Server Configuration Reference

Top-level configuration schema for the Elide HTTP server.

This module is the root of an elide serve configuration. It covers listeners, routing, forward proxying, TLS, the admin API, global middleware, and observability. Every field has a sane default so a minimal config only needs to specify what differs from the defaults.

Server block keys

The servers mapping uses the key as the server's identity. The key determines default listener and domain settings:

• Domain key (contains ., no :): infers listen :443 and

• Address key (starts with : or matches host:port): infers

• Label key (anything else): no inference; listen and domains

Explicit listen or domains declarations always override inference.

Quick examples

Static site with auto-TLS (inferred from domain key):

amends "elide:serve/ElideServer.pkl"
servers {
  ["example.com"] {
    handler = new StaticFiles { root = "./dist"; spaFallback = true }
  }
}

Reverse proxy:

servers {
  ["api.example.com"] {
    handler = new ReverseProxy { upstreams { "backend:8080" } }
  }
}

Forward proxy with MITM:

servers {
  [":8080"] {
    proxy { mitm {}; recording {} }
  }
}

Mixed — serve files, reverse proxy an API, and forward proxy on one port:

servers {
  ["app.example.com"] {
    routes {
      new { match = "/api/**"; handler = new ReverseProxy { upstreams { "backend:9000" } } }
    }
    handler = new StaticFiles { root = "./dist"; spaFallback = true }
    proxy { mitm {}; recording {} }
  }
}

> This page is auto-generated from the PKL schema. See the Serve Guide for usage examples.

Serve Reference Pages

Proxy Reference Pages

Type Re-exports

Shared Types

ServerTransport

Transport backend to use for accepting connections.

typealias ServerTransport = "auto" | "io_uring" | "kqueue" | "epoll" | "nio" | "iocp"

LogLevel

Severity level for structured log output. Messages below the configured level are discarded. Ordered most to least verbose: "trace", "debug", "info", "warn", "error".

typealias LogLevel = "trace" | "debug" | "info" | "warn" | "error"

LogFormat

Format for structured log output.

• "json" — one JSON object per line (recommended for log pipelines)
• "text" — compact single-line text
• "pretty" — human-readable multiline output

typealias LogFormat = "json" | "text" | "pretty"

Http3Policy

HTTP/3 (QUIC) enablement policy.

• "ifTls" (default): enable HTTP/3 transparently when TLS is configured;

• "required": require HTTP/3 — the server refuses to start if TLS is not

• "disabled": never enable HTTP/3, even when TLS is available.

typealias Http3Policy = "ifTls" | "required" | "disabled"

ListenEntry

Listener entry — either a full Listen object or a string shorthand.

typealias ListenEntry = String | _listen.Listen

UpstreamEntry

Upstream entry — either a full Upstream object or a string shorthand.

typealias UpstreamEntry = String | _handler.Upstream

HandlerEntry

Handler for the server block — either a full Handler, or a UInt status code shorthand.

typealias HandlerEntry = UInt(isBetween(100, 599)) | _handler.Handler

---

Root Properties

global

Global settings applied to all server blocks. See GlobalSettings for available fields (workers, connection limits, transport, keep-alive, DNS).

servers

Server blocks, keyed by domain, address, or label.

When null, a single implicit server block is used with default settings. See ServerBlock for per-block options and the module-level doc comment for key-inference rules.

servers {
  ["example.com"] {
    handler = new StaticFiles { root = "./dist" }
  }
  [":8080"] {
    proxy { mitm {}; recording {} }
  }
}

tls

TLS and certificate management configuration applied to all server blocks by default. Individual blocks can override specific fields via ServerBlock.tls. See TlsConfig for ACME, cert storage, OCSP stapling, and cipher-suite options.

networks

Named network attachments (Tailscale, WireGuard, or both).

Each entry is an independent tunnel with its own data plane, routing rules, and identity. The key is a human-readable name used in logs and metrics. See NetworkConfig for per-attachment options.

networks {
  ["production"] {
    tailscale { direct = true; authKey = env("TS_PROD_KEY") }
    tunnel { bridgeInbound = true }
  }
  ["office-vpn"] {
    wireguard { configFile = "./wg-office.conf" }
    tunnel { bridgeOutbound = true }
  }
}

devMode

Enable development mode. When true, the server injects a live-reload SSE endpoint and a companion