- Load-balance incoming requests among different available backends, or redirect all requests to the best-available matching backend, depending on desired configuration
Tricot uses the following environment variables for its configuration (they can also be passed as command line arguments, see `--help`):
-`TRICOT_LETSENCRYPT_EMAIL` (**mandatory**): the e-mail address used to register a Let's encrypt account
-`TRICOT_NODE_NAME` (**mandatory**): the name in Consul of the node on which this instance of Tricot is running
-`TRICOT_CONSUL_HOST` (default: `http://127.0.0.1:8500`): the HTTP or HTTPS address at which the Consul catalog can be reached
-`TRICOT_CONSUL_CA_CERT`, `TRICOT_CONSUL_CLIENT_CERT`, `TRICOT_CONSUL_CLIENT_KEY` (optional): parameters necessary to access Consul over HTTPS when cluster TLS is enabled
-`TRICOT_CONSUL_KV_PREFIX` (default: `tricot/`): the prefix in Consul's key-value store under which Tricot stores its data (the certificates it obtained from Lets Encrypt)
-`TRICOT_HTTP_BIND_ADDR` (default: `0.0.0.0:80`): the HTTP address and port on which Tricot listens
-`TRICOT_HTTPS_BIND_ADDR` (default: `0.0.0.0:443`): the HTTPS address and port on which Tricot listens
-`TRICOT_ENABLE_COMPRESSION` (default: `false`): whether to enable transparent compression of data coming back from backends
-`TRICOT_COMPRESS_MIME_TYPES` (default: `text/html,text/plain,text/css,text/javascript,text/xml,application/javascript,application/json,application/xml,image/svg+xml,font/ttf`): comma-separated list of MIME types for which Tricot will do compression
[Here is an example of how to run Tricot as a Nomad service](https://git.deuxfleurs.fr/Deuxfleurs/nixcfg/src/commit/1a11ff42029e0a6cb5f5b9c34043af9d6d52e5ab/cluster/prod/app/core/deploy/tricot.hcl)
(in this example it also integrates with [Diplonat](https://git.deuxfleurs.fr/Deuxfleurs/diplonat)).
Backends are configured by adding tags of the following form to the services in Consul:
-`tricot myapp.example.com`: indicates that Tricot should get a TLS certificate for domain myapp.example.com and route traffic for this domain to this service
-`tricot myapp.example.com 10`: same but with a priority of 10. This is lower than the default priority value of 100, so Tricot will only use this rule if no higher-priority services are available.
-`tricot myapp.example.com/path/to_subresource`: same but indicates that only requests whose paths start with `/path/to/subresource` should be routed to this service
-`tricot myapp.example.com/path/to_subresource 10`: combining the previous two examples
-`tricot-https myapp.example.com`: same, but indicates that the backend service handling the request expects an HTTPS request and not an HTTP request. In this case, Tricot will do everything in its power to NOT verify the backend's TLS certificate (ignore self-signed certificate, ignore TLS hostname, etc).
-`tricot-add-header Access-Control-Allow-Origin *`: add the `Access-Control-Allow-Origin: *` header to all of the HTTP responses when they are proxied back to the client
-`tricot-global-lb`: load-balance incoming requests to all matching backends
-`tricot-site-lb`: load-balance incoming requests to all matching backends that are in the same site (geographical location); when site information about nodes is not available, this is equivalent to `tricot-global-lb`
3. Select rule that redirects request to the same node Tricot is running on, except `tricot-site-lb` or `tricot-global-lb` is used
4. Select rule that redirects request to a node that is running in the same site (geographical region, datacenter, whatever) than the node Tricot is running on, based on the metadata key `site` in Consul's node information, if such information is available, except if `tricot-global-lb` is used
Logs are the privileged place to get information about what Tricot is doing. You can set the log level by changing the `RUST_LOG` environment variable. The following log levels are avaialble:
-`RUST_LOG=tricot=warn`: Tricot will only show warning and errors, it should be quite quiet
-`RUST_LOG=tricot=info`: Tricot will dump the proxy configuration (the set of rules it uses to match backends) each time it changes, and will show a line for each incoming request (but it won't indicate which backend the request was routed to). You will also get information about certificate obtention and renewal using Let's Encrypt.
-`RUST_LOG=tricot=debug`: Tricot will show for each request the backend to which it is routed. It will also show all of its interactions with Consul
-`RUST_LOG=tricot=trace`: Tricot will show details such as the request's headers for all request at all stages of proxying.
