Configuration reference

To listen to a specific IP:
server_bind_addr = "192.168.12.69"

To listen to any IPv4 address:
server_bind_addr = "0.0.0.0"

Or to listen to any address including IPv6 (if supported):
server_bind_addr = "any"

This specifies the number of connections the hub will be able to accept in the backlog before they must be processed by the hub.

A too low number here will mean the hub will not accept connections fast enough when users are reconnecting really fast. The hub should under normal circumstances be able to empty the listen backlog several times per second.

Set SO_REUSEPORT on the listening socket so that multiple hub processes can bind the same server_port; the kernel then load-balances incoming client connections across them. This is the basis for running one logical hub as several worker processes on a multi-core machine (linked together so they share one roster and SID space).

Enabled automatically when "workers" is greater than 1. Only set it by hand if you supervise the worker processes yourself (e.g. a systemd template).

High security with emphasis on forward secrecy:
tls_ciphersuite = "ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS"

Allow ChaCha20/Poly1305 which are secure, yet generally faster:
tls_ciphersuite = "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA"

Prefer AES-256-GCM, then ChaCha20/Poly1305, then AES-128-GCM:
tls_ciphersuites = "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256"

This allows you to specify the minimum TLS version the hub requires from connecting clients in order to connect to the hub. Valid values are "1.2" and "1.3".

TLS version 1.2 is recommended and enabled by default. TLS version 1.3 can be required to admit only the most modern clients. TLS versions below 1.2 are deprecated and no longer supported.

When enabled, the hub answers HTTP GET requests for the metrics path (see metrics_path) on the regular server port(s) with a Prometheus text-exposition document. A valid bearer token (metrics_token) is required; if no token is configured the endpoint stays disabled.

The endpoint is served on the same port(s) as ADC, both over plain HTTP and, when tls_enable is set, over HTTPS (scrape with https://). Use HTTPS to keep the bearer token confidential: plain HTTP is also accepted on the same port, so over plain HTTP the token is exposed on an untrusted network -- scrape over loopback/a trusted network, or use HTTPS.

Number of worker processes to run as a single logical hub on a multi-core machine. With workers greater than 1, the hub forks that many processes that share the client port (SO_REUSEPORT, so the kernel spreads connections across cores) and link to each other over Unix sockets, presenting one unified roster and SID space to clients. Each worker is a normal single-threaded hub, so this scales the CPU-bound work (especially TLS) across cores without any threading.

1 (the default) runs a single process. 0 means auto: one worker per online CPU. The master process only supervises the workers (restarting any that exit); it serves no clients itself.

Hostname resolution (for hub linking and registration server announcements) runs on a pool of background threads so the main event loop never blocks on a slow DNS lookup. This option sets the number of worker threads in that pool.

A small pool is plenty for a typical hub; raise it only if a large number of outbound lookups must run concurrently. Changing this value takes effect on restart, not on a configuration reload.

Master-slave authentication for linked hubs. When enabled this node is an auth slave: it holds no user accounts of its own and defers registered-user login to its upstream linked hub (the master), which keeps the only copy of the account database. The slave asks the master whether a nick is registered, and forwards the password challenge-response to the master to verify, so passwords never leave the master.

Leave disabled on the master (the hub that loads the auth plugin with the accounts). Guests are unaffected and log in locally.

Path to a Unix domain socket this hub listens on for inbound links from other hub processes on the same machine. Used to link worker processes of one logical hub without routing link traffic through the shared client port. Empty disables the Unix-socket listener (TCP links on the normal port still work). A link_peer that begins with "/" connects to such a socket.

Protect the socket with filesystem permissions; it grants the same privileges as any link.

When enabled, the hub advertises the HBRI extension and lets dual-stack clients prove reachability on both IPv4 and IPv6. After a client logs in over one protocol, the hub asks it to open a short-lived secondary connection over the other protocol; on success the client's INF will carry both an IPv4 (I4) and an IPv6 (I6) address, so users behind either protocol can connect to each other.

This requires the hub to be reachable on both IPv4 and IPv6 and both hbri_address4 and hbri_address6 to be configured. If either is empty, HBRI is not advertised.

Unix users:
file_acl = "/etc/uhub/users.conf"

Windows users:
file_acl = "c:\uhub\users.conf"

file_plugins = "/etc/uhub/plugins.conf"