Common configuration

Several configuration structs are shared across Platform Filter components. This page documents them in one place so individual component docs can link here instead of repeating the same tables.

TLS — tlsconfig.Config

Source: github.com/PowerDNS/go-tlsconfig

Most components that accept or initiate network connections have a tls field of type tlsconfig.Config. An empty block (tls: {}) means no TLS — plain TCP or HTTP. Populate the block to enable encrypted and optionally authenticated transport.

Certificate and CA

Certificates can be provided inline (PEM strings) or as file paths. File-based certificates support background reloading without a service restart.

Parameter	Type	Default	Description
cert	string	""	PEM-encoded client or server certificate (inline).
cert_file	string	""	Path to a PEM certificate file. Mutually exclusive with cert.
key	string	""	PEM-encoded private key (inline).
key_file	string	""	Path to a PEM key file. Mutually exclusive with key.
ca	string	""	PEM-encoded CA certificate for verifying the remote (inline).
ca_file	string	""	Path to a PEM CA file. Mutually exclusive with ca.
add_system_ca_pool	boolean	false	Also trust the system CA pool when a private CA is configured. By default, setting ca or ca_file replaces the system pool entirely.

Certificate reloading

Parameter	Type	Default	Description
watch_certs	boolean	false	Reload certificate files in the background. Only applies to file-based certificates (cert_file / key_file).
watch_certs_poll_interval	go: Duration	5s	How often to check for certificate file changes.

Server options

Parameter	Type	Default	Description
require_client_cert	boolean	false	Require a client certificate (mTLS). The CA must be configured when this is enabled.

Debugging

Warning

These settings weaken TLS security. Use them only for local testing and debugging, never in production.

Parameter	Type	Default	Description
insecure_skip_verify	boolean	false	Skip verification of the remote certificate. TLS is still encrypted but vulnerable to man-in-the-middle attacks.
insecure_key_log_file	string	""	Write TLS master secrets in NSS key log format for Wireshark decryption.

Example

Minimal server TLS with file-based certificates:

tls:
  cert_file: /etc/pki/tls/certs/myservice.pem
  key_file: /etc/pki/tls/private/myservice.key
  watch_certs: true

Client TLS with a private CA:

tls:
  ca_file: /etc/pki/tls/certs/internal-ca.pem

Mutual TLS (mTLS) on a server:

tls:
  cert_file: /etc/pki/tls/certs/server.pem
  key_file: /etc/pki/tls/private/server.key
  ca_file: /etc/pki/tls/certs/client-ca.pem
  require_client_cert: true

NATS — itsy.Config

Source: github.com/PowerDNS/itsy

Components that communicate over NATS (e.g. Device Register in split mode) use the itsy library for service discovery and message routing. The itsy block configures the NATS connection, subject prefix, and optional topology registration.

Connection

Parameter	Type	Default	Description
url	string	""	NATS server URL. Use nats://host:port for plain connections or tls://host:port for TLS. Credentials can be embedded: nats://user:pass@host:port.
username	string	""	NATS username. Alternative to embedding credentials in the URL.
password	string	""	NATS password.
token	string	""	NATS authentication token. Alternative to username/password.
tls	tlsconfig.Config	{}	TLS configuration for the NATS connection. See the TLS section above.

Service registration

Parameter	Type	Default	Description
prefix	string	"svc"	Subject prefix for all itsy-managed subjects. For example, Device Register uses <prefix>.device-register.seen-device. Producer and consumer instances must agree on the prefix.
topologies	[]string	[]	Dotted topology identifiers to register the service under (e.g. "eu.nl.ams"). Parent levels are registered automatically — adding "eu.nl.ams" also registers "eu.nl" and "eu".
meta	map[string]string	{}	Free-form key-value metadata exposed in the NATS service registration. Useful for monitoring and tooling.

Environment variable overrides

itsy fields can also be set via environment variables with the ITSY_ prefix. These override the YAML values:

Variable	Overrides
ITSY_URL	url
ITSY_PREFIX	prefix
ITSY_TOPO	topologies (space-separated list, appended to YAML values)
ITSY_META_<KEY>	meta.<key> (key is lowercased)

Example

Split-mode producer connecting to a NATS cluster with TLS:

nats:
  split-mode-producer: true
  itsy:
    url: tls://nats.internal:4222
    prefix: pf
    topologies:
      - eu.nl.ams
    tls:
      ca_file: /etc/pki/tls/certs/nats-ca.pem

Plain connection for development:

nats:
  split-mode-consumer: true
  itsy:
    url: nats://localhost:4222