1 ========================
2 Configuring a Tahoe-LAFS node
3 ========================
5 1. `Overall Node Configuration`_
6 2. `Client Configuration`_
7 3. `Storage Server Configuration`_
9 5. `Running An Introducer`_
10 6. `Other Files in BASEDIR`_
12 8. `Backwards Compatibility Files`_
15 A Tahoe-LAFS node is configured by writing to files in its base directory. These
16 files are read by the node when it starts, so each time you change them, you
17 need to restart the node.
19 The node also writes state to its base directory, so it will create files on
22 This document contains a complete list of the config files that are examined
23 by the client node, as well as the state files that you'll observe in its
26 The main file is named 'tahoe.cfg', which is an ".INI"-style configuration
27 file (parsed by the Python stdlib 'ConfigParser' module: "[name]" section
28 markers, lines with "key.subkey: value", rfc822-style continuations). There
29 are other files that contain information which does not easily fit into this
30 format. The 'tahoe create-node' or 'tahoe create-client' command will create
31 an initial tahoe.cfg file for you. After creation, the node will never modify
32 the 'tahoe.cfg' file: all persistent state is put in other files.
34 The item descriptions below use the following types:
37 one of (True, yes, on, 1, False, off, no, 0), case-insensitive
40 a Twisted listening-port specification string, like "tcp:80"
41 or "tcp:3456:interface=127.0.0.1". For a full description of
43 http://twistedmatrix.com/documents/current/api/twisted.application.strports.html
46 a Foolscap endpoint identifier, like
47 pb://soklj4y7eok5c3xkmjeqpw@192.168.69.247:44801/eqpwqtzm
50 Overall Node Configuration
51 ==========================
53 This section controls the network behavior of the node overall: which ports
54 and IP addresses are used, when connections are timed out, etc. This
55 configuration is independent of the services that the node is offering: the
56 same controls are used for client and introducer nodes.
58 If your node is behind a firewall or NAT device and you want other clients to
59 connect to it, you'll need to open a port in the firewall or NAT, and specify
60 that port number in the tub.port option. If behind a NAT, you *may* need to
61 set the tub.location option described below.
67 nickname = (UTF-8 string, optional)
69 This value will be displayed in management tools as this node's
70 "nickname". If not provided, the nickname will be set to "<unspecified>".
71 This string shall be a UTF-8 encoded unicode string.
73 web.port = (strports string, optional)
75 This controls where the node's webserver should listen, providing
76 filesystem access and node status as defined in webapi.txt . This file
77 contains a Twisted "strports" specification such as "3456" or
78 "tcp:3456:interface=127.0.0.1". The 'tahoe create-node' or 'tahoe
79 create-client' commands set the web.port to
80 "tcp:3456:interface=127.0.0.1" by default; this is overridable by the
81 "--webport" option. You can make it use SSL by writing
82 "ssl:3456:privateKey=mykey.pem:certKey=cert.pem" instead.
84 If this is not provided, the node will not run a web server.
86 web.static = (string, optional)
88 This controls where the /static portion of the URL space is served. The
89 value is a directory name (~username is allowed, and non-absolute names
90 are interpreted relative to the node's basedir) which can contain HTML
91 and other files. This can be used to serve a javascript-based frontend to
92 the Tahoe-LAFS node, or other services.
94 The default value is "public_html", which will serve $BASEDIR/public_html .
95 With the default settings, http://127.0.0.1:3456/static/foo.html will
96 serve the contents of $BASEDIR/public_html/foo.html .
98 tub.port = (integer, optional)
100 This controls which port the node uses to accept Foolscap connections
101 from other nodes. If not provided, the node will ask the kernel for any
102 available port. The port will be written to a separate file (named
103 client.port or introducer.port), so that subsequent runs will re-use the
106 tub.location = (string, optional)
108 In addition to running as a client, each Tahoe-LAFS node also runs as a
109 server, listening for connections from other Tahoe-LAFS clients. The node
110 announces its location by publishing a "FURL" (a string with some
111 connection hints) to the Introducer. The string it publishes can be found
112 in $BASEDIR/private/storage.furl . The "tub.location" configuration
113 controls what location is published in this announcement.
115 If you don't provide tub.location, the node will try to figure out a
116 useful one by itself, by using tools like 'ifconfig' to determine the set
117 of IP addresses on which it can be reached from nodes both near and far.
118 It will also include the TCP port number on which it is listening (either
119 the one specified by tub.port, or whichever port was assigned by the
120 kernel when tub.port is left unspecified).
122 You might want to override this value if your node lives behind a
123 firewall that is doing inbound port forwarding, or if you are using other
124 proxies such that the local IP address or port number is not the same one
125 that remote clients should use to connect. You might also want to control
126 this when using a Tor proxy to avoid revealing your actual IP address
127 through the Introducer announcement.
129 The value is a comma-separated string of host:port location hints, like
132 123.45.67.89:8098,tahoe.example.com:8098,127.0.0.1:8098
136 Emulate default behavior, assuming your host has IP address
137 123.45.67.89 and the kernel-allocated port number was 8098:
140 tub.location = 123.45.67.89:8098,127.0.0.1:8098
142 Use a DNS name so you can change the IP address more easily:
145 tub.location = tahoe.example.com:8098
147 Run a node behind a firewall (which has an external IP address) that
148 has been configured to forward port 7912 to our internal node's port
152 tub.location = external-firewall.example.com:7912
154 Run a node behind a Tor proxy (perhaps via torsocks), in client-only
155 mode (i.e. we can make outbound connections, but other nodes will not
156 be able to connect to us). The literal 'unreachable.example.org' will
157 not resolve, but will serve as a reminder to human observers that this
158 node cannot be reached. "Don't call us.. we'll call you":
161 tub.location = unreachable.example.org:0
163 Run a node behind a Tor proxy, and make the server available as a Tor
164 "hidden service". (this assumes that other clients are running their
165 node with torsocks, such that they are prepared to connect to a .onion
166 address). The hidden service must first be configured in Tor, by giving
167 it a local port number and then obtaining a .onion name, using
168 something in the torrc file like:
170 HiddenServiceDir /var/lib/tor/hidden_services/tahoe
171 HiddenServicePort 29212 127.0.0.1:8098
173 once Tor is restarted, the .onion hostname will be in
174 /var/lib/tor/hidden_services/tahoe/hostname . Then set up your
178 tub.location = ualhejtq2p7ohfbb.onion:29212
180 Most users will not need to set tub.location .
182 Note that the old 'advertised_ip_addresses' file from earlier releases is
183 no longer supported. Tahoe-LAFS 1.3.0 and later will ignore this file.
185 log_gatherer.furl = (FURL, optional)
187 If provided, this contains a single FURL string which is used to contact
188 a 'log gatherer', which will be granted access to the logport. This can
189 be used by centralized storage meshes to gather operational logs in a
190 single place. Note that when an old-style BASEDIR/log_gatherer.furl file
191 exists (see 'Backwards Compatibility Files', below), both are used. (for
192 most other items, the separate config file overrides the entry in
195 timeout.keepalive = (integer in seconds, optional)
196 timeout.disconnect = (integer in seconds, optional)
198 If timeout.keepalive is provided, it is treated as an integral number of
199 seconds, and sets the Foolscap "keepalive timer" to that value. For each
200 connection to another node, if nothing has been heard for a while, we
201 will attempt to provoke the other end into saying something. The duration
202 of silence that passes before sending the PING will be between KT and
203 2*KT. This is mainly intended to keep NAT boxes from expiring idle TCP
204 sessions, but also gives TCP's long-duration keepalive/disconnect timers
205 some traffic to work with. The default value is 240 (i.e. 4 minutes).
207 If timeout.disconnect is provided, this is treated as an integral number
208 of seconds, and sets the Foolscap "disconnect timer" to that value. For
209 each connection to another node, if nothing has been heard for a while,
210 we will drop the connection. The duration of silence that passes before
211 dropping the connection will be between DT-2*KT and 2*DT+2*KT (please see
212 ticket #521 for more details). If we are sending a large amount of data
213 to the other end (which takes more than DT-2*KT to deliver), we might
214 incorrectly drop the connection. The default behavior (when this value is
215 not provided) is to disable the disconnect timer.
217 See ticket #521 for a discussion of how to pick these timeout values.
218 Using 30 minutes means we'll disconnect after 22 to 68 minutes of
219 inactivity. Receiving data will reset this timeout, however if we have
220 more than 22min of data in the outbound queue (such as 800kB in two
221 pipelined segments of 10 shares each) and the far end has no need to
222 contact us, our ping might be delayed, so we may disconnect them by
225 ssh.port = (strports string, optional)
226 ssh.authorized_keys_file = (filename, optional)
228 This enables an SSH-based interactive Python shell, which can be used to
229 inspect the internal state of the node, for debugging. To cause the node
230 to accept SSH connections on port 8022 from the same keys as the rest of
235 ssh.authorized_keys_file = ~/.ssh/authorized_keys
237 tempdir = (string, optional)
239 This specifies a temporary directory for the webapi server to use, for
240 holding large files while they are being uploaded. If a webapi client
241 attempts to upload a 10GB file, this tempdir will need to have at least
242 10GB available for the upload to complete.
244 The default value is the "tmp" directory in the node's base directory
245 (i.e. $NODEDIR/tmp), but it can be placed elsewhere. This directory is
246 used for files that usually (on a unix system) go into /tmp . The string
247 will be interpreted relative to the node's base directory.
255 introducer.furl = (FURL string, mandatory)
257 This FURL tells the client how to connect to the introducer. Each Tahoe-LAFS
258 grid is defined by an introducer. The introducer's furl is created by the
259 introducer node and written into its base directory when it starts,
260 whereupon it should be published to everyone who wishes to attach a
263 helper.furl = (FURL string, optional)
265 If provided, the node will attempt to connect to and use the given helper
266 for uploads. See docs/helper.txt for details.
268 key_generator.furl = (FURL string, optional)
270 If provided, the node will attempt to connect to and use the given
271 key-generator service, using RSA keys from the external process rather
272 than generating its own.
274 stats_gatherer.furl = (FURL string, optional)
276 If provided, the node will connect to the given stats gatherer and
277 provide it with operational statistics.
279 shares.needed = (int, optional) aka "k", default 3
280 shares.total = (int, optional) aka "N", N >= k, default 10
281 shares.happy = (int, optional) 1 <= happy <= N, default 7
283 These three values set the default encoding parameters. Each time a new
284 file is uploaded, erasure-coding is used to break the ciphertext into
285 separate pieces. There will be "N" (i.e. shares.total) pieces created,
286 and the file will be recoverable if any "k" (i.e. shares.needed) pieces
287 are retrieved. The default values are 3-of-10 (i.e. shares.needed = 3,
288 shares.total = 10). Setting k to 1 is equivalent to simple replication
289 (uploading N copies of the file).
291 These values control the tradeoff between storage overhead, performance,
292 and reliability. To a first approximation, a 1MB file will use (1MB*N/k)
293 of backend storage space (the actual value will be a bit more, because of
294 other forms of overhead). Up to N-k shares can be lost before the file
295 becomes unrecoverable, so assuming there are at least N servers, up to
296 N-k servers can be offline without losing the file. So large N/k ratios
297 are more reliable, and small N/k ratios use less disk space. Clearly, k
298 must never be smaller than N.
300 Large values of N will slow down upload operations slightly, since more
301 servers must be involved, and will slightly increase storage overhead due
302 to the hash trees that are created. Large values of k will cause
303 downloads to be marginally slower, because more servers must be involved.
304 N cannot be larger than 256, because of the 8-bit erasure-coding
305 algorithm that Tahoe-LAFS uses.
307 shares.happy allows you control over the distribution of your immutable
308 file. For a successful upload, shares are guaranteed to be initially
309 placed on at least 'shares.happy' distinct servers, the correct
310 functioning of any k of which is sufficient to guarantee the availability
311 of the uploaded file. This value should not be larger than the number of
312 servers on your grid.
314 A value of shares.happy <= k is allowed, but does not provide any
315 redundancy if some servers fail or lose shares.
317 (Mutable files use a different share placement algorithm that does not
318 consider this parameter.)
321 Storage Server Configuration
322 ============================
327 enabled = (boolean, optional)
329 If this is True, the node will run a storage server, offering space to
330 other clients. If it is False, the node will not run a storage server,
331 meaning that no shares will be stored on this node. Use False this for
332 clients who do not wish to provide storage service. The default value is
335 readonly = (boolean, optional)
337 If True, the node will run a storage server but will not accept any
338 shares, making it effectively read-only. Use this for storage servers
339 which are being decommissioned: the storage/ directory could be mounted
340 read-only, while shares are moved to other servers. Note that this
341 currently only affects immutable shares. Mutable shares (used for
342 directories) will be written and modified anyway. See ticket #390 for the
343 current status of this bug. The default value is False.
345 reserved_space = (str, optional)
347 If provided, this value defines how much disk space is reserved: the
348 storage server will not accept any share which causes the amount of free
349 disk space to drop below this value. (The free space is measured by a
350 call to statvfs(2) on Unix, or GetDiskFreeSpaceEx on Windows, and is the
351 space available to the user account under which the storage server runs.)
353 This string contains a number, with an optional case-insensitive scale
354 suffix like "K" or "M" or "G", and an optional "B" or "iB" suffix. So
355 "100MB", "100M", "100000000B", "100000000", and "100000kb" all mean the
356 same thing. Likewise, "1MiB", "1024KiB", and "1048576B" all mean the same
361 expire.override_lease_duration =
366 These settings control garbage-collection, in which the server will
367 delete shares that no longer have an up-to-date lease on them. Please see
368 the neighboring "garbage-collection.rst" document for full details.
374 A "helper" is a regular client node that also offers the "upload helper"
380 enabled = (boolean, optional)
382 If True, the node will run a helper (see docs/helper.txt for details).
383 The helper's contact FURL will be placed in private/helper.furl, from
384 which it can be copied to any clients which wish to use it. Clearly nodes
385 should not both run a helper and attempt to use one: do not create both
386 helper.furl and run_helper in the same node. The default is False.
389 Running An Introducer
390 =====================
392 The introducer node uses a different '.tac' file (named introducer.tac), and
393 pays attention to the "[node]" section, but not the others.
395 The Introducer node maintains some different state than regular client nodes.
397 BASEDIR/introducer.furl : This is generated the first time the introducer
398 node is started, and used again on subsequent runs, to give the introduction
399 service a persistent long-term identity. This file should be published and
400 copied into new client nodes before they are started for the first time.
403 Other Files in BASEDIR
404 ======================
406 Some configuration is not kept in tahoe.cfg, for the following reasons:
408 * it is generated by the node at startup, e.g. encryption keys. The node
409 never writes to tahoe.cfg
410 * it is generated by user action, e.g. the 'tahoe create-alias' command
412 In addition, non-configuration persistent state is kept in the node's base
413 directory, next to the configuration knobs.
415 This section describes these other files.
418 This contains an SSL private-key certificate. The node
419 generates this the first time it is started, and re-uses it on subsequent
420 runs. This certificate allows the node to have a cryptographically-strong
421 identifier (the Foolscap "TubID"), and to establish secure connections to
425 Nodes which host StorageServers will create this directory to hold shares
426 of files on behalf of other clients. There will be a directory underneath
427 it for each StorageIndex for which this node is holding shares. There is
428 also an "incoming" directory where partially-completed shares are held
429 while they are being received.
432 this file defines the client, by constructing the actual Client instance
433 each time the node is started. It is used by the 'twistd' daemonization
434 program (in the "-y" mode), which is run internally by the "tahoe start"
435 command. This file is created by the "tahoe create-node" or "tahoe
436 create-client" commands.
439 this file contains a FURL that provides access to a control port on the
440 client node, from which files can be uploaded and downloaded. This file is
441 created with permissions that prevent anyone else from reading it (on
442 operating systems that support such a concept), to insure that only the
443 owner of the client node can use this feature. This port is intended for
444 debugging and testing use.
447 this file contains a FURL that provides access to a 'log port' on the
448 client node, from which operational logs can be retrieved. Do not grant
449 logport access to strangers, because occasionally secret information may be
453 if the node is running a helper (for use by other clients), its contact
454 FURL will be placed here. See docs/helper.txt for more details.
456 private/root_dir.cap (optional)
457 The command-line tools will read a directory cap out of this file and use
458 it, if you don't specify a '--dir-cap' option or if you specify
461 private/convergence (automatically generated)
462 An added secret for encrypting immutable files. Everyone who has this same
463 string in their private/convergence file encrypts their immutable files in
464 the same way when uploading them. This causes identical files to "converge"
465 -- to share the same storage space since they have identical ciphertext --
466 which conserves space and optimizes upload time, but it also exposes files
467 to the possibility of a brute-force attack by people who know that string.
468 In this attack, if the attacker can guess most of the contents of a file,
469 then they can use brute-force to learn the remaining contents.
471 So the set of people who know your private/convergence string is the set of
472 people who converge their storage space with you when you and they upload
473 identical immutable files, and it is also the set of people who could mount
476 The content of the private/convergence file is a base-32 encoded string. If
477 the file doesn't exist, then when the Tahoe-LAFS client starts up it will generate
478 a random 256-bit string and write the base-32 encoding of this string into
479 the file. If you want to converge your immutable files with as many people as
480 possible, put the empty string (so that private/convergence is a zero-length
487 Each Tahoe-LAFS node creates a directory to hold the log messages produced as
488 the node runs. These logfiles are created and rotated by the "twistd"
489 daemonization program, so logs/twistd.log will contain the most recent
490 messages, logs/twistd.log.1 will contain the previous ones,
491 logs/twistd.log.2 will be older still, and so on. twistd rotates logfiles
492 after they grow beyond 1MB in size. If the space consumed by logfiles
493 becomes troublesome, they should be pruned: a cron job to delete all files
494 that were created more than a month ago in this logs/ directory should be
498 this is written by all nodes after startup, and contains a base32-encoded
499 (i.e. human-readable) NodeID that identifies this specific node. This
500 NodeID is the same string that gets displayed on the web page (in the
501 "which peers am I connected to" list), and the shortened form (the first
502 characters) is recorded in various log messages.
504 Backwards Compatibility Files
505 =============================
507 Tahoe-LAFS releases before 1.3.0 had no 'tahoe.cfg' file, and used distinct files
508 for each item listed below. For each configuration knob, if the distinct file
509 exists, it will take precedence over the corresponding item in tahoe.cfg.
511 =========================== =============================== =================
512 Config setting File Comment
513 =========================== =============================== =================
514 [node]nickname BASEDIR/nickname
515 [node]web.port BASEDIR/webport
516 [node]tub.port BASEDIR/client.port (for Clients, not Introducers)
517 [node]tub.port BASEDIR/introducer.port (for Introducers, not Clients) (note that, unlike other keys, tahoe.cfg overrides this file)
518 [node]tub.location BASEDIR/advertised_ip_addresses
519 [node]log_gatherer.furl BASEDIR/log_gatherer.furl (one per line)
520 [node]timeout.keepalive BASEDIR/keepalive_timeout
521 [node]timeout.disconnect BASEDIR/disconnect_timeout
522 [client]introducer.furl BASEDIR/introducer.furl
523 [client]helper.furl BASEDIR/helper.furl
524 [client]key_generator.furl BASEDIR/key_generator.furl
525 [client]stats_gatherer.furl BASEDIR/stats_gatherer.furl
526 [storage]enabled BASEDIR/no_storage (False if no_storage exists)
527 [storage]readonly BASEDIR/readonly_storage (True if readonly_storage exists)
528 [storage]sizelimit BASEDIR/sizelimit
529 [storage]debug_discard BASEDIR/debug_discard_storage
530 [helper]enabled BASEDIR/run_helper (True if run_helper exists)
531 =========================== =============================== =================
533 Note: the functionality of [node]ssh.port and [node]ssh.authorized_keys_file
534 were previously combined, controlled by the presence of a
535 BASEDIR/authorized_keys.SSHPORT file, in which the suffix of the filename
536 indicated which port the ssh server should listen on, and the contents of the
537 file provided the ssh public keys to accept. Support for these files has been
538 removed completely. To ssh into your Tahoe-LAFS node, add [node]ssh.port and
539 [node].ssh_authorized_keys_file statements to your tahoe.cfg.
541 Likewise, the functionality of [node]tub.location is a variant of the
542 now-unsupported BASEDIR/advertised_ip_addresses . The old file was additive
543 (the addresses specified in advertised_ip_addresses were used in addition to
544 any that were automatically discovered), whereas the new tahoe.cfg directive
545 is not (tub.location is used verbatim).
551 The following is a sample tahoe.cfg file, containing values for all keys
552 described above. Note that this is not a recommended configuration (most of
553 these are not the default values), merely a legal one.
558 nickname = Bob's Tahoe-LAFS Node
560 tub.location = 123.45.67.89:8098,44.55.66.77:8098
562 log_gatherer.furl = pb://soklj4y7eok5c3xkmjeqpw@192.168.69.247:44801/eqpwqtzm
563 timeout.keepalive = 240
564 timeout.disconnect = 1800
566 ssh.authorized_keys_file = ~/.ssh/authorized_keys
569 introducer.furl = pb://ok45ssoklj4y7eok5c3xkmj@tahoe.example:44801/ii3uumo
570 helper.furl = pb://ggti5ssoklj4y7eok5c3xkmj@helper.tahoe.example:7054/kk8lhr
574 readonly_storage = True
575 sizelimit = 10000000000