Documentation
¶
Overview ¶
Package gateway is the security policy gateway: its HTTP server and reverse proxy, the request pipeline that applies the five security controls (token verification, role permits, rate limits, request validation and the security event log), the policy compiler and controller with confirmed policy activation and temporary overrides, the SQLite store, the protected Admin API and the local operator commands. Main runs the gateway program.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( ErrConfig = errors.New("configuration invalid") ErrLocked = errors.New("deployment held by another process") ErrStorage = errors.New("database or audit log unusable") ErrListen = errors.New("listener unavailable") ErrStarted = errors.New("already started") ErrStopped = errors.New("stopped") ErrIncomplete = errors.New("stop incomplete") )
Kinds of lifecycle failure. Every error returned while loading, opening, starting or stopping a gateway matches exactly one of them with errors.Is; its text is the underlying error's, unchanged.
Functions ¶
Types ¶
type Embedded ¶
type Embedded struct {
// contains filtered or unexported fields
}
Embedded is one gateway whose data plane a host program serves. Its methods are safe for concurrent use.
func OpenEmbedded ¶
OpenEmbedded opens the deployment settings name, as the run command would, without binding any listener. Until Start, every request is refused with 503 gateway_unavailable and recorded.
func (*Embedded) ServeHTTP ¶
func (e *Embedded) ServeHTTP(w http.ResponseWriter, r *http.Request)
ServeHTTP runs the data plane: the full request pipeline for every request.
func (*Embedded) ServerSettings ¶
func (e *Embedded) ServerSettings() ServerSettings
ServerSettings returns the configured limits for the host's server.
func (*Embedded) Start ¶
Start binds the metrics listener, starts the Admin API and then admits requests. It succeeds at most once (ErrStarted), never after Stop began (ErrStopped); when it fails otherwise (ErrListen), the gateway is stopped and released.
func (*Embedded) Stop ¶
Stop ends admission (later requests are refused with 503), stops the metrics listener, waits for ServeHTTP calls in progress, then stops the Admin API, writes the queued audit events and closes the database. ctx bounds the waits. It runs once; every call returns the first call's result, nil only when every step completed, else ErrIncomplete. It also releases a gateway that was never started.
type ServerSettings ¶
type ServerSettings struct {
MaxHeaderBytes int
ReadHeaderTimeout time.Duration
ReadTimeout time.Duration
WriteTimeout time.Duration
IdleTimeout time.Duration
HTTP2 bool
}
ServerSettings are the configured limits of the server that runs the data plane. Header size and the timeouts bound slow and oversized clients; the gateway cannot enforce them on a server it does not own. HTTP2 allows HTTP/2, which net/http serves only over TLS.
func (ServerSettings) Apply ¶
func (s ServerSettings) Apply(server *http.Server)
Apply sets the limits and protocols on server, replacing its own values for them, so a host never serves a protocol the gateway did not configure. The header list of an HTTP/2 request is bounded by MaxHeaderBytes too.
type Settings ¶
type Settings struct {
// contains filtered or unexported fields
}
Settings is a configuration file checked as the run command checks it. Only LoadSettings makes one; the zero value is refused.
func LoadSettings ¶
LoadSettings reads and checks the configuration file at path, including the files it names. Its errors are ErrConfig.
Source Files