Configuration
An INI-style file of named sections. Listeners say where traffic arrives, serverfarms say where it goes, real servers are the backends, and everything else tunes those three.
The shipped etc/sslb-sample.conf is the reference: every setting appears in it with the reasoning next to it, which is a more reliable source than any page here. This is the shape, not the catalogue.
The shape of it
sslb.conf
[System] User = sslb3 Group = sslb3 Daemon = false # false under systemd, always Threads = 0 # one worker per core [Log] LogName = sslb3 DebugLevel = 2 UseSyslog = true [Listener-http] Protocol = tcp BindAddress = :: ListenPort = 8080 Serverfarm = web [Listener-https] Protocol = tls BindAddress = :: ListenPort = 8443 Serverfarm = web [Serverfarm-web] Balancer = round-robin Layer7Module = http HealthCheck = true HealthCheckType = http [Realserver-web-1] Serverfarm = web Address = 10.0.0.11 Port = 8080 [Realserver-web-2] Serverfarm = web Address = 10.0.0.12 Port = 8080
Listeners
A socket, and the two questions that have to be answered before a byte is read: where the traffic goes, and whether anything should parse it. A listener pinned to a serverfarm with Layer7Module = none is a plain passthrough — and the shape the kernel fast path can take over.
Protocol is tcp, tls, udp or quic. A tls listener presents whatever the certificate store holds for the server name asked for, so adding a certificate does not touch the listener.
Source address filtering
AllowSourceRange and DenySourceRange, applied at accept before a permit is taken. This is the access control available in front of a protocol nobody parses.
The two resolve by specificity rather than by list: a rule about one host beats a rule about its network whichever list it came from, and a tie goes to deny. An empty allow list means "admit anything not denied"; a non-empty one means "admit only these".
Serverfarms and real servers
A farm is a group of backends plus how to choose between them. Balancers are round-robin, weighted, least-connections, source-hash, or a Lua function where the choice is worth expressing in code.
A real server belongs to exactly one farm and carries an address, a port, a weight, and optionally TLS to the backend. Weight zero means "configured but take no traffic", which is how a backend is drained without being removed.
Health checks
Off per farm until configured, and then on their own schedule rather than on the request path — a request never waits for a check. Types include a TCP connect, an HTTP request with an expected status, and noop, which means "assume healthy" and is what the ingress controller sets, because Kubernetes already decides which endpoints exist.
Overriding from the environment
Any setting present in the file can be overridden as SSLB3_<SECTION>_<KEY>, uppercased, with dashes becoming underscores. The environment always wins.
shell
SSLB3_LOG_DEBUGLEVEL=5 # overrides [Log] DebugLevel SSLB3_REALSERVER_1_PORT=8443 # overrides [Realserver-1] Port
The key has to exist in the file to be overridable, which keeps every available knob documented there rather than hidden in a deployment's environment. Give it an empty value if the real one is a secret that should only ever come from the environment — SSLB3 logs the names of settings it took from there, never their values.
Reloading
SIGHUP rereads the configuration and the certificates without dropping a listener. A renewed certificate needs nothing more than that. A handle to the file is kept from before privileges were dropped, so a root-owned configuration at mode 0600 still reloads as the unprivileged user.