github.com/outbrain/consul@v1.4.5/website/source/docs/commands/connect/proxy.html.md.erb (about)

     1  ---
     2  layout: "docs"
     3  page_title: "Commands: Connect Proxy"
     4  sidebar_current: "docs-commands-connect-proxy"
     5  description: >
     6    The connect proxy subcommand is used to run the built-in mTLS proxy for Connect.
     7  ---
     8  
     9  # Consul Connect Proxy
    10  
    11  Command: `consul connect proxy`
    12  
    13  The connect proxy command is used to run Consul's built-in mTLS proxy for
    14  use with Connect. This can be used in production to enable a Connect-unaware
    15  application to accept and establish Connect-based connections. This proxy
    16  can also be used in development to connect to Connect-enabled services.
    17  
    18  
    19  ## Usage
    20  
    21  Usage: `consul connect proxy [options]`
    22  
    23  #### API Options
    24  
    25  <%= partial "docs/commands/http_api_options_client" %>
    26  <%= partial "docs/commands/http_api_options_server" %>
    27  
    28  #### Proxy Options
    29  
    30  * `-sidecar-for` - The _ID_ (not name if they differ) of the service instance
    31    this proxy will represent. The target service doesn't need to exist on the
    32    local agent yet but a [sidecar proxy
    33    registration](/docs/connect/proxies.html#sidecar-proxy-fields) with
    34    `proxy.destination_service_id` equal to the passed value must be present. If
    35    multiple proxy registrations targeting the same local service instance are
    36    present the command will error and `-proxy-id` should be used instead.
    37  
    38  * `-proxy-id` - The [proxy
    39    service](/docs/connect/proxies.html#proxy-service-definitions) ID on the
    40    local agent. This must already be present on the local agent.
    41  
    42  * `-log-level` - Specifies the log level.
    43  
    44  * `-pprof-addr` - Enable debugging via pprof. Providing a host:port (or just ':port')
    45    enables profiling HTTP endpoints on that address.
    46  
    47  * `-service` - Name of the service this proxy is representing. This service
    48    doesn't need to actually exist in the Consul catalog, but proper ACL
    49    permissions (`service:write`) are required. This and the remaining options can
    50    be used to setup a proxy that is not registered already with local config
    51    [useful for development](/docs/connect/dev.html).
    52  
    53  * `-upstream` - Upstream service to support connecting to. The format should be
    54    'name:addr', such as 'db:8181'. This will make 'db' available on port 8181.
    55    When a regular TCP connection is made to port 8181, the proxy will service
    56    discover "db" and establish a Connect mTLS connection identifying as
    57    the `-service` value. This flag can be repeated multiple times.
    58  
    59  * `-listen` - Address to listen for inbound connections to the proxied service.
    60    Must be specified with -service and -service-addr. If this isn't specified,
    61    an inbound listener is not started.
    62  
    63  * `-service-addr` - Address of the local service to proxy. Required for
    64    `-listen`.
    65  
    66  * `-register` - Self-register with the local Consul agent, making this
    67    proxy available as Connect-capable service in the catalog. This is only
    68    useful with `-listen`.
    69  
    70  * `-register-id` - Optional ID suffix for the service when `-register` is set to
    71    disambiguate the service ID. By default the service ID is "<service>-proxy"
    72    where `<service>` is the `-service` value. In most cases it is now preferable
    73    to use [`consul services register`](/docs/commands/services/register.html) to
    74    register a fully configured proxy instance rather than specify config and
    75    registration via this command.
    76  
    77  ## Examples
    78  
    79  The example below shows how to start a local proxy for establishing outbound
    80  connections to "db" representing the frontend service. Once running, any
    81  process that creates a TCP connection to the specified port (8181) will
    82  establish a mutual TLS connection to "db" identified as "frontend".
    83  
    84  ```text
    85  $ consul connect proxy -service frontend -upstream db:8181
    86  ```
    87  
    88  The next example starts a local proxy that also accepts inbound connections
    89  on port 8443, authorizes the connection, then proxies it to port 8080:
    90  
    91  ```text
    92  $ consul connect proxy \
    93      -service frontend \
    94      -service-addr 127.0.0.1:8080 \
    95      -listen ':8443'
    96  ```