Configuration

# All traffic to example.com goes to backend on port 8080
example.com -> http://backend:8080

# Multiple domains, each with its own backend
api.example.com   -> http://api-server:3000
admin.example.com -> http://admin-panel:4000

# Only /api/* paths on app.example.com go to the API service
app.example.com/api/* -> http://api:8082

# Everything else on app.example.com goes to the frontend
app.example.com -> http://frontend:3000

# Prefix match: /api/ and all subpaths
/api/* -> http://api:8090

# Exact match: only /health (not /health/check)
/health -> http://monitoring:9090

# WebSocket route
/ws -> ws://realtime:8888

# Match versioned API paths: /v1/..., /v2/..., etc.
~^/v[0-9]+/.*$ -> http://versioned:8091

# Match UUID-based resource paths
~^/resources/[0-9a-f]{8}-[0-9a-f]{4}-.*$ -> http://resources:8092

# Route /api/* to backend (prefix stripped from request)
/api/* -> http://api:8090

# Two backends on a single line
/app/* -> http://b1:8080, http://b2:8080

# Line continuation with backslash for readability
/api/* -> http://backend1:8080, \
          http://backend2:8080, \
          http://backend3:8080

# Single script on a route
/admin/* -> http://admin:4000 @script:auth.lua

# Multiple scripts on a route
/api/* -> http://api:3000 @script:auth.lua,rate_limit.lua

# Works with multi-backend and line continuation
/api/* -> http://a:8080, \
          http://b:8080 @script:auth.lua

# These scripts run on every request
[global] @script:cors.lua,logging.lua

# Routes follow as normal
/api/* -> http://api:3000 @script:auth.lua
default -> http://localhost:8080

# Catch-all fallback (must be last)
default -> http://localhost:8080

[server]
bind = "0.0.0.0:80"            # HTTP listen address
https_port = 443               # HTTPS listen port
worker_threads = "auto"        # "auto" = num CPUs, or a number

[tls]
mode = "auto"                  # "auto" = self-signed dev certs
                                # "letsencrypt" = ACME production certs
cache_dir = "./certs"          # Directory to store certificates

[letsencrypt]
staging = false               # true = use staging ACME server (for testing)
email = "[email protected]"   # Contact email for certificate notifications
terms_agreed = true          # You must agree to the ACME ToS

[admin]
enabled = true                # Enable the admin API
bind = "0.0.0.0:9090"         # Admin API listen address
api_key = "your-secret-key"   # Optional: require X-API-Key header

[circuit_breaker]
failure_threshold = 5        # Consecutive failures before opening
recovery_timeout_secs = 30   # Seconds before probing an open backend
success_threshold = 2        # Successful probes needed to close
failure_status_codes = [502, 503, 504]  # HTTP codes that count as failures

[scripting]
enabled = true                # Enable Lua scripting engine
scripts_dir = "./scripts/lua"  # Directory containing Lua scripts
hook_timeout_ms = 10         # Max execution time per hook (ms)

[logging]
level = "info"                # trace, debug, info, warn, error
format = "json"               # "json" or "pretty"
output = "stdout"             # "stdout" or "file:/var/log/soli-proxy.log"

[limits]
max_connections = 10000      # Maximum concurrent connections
max_request_size = "10MB"    # Maximum request body size
keep_alive_timeout = 30     # Keep-alive timeout in seconds
request_timeout = 60        # Total request timeout in seconds

[rate_limiting]
enabled = true                # Enable rate limiting
strategy = "token_bucket"     # Rate limiting algorithm
requests_per_second = 1000   # Sustained request rate
burst_size = 2000            # Maximum burst above sustained rate

# Find and signal the process
kill -USR1 $(pidof soli-proxy)

# Or if using systemd
systemctl kill --signal=USR1 soli-proxy

# Without API key
curl -X POST http://localhost:9090/reload

# With API key authentication
curl -X POST http://localhost:9090/reload \
  -H "X-API-Key: your-secret-key"