ia64/xen-unstable

annotate tools/examples/xend-config.sxp @ 12604:6206685650f5

Implement an "allowed hosts" mechanism for the XML-RPC server layer, using
code from the relocation protocol handling and some plumbing. Add a new
configuration entry for the Xen-API server, including use of this mechanism.

Signed-off-by: Ewan Mellor <ewan@xensource.com>
author Ewan Mellor <ewan@xensource.com>
date Tue Nov 28 10:23:34 2006 +0000 (2006-11-28)
parents 55e8f40ef6e4
children ee70bf177981
rev   line source
emellor@7467 1 # -*- sh -*-
emellor@7467 2
emellor@7467 3 #
mjw@1723 4 # Xend configuration file.
emellor@7467 5 #
mjw@1723 6
nivedita@8404 7 # This example configuration is appropriate for an installation that
nivedita@8404 8 # utilizes a bridged network configuration. Access to xend via http
nivedita@8404 9 # is disabled.
emellor@7467 10
emellor@7467 11 # Commented out entries show the default for that entry, unless otherwise
emellor@7467 12 # specified.
emellor@7467 13
kaf24@11316 14 #(logfile /var/log/xen/xend.log)
emellor@7467 15 #(loglevel DEBUG)
mjw@1723 16
ewan@12604 17 # The Xen-API server configuration. (Please note that this server is available
ewan@12604 18 # as an UNSUPPORTED PREVIEW in Xen 3.0.4, and should not be relied upon).
ewan@12604 19 #
ewan@12604 20 # This value configures the ports, interfaces, and access controls for the
ewan@12604 21 # Xen-API server. Each entry in the list starts with either unix, a port
ewan@12604 22 # number, or an address:port pair. If this is "unix", then a UDP socket is
ewan@12604 23 # opened, and this entry applies to that. If it is a port, then Xend will
ewan@12604 24 # listen on all interfaces on that TCP port, and if it is an address:port pair,
ewan@12604 25 # then Xend will listen on the specified port, using the interface with the
ewan@12604 26 # specified address.
ewan@12604 27 #
ewan@12604 28 # The subsequent string gives the access control for the listener in question.
ewan@12604 29 # If this is missing or empty, then all connections are accepted.
ewan@12604 30 # Otherwise, this should be a space-separated sequence of regular expressions;
ewan@12604 31 # any host with a fully-qualified domain name or an IP address that matches one
ewan@12604 32 # of these regular expressions will be accepted.
ewan@12604 33 #
ewan@12604 34 # Example:
ewan@12604 35 #
ewan@12604 36 # Listen on TCP port 9363 on all interfaces, accepting connections only from
ewan@12604 37 # machines in example.com or localhost.
ewan@12604 38 # (xen-api-server ((9363 '^localhost$ example\\.com$')))
ewan@12604 39 #
ewan@12604 40 # Default:
ewan@12604 41 # (xen-api-server ((unix)))
ewan@12604 42
emellor@7467 43 #(xend-http-server no)
emellor@9425 44 #(xend-unix-server no)
emellor@9425 45 #(xend-tcp-xmlrpc-server no)
emellor@9425 46 #(xend-unix-xmlrpc-server yes)
emellor@7467 47 #(xend-relocation-server no)
emellor@7467 48 (xend-relocation-server yes)
emellor@7467 49
emellor@7467 50 #(xend-unix-path /var/lib/xend/xend-socket)
mjw@4095 51
emellor@7467 52 # Port xend should use for the HTTP interface, if xend-http-server is set.
emellor@7467 53 #(xend-port 8000)
emellor@7467 54
emellor@7467 55 # Port xend should use for the relocation interface, if xend-relocation-server
emellor@7467 56 # is set.
emellor@7467 57 #(xend-relocation-port 8002)
emellor@7467 58
emellor@7467 59 # Address xend should listen on for HTTP connections, if xend-http-server is
emellor@7467 60 # set.
mjw@1723 61 # Specifying 'localhost' prevents remote connections.
emellor@7467 62 # Specifying the empty string '' (the default) allows all connections.
emellor@7467 63 #(xend-address '')
nivedita@8404 64 #(xend-address localhost)
mjw@1723 65
emellor@7467 66 # Address xend should listen on for relocation-socket connections, if
emellor@7467 67 # xend-relocation-server is set.
emellor@7467 68 # Meaning and default as for xend-address above.
emellor@7467 69 #(xend-relocation-address '')
emellor@8326 70
emellor@8326 71 # The hosts allowed to talk to the relocation port. If this is empty (the
emellor@8326 72 # default), then all connections are allowed (assuming that the connection
emellor@8326 73 # arrives on a port and interface on which we are listening; see
emellor@8326 74 # xend-relocation-port and xend-relocation-address above). Otherwise, this
emellor@8326 75 # should be a space-separated sequence of regular expressions. Any host with
emellor@8326 76 # a fully-qualified domain name or an IP address that matches one of these
emellor@8326 77 # regular expressions will be accepted.
emellor@8326 78 #
emellor@8326 79 # For example:
ewan@12208 80 # (xend-relocation-hosts-allow '^localhost$ ^.*\\.example\\.org$')
emellor@8326 81 #
emellor@8326 82 #(xend-relocation-hosts-allow '')
kfraser@11071 83 (xend-relocation-hosts-allow '^localhost$ ^localhost\\.localdomain$')
mjw@4095 84
emellor@7441 85 # The limit (in kilobytes) on the size of the console buffer
emellor@7467 86 #(console-limit 1024)
emellor@7441 87
emellor@7557 88 ##
emellor@7557 89 # To bridge network traffic, like this:
emellor@7557 90 #
emellor@7557 91 # dom0: fake eth0 -> vif0.0 -+
emellor@7557 92 # |
emellor@7557 93 # bridge -> real eth0 -> the network
emellor@7557 94 # |
emellor@7557 95 # domU: fake eth0 -> vifN.0 -+
emellor@7557 96 #
emellor@7557 97 # use
emellor@7557 98 #
emellor@7557 99 # (network-script network-bridge)
emellor@7557 100 #
emellor@8821 101 # Your default ethernet device is used as the outgoing interface, by default.
emellor@8821 102 # To use a different one (e.g. eth1) use
emellor@7557 103 #
emellor@7557 104 # (network-script 'network-bridge netdev=eth1')
emellor@7557 105 #
emellor@7557 106 # The bridge is named xenbr0, by default. To rename the bridge, use
emellor@7557 107 #
emellor@7557 108 # (network-script 'network-bridge bridge=<name>')
emellor@7557 109 #
emellor@7557 110 # It is possible to use the network-bridge script in more complicated
emellor@7557 111 # scenarios, such as having two outgoing interfaces, with two bridges, and
emellor@7557 112 # two fake interfaces per guest domain. To do things like this, write
emellor@7557 113 # yourself a wrapper script, and call network-bridge from it, as appropriate.
emellor@7557 114 #
emellor@7557 115 (network-script network-bridge)
kaf24@3431 116
emellor@7557 117 # The script used to control virtual interfaces. This can be overridden on a
emellor@7557 118 # per-vif basis when creating a domain or a configuring a new vif. The
emellor@7557 119 # vif-bridge script is designed for use with the network-bridge script, or
emellor@7557 120 # similar configurations.
emellor@7557 121 #
emellor@7557 122 # If you have overridden the bridge name using
emellor@7557 123 # (network-script 'network-bridge bridge=<name>') then you may wish to do the
emellor@7557 124 # same here. The bridge name can also be set when creating a domain or
emellor@7557 125 # configuring a new vif, but a value specified here would act as a default.
emellor@7557 126 #
emellor@7557 127 # If you are using only one bridge, the vif-bridge script will discover that,
emellor@7557 128 # so there is no need to specify it explicitly.
emellor@7557 129 #
emellor@7557 130 (vif-script vif-bridge)
emellor@7557 131
emellor@7557 132
emellor@7557 133 ## Use the following if network traffic is routed, as an alternative to the
emellor@7557 134 # settings for bridged networking given above.
emellor@7557 135 #(network-script network-route)
emellor@7557 136 #(vif-script vif-route)
emellor@7557 137
emellor@7557 138
emellor@7557 139 ## Use the following if network traffic is routed with NAT, as an alternative
emellor@7557 140 # to the settings for bridged networking given above.
emellor@7557 141 #(network-script network-nat)
emellor@7557 142 #(vif-script vif-nat)
emellor@7557 143
mjw@1723 144
kaf24@5932 145 # Dom0 will balloon out when needed to free memory for domU.
kaf24@5932 146 # dom0-min-mem is the lowest memory level (in MB) dom0 will get down to.
kaf24@5932 147 # If dom0-min-mem=0, dom0 will never balloon out.
iap10@8218 148 (dom0-min-mem 196)
kaf24@5932 149
cl349@6916 150 # In SMP system, dom0 will use dom0-cpus # of CPUS
kaf24@5932 151 # If dom0-cpus = 0, dom0 will take all cpus available
kaf24@5932 152 (dom0-cpus 0)
emellor@7467 153
emellor@7467 154 # Whether to enable core-dumps when domains crash.
emellor@7467 155 #(enable-dump no)
emellor@9727 156
emellor@9727 157 # The tool used for initiating virtual TPM migration
emellor@9727 158 #(external-migration-tool '')
ewan@12191 159
ewan@12191 160 # The interface for VNC servers to listen on. Defaults
ewan@12191 161 # to 127.0.0.1 To restore old 'listen everywhere' behaviour
ewan@12191 162 # set this to 0.0.0.0
ewan@12191 163 #(vnc-listen '127.0.0.1')
ewan@12191 164
ewan@12191 165 # The default password for VNC console on HVM domain.
ewan@12191 166 # Empty string is no authentication.
ewan@12191 167 (vncpasswd '')