Kvindo™ Cloud Docs
A TLS Listener terminates TLS at Layer 4 and forwards the decrypted TCP stream to Target Groups. Unlike an HTTPS listener it does not parse HTTP — it unwraps the TLS envelope and passes raw bytes on, so it suits any TLS-wrapped TCP protocol. It presents a Certificate you supply — or one generated automatically via Let's Encrypt.
• Load balancer — the LB this listener belongs to (spec.loadbalancerId)
• TLS — the Certificate and TLS protocol versions used to terminate traffic (spec.tls)
• Ports / Hosts — the ports to accept on, and an optional SNI host filter
• Security rules — optional IP allow/deny list applied before routing
| UI Name | API / kc name | Terraform name | Optional | Format | Default | Is read only | Description |
|---|---|---|---|---|---|---|---|
| Load balancer | spec.loadbalancerId |
spec.loadbalancer_id |
No | ULID — references a Load Balancer | — | No | The load balancer this listener belongs to |
| Interface | spec.interface |
spec.interface |
Yes | string — all / public / private |
all |
No | Which network interface to bind on |
| Order | spec.order |
spec.order |
Yes | integer | 0 |
No | Tie-breaking priority when multiple listeners match |
| Ports | spec.ports |
spec.ports |
No | list of string | — | No | Ports the listener accepts connections on |
| Hosts | spec.hosts |
spec.hosts |
Yes | list of string | [] |
No | Optional SNI host filter |
| TLS | spec.tls |
spec.tls |
No | object | — | No | TLS termination config |
| Certificate | spec.tls.certificateId |
certificate_id |
Yes | ULID (nullable) — references a Certificate | — | No | Certificate used to terminate TLS |
| Protocols | spec.tls.protocols |
protocols |
Yes | list of string — e.g. TLSv1.2, TLSv1.3 |
— | No | Allowed TLS protocol versions |
| Auto-generate certificate | spec.tls.autogenerateCertificate |
autogenerate_certificate |
Yes | boolean | false |
No | Issue a certificate automatically via Let's Encrypt (HTTP-01 challenge) instead of supplying one. Only works if the load balancer has a public IP and every spec.hosts entry already resolves to it |
| Security rules | spec.securityRules |
spec.security_rules |
Yes | list of rule objects — {order, description, action, ipV4Blocks, ipV6Blocks} |
[] |
No | IP allow/deny list applied before routing |
A TLS listener on port 8443 that terminates TLS with a self-managed certificate and forwards the plain TCP stream onward.
Terraform
Python SDK
kc CLI
Resource docs
More in this section