Listen

The [listen] section controls where the proxy accepts client connections. Static: changing it requires a process restart.

Fields

• addrs: list of socket addresses (IPv4 and/or IPv6), for example 0.0.0.0:7000 and [::]:7000 for dual-stack.
• tcp_backlog: listen queue depth (default 4096).
• proxy_protocol: optional PROXY protocol v1/v2 support when huginn sits behind a trusted L4 load balancer (see below).

Example

YAML

listen:
 addrs:
 - "0.0.0.0:7000"
 - "[::]:7000"
 # tcp_backlog: 4096
 # proxy_protocol:
 # mode: off # off | optional | require
 # header_timeout_ms: 100

TOML

[listen]
addrs = ["0.0.0.0:7000", "[::]:7000"]
# tcp_backlog = 4096

# [listen.proxy_protocol]
# mode = "off" # off | optional | require
# header_timeout_ms = 100

PROXY protocol

When an L4 load balancer prepends a PROXY protocol header (HAProxy, nginx stream, AWS NLB, Envoy, …), huginn can recover the real client (src_ip, src_port). That address is used for X-Forwarded-For / X-Forwarded-Port, rate limiting, IP filtering, eBPF SYN lookup, and logs.

mode	Behavior
off (default)	Never read a PROXY header; peer is always the TCP socket peer.
optional	If a trusted peer sends a header, use it; otherwise treat as a direct client.
require	A trusted peer must send a valid header, else the connection is dropped.

A header is honored only from peers in security.trusted_proxies. With an empty list, optional behaves like off, and require drops every connection (fail-closed).

header_timeout_ms (default 100) bounds how long a trusted peer may sit waiting for the header. Both v1 (text) and v2 (binary) are auto-detected.

See Configuration overview for the full config layout.