Documentation Grafana Alloy Reference Configuration blocks http

http block

http is an optional configuration block used to customize how the Alloy HTTP server functions. http is specified without a label and can only be provided once per configuration file.

Example

alloy Copy

http {
  tls {
    cert_file = sys.env("TLS_CERT_FILE_PATH")
    key_file  = sys.env("TLS_KEY_FILE_PATH")
  }
}

Arguments

The http block supports no arguments and is configured completely through inner blocks.

Blocks

The following blocks are supported inside the definition of http:

tls block

The tls block configures TLS settings for the HTTP server.

When the tls block is specified, arguments for the TLS certificate (using cert_pem or cert_file) and for the TLS key (using key_pem or key_file) are required.

The following pairs of arguments are mutually exclusive, and only one may be configured at a time:

• cert_pem and cert_file
• key_pem and key_file
• client_ca_pem and client_ca_file

The client_auth_type argument determines whether to validate client certificates. The default value, NoClientCert, indicates that the client certificate isn’t validated. The client_ca_pem and client_ca_file arguments may only be configured when client_auth_type is not NoClientCert.

The following values are accepted for client_auth_type:

• NoClientCert: client certificates are neither requested nor validated.
• RequestClientCert: requests clients to send an optional certificate. Certificates provided by clients aren’t validated.
• RequireAnyClientCert: requires at least one certificate from clients. Certificates provided by clients aren’t validated.
• VerifyClientCertIfGiven: requests clients to send an optional certificate. If a certificate is sent, it must be valid.
• RequireAndVerifyClientCert: requires clients to send a valid certificate.

The client_ca_pem or client_ca_file arguments may be used to perform client certificate validation. These arguments may only be provided when client_auth_type isn’t set to NoClientCert.

The cipher_suites argument determines what cipher suites to use. If you don’t provide cipher suite, a default list is used. The set of cipher suites specified may be from the following:

The curve_preferences argument determines the set of elliptic curves to prefer during a handshake in preference order. If not provided, a default list is used. The set of elliptic curves specified may be from the following:

The min_version and max_version arguments determine the oldest and newest TLS version that’s acceptable from clients. If you don’t provide the min and max TLS version, a default value is used.

The following versions are recognized:

• TLS13 for TLS 1.3
• TLS12 for TLS 1.2
• TLS11 for TLS 1.1
• TLS10 for TLS 1.0

windows certificate filter block

The windows_certificate_filter block is used to configure retrieving certificates from the built-in Windows certificate store. When you use the windows_certificate_filter block the following TLS settings are overridden and cause an error if defined.

• cert_pem
• cert_file
• key_pem
• key_file
• client_ca
• client_ca_file

server block

The server block is used to find the certificate to check the signer. If multiple certificates are found, the windows_certificate_filter chooses the certificate with the expiration farthest in the future.

client block

The client block is used to check the certificate presented to the server.