Kvindo™ Cloud Docs
A TLS Listener terminates TLS at Layer 4 and forwards the decrypted TCP stream to Target Groups. Unlike an HTTPS listener it does not parse HTTP — it unwraps the TLS envelope and passes raw bytes on, so it suits any TLS-wrapped TCP protocol. It presents a Certificate you supply — or one generated automatically via Let's Encrypt.
• Load balancer — the LB this listener belongs to (spec.loadbalancerId)
• TLS — the Certificate and TLS protocol versions used to terminate traffic (spec.tls)
• Ports / Hosts — the ports to accept on, and the SNI host(s) to match — both required
• Security rules — optional IP allow/deny list applied before routing
| UI Name | API / kc name | Terraform name | Optional | Format | Default | Is read only | Description |
|---|---|---|---|---|---|---|---|
| Load balancer | spec.loadbalancerId |
spec.loadbalancer_id |
No | ULID — references a Load Balancer | — | No | The load balancer this listener belongs to |
| Interface | spec.interface |
spec.interface |
No | string — all / public / private |
— | No | Which network interface to bind on. No server-side default — the console preselects all for convenience, but the API rejects a missing/empty value |
| Order | spec.order |
spec.order |
Yes | integer | 0 |
No | Tie-breaking priority when multiple listeners match |
| Ports | spec.ports |
spec.ports |
No | list of string — integers only, 1-65535 (no "8000-8010" range form) |
— | No | Ports the listener accepts connections on. At least one required. Port 22 is reserved for the Loadbalancer VM's own SSH access and is rejected. Each port must be unique across every listener (of any protocol) on the same Load Balancer |
| Hosts | spec.hosts |
spec.hosts |
No | list of string — hostname, optionally with a single leading *. wildcard, or a ~/~*-prefixed regex |
— | No | SNI host filter. At least one host is required; each entry is either a hostname (optionally a single leading *. wildcard, then standard DNS labels), or an nginx-style server_name regex — ~ (case-sensitive) / ~* (case-insensitive) followed by a regular expression, e.g. ~^(a|b)\.example\.com$. If TLS autogenerateCertificate is enabled, at least one host must be a literal (non-regex) domain — Let's Encrypt cannot issue a certificate for a regex host |
| TLS | spec.tls |
spec.tls |
No | object | — | No | TLS termination config |
| Certificate | spec.tls.certificateId |
certificate_id |
Yes | ULID (nullable) — references a Certificate | — | No | Certificate used to terminate TLS |
| Protocols | spec.tls.protocols |
protocols |
No | list of string — e.g. TLSv1.2, TLSv1.3 |
— | No | Allowed TLS protocol versions. Non-nullable array — omitting it fails ASP.NET model binding with a 400 error even though there is no explicit content check |
| Auto-generate certificate | spec.tls.autogenerateCertificate |
autogenerate_certificate |
Yes | boolean | false |
No | Issue a certificate automatically via Let's Encrypt (HTTP-01 challenge) instead of supplying one. Only works if the load balancer has a public IP and every spec.hosts entry already resolves to it |
| Security rules | spec.securityRules |
spec.security_rules |
Yes | list of rule objects | [] |
No | IP allow/deny list applied before routing |
| Order | spec.securityRules[].order |
order |
Yes | integer | — | No | Evaluation order of the rule within this listener's allow/deny list — rules are checked in ascending order and the first one whose IPv4/IPv6 blocks contain the client IP decides allow or deny; traffic matching no rule is denied by default |
| Description | spec.securityRules[].description |
description |
Yes | string (nullable) | — | No | Free-form note on what the rule is for |
| Action | spec.securityRules[].action |
action |
No | string — allow / deny |
— | No | Whether to allow or deny the matched IPs |
| IPv4 blocks | spec.securityRules[].ipV4Blocks |
ipv4_blocks |
Yes | list of string — CIDR | [] |
No | IPv4 ranges the rule matches |
| IPv6 blocks | spec.securityRules[].ipV6Blocks |
ipv6_blocks |
Yes | list of string — CIDR | [] |
No | IPv6 ranges the rule matches. IPv6 is not yet implemented — this field is reserved for future use |
A TLS listener on port 8443 that terminates TLS with a self-managed certificate and forwards the plain TCP stream onward.
Terraform
Python SDK
kc CLI
Resource docs
More in this section