Documentation Grafana Agent Flow mode Reference Configuration blocks http

http block

http is an optional configuration block used to customize how the Grafana Agent Flow HTTP server functions. http is specified without a label and can only be provided once per configuration file.

Example

river Copy

http {
  tls {
    cert_file = env("TLS_CERT_FILE_PATH")
    key_file  = env("TLS_KEY_FILE_PATH")
  }
}

Arguments

The http block supports no arguments and is configured completely through inner blocks.

Blocks

The following blocks are supported inside the definition of http:

tls block

The tls block configures TLS settings for the HTTP server.

When the tls block is specified, arguments for the TLS certificate (using cert_pem or cert_file) and for the TLS key (using key_pem or key_file) are required.

The following pairs of arguments are mutually exclusive, and only one may be configured at a time:

• cert_pem and cert_file
• key_pem and key_file
• client_ca_pem and client_ca_file

The client_auth_type argument determines whether to validate client certificates. The default value, NoClientCert, indicates that the client certificate is not validated. The client_ca_pem and client_ca_file arguments may only be configured when client_auth_type is not NoClientCert.

The following values are accepted for client_auth_type:

• NoClientCert: client certificates are neither requested nor validated.
• RequestClientCert: requests clients to send an optional certificate. Certificates provided by clients are not validated.
• RequireAnyClientCert: requires at least one certificate from clients. Certificates provided by clients are not validated.
• VerifyClientCertIfGiven: requests clients to send an optional certificate. If a certificate is sent, it must be valid.
• RequireAndVerifyClientCert: requires clients to send a valid certificate.

The client_ca_pem or client_ca_file arguments may be used to perform client certificate validation. These arguments may only be provided when client_auth_type is not set to NoClientCert.

The cipher_suites argument determines what cipher suites to use. If you don’t provide cipher suite, a default list is used. The set of cipher suites specified may be from the following:

The curve_preferences argument determines the set of elliptic curves to prefer during a handshake in preference order. If not provided, a default list is used. The set of elliptic curves specified may be from the following:

The min_version and max_version arguments determine the oldest and newest TLS version that’s acceptable from clients. If you don’t provide the min and max TLS version, a default value is used.

The following versions are recognized:

• TLS13 for TLS 1.3
• TLS12 for TLS 1.2
• TLS11 for TLS 1.1
• TLS10 for TLS 1.0

windows certificate filter block

The windows_certificate_filter block is used to configure retrieving certificates from the built-in Windows certificate store. When you use the windows_certificate_filter block the following TLS settings are overridden and cause an error if defined.

• cert_pem
• cert_file
• key_pem
• key_file
• client_ca
• client_ca_file

server block

The server block is used to find the certificate to check the signer. If multiple certificates are found, the windows_certificate_filter chooses the certificate with the expiration farthest in the future.

client block

The client block is used to check the certificate presented to the server.