Kvindo™ Cloud Docs
A TLS Listener terminates TLS at Layer 4 and forwards the decrypted TCP stream to Target Groups. Unlike an HTTPS listener it does not parse HTTP — it unwraps the TLS envelope and passes raw bytes on, so it suits any TLS-wrapped TCP protocol. It presents a Certificate you supply — or one generated automatically via Let's Encrypt.
• Load balancer — the LB this listener belongs to (spec.loadbalancerId)
• TLS — the Certificate and TLS protocol versions used to terminate traffic (spec.tls)
• Ports / Hosts — the ports to accept on, and an optional SNI host filter
• Security rules — optional IP allow/deny list applied before routing
| UI Name | API / kc name | Terraform name | Optional | Format | Default | Is read only | Description |
|---|---|---|---|---|---|---|---|
| Load balancer | spec.loadbalancerId |
spec.loadbalancer_id |
No | ULID — references a Load Balancer | — | No | The load balancer this listener belongs to |
| Interface | spec.interface |
spec.interface |
Yes | string — all / public / private |
all |
No | Which network interface to bind on |
| Order | spec.order |
spec.order |
Yes | integer | 0 |
No | Tie-breaking priority when multiple listeners match |
| Ports | spec.ports |
spec.ports |
No | list of string | — | No | Ports the listener accepts connections on |
| Hosts | spec.hosts |
spec.hosts |
Yes | list of string | [] |
No | Optional SNI host filter |
| TLS | spec.tls |
spec.tls |
No | object | — | No | TLS termination config |
| Certificate | spec.tls.certificateId |
certificate_id |
Yes | ULID (nullable) — references a Certificate | — | No | Certificate used to terminate TLS |
| Protocols | spec.tls.protocols |
protocols |
Yes | list of string — e.g. TLSv1.2, TLSv1.3 |
— | No | Allowed TLS protocol versions |
| Auto-generate certificate | spec.tls.autogenerateCertificate |
autogenerate_certificate |
Yes | boolean | false |
No | Issue a certificate automatically via Let's Encrypt (HTTP-01 challenge) instead of supplying one. Only works if the load balancer has a public IP and every spec.hosts entry already resolves to it |
| Security rules | spec.securityRules |
spec.security_rules |
Yes | list of rule objects | [] |
No | IP allow/deny list applied before routing |
| Order | spec.securityRules[].order |
order |
Yes | integer | — | No | Evaluation order of the rule within this listener's allow/deny list — rules are checked in ascending order and the first one whose IPv4/IPv6 blocks contain the client IP decides allow or deny; traffic matching no rule is denied by default |
| Description | spec.securityRules[].description |
description |
Yes | string (nullable) | — | No | Free-form note on what the rule is for |
| Action | spec.securityRules[].action |
action |
No | string — allow / deny |
— | No | Whether to allow or deny the matched IPs |
| IPv4 blocks | spec.securityRules[].ipV4Blocks |
ipv4_blocks |
Yes | list of string — CIDR | [] |
No | IPv4 ranges the rule matches |
| IPv6 blocks | spec.securityRules[].ipV6Blocks |
ipv6_blocks |
Yes | list of string — CIDR | [] |
No | IPv6 ranges the rule matches. IPv6 is not yet implemented — this field is reserved for future use |
A TLS listener on port 8443 that terminates TLS with a self-managed certificate and forwards the plain TCP stream onward.
Terraform
Python SDK
kc CLI
Resource docs
More in this section