumps request headers received by HTTP/2 frontend
|
||||
to the file denoted in <PATH>. The output is
|
||||
done in HTTP/1 header field format and each
|
||||
header block is followed by an empty line. This
|
||||
option is not thread safe and MUST NOT be used
|
||||
with option -n<N>, where <N> >= 2.
|
||||
--frontend-http2-dump-response-header=<PATH>
|
||||
Dumps response headers sent from HTTP/2 frontend
|
||||
to the file denoted in <PATH>. The output is
|
||||
done in HTTP/1 header field format and each
|
||||
header block is followed by an empty line. This
|
||||
option is not thread safe and MUST NOT be used
|
||||
with option -n<N>, where <N> >= 2.
|
||||
-o, --frontend-frame-debug
|
||||
Print HTTP/2 frames in frontend to stderr. This
|
||||
option is not thread safe and MUST NOT be used
|
||||
with option -n=N, where N >= 2.
|
||||
-D, --daemon
|
||||
Run in a background. If -D is used, the current
|
||||
working directory is changed to '/'.
|
||||
--pid-file=<PATH> Set path to save PID of this program.
|
||||
--user=<USER> Run this program as <USER>. This option is
|
||||
intended to be used to drop root privileges.
|
||||
--conf=<PATH> Load configuration from <PATH>.
|
||||
Default: )"
|
||||
<< get_config()->conf_path << R"(
|
||||
-v, --version Print version and exit.
|
||||
-h, --help Print this help and exit.)"
|
||||
<< std::endl;
|
||||
}
|
||||
} // namespace
|
||||
|
|
|
|||
Loading…
Reference in New Issue