kong.conf.default

# -----------------------
# Kong configuration file
# -----------------------
#
# The commented-out settings shown in this file represent the default values.
#
# This file is read when `kong start` or `kong prepare` are used. Kong
# generates the Nginx configuration with the settings specified in this file.
#
# All environment variables prefixed with `KONG_` and capitalized will override
# the settings specified in this file.
# Example:
#   `log_level` setting -> `KONG_LOG_LEVEL` env variable
#
# Boolean values can be specified as `on`/`off` or `true`/`false`.
# Lists must be specified as comma-separated strings.
#
# All comments in this file can be removed safely, including the
# commented-out properties.
# You can verify the integrity of your settings with `kong check <conf>`.

#------------------------------------------------------------------------------
# GENERAL
#------------------------------------------------------------------------------

#prefix = /usr/local/kong/       # Working directory. Equivalent to Nginx's
                                 # prefix path, containing temporary files
                                 # and logs.
                                 # Each Kong process must have a separate
                                 # working directory.

#log_level = notice              # Log level of the Nginx server. Logs are
                                 # found at `<prefix>/logs/error.log`.

# See http://nginx.org/en/docs/ngx_core_module.html#error_log for a list
# of accepted values.

#proxy_access_log = logs/access.log       # Path for proxy port request access
                                          # logs. Set this value to `off` to
                                          # disable logging proxy requests.
                                          # If this value is a relative path,
                                          # it will be placed under the
                                          # `prefix` location.


#proxy_error_log = logs/error.log         # Path for proxy port request error logs.
                                          # The granularity of these logs is adjusted by the `log_level` property.

#proxy_stream_access_log = logs/access.log basic # Path for TCP streams proxy port access logs.
                                                 # Set to `off` to disable logging proxy requests.
                                                 # If this value is a relative path, it will be placed under the `prefix` location.
                                                 # `basic` is defined as `'$remote_addr [$time_local] '
                                                 # '$protocol $status $bytes_sent $bytes_received '
                                                 # '$session_time'`

#proxy_stream_error_log = logs/error.log         # Path for tcp streams proxy port request error
                                                 # logs. The granularity of these logs
                                                 # is adjusted by the `log_level`
                                                 # property.

#admin_access_log = logs/admin_access.log # Path for Admin API request access logs.
                                          # If hybrid mode is enabled and the current node is set
                                          # to be the control plane, then the connection requests
                                          # from data planes are also written to this file with
                                          # server name "kong_cluster_listener".
                                          #
                                          # Set this value to `off` to disable logging Admin API requests.
                                          # If this value is a relative path, it will be placed under the `prefix` location.


#admin_error_log = logs/error.log         # Path for Admin API request error logs.
                                          # The granularity of these logs is adjusted by the `log_level` property.

#status_access_log = off                  # Path for Status API request access logs.
                                          # The default value of `off` implies that logging for this API
                                          # is disabled by default.
                                          # If this value is a relative path, it will be placed under the `prefix` location.

#status_error_log = logs/status_error.log # Path for Status API request error logs.
                                          # The granularity of these logs is adjusted by the `log_level` property.

#vaults = bundled                # Comma-separated list of vaults this node should load.
                                 # By default, all the bundled vaults are enabled.
                                 #
                                 # The specified name(s) will be substituted as
                                 # such in the Lua namespace:
                                 # `kong.vaults.{name}.*`.

#opentelemetry_tracing = off                # Deprecated: use `tracing_instrumentations` instead.

#tracing_instrumentations = off             # Comma-separated list of tracing instrumentations this node should load.
                                            # By default, no instrumentations are enabled.
                                            #
                                            # Valid values for this setting are:
                                            #
                                            # - `off`: do not enable instrumentations.
                                            # - `request`: only enable request-level instrumentations.
                                            # - `all`: enable all the following instrumentations.
                                            # - `db_query`: trace database queries.
                                            # - `dns_query`: trace DNS queries.
                                            # - `router`: trace router execution, including router rebuilding.
                                            # - `http_client`: trace OpenResty HTTP client requests.
                                            # - `balancer`: trace balancer retries.
                                            # - `plugin_rewrite`: trace plugin iterator execution with rewrite phase.
                                            # - `plugin_access`: trace plugin iterator execution with access phase.
                                            # - `plugin_header_filter`: trace plugin iterator execution with header_filter phase.
                                            #
                                            # **Note:** In the current implementation, tracing instrumentations are not enabled in stream mode.

#opentelemetry_tracing_sampling_rate = 1.0  # Deprecated: use `tracing_sampling_rate` instead.
#tracing_sampling_rate = 0.01               # Tracing instrumentation sampling rate.
                                            # Tracer samples a fixed percentage of all spans
                                            # following the sampling rate.
                                            #
                                            # Example: `0.25`, this accounts for 25% of all traces.


#plugins = bundled               # Comma-separated list of plugins this node should load.
                                 # By default, only plugins bundled in official distributions
                                 # are loaded via the `bundled` keyword.
                                 #
                                 # Loading a plugin does not enable it by default, but only
                                 # instructs Kong to load its source code and allows
                                 # configuration via the various related Admin API endpoints.
                                 #
                                 # The specified name(s) will be substituted as such in the
                                 # Lua namespace: `kong.plugins.{name}.*`.
                                 #
                                 # When the `off` keyword is specified as the only value,
                                 # no plugins will be loaded.
                                 #
                                 # `bundled` and plugin names can be mixed together, as the
                                 # following examples suggest:
                                 #
                                 # - `plugins = bundled,custom-auth,custom-log`
                                 #   will include the bundled plugins plus two custom ones.
                                 # - `plugins = custom-auth,custom-log` will
                                 #   *only* include the `custom-auth` and `custom-log` plugins.
                                 # - `plugins = off` will not include any plugins.
                                 #
                                 # **Note:** Kong will not start if some plugins were previously
                                 # configured (i.e. have rows in the database) and are not
                                 # specified in this list. Before disabling a plugin, ensure
                                 # all instances of it are removed before restarting Kong.
                                 #
                                 # **Note:** Limiting the amount of available plugins can
                                 # improve P99 latency when experiencing LRU churning in the
                                 # database cache (i.e. when the configured `mem_cache_size`) is full.


#dedicated_config_processing = on  # Enables or disables a special worker
                                   # process for configuration processing. This process
                                   # increases memory usage a little bit while
                                   # allowing to reduce latencies by moving some
                                   # background tasks, such as CP/DP connection
                                   # handling, to an additional worker process specific
                                   # to handling these background tasks.
                                   # Currently this has effect only on data planes.

#pluginserver_names =            # Comma-separated list of names for pluginserver
                                 # processes. The actual names are used for
                                 # log messages and to relate the actual settings.

#pluginserver_XXX_socket = <prefix>/<XXX>.socket            # Path to the unix socket
                                                            # used by the <XXX> pluginserver.

#pluginserver_XXX_start_cmd = /usr/local/bin/<XXX>          # Full command (including
                                                            # any needed arguments) to
                                                            # start the <XXX>
                                                            # pluginserver.

#pluginserver_XXX_query_cmd = /usr/local/bin/query_<XXX>    # Full command to "query" the
                                                            # <XXX> pluginserver.  Should
                                                            # produce a JSON with the
                                                            # dump info of the plugin it
                                                            # manages.

#port_maps =                     # With this configuration parameter, you can
                                 # let Kong Gateway know the port from
                                 # which the packets are forwarded to it. This
                                 # is fairly common when running Kong in a
                                 # containerized or virtualized environment.
                                 # For example, `port_maps=80:8000, 443:8443`
                                 # instructs Kong that the port 80 is mapped
                                 # to 8000 (and the port 443 to 8443), where
                                 # 8000 and 8443 are the ports that Kong is
                                 # listening to.
                                 #
                                 # This parameter helps Kong set a proper
                                 # forwarded upstream HTTP request header or to
                                 # get the proper forwarded port with the Kong PDK
                                 # (in case other means determining it has
                                 # failed). It changes routing by a destination
                                 # port to route by a port from which packets
                                 # are forwarded to Kong, and similarly it
                                 # changes the default plugin log serializer to
                                 # use the port according to this mapping
                                 # instead of reporting the port Kong is
                                 # listening to.

#anonymous_reports = on          # Send anonymous usage data such as error
                                 # stack traces to help improve Kong.


#proxy_server =                  # Proxy server defined as an encoded URL. Kong will only
                                 # use this option if a component is explicitly configured
                                 # to use a proxy.


#proxy_server_ssl_verify = off   # Toggles server certificate verification if
                                 # `proxy_server` is in HTTPS.
                                 # See the `lua_ssl_trusted_certificate`
                                 # setting to specify a certificate authority.

#error_template_html =           # Path to the custom html error template to
                                 # override the default html kong error
                                 # template.
                                 #
                                 # The template may contain up to two `%s`
                                 # placeholders. The first one will expand to
                                 # the error message. The second one will
                                 # expand to the request ID. Both placeholders
                                 # are optional, but recommended.
                                 # Adding more than two placeholders will
                                 # result in a runtime error when trying to
                                 # render the template:
                                 # ```
                                 # <html>
                                 #   <body>
                                 #     <h1>My custom error template</h1>
                                 #     <p>error: %s</p>
                                 #     <p>request_id: %s</p>
                                 #   </body>
                                 # </html>
                                 # ```

#error_template_json =           # Path to the custom json error template to
                                 # override the default json kong error
                                 # template.
                                 #
                                 # Similarly to `error_template_html`, the
                                 # template may contain up to two `%s`
                                 # placeholders for the error message and the
                                 # request ID respectively.

#error_template_xml =            # Path to the custom xml error template to
                                 # override the default xml kong error template
                                 #
                                 # Similarly to `error_template_html`, the
                                 # template may contain up to two `%s`
                                 # placeholders for the error message and the
                                 # request ID respectively.

#error_template_plain =          # Path to the custom plain error template to
                                 # override the default plain kong error
                                 # template
                                 #
                                 # Similarly to `error_template_html`, the
                                 # template may contain up to two `%s`
                                 # placeholders for the error message and the
                                 # request ID respectively.

#------------------------------------------------------------------------------
# HYBRID MODE
#------------------------------------------------------------------------------

#role = traditional              # Use this setting to enable hybrid mode,
                                 # This allows running some Kong nodes in a
                                 # control plane role with a database and
                                 # have them deliver configuration updates
                                 # to other nodes running to DB-less running in
                                 # a data plane role.
                                 #
                                 # Valid values for this setting are:
                                 #
                                 # - `traditional`: do not use hybrid mode.
                                 # - `control_plane`: this node runs in a
                                 #   control plane role. It can use a database
                                 #   and will deliver configuration updates
                                 #   to data plane nodes.
                                 # - `data_plane`: this is a data plane node.
                                 #   It runs DB-less and receives configuration
                                 #   updates from a control plane node.

#cluster_mtls = shared           # Sets the verification method between nodes of the cluster.
                                 #
                                 # Valid values for this setting are:
                                 #
                                 # - `shared`: use a shared certificate/key pair specified with
                                 #   the `cluster_cert` and `cluster_cert_key` settings.
                                 #   Note that CP and DP nodes must present the same certificate
                                 #   to establish mTLS connections.
                                 # - `pki`: use `cluster_ca_cert`, `cluster_server_name`, and
                                 #   `cluster_cert` for verification. These are different
                                 #   certificates for each DP node, but issued by a cluster-wide
                                 #   common CA certificate: `cluster_ca_cert`.
                                 # - `pki_check_cn`: similar to `pki` but additionally checks
                                 #   for the common name of the data plane certificate specified
                                 #   in `cluster_allowed_common_names`.

#cluster_cert =                  # Cluster certificate to use
                                 # when establishing secure communication
                                 # between control and data plane nodes.
                                 # You can use the `kong hybrid` command to
                                 # generate the certificate/key pair.
                                 # Under `shared` mode, it must be the same
                                 # for all nodes.  Under `pki` mode it
                                 # should be a different certificate for each
                                 # DP node.
                                 #
                                 # The certificate can be configured on this
                                 # property with either of the following values:
                                 # * absolute path to the certificate
                                 # * certificate content
                                 # * base64 encoded certificate content

#cluster_cert_key =              # Cluster certificate key to
                                 # use when establishing secure communication
                                 # between control and data plane nodes.
                                 # You can use the `kong hybrid` command to
                                 # generate the certificate/key pair.
                                 # Under `shared` mode, it must be the same
                                 # for all nodes.  Under `pki` mode it
                                 # should be a different certificate for each
                                 # DP node.
                                 #
                                 # The certificate key can be configured on this
                                 # property with either of the following values:
                                 # - absolute path to the certificate key
                                 # - certificate key content
                                 # - base64 encoded certificate key content

#cluster_ca_cert =               # The trusted CA certificate file in PEM format used for:
                                 # - Control plane to verify data plane's certificate
                                 # - Data plane to verify control plane's certificate
                                 #
                                 # Required on data plane if `cluster_mtls` is set to `pki`.
                                 # If the control plane certificate is issued by a well-known CA,
                                 # set `lua_ssl_trusted_certificate=system` on the data plane and leave this field empty.
                                 #
                                 # This field is ignored if `cluster_mtls` is set to `shared`.
                                 #
                                 # The certificate can be configured on this property with any of the following values:
                                 # - absolute path to the certificate
                                 # - certificate content
                                 # - base64 encoded certificate content

#------------------------------------------------------------------------------
# HYBRID MODE DATA PLANE
#------------------------------------------------------------------------------

#cluster_server_name =           # The server name used in the SNI of the TLS
                                 # connection from a DP node to a CP node.
                                 # Must match the Common Name (CN) or Subject
                                 # Alternative Name (SAN) found in the CP
                                 # certificate.
                                 # If `cluster_mtls` is set to
                                 # `shared`, this setting is ignored and
                                 # `kong_clustering` is used.

#cluster_control_plane =         # To be used by data plane nodes only:
                                 # address of the control plane node from which
                                 # configuration updates will be fetched,
                                 # in `host:port` format.

#cluster_max_payload = 16777216
                                 # This sets the maximum compressed payload size allowed
                                 # to be sent across from CP to DP in Hybrid mode
                                 # Default is 16MB - 16 * 1024 * 1024.

#cluster_dp_labels =             # Comma-separated list of labels for the data plane.
                                 # Labels are key-value pairs that provide additional
                                 # context information for each DP.
                                 # Each label must be configured as a string in the
                                 # format `key:value`.
                                 #
                                 # Labels are only compatible with hybrid mode
                                 # deployments with Kong Konnect (SaaS).
                                 # This configuration doesn't work with
                                 # self-hosted deployments.
                                 #
                                 # Keys and values follow the AIP standards:
                                 # https://kong-aip.netlify.app/aip/129/
                                 #
                                 # Example:
                                 # `deployment:mycloud,region:us-east-1`

#------------------------------------------------------------------------------
# HYBRID MODE CONTROL PLANE
#------------------------------------------------------------------------------

#cluster_listen = 0.0.0.0:8005
                         # Comma-separated list of addresses and ports on
                         # which the cluster control plane server should listen
                         # for data plane connections.
                         # The cluster communication port of the control plane
                         # must be accessible by all the data planes
                         # within the same cluster. This port is mTLS protected
                         # to ensure end-to-end security and integrity.
                         #
                         # This setting has no effect if `role` is not set to
                         # `control_plane`.
                         #
                         # Connections made to this endpoint are logged
                         # to the same location as Admin API access logs.
                         # See `admin_access_log` config description for more
                         # information.

#cluster_data_plane_purge_delay = 1209600
                         # How many seconds must pass from the time a DP node
                         # becomes offline to the time its entry gets removed
                         # from the database, as returned by the
                         # /clustering/data-planes Admin API endpoint.
                         #
                         # This is to prevent the cluster data plane table from
                         # growing indefinitely. The default is set to
                         # 14 days. That is, if the CP hasn't heard from a DP for
                         # 14 days, its entry will be removed.

#cluster_ocsp = off
                         # Whether to check for revocation status of DP
                         # certificates using OCSP (Online Certificate Status Protocol).
                         # If enabled, the DP certificate should contain the
                         # "Certificate Authority Information Access" extension
                         # and the OCSP method with URI of which the OCSP responder
                         # can be reached from CP.
                         #
                         # OCSP checks are only performed on CP nodes, it has no
                         # effect on DP nodes.
                         #
                         # Valid values for this setting are:
                         #
                         # - `on`: OCSP revocation check is enabled and DP
                         #   must pass the check in order to establish
                         #   connection with CP.
                         # - `off`: OCSP revocation check is disabled.
                         # - `optional`: OCSP revocation check will be attempted,
                         #   however, if the required extension is not
                         #   found inside DP-provided certificate
                         #   or communication with the OCSP responder
                         #   failed, then DP is still allowed through.

#cluster_use_proxy = off
                         # Whether to turn on HTTP CONNECT proxy support for
                         # hybrid mode connections. `proxy_server` will be used
                         # for hybrid mode connections if this option is turned on.
#------------------------------------------------------------------------------
# NGINX
#------------------------------------------------------------------------------

#proxy_listen = 0.0.0.0:8000 reuseport backlog=16384, 0.0.0.0:8443 http2 ssl reuseport backlog=16384
                         # Comma-separated list of addresses and ports on
                         # which the proxy server should listen for
                         # HTTP/HTTPS traffic.
                         # The proxy server is the public entry point of Kong,
                         # which proxies traffic from your consumers to your
                         # backend services. This value accepts IPv4, IPv6, and
                         # hostnames.
                         #
                         # Some suffixes can be specified for each pair:
                         #
                         # - `ssl` will require that all connections made
                         #   through a particular address/port be made with TLS
                         #   enabled.
                         # - `http2` will allow for clients to open HTTP/2
                         #   connections to Kong's proxy server.
                         # - `proxy_protocol` will enable usage of the
                         #   PROXY protocol for a given address/port.
                         # - `deferred` instructs to use a deferred accept on
                         #   Linux (the `TCP_DEFER_ACCEPT` socket option).
                         # - `bind` instructs to make a separate bind() call
                         #   for a given address:port pair.
                         # - `reuseport` instructs to create an individual
                         #   listening socket for each worker process,
                         #   allowing the kernel to better distribute incoming
                         #   connections between worker processes.
                         # - `backlog=N` sets the maximum length for the queue
                         #   of pending TCP connections. This number should
                         #   not be too small to prevent clients
                         #   seeing "Connection refused" errors when connecting to
                         #   a busy Kong instance.
                         #   **Note:** On Linux, this value is limited by the
                         #   setting of the `net.core.somaxconn` kernel parameter.
                         #   In order for the larger `backlog` set here to take
                         #   effect, it is necessary to raise
                         #   `net.core.somaxconn` at the same time to match or
                         #   exceed the `backlog` number set.
                         # - `ipv6only=on|off` specifies whether an IPv6 socket listening
                         #   on a wildcard address [::] will accept only IPv6
                         #   connections or both IPv6 and IPv4 connections.
                         # - `so_keepalive=on|off|[keepidle]:[keepintvl]:[keepcnt]`
                         #   configures the `TCP keepalive` behavior for the listening
                         #   socket. If this parameter is omitted, the operating
                         #   system’s settings will be in effect for the socket. If it
                         #   is set to the value `on`, the `SO_KEEPALIVE` option is turned
                         #   on for the socket. If it is set to the value `off`, the
                         #   `SO_KEEPALIVE` option is turned off for the socket. Some
                         #   operating systems support setting of TCP keepalive parameters
                         #   on a per-socket basis using the `TCP_KEEPIDLE`,` TCP_KEEPINTVL`,
                         #   and `TCP_KEEPCNT` socket options.
                         #
                         # This value can be set to `off`, thus disabling
                         # the HTTP/HTTPS proxy port for this node.
                         # If `stream_listen` is also set to `off`, this enables
                         # control plane mode for this node
                         # (in which all traffic proxying capabilities are
                         # disabled). This node can then be used only to
                         # configure a cluster of Kong
                         # nodes connected to the same datastore.
                         #
                         # Example:
                         # `proxy_listen = 0.0.0.0:443 ssl, 0.0.0.0:444 http2 ssl`
                         #
                         # See http://nginx.org/en/docs/http/ngx_http_core_module.html#listen
                         # for a description of the accepted formats for this
                         # and other `*_listen` values.
                         #
                         # See https://www.nginx.com/resources/admin-guide/proxy-protocol/
                         # for more details about the `proxy_protocol`
                         # parameter.
                         #
                         # Not all `*_listen` values accept all formats
                         # specified in nginx's documentation.

#stream_listen = off
                         # Comma-separated list of addresses and ports on
                         # which the stream mode should listen.
                         #
                         # This value accepts IPv4, IPv6, and hostnames.
                         # Some suffixes can be specified for each pair:
                         # - `ssl` will require that all connections made
                         #   through a particular address/port be made with TLS
                         #   enabled.
                         # - `proxy_protocol` will enable usage of the
                         #   PROXY protocol for a given address/port.
                         # - `bind` instructs to make a separate bind() call
                         #   for a given address:port pair.
                         # - `reuseport` instructs to create an individual
                         #   listening socket for each worker process,
                         #   allowing the kernel to better distribute incoming
                         #   connections between worker processes.
                         # - `backlog=N` sets the maximum length for the queue
                         #   of pending TCP connections. This number should
                         #   not be too small to prevent clients
                         #   seeing "Connection refused" errors when connecting to
                         #   a busy Kong instance.
                         #   **Note:** On Linux, this value is limited by the
                         #   setting of the `net.core.somaxconn` kernel parameter.
                         #   In order for the larger `backlog` set here to take
                         #   effect, it is necessary to raise
                         #   `net.core.somaxconn` at the same time to match or
                         #   exceed the `backlog` number set.
                         # - `ipv6only=on|off` specifies whether an IPv6 socket listening
                         #   on a wildcard address [::] will accept only IPv6
                         #   connections or both IPv6 and IPv4 connections.
                         # - `so_keepalive=on|off|[keepidle]:[keepintvl]:[keepcnt]`
                         #   configures the `TCP keepalive` behavior for the listening
                         #   socket. If this parameter is omitted, the operating
                         #   system’s settings will be in effect for the socket. If it
                         #   is set to the value `on`, the `SO_KEEPALIVE` option is turned
                         #   on for the socket. If it is set to the value `off`, the
                         #   `SO_KEEPALIVE` option is turned off for the socket. Some
                         #   operating systems support setting of TCP keepalive parameters
                         #   on a per-socket basis using the` TCP_KEEPIDLE`, `TCP_KEEPINTVL`,
                         #   and `TCP_KEEPCNT` socket options.
                         #
                         # Examples:
                         #
                         # ```
                         # stream_listen = 127.0.0.1:7000 reuseport backlog=16384
                         # stream_listen = 0.0.0.0:989 reuseport backlog=65536, 0.0.0.0:20
                         # stream_listen = [::1]:1234 backlog=16384
                         # ```
                         #
                         # By default, this value is set to `off`, thus
                         # disabling the stream proxy port for this node.

# See http://nginx.org/en/docs/stream/ngx_stream_core_module.html#listen
# for a description of the formats that Kong might accept in stream_listen.

#admin_listen = 127.0.0.1:8001 reuseport backlog=16384, 127.0.0.1:8444 http2 ssl reuseport backlog=16384
                         # Comma-separated list of addresses and ports on
                         # which the Admin interface should listen.
                         # The Admin interface is the API allowing you to
                         # configure and manage Kong.
                         # Access to this interface should be *restricted*
                         # to Kong administrators *only*. This value accepts
                         # IPv4, IPv6, and hostnames.
                         #
                         # It is highly recommended to avoid exposing the Admin API to public
                         # interfaces, by using values such as `0.0.0.0:8001`
                         #
                         # See https://docs.konghq.com/gateway/latest/production/running-kong/secure-admin-api/
                         # for more information about how to secure your Admin API.
                         #
                         # Some suffixes can be specified for each pair:
                         #
                         # - `ssl` will require that all connections made
                         #   through a particular address/port be made with TLS
                         #   enabled.
                         # - `http2` will allow for clients to open HTTP/2
                         #   connections to Kong's proxy server.
                         # - `proxy_protocol` will enable usage of the
                         #   PROXY protocol for a given address/port.
                         # - `deferred` instructs to use a deferred accept on
                         #   Linux (the `TCP_DEFER_ACCEPT` socket option).
                         # - `bind` instructs to make a separate bind() call
                         #   for a given address:port pair.
                         # - `reuseport` instructs to create an individual
                         #   listening socket for each worker process,
                         #   allowing the Kernel to better distribute incoming
                         #   connections between worker processes.
                         # - `backlog=N` sets the maximum length for the queue
                         #   of pending TCP connections. This number should
                         #   not be too small to prevent clients
                         #   seeing "Connection refused" errors when connecting to
                         #   a busy Kong instance.
                         #   **Note:** On Linux, this value is limited by the
                         #   setting of the `net.core.somaxconn` kernel parameter.
                         #   In order for the larger `backlog` set here to take
                         #   effect, it is necessary to raise
                         #   `net.core.somaxconn` at the same time to match or
                         #   exceed the `backlog` number set.
                         # - `ipv6only=on|off` specifies whether an IPv6 socket listening
                         #   on a wildcard address [::] will accept only IPv6
                         #   connections or both IPv6 and IPv4 connections.
                         # - `so_keepalive=on|off|[keepidle]:[keepintvl]:[keepcnt]`
                         #   configures the “TCP keepalive” behavior for the listening
                         #   socket. If this parameter is omitted, the operating
                         #   system’s settings will be in effect for the socket. If it
                         #   is set to the value `on`, the `SO_KEEPALIVE` option is turned
                         #   on for the socket. If it is set to the value `off`, the
                         #   `SO_KEEPALIVE` option is turned off for the socket. Some
                         #   operating systems support setting of TCP keepalive parameters
                         #   on a per-socket basis using the `TCP_KEEPIDLE`, `TCP_KEEPINTVL`,
                         #   and `TCP_KEEPCNT` socket options.
                         #
                         # This value can be set to `off`, thus disabling
                         # the Admin interface for this node, enabling a
                         # data plane mode (without configuration
                         # capabilities) pulling its configuration changes
                         # from the database.
                         #
                         # Example: `admin_listen = 127.0.0.1:8444 http2 ssl`

#status_listen = 127.0.0.1:8007 reuseport backlog=16384
                         # Comma-separated list of addresses and ports on
                         # which the Status API should listen.
                         # The Status API is a read-only endpoint
                         # allowing monitoring tools to retrieve metrics,
                         # healthiness, and other non-sensitive information
                         # of the current Kong node.
                         #
                         # The following suffix can be specified for each pair:
                         #
                         # - `ssl` will require that all connections made
                         #   through a particular address/port be made with TLS
                         #   enabled.
                         # - `http2` will allow for clients to open HTTP/2
                         #   connections to Kong's Status API server.
                         # - `proxy_protocol` will enable usage of the PROXY protocol.
                         #
                         # This value can be set to `off`, disabling
                         # the Status API for this node.
                         #
                         # Example: `status_listen = 0.0.0.0:8100 ssl http2`


#nginx_user = kong kong          # Defines user and group credentials used by
                                 # worker processes. If group is omitted, a
                                 # group whose name equals that of user is
                                 # used.
                                 #
                                 # Example: `nginx_user = nginx www`
                                 #
                                 # **Note**: If the `kong` user and the `kong`
                                 # group are not available, the default user
                                 # and group credentials will be
                                 # `nobody nobody`.

#nginx_worker_processes = auto   # Determines the number of worker processes
                                 # spawned by Nginx.
                                 #
                                 # See http://nginx.org/en/docs/ngx_core_module.html#worker_processes
                                 # for detailed usage of the equivalent Nginx
                                 # directive and a description of accepted
                                 # values.

#nginx_daemon = on               # Determines whether Nginx will run as a daemon
                                 # or as a foreground process. Mainly useful
                                 # for development or when running Kong inside
                                 # a Docker environment.
                                 #
                                 # See http://nginx.org/en/docs/ngx_core_module.html#daemon.

#mem_cache_size = 128m           # Size of each of the two shared memory caches
                                 # for traditional mode database entities
                                 # and runtime data, `kong_core_cache` and
                                 # `kong_cache`.
                                 #
                                 # The accepted units are `k` and `m`, with a minimum
                                 # recommended value of a few MBs.
                                 #
                                 # **Note**: As this option controls the size of two
                                 # different cache zones, the total memory Kong
                                 # uses to cache entities might be double this value.
                                 # The created zones are shared by all worker
                                 # processes and do not become larger when more
                                 # workers are used.

#ssl_cipher_suite = intermediate # Defines the TLS ciphers served by Nginx.
                                 # Accepted values are `modern`,
                                 # `intermediate`, `old`, `fips` or `custom`.
                                 # If you want to enable TLSv1.1, this value has to be `old`.
                                 #
                                 # See https://wiki.mozilla.org/Security/Server_Side_TLS
                                 # for detailed descriptions of each cipher
                                 # suite. `fips` cipher suites are as described in
                                 # https://wiki.openssl.org/index.php/FIPS_mode_and_TLS.

#ssl_ciphers =                   # Defines a custom list of TLS ciphers to be
                                 # served by Nginx. This list must conform to
                                 # the pattern defined by `openssl ciphers`.
                                 # This value is ignored if `ssl_cipher_suite`
                                 # is not `custom`.
                                 # If you use DHE ciphers, you must also
                                 # configure the `ssl_dhparam` parameter.

#ssl_protocols = TLSv1.2 TLSv1.3
                                 # Enables the specified protocols for
                                 # client-side connections. The set of
                                 # supported protocol versions also depends
                                 # on the version of OpenSSL Kong was built
                                 # with. This value is ignored if
                                 # `ssl_cipher_suite` is not `custom`.
                                 # If you want to enable TLSv1.1, you should
                                 # set `ssl_cipher_suite` to `old`.
                                 #
                                 # See http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols

#ssl_prefer_server_ciphers = on  # Specifies that server ciphers should be
                                 # preferred over client ciphers when using
                                 # the SSLv3 and TLS protocols. This value is
                                 # ignored if `ssl_cipher_suite` is not `custom`.
                                 #
                                 # See http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers

#ssl_dhparam =                   # Defines DH parameters for DHE ciphers from the
                                 # predefined groups: `ffdhe2048`, `ffdhe3072`,
                                 # `ffdhe4096`, `ffdhe6144`, `ffdhe8192`,
                                 # from the absolute path to a parameters file, or
                                 # directly from the parameters content.
                                 #
                                 # This value is ignored if `ssl_cipher_suite`
                                 # is `modern` or `intermediate`. The reason is
                                 # that `modern` has no ciphers that need this,
                                 # and `intermediate` uses `ffdhe2048`.
                                 #
                                 # See http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam

#ssl_session_tickets = on        # Enables or disables session resumption through
                                 # TLS session tickets. This has no impact when
                                 # used with TLSv1.3.
                                 #
                                 # Kong enables this by default for performance
                                 # reasons, but it has security implications:
                                 # https://github.com/mozilla/server-side-tls/issues/135
                                 #
                                 # See http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_tickets

#ssl_session_timeout = 1d        # Specifies a time during which a client may
                                 # reuse the session parameters. See the rationale:
                                 # https://github.com/mozilla/server-side-tls/issues/198
                                 #
                                 # See http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_timeout

#ssl_session_cache_size = 10m    # Sets the size of the caches that store session parameters.
                                 #
                                 # See https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache

#ssl_cert =                      # Comma-separated list of certificates for `proxy_listen` values with TLS enabled.
                                 #
                                 # If more than one certificate is specified, it can be used to provide
                                 # alternate types of certificates (for example, ECC certificates) that will be served
                                 # to clients that support them. Note that to properly serve using ECC certificates,
                                 # it is recommended to also set `ssl_cipher_suite` to
                                 # `modern` or `intermediate`.
                                 #
                                 # Unless this option is explicitly set, Kong will auto-generate
                                 # a pair of default certificates (RSA + ECC) the first time it starts up and use
                                 # them for serving TLS requests.
                                 #
                                 # Certificates can be configured on this property with any of the following
                                 # values:
                                 # - absolute path to the certificate
                                 # - certificate content
                                 # - base64 encoded certificate content

#ssl_cert_key =                  # Comma-separated list of keys for `proxy_listen` values with TLS enabled.
                                 #
                                 # If more than one certificate was specified for `ssl_cert`, then this
                                 # option should contain the corresponding key for all certificates
                                 # provided in the same order.
                                 #
                                 # Unless this option is explicitly set, Kong will auto-generate
                                 # a pair of default private keys (RSA + ECC) the first time it starts up and use
                                 # them for serving TLS requests.
                                 #
                                 # Keys can be configured on this property with any of the following
                                 # values:
                                 # - absolute path to the certificate key
                                 # - certificate key content
                                 # - base64 encoded certificate key content

#client_ssl = off                # Determines if Nginx should attempt to send client-side
                                 # TLS certificates and perform Mutual TLS Authentication
                                 # with upstream service when proxying requests.

#client_ssl_cert =               # If `client_ssl` is enabled, the client certificate
                                 # for the `proxy_ssl_certificate` directive.
                                 #
                                 # This value can be overwritten dynamically with the `client_certificate`
                                 # attribute of the `Service` object.
                                 #
                                 # The certificate can be configured on this property with any of the following
                                 # values:
                                 # - absolute path to the certificate
                                 # - certificate content
                                 # - base64 encoded certificate content

#client_ssl_cert_key =           # If `client_ssl` is enabled, the client TLS key
                                 # for the `proxy_ssl_certificate_key` directive.
                                 #
                                 # This value can be overwritten dynamically with the `client_certificate`
                                 # attribute of the `Service` object.
                                 #
                                 # The certificate key can be configured on this property with any of the following
                                 # values:
                                 # - absolute path to the certificate key
                                 # - certificate key content
                                 # - base64 encoded certificate key content

#admin_ssl_cert =                # Comma-separated list of certificates for `admin_listen` values with TLS enabled.
                                 #
                                 # See docs for `ssl_cert` for detailed usage.

#admin_ssl_cert_key =            # Comma-separated list of keys for `admin_listen` values with TLS enabled.
                                 #
                                 # See docs for `ssl_cert_key` for detailed usage.

#status_ssl_cert =               # Comma-separated list of certificates for `status_listen` values with TLS enabled.
                                 #
                                 # See docs for `ssl_cert` for detailed usage.

#status_ssl_cert_key =           # Comma-separated list of keys for `status_listen` values with TLS enabled.
                                 #
                                 # See docs for `ssl_cert_key` for detailed usage.

#debug_ssl_cert =                # Comma-separated list of certificates for `debug_listen` values with TLS enabled.
                                 #
                                 # See docs for `ssl_cert` for detailed usage.

#debug_ssl_cert_key =            # Comma-separated list of keys for `debug_listen` values with TLS enabled.
                                 #
                                 # See docs for `ssl_cert_key` for detailed usage.

#headers = server_tokens, latency_tokens, X-Kong-Request-Id
                                 # Comma-separated list of headers Kong should
                                 # inject in client responses.
                                 #
                                 # Accepted values are:
                                 # - `Server`: Injects `Server: kong/x.y.z`
                                 #   on Kong-produced responses (e.g., Admin
                                 #   API, rejected requests from auth plugin).
                                 # - `Via`: Injects `Via: kong/x.y.z` for
                                 #   successfully proxied requests.
                                 # - `X-Kong-Proxy-Latency`: Time taken
                                 #   (in milliseconds) by Kong to process
                                 #   a request and run all plugins before
                                 #   proxying the request upstream.
                                 # - `X-Kong-Response-Latency`: Time taken
                                 #   (in milliseconds) by Kong to produce
                                 #   a response in case of, e.g., a plugin
                                 #   short-circuiting the request, or in
                                 #   case of an error.
                                 # - `X-Kong-Upstream-Latency`: Time taken
                                 #   (in milliseconds) by the upstream
                                 #   service to send response headers.
                                 # - `X-Kong-Admin-Latency`: Time taken
                                 #   (in milliseconds) by Kong to process
                                 #   an Admin API request.
                                 # - `X-Kong-Upstream-Status`: The HTTP status
                                 #   code returned by the upstream service.
                                 #   This is particularly useful for clients to
                                 #   distinguish upstream statuses if the
                                 #   response is rewritten by a plugin.
                                 # - `X-Kong-Request-Id`: Unique identifier of
                                 #   the request.
                                 # - `server_tokens`: Same as specifying both
                                 #   `Server` and `Via`.
                                 # - `latency_tokens`: Same as specifying
                                 #   `X-Kong-Proxy-Latency`,
                                 #   `X-Kong-Response-Latency`,
                                 #   `X-Kong-Admin-Latency`, and
                                 #   `X-Kong-Upstream-Latency`.
                                 #
                                 # In addition to these, this value can be set
                                 # to `off`, which prevents Kong from injecting
                                 # any of the above headers. Note that this
                                 # does not prevent plugins from injecting
                                 # headers of their own.
                                 #
                                 # Example: `headers = via, latency_tokens`


#headers_upstream = X-Kong-Request-Id
                                 # Comma-separated list of headers Kong should
                                 # inject in requests to upstream.
                                 #
                                 # At this time, the only accepted value is:
                                 # - `X-Kong-Request-Id`: Unique identifier of
                                 #   the request.
                                 #
                                 # In addition, this value can be set
                                 # to `off`, which prevents Kong from injecting
                                 # the above header. Note that this
                                 # does not prevent plugins from injecting
                                 # headers of their own.

#trusted_ips =                   # Defines trusted IP address blocks that are
                                 # known to send correct `X-Forwarded-*`
                                 # headers.
                                 # Requests from trusted IPs make Kong forward
                                 # their `X-Forwarded-*` headers upstream.
                                 # Non-trusted requests make Kong insert its
                                 # own `X-Forwarded-*` headers.
                                 #
                                 # This property also sets the
                                 # `set_real_ip_from` directive(s) in the Nginx
                                 # configuration. It accepts the same type of
                                 # values (CIDR blocks) but as a
                                 # comma-separated list.
                                 #
                                 # To trust *all* IPs, set this value to
                                 # `0.0.0.0/0,::/0`.
                                 #
                                 # If the special value `unix:` is specified,
                                 # all UNIX-domain sockets will be trusted.
                                 #
                                 # See http://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from
                                 # for examples of accepted values.

#real_ip_header = X-Real-IP      # Defines the request header field whose value
                                 # will be used to replace the client address.
                                 # This value sets the `ngx_http_realip_module`
                                 # directive of the same name in the Nginx
                                 # configuration.
                                 #
                                 # If this value receives `proxy_protocol`:
                                 #
                                 # - at least one of the `proxy_listen` entries
                                 #   must have the `proxy_protocol` flag
                                 #   enabled.
                                 # - the `proxy_protocol` parameter will be
                                 #   appended to the `listen` directive of the
                                 #   Nginx template.
                                 #
                                 # See http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header
                                 # for a description of this directive.

#real_ip_recursive = off         # This value sets the `ngx_http_realip_module`
                                 # directive of the same name in the Nginx
                                 # configuration.
                                 #
                                 # See http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_recursive
                                 # for a description of this directive.

#error_default_type = text/plain  # Default MIME type to use when the request
                                  # `Accept` header is missing and Nginx
                                  # is returning an error for the request.
                                  # Accepted values are `text/plain`,
                                  # `text/html`, `application/json`, and
                                  # `application/xml`.

#upstream_keepalive_pool_size = 512  # Sets the default size of the upstream
                                     # keepalive connection pools.
                                     # Upstream keepalive connection pools
                                     # are segmented by the `dst ip/dst
                                     # port/SNI` attributes of a connection.
                                     # A value of `0` will disable upstream
                                     # keepalive connections by default, forcing
                                     # each upstream request to open a new
                                     # connection.

#upstream_keepalive_max_requests = 10000 # Sets the default maximum number of
                                         # requests that can be proxied upstream
                                         # through one keepalive connection.
                                         # After the maximum number of requests
                                         # is reached, the connection will be
                                         # closed.
                                         # A value of `0` will disable this
                                         # behavior, and a keepalive connection
                                         # can be used to proxy an indefinite
                                         # number of requests.

#upstream_keepalive_idle_timeout = 60   # Sets the default timeout (in seconds)
                                        # for which an upstream keepalive
                                        # connection should be kept open. When
                                        # the timeout is reached while the
                                        # connection has not been reused, it
                                        # will be closed.
                                        # A value of `0` will disable this
                                        # behavior, and an idle keepalive
                                        # connection may be kept open
                                        # indefinitely.

#allow_debug_header = off               # Enable the `Kong-Debug` header function.
                                        # If it is `on`, Kong will add
                                        # `Kong-Route-Id`, `Kong-Route-Name`, `Kong-Service-Id`,
                                        # and `Kong-Service-Name` debug headers to the response when
                                        # the client request header `Kong-Debug: 1` is present.

#------------------------------------------------------------------------------
# NGINX injected directives
#------------------------------------------------------------------------------

# Nginx directives can be dynamically injected in the runtime nginx.conf file
# without requiring a custom Nginx configuration template.
#
# All configuration properties following the naming scheme
# `nginx_<namespace>_<directive>` will result in `<directive>` being injected in
# the Nginx configuration block corresponding to the property's `<namespace>`.
# Example:
#   `nginx_proxy_large_client_header_buffers = 8 24k`
#
#   Will inject the following directive in Kong's proxy `server {}` block:
#
#   `large_client_header_buffers 8 24k;`
#
# The following namespaces are supported:
#
# - `nginx_main_<directive>`: Injects `<directive>` in Kong's configuration
#   `main` context.
# - `nginx_events_<directive>`: Injects `<directive>` in Kong's `events {}`
#   block.
# - `nginx_http_<directive>`: Injects `<directive>` in Kong's `http {}` block.
# - `nginx_proxy_<directive>`: Injects `<directive>` in Kong's proxy
#   `server {}` block.
# - `nginx_location_<directive>`: Injects `<directive>` in Kong's proxy `/`
#   location block (nested under Kong's proxy `server {}` block).
# - `nginx_upstream_<directive>`: Injects `<directive>` in Kong's proxy
#   `upstream {}` block.
# - `nginx_admin_<directive>`: Injects `<directive>` in Kong's Admin API
#   `server {}` block.
# - `nginx_status_<directive>`: Injects `<directive>` in Kong's Status API
#   `server {}` block (only effective if `status_listen` is enabled).
# - `nginx_debug_<directive>`: Injects `<directive>` in Kong's Debug API
#   `server{}` block (only effective if `debug_listen` or `debug_listen_local`
#   is enabled).
# - `nginx_stream_<directive>`: Injects `<directive>` in Kong's stream module
#   `stream {}` block (only effective if `stream_listen` is enabled).
# - `nginx_sproxy_<directive>`: Injects `<directive>` in Kong's stream module
#   `server {}` block (only effective if `stream_listen` is enabled).
# - `nginx_supstream_<directive>`: Injects `<directive>` in Kong's stream
#   module `upstream {}` block.
#
# As with other configuration properties, Nginx directives can be injected via
# environment variables when capitalized and prefixed with `KONG_`.
# Example:
#   `KONG_NGINX_HTTP_SSL_PROTOCOLS` -> `nginx_http_ssl_protocols`
#
#   Will inject the following directive in Kong's `http {}` block:
#
#   `ssl_protocols <value>;`
#
#   If different sets of protocols are desired between the proxy and Admin API
#   server, you may specify `nginx_proxy_ssl_protocols` and/or
#   `nginx_admin_ssl_protocols`, both of which take precedence over the
#   `http {}` block.

#nginx_main_worker_rlimit_nofile = auto
                                 # Changes the limit on the maximum number of open files
                                 # for worker processes.
                                 #
                                 # The special and default value of `auto` sets this
                                 # value to `ulimit -n` with the upper bound limited to
                                 # 16384 as a measure to protect against excess memory use,
                                 # and the lower bound of 1024 as a good default.
                                 #
                                 # See http://nginx.org/en/docs/ngx_core_module.html#worker_rlimit_nofile

#nginx_events_worker_connections = auto
                                 # Sets the maximum number of simultaneous
                                 # connections that can be opened by a worker process.
                                 #
                                 # The special and default value of `auto` sets this
                                 # value to `ulimit -n` with the upper bound limited to
                                 # 16384 as a measure to protect against excess memory use,
                                 # and the lower bound of 1024 as a good default.
                                 #
                                 # See http://nginx.org/en/docs/ngx_core_module.html#worker_connections

#nginx_http_client_header_buffer_size = 1k  # Sets buffer size for reading the
                                            # client request headers.
                                            # See http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_buffer_size

#nginx_http_large_client_header_buffers = 4 8k  # Sets the maximum number and
                                                # size of buffers used for
                                                # reading large client
                                                # request headers.
                                                # See http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers

#nginx_http_client_max_body_size = 0  # Defines the maximum request body size
                                      # allowed by requests proxied by Kong,
                                      # specified in the Content-Length request
                                      # header. If a request exceeds this
                                      # limit, Kong will respond with a 413
                                      # (Request Entity Too Large). Setting
                                      # this value to 0 disables checking the
                                      # request body size.
                                      # See http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size

#nginx_admin_client_max_body_size = 10m  # Defines the maximum request body size for
                                         # Admin API.

#nginx_http_charset = UTF-8  # Adds the specified charset to the “Content-Type”
                             # response header field. If this charset is different
                             # from the charset specified in the `source_charset`
                             # directive, a conversion is performed.
                             #
                             # The parameter `off` cancels the addition of
                             # charset to the “Content-Type” response header field.
                             # See http://nginx.org/en/docs/http/ngx_http_charset_module.html#charset

#nginx_http_client_body_buffer_size = 8k  # Defines the buffer size for reading
                                          # the request body. If the client
                                          # request body is larger than this
                                          # value, the body will be buffered to
                                          # disk. Note that when the body is
                                          # buffered to disk, Kong plugins that
                                          # access or manipulate the request
                                          # body may not work, so it is
                                          # advisable to set this value as high
                                          # as possible (e.g., set it as high
                                          # as `client_max_body_size` to force
                                          # request bodies to be kept in
                                          # memory). Do note that
                                          # high-concurrency environments will
                                          # require significant memory
                                          # allocations to process many
                                          # concurrent large request bodies.
                                          # See http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size

#nginx_admin_client_body_buffer_size = 10m  # Defines the buffer size for reading
                                            # the request body on Admin API.

#nginx_http_lua_regex_match_limit = 100000  # Global `MATCH_LIMIT` for PCRE
                                            # regex matching. The default of `100000` should ensure
                                            # at worst any regex Kong executes could finish within
                                            # roughly 2 seconds.

#nginx_http_lua_regex_cache_max_entries = 8192  # Specifies the maximum number of entries allowed
                                                # in the worker process level PCRE JIT compiled regex cache.
                                                # It is recommended to set it to at least (number of regex paths * 2)
                                                # to avoid high CPU usages if you manually specified `router_flavor` to
                                                # `traditional`. `expressions` and `traditional_compat` router do
                                                # not make use of the PCRE library and their behavior
                                                # is unaffected by this setting.

#nginx_http_keepalive_requests = 10000 # Sets the maximum number of client requests that can be served through one
                                       # keep-alive connection. After the maximum number of requests are made,
                                       # the connection is closed.
                                       # Closing connections periodically is necessary to free per-connection
                                       # memory allocations. Therefore, using too high a maximum number of requests
                                       # could result in excessive memory usage and is not recommended.
                                       # See: https://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_requests


#------------------------------------------------------------------------------
# DATASTORE
#------------------------------------------------------------------------------

# Kong can run with a database to store coordinated data between Kong nodes in
# a cluster, or without a database, where each node stores its information
# independently in memory.
#
# When using a database, Kong will store data for all its entities (such as
# routes, services, consumers, and plugins) in PostgreSQL,
# and all Kong nodes belonging to the same cluster must connect to the same database.
#
# Kong supports PostgreSQL versions 9.5 and above.
#
# When not using a database, Kong is said to be in "DB-less mode": it will keep
# its entities in memory, and each node needs to have this data entered via a
# declarative configuration file, which can be specified through the
# `declarative_config` property, or via the Admin API using the `/config`
# endpoint.
#
# When using Postgres as the backend storage, you can optionally enable Kong
# to serve read queries from a separate database instance.
# When the number of proxies is large, this can greatly reduce the load
# on the main Postgres instance and achieve better scalability. It may also
# reduce the latency jitter if the Kong proxy node's latency to the main
# Postgres instance is high.
#
# The read-only Postgres instance only serves read queries, and write
# queries still go to the main connection. The read-only Postgres instance
# can be eventually consistent while replicating changes from the main
# instance.
#
# At least the `pg_ro_host` config is needed to enable this feature.
# By default, all other database config for the read-only connection is
# inherited from the corresponding main connection config described above but
# may be optionally overwritten explicitly using the `pg_ro_*` config below.

#database = postgres             # Determines the database (or no database) for
                                 # this node
                                 # Accepted values are `postgres` and `off`.

#pg_host = 127.0.0.1             # Host of the Postgres server.
#pg_port = 5432                  # Port of the Postgres server.
#pg_timeout = 5000               # Defines the timeout (in ms), for connecting,
                                 # reading and writing.

#pg_user = kong                  # Postgres user.
#pg_password =                   # Postgres user's password.
#pg_database = kong              # The database name to connect to.

#pg_schema =                     # The database schema to use. If unspecified,
                                 # Kong will respect the `search_path` value of
                                 # your PostgreSQL instance.

#pg_ssl = off                    # Toggles client-server TLS connections
                                 # between Kong and PostgreSQL.
                                 # Because PostgreSQL uses the same port for TLS
                                 # and non-TLS, this is only a hint. If the
                                 # server does not support TLS, the established
                                 # connection will be a plain one.

#pg_ssl_verify = off             # Toggles server certificate verification if
                                 # `pg_ssl` is enabled.
                                 # See the `lua_ssl_trusted_certificate`
                                 # setting to specify a certificate authority.

#pg_max_concurrent_queries = 0   # Sets the maximum number of concurrent queries
                                 # that can be executing at any given time. This
                                 # limit is enforced per worker process; the
                                 # total number of concurrent queries for this
                                 # node will be will be:
                                 # `pg_max_concurrent_queries * nginx_worker_processes`.
                                 #
                                 # The default value of 0 removes this
                                 # concurrency limitation.

#pg_semaphore_timeout = 60000    # Defines the timeout (in ms) after which
                                 # PostgreSQL query semaphore resource
                                 # acquisition attempts will fail. Such
                                 # failures will generally result in the
                                 # associated proxy or Admin API request
                                 # failing with an HTTP 500 status code.
                                 # Detailed discussion of this behavior is
                                 # available in the online documentation.

#pg_keepalive_timeout =          # Specify the maximal idle timeout (in ms)
                                 # for the postgres connections in the pool.
                                 # If this value is set to 0 then the timeout interval
                                 # is unlimited.
                                 #
                                 # If not specified this value will be same as
                                 # `lua_socket_keepalive_timeout`

#pg_pool_size =                  # Specifies the size limit (in terms of connection
                                 # count) for the Postgres server.
                                 # Note that this connection pool is intended
                                 # per Nginx worker rather than per Kong instance.
                                 #
                                 # If not specified, the default value is the same as
                                 # `lua_socket_pool_size`

#pg_backlog =                    # If specified, this value will limit the total
                                 # number of open connections to the Postgres
                                 # server to `pg_pool_size`. If the connection
                                 # pool is full, subsequent connect operations
                                 # will be inserted in a queue with size equal
                                 # to this option's value.
                                 #
                                 # If the number of queued connect operations
                                 # reaches `pg_backlog`, exceeding connections will fail.
                                 #
                                 # If not specified, then number of open connections
                                 # to the Postgres server is not limited.

#pg_ro_host =                    # Same as `pg_host`, but for the
                                 # read-only connection.
                                 # **Note:** Refer to the documentation
                                 # section above for detailed usage.

#pg_ro_port = <pg_port>          # Same as `pg_port`, but for the
                                 # read-only connection.

#pg_ro_timeout = <pg_timeout>    # Same as `pg_timeout`, but for the
                                 # read-only connection.

#pg_ro_user = <pg_user>          # Same as `pg_user`, but for the
                                 # read-only connection.

#pg_ro_password = <pg_password>  # Same as `pg_password`, but for the
                                 # read-only connection.

#pg_ro_database = <pg_database>  # Same as `pg_database`, but for the
                                 # read-only connection.

#pg_ro_schema = <pg_schema>      # Same as `pg_schema`, but for the
                                 # read-only connection.

#pg_ro_ssl = <pg_ssl>            # Same as `pg_ssl`, but for the
                                 # read-only connection.

#pg_ro_ssl_verify = <pg_ssl_verify>
                                 # Same as `pg_ssl_verify`, but for the
                                 # read-only connection.

#pg_ro_max_concurrent_queries = <pg_max_concurrent_queries>
                                 # Same as `pg_max_concurrent_queries`, but for
                                 # the read-only connection.
                                 # Note: read-only concurrency is not shared
                                 # with the main (read-write) connection.

#pg_ro_semaphore_timeout = <pg_semaphore_timeout>
                                 # Same as `pg_semaphore_timeout`, but for the
                                 # read-only connection.

#pg_ro_keepalive_timeout = <pg_keepalive_timeout>
                                 # Same as `pg_keepalive_timeout`, but for the
                                 # read-only connection.

#pg_ro_pool_size = <pg_pool_size>
                                 # Same as `pg_pool_size`, but for the
                                 # read-only connection.

#pg_ro_backlog = <pg_backlog>
                                 # Same as `pg_backlog`, but for the
                                 # read-only connection.

#declarative_config =           # The path to the declarative configuration
                                # file which holds the specification of all
                                # entities (routes, services, consumers, etc.)
                                # to be used when the `database` is set to
                                # `off`.
                                #
                                # Entities are stored in Kong's LMDB cache,
                                # so you must ensure that enough headroom is
                                # allocated to it via the `lmdb_map_size`
                                # property.
                                #
                                # If the hybrid mode `role` is set to `data_plane`
                                # and there's no configuration cache file,
                                # this configuration is used before connecting
                                # to the control plane node as a user-controlled
                                # fallback.

#declarative_config_string =    # The declarative configuration as a string

#lmdb_environment_path = dbless.lmdb  # Directory where the LMDB database files used by
                                      # DB-less and hybrid mode to store Kong
                                      # configurations reside.
                                      #
                                      # This path is relative under the Kong `prefix`.

#lmdb_map_size = 2048m                # Maximum size of the LMDB memory map, used to store the
                                      # DB-less and hybrid mode configurations. Default is 2048m.
                                      #
                                      # This config defines the limit of LMDB file size; the
                                      # actual file size growth will be on-demand and
                                      # proportional to the actual config size.
                                      #
                                      # Note this value can be set very large, say a couple of GBs,
                                      # to accommodate future database growth and
                                      # Multi-Version Concurrency Control (MVCC) headroom needs.
                                      # The file size of the LMDB database file should stabilize
                                      # after a few config reloads/hybrid mode syncs, and the actual
                                      # memory used by the LMDB database will be smaller than
                                      # the file size due to dynamic swapping of database pages by
                                      # the OS.

#------------------------------------------------------------------------------
# DATASTORE CACHE
#------------------------------------------------------------------------------

# In order to avoid unnecessary communication with the datastore, Kong caches
# entities (such as APIs, consumers, credentials...) for a configurable period
# of time. It also handles invalidations if such an entity is updated.
#
# This section allows for configuring the behavior of Kong regarding the
# caching of such configuration entities.
#db_update_frequency = 5         # Frequency (in seconds) at which to check for
                                 # updated entities with the datastore.
                                 #
                                 # When a node creates, updates, or deletes an
                                 # entity via the Admin API, other nodes need
                                 # to wait for the next poll (configured by
                                 # this value) to eventually purge the old
                                 # cached entity and start using the new one.

#db_update_propagation = 0       # Time (in seconds) taken for an entity in the
                                 # datastore to be propagated to replica nodes
                                 # of another datacenter.
                                 #
                                 # When set, this property will increase the
                                 # time taken by Kong to propagate the change
                                 # of an entity.
                                 #
                                 # Single-datacenter setups or PostgreSQL
                                 # servers should suffer no such delays, and
                                 # this value can be safely set to 0.
                                 # Postgres setups with read replicas should
                                 # set this value to the maximum expected replication
                                 # lag between the writer and reader instances.

#db_cache_ttl = 0                # Time-to-live (in seconds) of an entity from
                                 # the datastore when cached by this node.
                                 #
                                 # Database misses (no entity) are also cached
                                 # according to this setting if you do not
                                 # configure `db_cache_neg_ttl`.
                                 #
                                 # If set to 0 (default), such cached entities
                                 # or misses never expire.

#db_cache_neg_ttl =              # Time-to-live (in seconds) of a datastore
                                 # miss (no entity).
                                 #
                                 # If not specified (default), `db_cache_ttl`
                                 # value will be used instead.
                                 #
                                 # If set to 0, misses will never expire.

#db_resurrect_ttl = 30           # Time (in seconds) for which stale entities
                                 # from the datastore should be resurrected
                                 # when they cannot be refreshed (e.g., the
                                 # datastore is unreachable). When this TTL
                                 # expires, a new attempt to refresh the stale
                                 # entities will be made.

#db_cache_warmup_entities = services
                                 # Entities to be pre-loaded from the datastore
                                 # into the in-memory cache at Kong start-up.
                                 # This speeds up the first access of endpoints
                                 # that use the given entities.
                                 #
                                 # When the `services` entity is configured
                                 # for warmup, the DNS entries for values in
                                 # its `host` attribute are pre-resolved
                                 # asynchronously as well.
                                 #
                                 # Cache size set in `mem_cache_size` should
                                 # be set to a value large enough to hold all
                                 # instances of the specified entities.
                                 # If the size is insufficient, Kong will log
                                 # a warning.

#------------------------------------------------------------------------------
# DNS RESOLVER
#------------------------------------------------------------------------------

# By default, the DNS resolver will use the standard configuration files
# `/etc/hosts` and `/etc/resolv.conf`. The settings in the latter file will be
# overridden by the environment variables `LOCALDOMAIN` and `RES_OPTIONS` if
# they have been set.
#
# Kong will resolve hostnames as either `SRV` or `A` records (in that order, and
# `CNAME` records will be dereferenced in the process).
# In case a name is resolved as an `SRV` record, it will also override any given
# port number with the `port` field contents received from the DNS server.
#
# The DNS options `SEARCH` and `NDOTS` (from the `/etc/resolv.conf` file) will
# be used to expand short names to fully qualified ones. So it will first try
# the entire `SEARCH` list for the `SRV` type, if that fails it will try the
# `SEARCH` list for `A`, etc.
#
# For the duration of the `ttl`, the internal DNS resolver will load balance each
# request it gets over the entries in the DNS record. For `SRV` records, the
# `weight` fields will be honored, but it will only use the lowest `priority`
# field entries in the record.

#dns_resolver =                  # Comma-separated list of nameservers, each
                                 # entry in `ip[:port]` format to be used by
                                 # Kong. If not specified, the nameservers in
                                 # the local `resolv.conf` file will be used.
                                 # Port defaults to 53 if omitted. Accepts
                                 # both IPv4 and IPv6 addresses.

#dns_hostsfile = /etc/hosts      # The hosts file to use. This file is read
                                 # once and its content is static in memory.
                                 # To read the file again after modifying it,
                                 # Kong must be reloaded.

#dns_order = LAST,SRV,A,CNAME    # The order in which to resolve different
                                 # record types. The `LAST` type means the
                                 # type of the last successful lookup (for the
                                 # specified name). The format is a (case
                                 # insensitive) comma-separated list.

#dns_valid_ttl =                 # By default, DNS records are cached using
                                 # the TTL value of a response. If this
                                 # property receives a value (in seconds), it
                                 # will override the TTL for all records.

#dns_stale_ttl = 3600            # Defines, in seconds, how long a record will
                                 # remain in cache past its TTL. This value
                                 # will be used while the new DNS record is
                                 # fetched in the background.
                                 # Stale data will be used from expiry of a
                                 # record until either the refresh query
                                 # completes, or the `dns_stale_ttl` number of
                                 # seconds have passed.
                                 # This configuration enables Kong to be more
                                 # resilient during resolver downtime.

#dns_cache_size = 10000          # Defines the maximum allowed number of
                                 # DNS records stored in memory cache.
                                 # Least recently used DNS records are discarded
                                 # from cache if it is full. Both errors and
                                 # data are cached; therefore, a single name query
                                 # can easily take up 10-15 slots.

#dns_not_found_ttl = 30          # TTL in seconds for empty DNS responses and
                                 # "(3) name error" responses.

#dns_error_ttl = 1               # TTL in seconds for error responses.

#dns_no_sync = off               # If enabled, then upon a cache-miss every
                                 # request will trigger its own DNS query.
                                 # When disabled, multiple requests for the
                                 # same name/type will be synchronized to a
                                 # single query.

#------------------------------------------------------------------------------
# New DNS RESOLVER
#------------------------------------------------------------------------------

# This DNS resolver introduces global caching for DNS records across workers,
# significantly reducing the query load on DNS servers.
#
# It provides observable statistics, you can retrieve them through the Admin API
# `/status/dns`.

#new_dns_client = off            # Enable or disable the new DNS resolver

#resolver_address = <name servers parsed from resolv.conf>
                                 # Comma-separated list of nameservers, each
                                 # entry in `ip[:port]` format to be used by
                                 # Kong. If not specified, the nameservers in
                                 # the local `resolv.conf` file will be used.
                                 # Port defaults to 53 if omitted. Accepts
                                 # both IPv4 and IPv6 addresses.
                                 #
                                 # Examples:
                                 #
                                 # ```
                                 # resolver_address = 8.8.8.8
                                 # resolver_address = 8.8.8.8, [::1]
                                 # resolver_address = 8.8.8.8:53, [::1]:53
                                 # ```

#resolver_hosts_file = /etc/hosts
                                 # The hosts file to use. This file is read
                                 # once and its content is static in memory.
                                 # To read the file again after modifying it,
                                 # Kong must be reloaded.

#resolver_family = A,SRV         # The supported query types.
                                 #
                                 # For a domain name, Kong will only query
                                 # either IP addresses (A or AAAA) or SRV
                                 # records, but not both.
                                 #
                                 # It will query SRV records only when the
                                 # domain matches the
                                 # "_<proto>._<service>.<name>" format, for
                                 # example, "_ldap._tcp.example.com".
                                 #
                                 # For IP addresses (A or AAAA) resolution, it
                                 # first attempts IPv4 (A) and then queries
                                 # IPv6 (AAAA).

#resolver_valid_ttl = <TTL from responses>
                                 # By default, DNS records are cached using
                                 # the TTL value of a response. This optional
                                 # parameter (in seconds) allows overriding it.

#resolver_error_ttl = 1          # TTL in seconds for error responses and empty
                                 # responses.

#resolver_stale_ttl = 3600       # Defines, in seconds, how long a record will
                                 # remain in cache past its TTL. This value
                                 # will be used while the new DNS record is
                                 # fetched in the background.
                                 #
                                 # Stale data will be used from expiry of a
                                 # record until either the refresh query
                                 # completes, or the `resolver_stale_ttl` number
                                 # of seconds have passed.
                                 #
                                 # This configuration enables Kong to be more
                                 # resilient during the DNS server downtime.

#resolver_lru_cache_size = 10000 # The DNS client uses a two-layer cache system:
                                 # L1 - worker-level LRU Lua VM cache
                                 # L2 - across-workers shared memory cache
                                 #
                                 # This value specifies the maximum allowed
                                 # number of DNS responses stored in the L1 LRU
                                 # lua VM cache.
                                 #
                                 # A single name query can easily take up 1~10
                                 # slots, depending on attempted query types and
                                 # extended domains from /etc/resolv.conf
                                 # options `domain` or `search`.

#resolver_mem_cache_size = 5m    # This value specifies the size of the L2
                                 # shared memory cache for DNS responses,
                                 # `kong_dns_cache`.
                                 #
                                 # Accepted units are `k` and `m`, with a
                                 # minimum recommended value of a few MBs.
                                 #
                                 # 5MB shared memory size could store
                                 # ~20000 DNS responeses with single A record or
                                 # ~10000 DNS responeses with 2~3 A records.
                                 #
                                 # 10MB shared memory size could store
                                 # ~40000 DNS responeses with single A record or
                                 # ~20000 DNS responeses with 2~3 A records.


#------------------------------------------------------------------------------
# VAULTS
#------------------------------------------------------------------------------

# A secret is any sensitive piece of information required for API gateway
# operations. Secrets may be part of the core Kong Gateway configuration,
# used in plugins, or part of the configuration associated with APIs serviced
# by the gateway.
#
# Some of the most common types of secrets used by Kong Gateway include:
#
# - Data store usernames and passwords, used with PostgreSQL and Redis
# - Private X.509 certificates
# - API keys
#
# Sensitive plugin configuration fields are generally used for authentication,
# hashing, signing, or encryption. Kong Gateway lets you store certain values
# in a vault. Here are the vault specific configuration options.

#vault_env_prefix =              # Defines the environment variable vault's
                                 # default prefix. For example if you have
                                 # all your secrets stored in environment
                                 # variables prefixed with `SECRETS_`, it
                                 # can be configured here so that it isn't
                                 # necessary to repeat them in Vault
                                 # references.

#------------------------------------------------------------------------------
# TUNING & BEHAVIOR
#------------------------------------------------------------------------------

#worker_consistency = eventual
                                 # Defines whether this node should rebuild its
                                 # state synchronously or asynchronously (the
                                 # balancers and the router are rebuilt on
                                 # updates that affect them, e.g., updates to
                                 # routes, services, or upstreams via the admin
                                 # API or loading a declarative configuration
                                 # file). (This option is deprecated and will be
                                 # removed in future releases. The new default
                                 # is `eventual`.)
                                 #
                                 # Accepted values are:
                                 #
                                 # - `strict`: the router will be rebuilt
                                 #   synchronously, causing incoming requests to
                                 #   be delayed until the rebuild is finished.
                                 #   (This option is deprecated and will be removed
                                 #    in future releases. The new default is `eventual`)
                                 # - `eventual`: the router will be rebuilt
                                 #   asynchronously via a recurring background
                                 #   job running every second inside of each
                                 #   worker.
                                 #
                                 # Note that `strict` ensures that all workers
                                 # of a given node will always proxy requests
                                 # with an identical router, but increased
                                 # long-tail latency can be observed if
                                 # frequent routes and services updates are
                                 # expected.
                                 # Using `eventual` will help prevent long-tail
                                 # latency issues in such cases, but may
                                 # cause workers to route requests differently
                                 # for a short period of time after routes and
                                 # services updates.

#worker_state_update_frequency = 5
                                 # Defines how often the worker state changes are
                                 # checked with a background job. When a change
                                 # is detected, a new router or balancer will be
                                 # built, as needed. Raising this value will
                                 # decrease the load on database servers and
                                 # result in less jitter in proxy latency, but
                                 # it might take more time to propagate changes
                                 # to each individual worker.

#router_flavor = traditional_compatible
                                 # Selects the router implementation to use when
                                 # performing request routing. Incremental router
                                 # rebuild is available when the flavor is set
                                 # to either `expressions` or
                                 # `traditional_compatible`, which could
                                 # significantly shorten rebuild time for a large
                                 # number of routes.
                                 #
                                 # Accepted values are:
                                 #
                                 # - `traditional_compatible`: the DSL-based expression
                                 #   router engine will be used under the hood. However,
                                 #   the router config interface will be the same
                                 #   as `traditional`, and expressions are
                                 #   automatically generated at router build time.
                                 #   The `expression` field on the `route` object
                                 #   is not visible.
                                 # - `expressions`: the DSL-based expression router engine
                                 #   will be used under the hood. The traditional router
                                 #   config interface is still visible, and you can also write
                                 #   router Expressions manually and provide them in the
                                 #   `expression` field on the `route` object.
                                 # - `traditional`: the pre-3.0 router engine will be
                                 #   used. The config interface will be the same as
                                 #   pre-3.0 Kong, and the `expression` field on the
                                 #   `route` object is not visible.
                                 #
                                 #   Deprecation warning: In Kong 3.0, `traditional`
                                 #   mode should be avoided and only be used if
                                 #   `traditional_compatible` does not work as expected.
                                 #   This flavor of the router will be removed in the next
                                 #   major release of Kong.

#lua_max_req_headers = 100       # Maximum number of request headers to parse by default.
                                 #
                                 # This argument can be set to an integer between 1 and 1000.
                                 #
                                 # When proxying, Kong sends all the request headers,
                                 # and this setting does not have any effect. It is used
                                 # to limit Kong and its plugins from reading too many
                                 # request headers.

#lua_max_resp_headers = 100      # Maximum number of response headers to parse by default.
                                 #
                                 # This argument can be set to an integer between 1 and 1000.
                                 #
                                 # When proxying, Kong returns all the response headers,
                                 # and this setting does not have any effect. It is used
                                 # to limit Kong and its plugins from reading too many
                                 # response headers.

#lua_max_uri_args = 100          # Maximum number of request URI arguments to parse by
                                 # default.
                                 #
                                 # This argument can be set to an integer between 1 and 1000.
                                 #
                                 # When proxying, Kong sends all the request query
                                 # arguments, and this setting does not have any effect.
                                 # It is used to limit Kong and its plugins from reading
                                 # too many query arguments.

#lua_max_post_args = 100         # Maximum number of request post arguments to parse by
                                 # default.
                                 #
                                 # This argument can be set to an integer between 1 and 1000.
                                 #
                                 # When proxying, Kong sends all the request post
                                 # arguments, and this setting does not have any effect.
                                 # It is used to limit Kong and its plugins from reading
                                 # too many post arguments.

#------------------------------------------------------------------------------
# MISCELLANEOUS
#------------------------------------------------------------------------------

# Additional settings inherited from lua-nginx-module allowing for more
# flexibility and advanced usage.
#
# See the lua-nginx-module documentation for more information:
# https://github.com/openresty/lua-nginx-module


#lua_ssl_trusted_certificate = system   # Comma-separated list of certificate authorities
                                        # for Lua cosockets in PEM format.
                                        #
                                        # The special value `system` attempts to search for the
                                        # "usual default" provided by each distro, according
                                        # to an arbitrary heuristic. In the current implementation,
                                        # the following pathnames will be tested in order,
                                        # and the first one found will be used:
                                        #
                                        # - `/etc/ssl/certs/ca-certificates.crt` (Debian/Ubuntu/Gentoo)
                                        # - `/etc/pki/tls/certs/ca-bundle.crt` (Fedora/RHEL 6)
                                        # - `/etc/ssl/ca-bundle.pem` (OpenSUSE)
                                        # - `/etc/pki/tls/cacert.pem` (OpenELEC)
                                        # - `/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem` (CentOS/RHEL 7)
                                        # - `/etc/ssl/cert.pem` (OpenBSD, Alpine)
                                        #
                                        # `system` can be used by itself or in conjunction with other
                                        # CA file paths.
                                        #
                                        # When `pg_ssl_verify` is enabled, these
                                        # certificate authority files will be
                                        # used for verifying Kong's database connections.
                                        #
                                        # Certificates can be configured on this property
                                        # with any of the following values:
                                        # - `system`
                                        # - absolute path to the certificate
                                        # - certificate content
                                        # - base64 encoded certificate content
                                        #
                                        # See https://github.com/openresty/lua-nginx-module#lua_ssl_trusted_certificate

#lua_ssl_verify_depth = 1        # Sets the verification depth in the server
                                 # certificates chain used by Lua cosockets,
                                 # set by `lua_ssl_trusted_certificate`.
                                 # This includes the certificates configured
                                 # for Kong's database connections.
                                 # If the maximum depth is reached before
                                 # reaching the end of the chain, verification
                                 # will fail. This helps mitigate certificate
                                 # based DoS attacks.
                                 #
                                 # See https://github.com/openresty/lua-nginx-module#lua_ssl_verify_depth

#lua_ssl_protocols = TLSv1.2 TLSv1.3   # Defines the TLS versions supported
                                               # when handshaking with OpenResty's
                                               # TCP cosocket APIs.
                                               #
                                               # This affects connections made by Lua
                                               # code, such as connections to the
                                               # database Kong uses, or when sending logs
                                               # using a logging plugin. It does *not*
                                               # affect connections made to the upstream
                                               # Service or from downstream clients.

#lua_package_path = ./?.lua;./?/init.lua;  # Sets the Lua module search path
                                           # (LUA_PATH). Useful when developing
                                           # or using custom plugins not stored
                                           # in the default search path.
                                           #
                                           # See https://github.com/openresty/lua-nginx-module#lua_package_path

#lua_package_cpath =             # Sets the Lua C module search path
                                 # (LUA_CPATH).
                                 #
                                 # See https://github.com/openresty/lua-nginx-module#lua_package_cpath

#lua_socket_pool_size = 256      # Specifies the size limit for every cosocket
                                 # connection pool associated with every remote
                                 # server.
                                 #
                                 # See https://github.com/openresty/lua-nginx-module#lua_socket_pool_size
#untrusted_lua = sandbox
                                 # Controls loading of Lua functions from admin-supplied
                                 # sources such as the Admin API. LuaJIT bytecode
                                 # loading is always disabled.
                                 #
                                 # **Warning:** LuaJIT is not designed as a secure
                                 # runtime for running malicious code, therefore
                                 # you should properly protect your Admin API endpoint
                                 # even with sandboxing enabled. The sandbox only
                                 # provides protection against trivial attackers or
                                 # unintentional modification of the Kong global
                                 # environment.
                                 #
                                 # Accepted values are: `off`, `sandbox`, or
                                 # `on`:
                                 #
                                 # * `off`: Disallow loading of any arbitrary
                                 #          Lua functions. The `off` option
                                 #          disables any functionality that runs
                                 #          arbitrary Lua code, including the
                                 #          Serverless Functions plugins and any
                                 #          transformation plugin that allows
                                 #          custom Lua functions.
                                 #
                                 # * `sandbox`: Allow loading of Lua functions,
                                 #              but use a sandbox when executing
                                 #              them. The sandboxed function has
                                 #              restricted access to the global
                                 #              environment and only has access
                                 #              to Kong PDK, OpenResty, and
                                 #              standard Lua functions that will
                                 #              generally not cause harm to the
                                 #              Kong Gateway node.
                                 #
                                 # * `on`: Functions have unrestricted
                                 #         access to the global environment and
                                 #         can load any Lua modules. This is
                                 #         similar to the behavior in
                                 #         Kong Gateway prior to 2.3.0.
                                 #
                                 # The default `sandbox` environment does not
                                 # allow importing other modules or libraries,
                                 # or executing anything at the OS level (for
                                 # example, file read/write). The global
                                 # environment is also not accessible.
                                 #
                                 # Examples of `untrusted_lua = sandbox`
                                 # behavior:
                                 #
                                 # * You can't access or change global values
                                 # such as `kong.configuration.pg_password`
                                 # * You can run harmless lua:
                                 # `local foo = 1 + 1`. However, OS level
                                 # functions are not allowed, like:
                                 # `os.execute('rm -rf /*')`.
                                 #
                                 # To customize the sandbox environment, use
                                 # the `untrusted_lua_sandbox_requires` and
                                 # `untrusted_lua_sandbox_environment`
                                 # parameters below.

#untrusted_lua_sandbox_requires = # Comma-separated list of modules allowed to
                                  # be loaded with `require` inside the
                                  # sandboxed environment. Ignored
                                  # if `untrusted_lua` is not `sandbox`.
                                  #
                                  # For example, say you have configured the
                                  # Serverless pre-function plugin and it
                                  # contains the following `requires`:
                                  #
                                  # ```
                                  # local template = require "resty.template"
                                  # local split = require "kong.tools.string".split
                                  # ```
                                  #
                                  # To run the plugin, add the modules to the
                                  # allowed list:
                                  # ```
                                  # untrusted_lua_sandbox_requires = resty.template, kong.tools.utils
                                  # ```
                                  #
                                  # **Warning:** Allowing certain modules may
                                  # create opportunities to escape the
                                  # sandbox. For example, allowing `os` or
                                  # `luaposix` may be unsafe.

#untrusted_lua_sandbox_environment = # Comma-separated list of global Lua
                                     # variables that should be made available
                                     # inside the sandboxed environment. Ignored
                                     # if `untrusted_lua` is not `sandbox`.
                                     #
                                     # **Warning**: Certain variables, when made
                                     # available, may create opportunities to
                                     # escape the sandbox.

#openresty_path =                 # Path to the OpenResty installation that Kong
                                  # will use. When this is empty (the default),
                                  # Kong determines the OpenResty installation
                                  # by searching for a system-installed OpenResty
                                  # and falling back to searching $PATH for the
                                  # nginx binary.
                                  #
                                  # Setting this attribute disables the search
                                  # behavior and explicitly instructs Kong which
                                  # OpenResty installation to use.

#node_id =                        # Node ID for the Kong node. Every Kong node
                                  # in a Kong cluster must have a unique and
                                  # valid UUID. When empty, node ID is
                                  # automatically generated.

#------------------------------------------------------------------------------
# KONG MANAGER
#------------------------------------------------------------------------------
#
# The Admin GUI for Kong Enterprise.
#
#admin_gui_listen = 0.0.0.0:8002, 0.0.0.0:8445 ssl
                        # Kong Manager Listeners
                        #
                        # Comma-separated list of addresses and ports on which
                        # Kong will expose Kong Manager. This web application
                        # lets you configure and manage Kong, and therefore
                        # should be kept secured.
                        #
                        # Suffixes can be specified for each pair, similarly to
                        # the `admin_listen` directive.

#admin_gui_url =        # Kong Manager URL
                        #
                        # Comma-separated list of addresses (the lookup or balancer) for Kong Manager.
                        #
                        # Accepted format (items in square brackets are optional):
                        #
                        #   `<scheme>://<IP / HOSTNAME>[:<PORT>][<PATH>][, <scheme>://<IP / HOSTNAME>[:<PORT>][<PATH>]]`
                        #
                        # Examples:
                        #
                        # - `http://127.0.0.1:8003`
                        # - `https://kong-admin.test`
                        # - `http://dev-machine`
                        # - `http://127.0.0.1:8003, https://exmple.com/manager`

#admin_gui_path = /     # Kong Manager base path
                        #
                        # This configuration parameter allows the user to customize
                        # the path prefix where Kong Manager is served. When updating
                        # this parameter, it's recommended to update the path in `admin_gui_url`
                        # as well.
                        #
                        # Accepted format:
                        #
                        # - Path must start with a `/`
                        # - Path must not end with a `/` (except for the `/`)
                        # - Path can only contain letters, digits, hyphens (`-`),
                        # underscores (`_`), and slashes (`/`)
                        # - Path must not contain continuous slashes (e.g., `//` and `///`)
                        #
                        # Examples:
                        #
                        # - `/`
                        # - `/manager`
                        # - `/kong-manager`
                        # - `/kong/manager`

#admin_gui_api_url =    # Hierarchical part of a URI which is composed
                        # optionally of a host, port, and path at which the
                        # Admin API accepts HTTP or HTTPS traffic. When
                        # this config is disabled, Kong Manager will
                        # use the window protocol + host and append the
                        # resolved admin_listen HTTP/HTTPS port.

#admin_gui_csp_header = off # Enable or disable the `Content-Security-Policy` (CSP) header for Kong Manager
                            #
                            # This configuration controls the presence of the
                            # `Content-Security-Policy` header while serving Kong Manager.
                            #
                            # Setting this configuration to `on` to enable the CSP header.

#admin_gui_ssl_cert =   # The SSL certificate for `admin_gui_listen` values
                        # with SSL enabled.
                        #
                        # values:
                        # - absolute path to the certificate
                        # - certificate content
                        # - base64 encoded certificate content

#admin_gui_ssl_cert_key = # The SSL key for `admin_gui_listen` values with SSL
                          # enabled.
                          #
                          # values:
                          # - absolute path to the certificate key
                          # - certificate key content
                          # - base64 encoded certificate key content

#admin_gui_access_log = logs/admin_gui_access.log
                        # Kong Manager Access Logs
                        #
                        # Here you can set an absolute or relative path for Kong
                        # Manager access logs. When the path is relative,
                        # logs are placed in the `prefix` location.
                        #
                        # Setting this value to `off` disables access logs
                        # for Kong Manager.


#admin_gui_error_log = logs/admin_gui_error.log
                        # Kong Manager Error Logs
                        #
                        # Here you can set an absolute or relative path for Kong
                        # Manager access logs. When the path is relative,
                        # logs are placed in the `prefix` location.
                        #
                        # Setting this value to `off` disables error logs for
                        # Kong Manager.
                        #
                        # Granularity can be adjusted through the `log_level`
                        # directive.


#------------------------------------------------------------------------------
# WEBASSEMBLY (WASM)
#------------------------------------------------------------------------------

#wasm = off             # Enable/disable wasm support. This must be enabled in
                        # order to use wasm filters and filter chains.

#wasm_filters_path =    # Path to the directory containing wasm filter modules.
                        #
                        # At startup, Kong discovers available wasm filters by
                        # scanning this directory for files with the `.wasm`
                        # file extension.
                        #
                        # The name of a wasm filter module is derived from the
                        # filename itself, with the .wasm extension removed. So,
                        # given the following tree:
                        #
                        # ```
                        # /path/to/wasm_filters
                        # ├── my_module.wasm
                        # ├── my_other_module.wasm
                        # └── not_a_wasm_module.txt
                        # ```
                        #
                        # The resulting filter modules available for use in Kong
                        # will be:
                        #
                        # - `my_module`
                        # - `my_other_module`
                        #
                        # Notes:
                        #
                        # - No recursion is performed. Only .wasm files at the
                        #   top level are registered.
                        # - This path _may_ be a symlink to a directory.

#wasm_filters = bundled,user        # Comma-separated list of Wasm filters to be made
                                    # available for use in filter chains.
                                    #
                                    # When the `off` keyword is specified as the
                                    # only value, no filters will be available for use.
                                    #
                                    # When the `bundled` keyword is specified, all filters
                                    # bundled with Kong will be available.
                                    #
                                    # When the `user` keyword is specified, all filters
                                    # within the `wasm_filters_path` will be available.
                                    #
                                    # **Examples:**
                                    #
                                    # - `wasm_filters = bundled,user` enables _all_ bundled
                                    #   and user-supplied filters
                                    # - `wasm_filters = user` enables _only_ user-supplied
                                    #   filters
                                    # - `wasm_filters = filter-a,filter-b` enables _only_
                                    #   filters named `filter-a` or `filter-b` (whether
                                    #   bundled _or_ user-supplied)
                                    #
                                    # If a conflict occurs where a bundled filter and a
                                    # user-supplied filter share the same name, a warning
                                    # will be logged, and the user-supplied filter will
                                    # be used instead.

#------------------------------------------------------------------------------
# WASM injected directives
#------------------------------------------------------------------------------

# The Nginx Wasm module (i.e., ngx_wasm_module) has its own settings, which can
# be tuned via `wasm_*` directives in the Nginx configuration file. Kong
# supports configuration of these directives via its Nginx directive injection
# mechanism.
#
# The following namespaces are supported:
#
# - `nginx_wasm_<directive>`: Injects `<directive>` into the `wasm {}` block.
# - `nginx_wasm_shm_kv`: Injects `shm_kv *` into the `wasm {}` block,
#   allowing operators to define a general memory zone which is usable by
#   the `get_shared_data`/`set_shared_data` Proxy-Wasm SDK functions as
#   an in-memory key-value store of data shareable across filters.
# - `nginx_wasm_shm_kv_<name>`: Injects `shm_kv <name>` into the `wasm {}` block,
#   allowing operators to define custom shared memory zones which are usable by
#   the `get_shared_data`/`set_shared_data` Proxy-Wasm SDK functions as
#   separate namespaces in the `"<name>/<key>"` format.
#   For using these functions with non-namespaced keys, the Nginx template needs
#   a `shm_kv *` entry, which can be defined using `nginx_wasm_shm_kv`.
# - `nginx_wasm_wasmtime_<flag>`: Injects `flag <flag>` into the `wasmtime {}`
#   block, allowing various Wasmtime-specific flags to be set.
# - `nginx_<http|proxy>_<directive>`: Injects `<directive>` into the
#   `http {}` or `server {}` blocks, as specified in the Nginx injected directives
#   section.
#
# The documentation for all supported directives can be found in the Nginx Wasm
# module repository:
#
# https://github.com/Kong/ngx_wasm_module/blob/main/docs/DIRECTIVES.md
#
# The Wasmtime flag documentation can be found here:
#
# https://docs.wasmtime.dev/c-api/config_8h.html
#
# There are several noteworthy ngx_wasm_module behaviors which can be tuned via
# `http {}`/`server {}` level directive injection (identical behavior in either
# level), for example:
#
# - `nginx_http_proxy_wasm_socket_<connect|read|send>_timeout`: sets connection/read/send
#   timeouts for Wasm dispatches.
# - `nginx_http_proxy_wasm_socket_buffer_size`: sets a buffer size for
#   reading Wasm dispatch responses.
#
# The values for these settings are inherited from their `nginx_*_lua_*`
# counterparts if they have not been explicitly set. For instance, if you set
# `nginx_http_lua_socket_connect_timeout`, the value
# of this setting will be propagated to `nginx_http_wasm_socket_connect_timeout`
# unless you _also_ set `nginx_http_wasm_socket_connect_timeout`.
#
# Some TLS-related settings receive special treatment as well:
#
# - `lua_ssl_trusted_certificate`: when set, the value is propagated to the
#   `nginx_wasm_tls_trusted_certificate` directive.
# - `lua_ssl_verify_depth`: when set (to a value greater than zero), several
#   TLS-related `nginx_wasm_*` settings are enabled:
#   - `nginx_wasm_tls_verify_cert`
#   - `nginx_wasm_tls_verify_host`
#   - `nginx_wasm_tls_no_verify_warn`
#
# Like other `kong.conf` fields, all injected Nginx directives documented here
# can be set via environment variable. For instance, setting:
#
#   `KONG_NGINX_WASM_TLS_VERIFY_CERT=<value>`
#
#   Will inject the following into the `wasm {}` block:
#
#   `tls_verify_cert <value>;`
#
# There are several Nginx directives supported by ngx_wasm_module which should
# not be used because they are irrelevant to or unsupported by Kong, or they may
# conflict with Kong's own management of Proxy-Wasm. Use of these directives may
# result in unintentional breakage:
#
# - `wasm_call`
# - `module`
# - `proxy_wasm`
# - `resolver_add`
# - `proxy_wasm_request_headers_in_access`
# - `shm_queue`

#-------------------------------------------------------------------------------
# REQUEST DEBUGGING
#-------------------------------------------------------------------------------
# Request debugging is a mechanism that allows admins to collect the timing of
# proxy path requests in the response header (X-Kong-Request-Debug-Output)
# and optionally, the error log.
#
# This feature provides insights into the time spent within various components of Kong,
# such as plugins, DNS resolution, load balancing, and more. It also provides contextual
# information such as domain names tried during these processes.
#
#request_debug = on              # When enabled, Kong will provide detailed timing information
                                 # for its components to the client and the error log
                                 # if the following headers are present in the proxy request:
                                 # - `X-Kong-Request-Debug`:
                                 #   If the value is set to `*`,
                                 #   timing information will be collected and exported for the current request.
                                 #   If this header is not present or contains an unknown value,
                                 #   timing information will not be collected for the current request.
                                 #   You can also specify a list of filters, separated by commas,
                                 #   to filter the scope of the time information that is collected.
                                 # The following filters are supported for `X-Kong-Request-Debug`:
                                 # - `rewrite`: Collect timing information from the `rewrite` phase.
                                 # - `access`: Collect timing information from the `access` phase.
                                 # - `balancer`: Collect timing information from the `balancer` phase.
                                 # - `response`: Collect timing information from the `response` phase.
                                 # - `header_filter`: Collect timing information from the `header_filter` phase.
                                 # - `body_filter`: Collect timing information from the `body_filter` phase.
                                 # - `log`: Collect timing information from the `log` phase.
                                 # - `upstream`: Collect timing information from the `upstream` phase.
                                 #
                                 # - `X-Kong-Request-Debug-Log`:
                                 #   If set to `true`, timing information will also be logged
                                 #   in the Kong error log with a log level of `notice`.
                                 #   Defaults to `false`.
                                 #
                                 # - `X-Kong-Request-Debug-Token`:
                                 #   Token for authenticating the client making the debug
                                 #   request to prevent abuse.
                                 #   ** Note: Debug requests originating from loopback
                                 #   addresses do not require this header. Deploying Kong behind
                                 #   other proxies may result in exposing the debug interface to
                                 #   the public.**
                                 #
#request_debug_token = <random>  # The Request Debug Token is used in the
                                 # `X-Kong-Request-Debug-Token` header to prevent abuse.
                                 # If this value is not set (the default),
                                 # a random token will be generated
                                 # when Kong starts, restarts, or reloads. If a token is
                                 # specified manually, then the provided token will be used.
                                 #
                                 # You can locate the generated debug token in two locations:
                                 # - Kong error log:
                                 #   Debug token will be logged in the error log (notice level)
                                 #   when Kong starts, restarts, or reloads.
                                 #   The log line will have the: `[request-debug]` prefix to aid searching.
                                 # - Filesystem:
                                 #   Debug token will also be stored in a file located at
                                 #   `{prefix}/.request_debug_token` and updated
                                 #   when Kong starts, restarts, or reloads.