How to: TLS Settings
logspout supports modification of the client TLS settings via environment variables described below:

| Environment Variable  | Description |
| :---                  |  :---       |
| `LOGSPOUT_TLS_DISABLE_SYSTEM_ROOTS` | when set to `true` it disables loading the system trust store into the trust store of logspout |
| `LOGSPOUT_TLS_CA_CERTS` | a comma separated list of filesystem paths to pem encoded CA certificates that should be added to logspout's TLS trust store. Each pem file can contain more than one certificate |
| `LOGSPOUT_TLS_CLIENT_CERT` | filesystem path to pem encoded x509 client certificate to load when TLS mutual authentication is desired |
| `LOGSPOUT_TLS_CLIENT_KEY` | filesystem path to pem encoded client private key to load when TLS mutual authentication is desired |
| `LOGSPOUT_TLS_HARDENING` | when set to `true` it enables stricter client TLS settings designed to mitigate some known TLS vulnerabilities |

#### Example TLS settings
The following settings cover some common use cases.
When running docker, use the `-e` flag to supply environment variables

**add your own CAs to the list of trusted authorities**
```
export LOGSPOUT_TLS_CA_CERTS="/opt/tls/ca/myRootCA1.pem,/opt/tls/ca/myRootCA2.pem"
```

**force logspout to ONLY trust your own CA**
```
export LOGSPOUT_TLS_DISABLE_SYSTEM_ROOTS=true
export LOGSPOUT_TLS_CA_CERTS="/opt/tls/ca/myRootCA1.pem"
```

**configure client authentication**
```
export LOGSPOUT_TLS_CLIENT_CERT="/opt/tls/client/myClient.pem"
export LOGSPOUT_TLS_CLIENT_KEY="/opt/tls/client/myClient-key.pem"
```

**highest possible security settings (paranoid mode)**
```
export LOGSPOUT_TLS_DISABLE_SYSTEM_ROOTS=true
export LOGSPOUT_TLS_HARDENING=true
export LOGSPOUT_TLS_CA_CERTS="/opt/tls/ca/myRootCA1.pem"
export LOGSPOUT_TLS_CLIENT_CERT="/opt/tls/client/myClient.pem"
export LOGSPOUT_TLS_CLIENT_KEY="/opt/tls/client/myClient-key.pem"
```