Configuration
An INI-style file of named sections. Listeners say where traffic arrives, serverfarms say where it goes, real servers are the backends, and everything else tunes those three.
The shipped etc/sslb-sample.conf is the reference: every setting appears in it with the reasoning next to it, which is a more reliable source than any page here. This is the shape, not the catalogue.
The shape of it
sslb.conf
[System] User = sslb3 Group = sslb3 # Always false under systemd, which wants the process in the foreground. Daemon = false # Zero means one worker per core. Threads = 0 [Log] LogName = sslb3 DebugLevel = 2 UseSyslog = true [Listener-http] Protocol = tcp BindAddress = :: ListenPort = 8080 Serverfarm = web [Listener-https] Protocol = tls BindAddress = :: ListenPort = 8443 CertificateFile = /etc/sslb3/tls/fullchain.pem PrivateKeyFile = /etc/sslb3/tls/privkey.pem Serverfarm = web [Serverfarm-web] Balancer = round-robin Layer7Module = http HealthCheckType = http HealthCheckPath = /health [Realserver-1] Serverfarm = web IPAddress = 10.0.0.11 Port = 8080 [Realserver-2] Serverfarm = web IPAddress = 10.0.0.12 Port = 8080
Comments go on a line of their own. There are no trailing comments: everything after the = is the value, so Daemon = false # note is a value that is not a boolean, and the file is refused. Real server sections are numbered.
Listeners
A socket, and the two questions that have to be answered before a byte is read: where the traffic goes, and whether anything should parse it. A listener pinned to a serverfarm with Layer7Module = none is a plain passthrough — and the shape the kernel fast path can take over.
Protocol is tcp, tls, udp or quic. A tls listener presents whatever the certificate store holds for the server name asked for, so adding a certificate does not touch the listener.
Source address filtering
AllowSourceRange and DenySourceRange, applied at accept before a permit is taken. This is the access control available in front of a protocol nobody parses.
The two resolve by specificity rather than by list: a rule about one host beats a rule about its network whichever list it came from, and a tie goes to deny. An empty allow list means "admit anything not denied"; a non-empty one means "admit only these".
Serverfarms and real servers
A farm is a group of backends plus how to choose between them. There are four balancers and no others — an unrecognised name is refused when the configuration is parsed rather than quietly falling back: round-robin, weighted, least-connections, and lua for the case where the choice is worth expressing in code.
A real server belongs to exactly one farm and carries an address, a port, a weight, and optionally TLS to the backend. How much of the traffic a weight is worth is proportioned by the weighted balancer only — round-robin and least-connections deal evenly whatever the numbers say. Zero is the exception, and it means the same thing everywhere: the backend is drained, taken out of rotation under every balancer and withheld from the kernel fast path as well, without being removed from the configuration.
Health checks
On by default — a TCP connect every ten seconds — and run on their own schedule rather than on the request path, so a request never waits for a check. A backend that fails three in a row is taken out of rotation and put back after its next success.
A check belongs to a real server, and is inherited: set it once on [Serverfarm] for everything, on a farm for its members, and on a single server only where that server differs. Members of one farm listening on different ports are each checked on their own port with nothing extra configured. Besides a TCP connect there is an HTTP or HTTPS request with the status codes you accept, an SMTP greeting, a Lua script, and noop, which passes without testing anything.
The ingress controller turns checking off unless an Ingress asks for it, because Kubernetes already removes an unready pod from the endpoints the backends are built from. Every setting is in the configuration reference.
Overriding from the environment
Any setting present in the file can be overridden as SSLB3_<SECTION>_<KEY>, uppercased, with dashes becoming underscores. The environment always wins.
shell
SSLB3_LOG_DEBUGLEVEL=5 # overrides [Log] DebugLevel SSLB3_REALSERVER_1_PORT=8443 # overrides [Realserver-1] Port
The key has to exist in the file to be overridable, which keeps every available knob documented there rather than hidden in a deployment's environment. Give it an empty value if the real one is a secret that should only ever come from the environment — SSLB3 logs the names of settings it took from there, never their values.
Reloading
SIGHUP rereads the configuration and the certificates without dropping a listener. A renewed certificate needs nothing more than that. A handle to the file is kept from before privileges were dropped, so a root-owned configuration at mode 0600 still reloads as the unprivileged user.
A reload replaces only what the file describes. Everything pushed through the admin API that the file does not mention is kept — serverfarms and their backends, certificates, listeners — and where both name the same farm or certificate, the file wins. That is what makes a reload safe on an ingress deployment, where the file declares no farms and no certificates at all: rebuilt from the file alone, the balancer would have nothing to route to until its controller pushed again. Scripts are compiled first: a syntax error means the reload is refused and the scripts in use are untouched, rather than every request failing on its next call.
For log rotation use SIGUSR1. It reopens the log file and does nothing else — SIGHUP reopens it too, but a daily rotation should not reload configuration, scripts and certificates as a side effect.