config

package
v1.10.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 7, 2026 License: MIT Imports: 21 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// EnvSecret is the proxy secret. Either a full mtg secret (ee-prefixed
	// hex or base64) or, for parity with the official image, a bare 16-byte
	// hex key which is combined with EnvSecretHost into a FakeTLS secret.
	EnvSecret = "SECRET"

	// EnvSecretHost is the domain-fronting hostname used when EnvSecret
	// holds a bare 16-byte key. Ignored when EnvSecret is a full secret.
	EnvSecretHost = "SECRET_HOST"

	// EnvAdTag is the advertising tag issued by @MTProxybot (the official
	// image calls it TAG). An empty value clears the tag from the file.
	EnvAdTag = "TAG"

	// EnvBindTo is a comma-separated list of host:port pairs to listen on.
	// It has no unprefixed form: the official image does not document one.
	EnvBindTo = "MTG_BIND_TO"
)

Environment variable names understood by ApplyEnvironment. The unprefixed names mirror the official telegrammessenger/proxy Docker image (https://hub.docker.com/r/telegrammessenger/proxy/), so its documented "docker run -e SECRET=... -e TAG=..." invocations work with mtg-proxy containers as well. MTG_-prefixed variants always win over the unprefixed ones, so generic names like SECRET cannot be captured by accident outside of a container.

View Source 
const (
	// TypeDoppelShapingRecord waits a drawn delay before every TLS record the
	// doppelganger writes. It is the default.
	TypeDoppelShapingRecord = "record"

	// TypeDoppelShapingBurst waits one drawn delay when a connection wakes
	// from idle and then sends records back to back.
	TypeDoppelShapingBurst = "burst"
)
View Source 
const (
	// TypeHandshakeBudgetModeEnforce charges the scan of a hello that no hint
	// matched against the CPU budget. A scan the budget can pay for within
	// 150 ms waits for it and runs; one it cannot pay for is fronted to the
	// cover site at once, never closed. It is the default.
	TypeHandshakeBudgetModeEnforce = "enforce"

	// TypeHandshakeBudgetModeObserve keeps the same accounting but never waits
	// and never refuses: it counts what enforce would have refused, and scans
	// anyway. It is the canary.
	TypeHandshakeBudgetModeObserve = "observe"

	// TypeHandshakeBudgetModeOff has no budget and no scan cap.
	TypeHandshakeBudgetModeOff = "off"
)
View Source 
const (
	// TypePreferIPPreferIPv4 states that you prefer to use IPv4 addresses
	// but IPv6 is also possible.
	TypePreferIPPreferIPv4 = "prefer-ipv4"

	// TypePreferIPPreferIPv6 states that you prefer to use IPv6 addresses
	// but IPv4 is also possible.
	TypePreferIPPreferIPv6 = "prefer-ipv6"

	// TypePreferOnlyIPv4 states that you prefer to use IPv4 addresses
	// only.
	TypePreferOnlyIPv4 = "only-ipv4"

	// TypePreferOnlyIPv6 states that you prefer to use IPv6 addresses
	// only.
	TypePreferOnlyIPv6 = "only-ipv6"
)
View Source 
const (
	// TypeStatsdTagFormatInfluxdb defines a tag format compatible with
	// InfluxDB.
	TypeStatsdTagFormatInfluxdb = "influxdb"

	// TypeStatsdTagFormatDatadog defines a tag format compatible with
	// DataDog.
	TypeStatsdTagFormatDatadog = "datadog"

	// TypeStatsdTagFormatGraphite defines a tag format compatible with
	// Graphite.
	TypeStatsdTagFormatGraphite = "graphite"
)
View Source 
const (
	// TypeUnknownSecretActionClose closes a refused connection immediately.
	TypeUnknownSecretActionClose = "close"

	// TypeUnknownSecretActionDrain reads and discards from a refused connection
	// under a bounded budget before closing it.
	TypeUnknownSecretActionDrain = "drain"
)

Variables

View Source 
var ErrOnlyMisplacedRetiringUser = errors.New(`[secrets] holds only the reserved name "retiring-secret", ` +
	"which is never served, and the top-level secret is not served while [secrets] is present, " +
	"so the file serves no secret: name the users to serve in [secrets], " +
	"and write an old key as a [[retiring-secret]] block above [secrets]")

ErrOnlyMisplacedRetiringUser is Validate's refusal of a [secrets] whose only user is misplacedRetiringUser. It says why nothing is served and how the file is written, and names no value. It is exported so that the reloader can add what a refusal keeps in force (errors.Is sees through the wrapping).

Functions

func ReadsAsAValue added in v1.10.0 

func ReadsAsAValue(text string) bool

ReadsAsAValue is readsAsAValue for the CLI and internal/rotation, which show a name by the same display rule: such a name is never shown.

func UnknownKeyPath added in v1.10.0 

func UnknownKeyPath(key string) string

UnknownKeyPath is an entry of Config.UnknownKeys without the line a hidden part adds to it: the dotted path alone, the same wherever the key moved in the file. An entry with nothing hidden is its path already.

func ValueFreeText added in v1.10.0 

func ValueFreeText(text string) string

ValueFreeText is text with every run that could spell a secret value replaced, wherever the text came from: for a message of another package that quotes a name of the file, such as the WEB relay's refusal of [web] host. Ordinary text is returned as it is.

Types

type ClientIPSource added in v1.1.0 

type ClientIPSource uint8

ClientIPSource says how the relay learns the browser's address.

It is a required decision rather than a default, because both wrong answers are silent. Trusting a header nobody sets makes every WEB user look like 127.0.0.1 -- the blocklist stops matching, the per-IP limits stop counting and every log names the loopback. Trusting one anybody can set hands those same controls to the client. 

const (
	// ClientIPProxyProtocol reads a PROXY header the front proxy writes. The
	// default, because it cannot be forged by the browser: it arrives before
	// the request, on a socket only the front proxy connects to.
	ClientIPProxyProtocol ClientIPSource = iota

	// ClientIPForwardedFor reads the right-most X-Forwarded-For entry, and only
	// from a loopback peer. Right-most because that is the entry the nearest
	// trusted hop appended; anything further left was written by whoever was
	// speaking before it.
	ClientIPForwardedFor
)

The two ways a relay behind a front proxy can learn who is connecting.

type Config 

type Config struct {
	Debug                    TypeBool                     `json:"debug"`
	AllowFallbackOnUnknownDC TypeBool                     `json:"allowFallbackOnUnknownDc"`
	Secret                   mtglib.Secret                `json:"secret"`
	Secrets                  map[string]mtglib.Secret     `json:"secrets"`
	AdTag                    TypeAdTag                    `json:"adTag"`
	SecretAdTags             map[string]TypeAdTag         `json:"secretAdTags"`
	SecretLimits             map[string]ConfigSecretLimit `json:"secretLimits"`

	// RetiringSecrets are the [[retiring-secret]] blocks, raw: a secret's
	// previous key and when it stops being accepted. GetRetiringSecrets judges
	// them; Validate never does, because a problem in one drops that entry and
	// never refuses the file. omitempty keeps Config.String() byte-identical
	// for every file without the table, the panel's included.
	RetiringSecrets []ConfigRetiringSecret `json:"retiringSecrets,omitempty"`

	// UnknownKeys are the dotted paths of every key the file carried that this
	// binary does not know, sorted. The parser is deliberately lenient -- a
	// file written for a newer binary must still load on an older one -- so a
	// typo, or a key in the wrong table, is not an error. It is not silent
	// either: whoever loads the file logs these. Not part of the config's own
	// rendering.
	UnknownKeys                 []string         `json:"-"`
	UsageStateFile              string           `json:"usageStateFile"`
	APIToken                    string           `json:"apiToken"`
	BindTo                      []TypeHostPort   `json:"bindTo"`
	Listeners                   []ConfigListener `json:"listeners"`
	Web                         ConfigWeb        `json:"web"`
	ProxyProtocolListener       TypeBool         `json:"proxyProtocolListener"`
	PreferIP                    TypePreferIP     `json:"preferIp"`
	AutoUpdate                  TypeBool         `json:"autoUpdate"`
	TrackClientIPs              TypeBool         `json:"trackClientIps"`
	DomainFrontingPort          TypePort         `json:"domainFrontingPort"`
	DomainFrontingIP            TypeIP           `json:"domainFrontingIp"`
	DomainFrontingProxyProtocol TypeBool         `json:"domainFrontingProxyProtocol"`
	TolerateTimeSkewness        TypeDuration     `json:"tolerateTimeSkewness"`
	Concurrency                 TypeConcurrency  `json:"concurrency"`
	PublicIPv4                  TypeIP           `json:"publicIpv4"`
	PublicIPv6                  TypeIP           `json:"publicIpv6"`
	DomainFronting              struct {
		Host          TypeHost `json:"host"`
		IP            TypeIP   `json:"ip"`
		Port          TypePort `json:"port"`
		ProxyProtocol TypeBool `json:"proxyProtocol"`
	} `json:"domainFronting"`
	Defense struct {
		AntiReplay struct {
			// Enabled is nil when the config does not say: replay protection
			// is then on. Only an explicit false turns it off.
			Enabled *TypeBool `json:"enabled"`

			MaxSize   TypeBytes     `json:"maxSize"`
			ErrorRate TypeErrorRate `json:"errorRate"`
		} `json:"antiReplay"`
		Blocklist    ListConfig `json:"blocklist"`
		Allowlist    ListConfig `json:"allowlist"`
		Doppelganger struct {
			URLs       []TypeHttpsURL    `json:"urls"`
			Repeats    TypeConcurrency   `json:"repeats_per_raid"`
			UpdateEach TypeDuration      `json:"raid_each"`
			DRS        TypeBool          `json:"drs"`
			Shaping    TypeDoppelShaping `json:"shaping"`
			// ScoutCovers is nil when the config does not say: the cover
			// sites are then measured. Only an explicit false turns it off.
			ScoutCovers *TypeBool `json:"scout_covers"`
		} `json:"doppelganger"`

		// HandshakeBudget is [defense.handshake-budget]. Its fields are the
		// zero value when the config does not say, which every getter below
		// reads as "the default"; omitzero keeps a config that does not use
		// the table rendering exactly as it did before the table existed.
		HandshakeBudget struct {
			Mode TypeHandshakeBudgetMode `json:"mode"`

			// PerIPMillis is nil when the config does not say (50); an
			// explicit 0 is a non-nil pointer to 0 and turns the per-address
			// bucket off.
			PerIPMillis *TypeHandshakeBudgetPerIP `json:"perIpMs,omitempty"`

			CPUPercent TypeHandshakeBudgetCPU `json:"cpuPercent"`

			// Hints is nil when the config does not say: the cache then
			// follows track-client-ips. Only an explicit value overrides it,
			// in either direction.
			Hints *TypeBool `json:"hints,omitempty"`
		} `json:"handshakeBudget,omitzero"`
	} `json:"defense"`
	Network struct {
		Timeout struct {
			TCP       TypeDuration `json:"tcp"`
			HTTP      TypeDuration `json:"http"`
			Idle      TypeDuration `json:"idle"`
			Handshake TypeDuration `json:"handshake"`
		} `json:"timeout"`
		KeepAlive struct {
			Disabled TypeBool        `json:"disabled"`
			Idle     TypeDuration    `json:"idle"`
			Interval TypeDuration    `json:"interval"`
			Count    TypeConcurrency `json:"count"`
		} `json:"keepAlive"`
		DOHIP           TypeIP         `json:"dohIp"`
		DNS             TypeDNSURI     `json:"dns"`
		Proxies         []TypeProxyURL `json:"proxies"`
		TCPNotSentLowat TypeBytes      `json:"tcpNotSentLowat"`
	} `json:"network"`
	APIBindTo TypeHostPort `json:"apiBindTo"`
	Throttle  struct {
		MaxConnections TypeConcurrency `json:"maxConnections"`
		CheckInterval  TypeDuration    `json:"checkInterval"`
	} `json:"throttle"`
	Stats struct {
		StatsD struct {
			Optional

			Address      TypeHostPort        `json:"address"`
			MetricPrefix TypeMetricPrefix    `json:"metricPrefix"`
			TagFormat    TypeStatsdTagFormat `json:"tagFormat"`
		} `json:"statsd"`
		Prometheus struct {
			Optional

			BindTo       TypeHostPort     `json:"bindTo"`
			HTTPPath     TypeHTTPPath     `json:"httpPath"`
			MetricPrefix TypeMetricPrefix `json:"metricPrefix"`
		} `json:"prometheus"`
	} `json:"stats"`
}

func Parse 

func Parse(rawData []byte) (*Config, error)

func (*Config) ApplyEnvironment 

func (c *Config) ApplyEnvironment() error

ApplyEnvironment overlays environment variables on top of a parsed config file. The environment always wins, mirroring how the official telegrammessenger/proxy image is configured per "docker run". It is applied on every config read, including hot reloads, so an env-pinned secret or tag survives a POST /reload.

func (*Config) GetAPIToken 

func (c *Config) GetAPIToken() string

GetAPIToken returns the bearer token guarding the management API, or an empty string when the API should stay unauthenticated (localhost-bind convention).

func (*Config) GetAdTag 

func (c *Config) GetAdTag() *[mtglib.AdTagLength]byte

GetAdTag returns the global advertising tag, or nil when none is configured.

func (*Config) GetBindAddrs 

func (c *Config) GetBindAddrs() []string

GetBindAddrs returns all bind addresses as strings.

func (*Config) GetConcurrency 

func (c *Config) GetConcurrency(defaultValue uint) uint

func (*Config) GetDNS 

func (c *Config) GetDNS() *url.URL

func (*Config) GetDomainFrontingHost 

func (c *Config) GetDomainFrontingHost() string

func (*Config) GetDomainFrontingPort 

func (c *Config) GetDomainFrontingPort(defaultValue uint) uint

func (*Config) GetDomainFrontingProxyProtocol 

func (c *Config) GetDomainFrontingProxyProtocol(defaultValue bool) bool

func (*Config) GetFirstBindPort 

func (c *Config) GetFirstBindPort() uint

GetFirstBindPort returns the port of the first bind address.

func (*Config) GetHandshakeBudgetCPUPercent added in v1.10.0 

func (c *Config) GetHandshakeBudgetCPUPercent() uint

GetHandshakeBudgetCPUPercent returns [defense.handshake-budget] cpu-percent, or 0 when the config does not say, which mtglib reads as 25. The file cannot say 0: it is refused when parsed.

func (*Config) GetHandshakeBudgetMode added in v1.10.0 

func (c *Config) GetHandshakeBudgetMode() string

GetHandshakeBudgetMode returns [defense.handshake-budget] mode, or "" when the config does not say, which mtglib reads as enforce.

func (*Config) GetHandshakeBudgetPerIPMillis added in v1.10.0 

func (c *Config) GetHandshakeBudgetPerIPMillis() *uint

GetHandshakeBudgetPerIPMillis returns [defense.handshake-budget] per-ip-ms, or nil when the config does not say, which mtglib reads as 50. An explicit 0 is returned as a pointer to 0: it turns the per-address bucket off.

func (*Config) GetHandshakeHints added in v1.10.0 

func (c *Config) GetHandshakeHints() *bool

GetHandshakeHints returns [defense.handshake-budget] hints, or nil when the config does not say, which mtglib reads as "follow track-client-ips". An explicit false is returned as a pointer to false, and is what keeps the hint cache off under track-client-ips = true.

func (*Config) GetListenerModes added in v1.1.0 

func (c *Config) GetListenerModes() mtglib.ModeSet

GetListenerModes returns the union of every [[listener]]'s accept set, for the /stats capability report and the unserved-secret warning.

func (*Config) GetListeners added in v1.1.0 

func (c *Config) GetListeners() []ConfigListener

GetListeners returns every configured [[listener]], or nil.

func (*Config) GetRetiringSecrets added in v1.10.0 

func (c *Config) GetRetiringSecrets(now time.Time) RetiringReport

GetRetiringSecrets judges the [[retiring-secret]] table at now, by §1.3's rules, in order, the first that applies deciding for each entry:

  1. name, secret or until missing, of the wrong type or malformed, or an all-zero key: a problem;
  2. until is not after now: inert (expired), counted;
  3. name is not a configured secret: a problem ("default" is one only while [secrets] is empty, as in GetSecrets);
  4. until is more than 720h after now: a warning, and the entry goes on through rules 5 to 8, which may still drop it;
  5. the key is another name's primary key, or the key of an entry of another name that passes rule 1, expired and dangling ones included: a problem, for every such entry (a primary is never touched);
  6. the key is the name's own primary key: a note;
  7. two unexpired entries of one name share a key: the later until is kept, the other is a note;
  8. past MaxRetiringPerSecret unexpired entries for a name, or MaxRetiringSecrets in all: the latest until are kept (ties broken by name, then key bytes), the rest are problems.

Before the entries it reports a [secrets] user named retiring-secret, which GetSecrets never serves, as a problem line of its own (§1.1, revision 4).

It is pure -- no log, no state, no clock but now -- and Validate never calls it: a problem drops its entry under run and never refuses the file. Two properties hold for an unchanged file and a later now: what has no line at now has no line later (P1), and a key not in Usable at now is not in it later (P2, R0). Rule 5 is judged on the text alone, against expired and dangling entries too, and rule 8's order is fixed by the entries alone, for P2; rule 4 is a warning, not a drop, for the same reason.

func (*Config) GetSecretAdTags 

func (c *Config) GetSecretAdTags() map[string][mtglib.AdTagLength]byte

GetSecretAdTags returns the per-secret advertising tag overrides keyed by secret name, or nil when none are configured.

func (*Config) GetSecretLimits 

func (c *Config) GetSecretLimits() map[string]mtglib.SecretLimits

GetSecretLimits converts the [secret-limits] tables into the engine-level map keyed by secret name, or nil when none impose any restriction.

func (*Config) GetSecrets 

func (c *Config) GetSecrets() map[string]mtglib.Secret

GetSecrets returns all secrets as a map. If the new [secrets] section is used, returns that map. Otherwise, wraps the single Secret as {"default": Secret}.

A [secrets] user named retiring-secret is never in it (misplacedRetiringUser): every reader that serves or prints secrets -- run and its reloader, access, doctor, the WEB relay -- reads this map, so none of them serves that user. Whether [secrets] is used is decided by the table as written, that user included: a [secrets] holding nothing else serves nothing, and never the top-level secret, which the file left off when it took up [secrets] (final review B, I-1: lost state kills a key, never revives one). Validate refuses such a file.

func (*Config) RetiringValues added in v1.10.0 

func (c *Config) RetiringValues() []mtglib.Secret

RetiringValues is the WEB relay's list of retired values: the value of every [[retiring-secret]] entry that passes rule 1 of §1.3 (name, secret and until present, of their types and well formed, the key not all zero), whatever its name or its time. Ordered by until, the latest first, ties in file order, with the duplicates kept (so a value written twice has its later until first); nil when none passes, and after the SECRET override, which clears the table (D29).

The order is what the cap keeps. The relay's registry holds the first MaxProfiles values it is given, and an expired block is inert, not deleted (only --prune removes it), so a long-lived file can hold more than that of them with a fresh rotation written after all of them. Ordered by until, the cut leaves out the grants that expired first, as rule 8 does, and not the newest retirements: the holders of a just-retired link are the ones most likely to present it, and a cut in file order would forward them to the cover site.

It is not GetRetiringSecrets' Usable list, and deliberately asks less. The relay recognises a retired key's capability so that its holder is answered by the local 404 and the capability is never forwarded to the cover site; an expired entry (rule 2), a name that is no secret (rule 3), a key that is another entry's (rules 5 to 7) or one past a cap (rule 8) is still a link somebody holds, and the relay has no clock to tell the live ones from the rest. Only an entry that is no key a client could hold (rule 1) has nothing to recognise. The relay's registry trims the list itself (duplicates, a value equal to a live one, more than MaxProfiles), so an inert file never refuses the relay's start or a reload.

It is pure and takes no clock. Never format an element of the result with %v or %s: a Secret's String() is its value.

func (*Config) String 

func (c *Config) String() string

String renders the configuration for a log line, with the credentials taken out.

Its one caller is a Debug log, and it used to serialise the struct verbatim: switching debug on wrote every client's secret and the management API token into the operator's log file, where they outlive the process and are read by whatever ships the logs. Names are kept, because knowing which secrets are configured is the entire value of that line, and values are not.

func (*Config) UnknownKeyWarnings added in v1.8.0 

func (c *Config) UnknownKeyWarnings() []string

UnknownKeyWarnings renders one warning per unknown key, in the words the log and the doctor both use.

func (*Config) Validate 

func (c *Config) Validate() error

func (*Config) ValidateWeb added in v1.1.0 

func (c *Config) ValidateWeb() error

ValidateWeb checks the [web] table against the rest of the configuration.

It is separate from Validate because the proxy must keep starting with a [web] table it does not understand or cannot satisfy: an operator editing the relay's settings has no business taking the MTProto port down.

func (*Config) WebBackendListener added in v1.1.0 

func (c *Config) WebBackendListener() (ConfigListener, bool)

WebBackendListener finds the [[listener]] stanza the [web] backend address names. The relay takes its PROXY-protocol decision from that stanza rather than from a setting of its own, so the two processes cannot disagree about what the socket between them speaks.

func (*Config) WebHost added in v1.10.0 

func (c *Config) WebHost() (string, error)

WebHost is [web] host as ValidateWeb accepts it, lowercased, or the error it refuses it with, which never shows a secret value pasted there. access prints no WEB link for a host it refuses (Task 10's second review, N-A).

type ConfigListener added in v1.1.0 

type ConfigListener struct {
	BindTo          TypeHostPort            `json:"bindTo"`
	Accept          []TypeSecretMode        `json:"accept"`
	Public          TypeBool                `json:"public"`
	ProxyProtocol   TypeBool                `json:"proxyProtocol"`
	OnUnknownSecret TypeUnknownSecretAction `json:"onUnknownSecret"`
	HandshakesPerIP TypeConcurrency         `json:"handshakesPerIp"`
}

ConfigListener is one [[listener]] block: an extra socket serving the pre-FakeTLS secret forms. It is purely additive -- the top-level bind-to is never replaced and always stays FakeTLS-only, because a socket that answers obfuscated2 is fingerprintable as an MTProto proxy and that has to be an explicit stanza rather than a one-token edit of an existing key.

func (ConfigListener) Policy added in v1.1.0 

func (l ConfigListener) Policy() (mtglib.ListenerPolicy, error)

Policy converts one configured listener into the runtime policy the proxy stamps onto every connection accepted from its socket. It is also where V2 is enforced, so Validate and run_proxy cannot disagree about what a listener honours.

type ConfigRetiringSecret added in v1.10.0 

type ConfigRetiringSecret struct {
	Name   string `json:"name"`
	Secret string `json:"secret"`
	Until  string `json:"until"`
	// contains filtered or unexported fields
}

ConfigRetiringSecret is one [[retiring-secret]] block, its three fields as the file spelled them: Name, Secret (the old value, hex or base64url, any mode) and Until (an RFC 3339 instant; a TOML offset date-time arrives here in RFC 3339 with nanoseconds). None is parsed while decoding, so a bad value never fails the file and no decoder error, which carries no entry index and might echo the value, is ever raised; GetRetiringSecrets parses and judges them. Secret is a credential: Config.String() redacts it.

type ConfigSecretLimit 

type ConfigSecretLimit struct {
	Quota      TypeBytes      `json:"quota"`
	QuotaReset TypeQuotaReset `json:"quotaReset"`
	Expires    TypeExpiry     `json:"expires"`
	Disabled   TypeBool       `json:"disabled"`
	Speed      TypeSpeed      `json:"speed"`
	SpeedUp    TypeSpeed      `json:"speedUp"`
	SpeedDown  TypeSpeed      `json:"speedDown"`
	IPLimit    TypeIPLimit    `json:"ipLimit"`

	// The per-address controls carry omitzero, so a table that does not use
	// them -- every one a panel writes -- renders in Config.String() exactly
	// as it did before they existed.
	ClientConns TypeClientConns `json:"clientConns,omitzero"`
	ClientSpeed TypeClientSpeed `json:"clientSpeed,omitzero"`
	ClientFair  TypeBool        `json:"clientFair,omitzero"`
}

ConfigSecretLimit is the typed form of a single [secret-limits.<name>] table: an optional data quota (with reset policy), a speed limit, an expiry deadline, a disabled flag, an address limit, a per-address connection cap, a per-address speed ceiling and the switch that divides the speed limits among the secret's addresses. All fields are optional; the zero value leaves the secret unrestricted.

type ConfigWeb added in v1.1.0 

type ConfigWeb struct {
	Optional

	Host          TypeHost           `json:"host"`
	BindTo        TypeHostPort       `json:"bindTo"`
	Backend       TypeHostPort       `json:"backend"`
	TokenKey      string             `json:"tokenKey"`
	CoverDir      string             `json:"coverDir"`
	CoverUpstream string             `json:"coverUpstream"`
	ClientIP      TypeClientIPSource `json:"clientIp"`
	MaxSessions   TypeConcurrency    `json:"maxSessions"`
	MaxStreams    TypeConcurrency    `json:"maxStreams"`
	MaxPayload    TypeBytes          `json:"maxFramePayload"`
	BatchBytes    TypeBytes          `json:"carrierBatchBytes"`

	// StatsBindTo is the loopback address the relay serves its own counters on.
	// Empty (the default) means no stats server at all.
	//
	// Deliberately a second socket rather than a path on BindTo: that one is
	// published to the internet by the front proxy, and the relay's recognition
	// rule says everything without a credential it minted gets the cover site.
	// An endpoint there would be a fingerprint whether or not it was gated.
	StatsBindTo TypeHostPort `json:"statsBindTo"`
}

ConfigWeb is the [web] table: everything the WEB relay needs and the proxy ignores.

It lives in the same file as the proxy's own settings on purpose. The relay is a second process of the same binary serving the same secrets, and the one thing it must agree with the proxy about -- whether the backend listener expects a PROXY header -- is already written in that listener's own stanza. Two places to say it is two places to disagree, and the disagreement is invisible: an unexpected header is consumed as the first bytes of the client's obfuscated handshake.

An old binary ignores this table entirely, because parsing does not reject unknown keys. That is what lets a panel write it before every deployment has upgraded.

type ListConfig 

type ListConfig struct {
	Optional

	DownloadConcurrency TypeConcurrency    `json:"downloadConcurrency"`
	URLs                []TypeBlocklistURI `json:"urls"`
	UpdateEach          TypeDuration       `json:"updateEach"`
}

type Optional 

type Optional struct {
	Enabled TypeBool `json:"enabled"`
}

type ParseError added in v1.10.0 

type ParseError struct {
	// contains filtered or unexported fields
}

ParseError is a document the TOML parser refused: the parser's Error() form, with any text that could spell a secret value replaced, and with the place in the document named after it when something was. It keeps the parser's position and key -- what run's advice about the [[retiring-secret]] table is built from -- and not the parser's own error, whose Error() and String() forms both carry the text it replaced: it is deliberately not unwrapped.

func (*ParseError) Error added in v1.10.0 

func (e *ParseError) Error() string

func (*ParseError) Key added in v1.10.0 

func (e *ParseError) Key() []string

Key is the key the parser was at when it stopped, one part per element, with any part that could spell a value not shown. It is relative to its table for a key defined twice, and nil when the parser names none (a byte-order mark, an unterminated string).

func (*ParseError) Position added in v1.10.0 

func (e *ParseError) Position() (line, column int)

Position is the line and column at which the parser stopped, both from 1.

type RetiringReport added in v1.10.0 

type RetiringReport struct {
	// Usable is what the engine is handed, in file order. A rule-4 entry
	// (until more than 720h away) is in it: it is warned about, not dropped.
	Usable []mtglib.RetiringSecret

	// Lines has one line per problem or warning, in file order, after a first
	// line for a [secrets] user named retiring-secret when the file has one
	// (the mis-edit GetSecrets never serves). run and the reloader log each at
	// Warning; run --check refuses the file for any.
	Lines []string

	// Expired counts the entries rule 2 made inert: until is not after now.
	// They are named nowhere else; the count is the Info summary, doctor's
	// count and the --prune hint.
	Expired int

	// Notes are Info lines, in file order, for entries that change nothing:
	// rule 6 (the secret's own primary key) and rule 7 (a duplicate).
	Notes []string
}

RetiringReport is what GetRetiringSecrets makes of the [[retiring-secret]] table at one instant.

Never format a RetiringReport, or an element of Usable, with %v, %s or %+v: a Secret's String() is its value.

type TypeAdTag 

type TypeAdTag struct {
	Value []byte
}

TypeAdTag is a Telegram advertising tag (ad_tag / proxy tag). It is a 16-byte value, configured as a 32-character hex string, and used to route a client through Telegram middle proxies so a sponsored channel is shown.

func (*TypeAdTag) Get 

func (t *TypeAdTag) Get() *[mtglib.AdTagLength]byte

Get returns the tag as a pointer to a fixed-size array, or nil when unset.

func (TypeAdTag) MarshalText 

func (t TypeAdTag) MarshalText() ([]byte, error)

func (*TypeAdTag) Set 

func (t *TypeAdTag) Set(value string) error

func (TypeAdTag) String 

func (t TypeAdTag) String() string

func (*TypeAdTag) UnmarshalText 

func (t *TypeAdTag) UnmarshalText(data []byte) error

type TypeBlocklistURI 

type TypeBlocklistURI struct {
	Value string
}

func (TypeBlocklistURI) Get 

func (t TypeBlocklistURI) Get(defaultValue string) string

func (TypeBlocklistURI) IsRemote 

func (t TypeBlocklistURI) IsRemote() bool

func (TypeBlocklistURI) MarshalText 

func (t TypeBlocklistURI) MarshalText() ([]byte, error)

func (*TypeBlocklistURI) Set 

func (t *TypeBlocklistURI) Set(value string) error

func (TypeBlocklistURI) String 

func (t TypeBlocklistURI) String() string

func (*TypeBlocklistURI) UnmarshalText 

func (t *TypeBlocklistURI) UnmarshalText(data []byte) error

type TypeBool 

type TypeBool struct {
	Value bool
}

func (TypeBool) Get 

func (t TypeBool) Get(defaultValue bool) bool

func (TypeBool) MarshalJSON 

func (t TypeBool) MarshalJSON() ([]byte, error)

func (*TypeBool) Set 

func (t *TypeBool) Set(data string) error

func (TypeBool) String 

func (t TypeBool) String() string

func (*TypeBool) UnmarshalJSON 

func (t *TypeBool) UnmarshalJSON(data []byte) error

type TypeBytes 

type TypeBytes struct {
	Value units.Base2Bytes
}

func (TypeBytes) Get 

func (t TypeBytes) Get(defaultValue int64) int64

Get keeps the parsed int64 width. uint is 32 bits on the 386/arm builds we ship, and narrowing here wrapped a per-secret quota above 4 GiB silently.

func (TypeBytes) GetUint added in v1.1.0 

func (t TypeBytes) GetUint(defaultValue uint) (uint, error)

GetUint serves the two machine-word consumers (bloom filter size, TCP_NOTSENT_LOWAT). It refuses what does not fit rather than wrapping or clamping it, bounded by MaxInt so their int cast is safe on 32-bit too.

func (TypeBytes) MarshalText 

func (t TypeBytes) MarshalText() ([]byte, error)

func (*TypeBytes) Set 

func (t *TypeBytes) Set(value string) error

func (TypeBytes) String 

func (t TypeBytes) String() string

func (*TypeBytes) UnmarshalText 

func (t *TypeBytes) UnmarshalText(data []byte) error

type TypeClientConns added in v1.10.0 

type TypeClientConns struct {
	Value int
}

TypeClientConns is a per-address connection cap as the config file spells it: a bare non-negative integer, the number of live connections one address may hold to the secret at once. Zero, or the key left out, is unlimited. A type of its own rather than TypeIPLimit, whose messages name ip-limit: an operator told "ip-limit must not be negative" about a client-conns line would look in the wrong place.

func (TypeClientConns) Get added in v1.10.0 

func (t TypeClientConns) Get(defaultValue int) int

Get returns the cap, or the default when none is set.

func (TypeClientConns) MarshalJSON added in v1.10.0 

func (t TypeClientConns) MarshalJSON() ([]byte, error)

func (*TypeClientConns) Set added in v1.10.0 

func (t *TypeClientConns) Set(value string) error

func (TypeClientConns) String added in v1.10.0 

func (t TypeClientConns) String() string

func (*TypeClientConns) UnmarshalJSON added in v1.10.0 

func (t *TypeClientConns) UnmarshalJSON(data []byte) error

type TypeClientIPSource added in v1.1.0 

type TypeClientIPSource struct {
	Value ClientIPSource
	// contains filtered or unexported fields
}

TypeClientIPSource parses the client-ip setting.

func (TypeClientIPSource) Get added in v1.1.0 

func (t TypeClientIPSource) Get(defaultValue ClientIPSource) ClientIPSource

func (TypeClientIPSource) MarshalText added in v1.1.0 

func (t TypeClientIPSource) MarshalText() ([]byte, error)

func (*TypeClientIPSource) Set added in v1.1.0 

func (t *TypeClientIPSource) Set(value string) error

func (TypeClientIPSource) String added in v1.1.0 

func (t TypeClientIPSource) String() string

func (*TypeClientIPSource) UnmarshalText added in v1.1.0 

func (t *TypeClientIPSource) UnmarshalText(data []byte) error

type TypeClientSpeed added in v1.10.0 

type TypeClientSpeed struct {
	TypeSpeed
}

TypeClientSpeed is a per-address speed ceiling as the config file spells it: a speed, exactly as TypeSpeed reads one -- the same parser, so the same units and the same 64kbit/s floor, and the API's client_speed agrees with it. A type of its own only for the message: the config decoder does not say which key a value it refused came from, and an operator told "speed is below the minimum" about a client-speed line would look at the wrong one.

func (*TypeClientSpeed) Set added in v1.10.0 

func (t *TypeClientSpeed) Set(value string) error

func (*TypeClientSpeed) UnmarshalText added in v1.10.0 

func (t *TypeClientSpeed) UnmarshalText(data []byte) error

type TypeConcurrency 

type TypeConcurrency struct {
	Value uint
}

func (TypeConcurrency) Get 

func (t TypeConcurrency) Get(defaultValue uint) uint

func (TypeConcurrency) MarshalJSON 

func (t TypeConcurrency) MarshalJSON() ([]byte, error)

func (*TypeConcurrency) Set 

func (t *TypeConcurrency) Set(value string) error

func (TypeConcurrency) String 

func (t TypeConcurrency) String() string

func (*TypeConcurrency) UnmarshalJSON 

func (t *TypeConcurrency) UnmarshalJSON(data []byte) error

type TypeDC 

type TypeDC struct {
	Value int
}

func (TypeDC) Get 

func (t TypeDC) Get() int

func (TypeDC) MarshalJSON 

func (t TypeDC) MarshalJSON() ([]byte, error)

func (*TypeDC) Set 

func (t *TypeDC) Set(value string) error

func (TypeDC) String 

func (t TypeDC) String() string

func (*TypeDC) UnmarshalJSON 

func (t *TypeDC) UnmarshalJSON(data []byte) error

type TypeDNSURI 

type TypeDNSURI struct {
	Value *url.URL
}

func (*TypeDNSURI) Get 

func (t *TypeDNSURI) Get(defaultValue *url.URL) *url.URL

func (TypeDNSURI) MarshalText 

func (t TypeDNSURI) MarshalText() ([]byte, error)

func (*TypeDNSURI) Set 

func (t *TypeDNSURI) Set(value string) error

func (TypeDNSURI) String 

func (t TypeDNSURI) String() string

func (*TypeDNSURI) UnmarshalText 

func (t *TypeDNSURI) UnmarshalText(data []byte) error

type TypeDoppelShaping added in v1.9.0 

type TypeDoppelShaping struct {
	Value string
}

func (TypeDoppelShaping) Get added in v1.9.0 

func (t TypeDoppelShaping) Get(defaultValue string) string

func (TypeDoppelShaping) MarshalText added in v1.9.0 

func (t TypeDoppelShaping) MarshalText() ([]byte, error)

func (*TypeDoppelShaping) Set added in v1.9.0 

func (t *TypeDoppelShaping) Set(value string) error

func (TypeDoppelShaping) String added in v1.9.0 

func (t TypeDoppelShaping) String() string

func (*TypeDoppelShaping) UnmarshalText added in v1.9.0 

func (t *TypeDoppelShaping) UnmarshalText(data []byte) error

type TypeDuration 

type TypeDuration struct {
	Value time.Duration
}

func (TypeDuration) Get 

func (t TypeDuration) Get(defaultValue time.Duration) time.Duration

func (TypeDuration) MarshalText 

func (t TypeDuration) MarshalText() ([]byte, error)

func (*TypeDuration) Set 

func (t *TypeDuration) Set(value string) error

func (TypeDuration) String 

func (t TypeDuration) String() string

func (*TypeDuration) UnmarshalText 

func (t *TypeDuration) UnmarshalText(data []byte) error

type TypeErrorRate 

type TypeErrorRate struct {
	Value float64
}

func (TypeErrorRate) Get 

func (t TypeErrorRate) Get(defaultValue float64) float64

func (TypeErrorRate) MarshalJSON 

func (t TypeErrorRate) MarshalJSON() ([]byte, error)

func (*TypeErrorRate) Set 

func (t *TypeErrorRate) Set(value string) error

func (TypeErrorRate) String 

func (t TypeErrorRate) String() string

func (*TypeErrorRate) UnmarshalJSON 

func (t *TypeErrorRate) UnmarshalJSON(data []byte) error

type TypeExpiry 

type TypeExpiry struct {
	Value time.Time
}

TypeExpiry is a secret validity deadline parsed from an RFC3339 timestamp or a plain YYYY-MM-DD date. The zero value means the secret never expires.

func (TypeExpiry) Get 

func (t TypeExpiry) Get(defaultValue time.Time) time.Time

func (TypeExpiry) MarshalText 

func (t TypeExpiry) MarshalText() ([]byte, error)

func (*TypeExpiry) Set 

func (t *TypeExpiry) Set(value string) error

func (TypeExpiry) String 

func (t TypeExpiry) String() string

func (*TypeExpiry) UnmarshalText 

func (t *TypeExpiry) UnmarshalText(data []byte) error

type TypeHTTPPath 

type TypeHTTPPath struct {
	Value string
}

func (TypeHTTPPath) Get 

func (t TypeHTTPPath) Get(defaultValue string) string

func (TypeHTTPPath) MarshalText 

func (t TypeHTTPPath) MarshalText() ([]byte, error)

func (*TypeHTTPPath) Set 

func (t *TypeHTTPPath) Set(value string) error

func (TypeHTTPPath) String 

func (t TypeHTTPPath) String() string

func (*TypeHTTPPath) UnmarshalText 

func (t *TypeHTTPPath) UnmarshalText(data []byte) error

type TypeHandshakeBudgetCPU added in v1.10.0 

type TypeHandshakeBudgetCPU struct {
	Value uint
}

TypeHandshakeBudgetCPU is [defense.handshake-budget] cpu-percent: the share of the cores the whole process may spend scanning, 1 to 100.

Unlike per-ip-ms there is no zero that means anything, so 0 is both "not set" (25) and, written in the file, an error. The TOML mirror holds it behind a pointer so the file's 0 reaches Set instead of being dropped as an empty value.

func (TypeHandshakeBudgetCPU) Get added in v1.10.0 

func (t TypeHandshakeBudgetCPU) Get(defaultValue uint) uint

func (TypeHandshakeBudgetCPU) MarshalJSON added in v1.10.0 

func (t TypeHandshakeBudgetCPU) MarshalJSON() ([]byte, error)

func (*TypeHandshakeBudgetCPU) Set added in v1.10.0 

func (t *TypeHandshakeBudgetCPU) Set(value string) error

func (TypeHandshakeBudgetCPU) String added in v1.10.0 

func (t TypeHandshakeBudgetCPU) String() string

func (*TypeHandshakeBudgetCPU) UnmarshalJSON added in v1.10.0 

func (t *TypeHandshakeBudgetCPU) UnmarshalJSON(data []byte) error

type TypeHandshakeBudgetMode added in v1.10.0 

type TypeHandshakeBudgetMode struct {
	Value string
}

TypeHandshakeBudgetMode is [defense.handshake-budget] mode: exactly one of the three lower-case words. Unlike its neighbour TypeDoppelShaping it does not fold case: mtglib.ProxyOpts accepts any case, for an embedder, but a config file that says "OBSERVE" is a typo this binary reports rather than guesses at.

func (TypeHandshakeBudgetMode) Get added in v1.10.0 

func (t TypeHandshakeBudgetMode) Get(defaultValue string) string

func (TypeHandshakeBudgetMode) MarshalText added in v1.10.0 

func (t TypeHandshakeBudgetMode) MarshalText() ([]byte, error)

func (*TypeHandshakeBudgetMode) Set added in v1.10.0 

func (t *TypeHandshakeBudgetMode) Set(value string) error

func (TypeHandshakeBudgetMode) String added in v1.10.0 

func (t TypeHandshakeBudgetMode) String() string

func (*TypeHandshakeBudgetMode) UnmarshalText added in v1.10.0 

func (t *TypeHandshakeBudgetMode) UnmarshalText(data []byte) error

type TypeHandshakeBudgetPerIP added in v1.10.0 

type TypeHandshakeBudgetPerIP struct {
	Value uint
}

TypeHandshakeBudgetPerIP is [defense.handshake-budget] per-ip-ms: the scan CPU one client address may spend per second, in milliseconds, 0 to 1000.

0 is a value, not an absence: it turns the per-address bucket off. Config holds this type behind a pointer so that an explicit 0 survives and "not set" (50) stays distinct from it.

func (TypeHandshakeBudgetPerIP) MarshalJSON added in v1.10.0 

func (t TypeHandshakeBudgetPerIP) MarshalJSON() ([]byte, error)

func (*TypeHandshakeBudgetPerIP) Set added in v1.10.0 

func (t *TypeHandshakeBudgetPerIP) Set(value string) error

func (TypeHandshakeBudgetPerIP) String added in v1.10.0 

func (t TypeHandshakeBudgetPerIP) String() string

func (*TypeHandshakeBudgetPerIP) UnmarshalJSON added in v1.10.0 

func (t *TypeHandshakeBudgetPerIP) UnmarshalJSON(data []byte) error

type TypeHost 

type TypeHost struct {
	Value string
}

TypeHost is a non-empty string that is either a literal IP address (IPv4 or IPv6) or a hostname suitable for DNS resolution. It does not include a port — the port belongs in a separate field.

func (TypeHost) Get 

func (t TypeHost) Get(defaultValue string) string

func (TypeHost) MarshalText 

func (t TypeHost) MarshalText() ([]byte, error)

func (*TypeHost) Set 

func (t *TypeHost) Set(value string) error

func (TypeHost) String 

func (t TypeHost) String() string

func (*TypeHost) UnmarshalText 

func (t *TypeHost) UnmarshalText(data []byte) error

type TypeHostPort 

type TypeHostPort struct {
	Value string
	Host  string
	Port  uint
}

func (TypeHostPort) Get 

func (t TypeHostPort) Get(defaultValue string) string

func (TypeHostPort) MarshalText 

func (t TypeHostPort) MarshalText() ([]byte, error)

func (*TypeHostPort) Set 

func (t *TypeHostPort) Set(value string) error

func (TypeHostPort) String 

func (t TypeHostPort) String() string

func (*TypeHostPort) UnmarshalText 

func (t *TypeHostPort) UnmarshalText(data []byte) error

type TypeHttpsURL 

type TypeHttpsURL struct {
	Value *url.URL
}

func (*TypeHttpsURL) Get 

func (t *TypeHttpsURL) Get(defaultValue *url.URL) *url.URL

func (TypeHttpsURL) MarshalText 

func (t TypeHttpsURL) MarshalText() ([]byte, error)

func (*TypeHttpsURL) Set 

func (t *TypeHttpsURL) Set(value string) error

func (TypeHttpsURL) String 

func (t TypeHttpsURL) String() string

func (*TypeHttpsURL) UnmarshalText 

func (t *TypeHttpsURL) UnmarshalText(data []byte) error

type TypeIP 

type TypeIP struct {
	Value net.IP
}

func (*TypeIP) Get 

func (t *TypeIP) Get(defaultValue net.IP) net.IP

func (TypeIP) MarshalText 

func (t TypeIP) MarshalText() ([]byte, error)

func (*TypeIP) Set 

func (t *TypeIP) Set(value string) error

func (TypeIP) String 

func (t TypeIP) String() string

func (*TypeIP) UnmarshalText 

func (t *TypeIP) UnmarshalText(data []byte) error

type TypeIPLimit added in v1.7.0 

type TypeIPLimit struct {
	Value int
}

TypeIPLimit is a per-user address limit as the config file spells it: a bare non-negative integer, the number of distinct addresses the user may hold connections from at once. Zero, or the key left out, is unlimited.

func (TypeIPLimit) Get added in v1.7.0 

func (t TypeIPLimit) Get(defaultValue int) int

Get returns the limit, or the default when none is set.

func (TypeIPLimit) MarshalJSON added in v1.7.0 

func (t TypeIPLimit) MarshalJSON() ([]byte, error)

func (*TypeIPLimit) Set added in v1.7.0 

func (t *TypeIPLimit) Set(value string) error

func (TypeIPLimit) String added in v1.7.0 

func (t TypeIPLimit) String() string

func (*TypeIPLimit) UnmarshalJSON added in v1.7.0 

func (t *TypeIPLimit) UnmarshalJSON(data []byte) error

type TypeMetricPrefix 

type TypeMetricPrefix struct {
	Value string
}

func (TypeMetricPrefix) Get 

func (t TypeMetricPrefix) Get(defaultValue string) string

func (TypeMetricPrefix) MarshalText 

func (t TypeMetricPrefix) MarshalText() ([]byte, error)

func (*TypeMetricPrefix) Set 

func (t *TypeMetricPrefix) Set(value string) error

func (TypeMetricPrefix) String 

func (t TypeMetricPrefix) String() string

func (*TypeMetricPrefix) UnmarshalText 

func (t *TypeMetricPrefix) UnmarshalText(data []byte) error

type TypePort 

type TypePort struct {
	Value uint
}

func (TypePort) Get 

func (t TypePort) Get(defaultValue uint) uint

func (TypePort) MarshalJSON 

func (t TypePort) MarshalJSON() ([]byte, error)

func (*TypePort) Set 

func (t *TypePort) Set(value string) error

func (TypePort) String 

func (t TypePort) String() string

func (*TypePort) UnmarshalJSON 

func (t *TypePort) UnmarshalJSON(data []byte) error

type TypePreferIP 

type TypePreferIP struct {
	Value string
}

func (*TypePreferIP) Get 

func (t *TypePreferIP) Get(defaultValue string) string

func (TypePreferIP) MarshalText 

func (t TypePreferIP) MarshalText() ([]byte, error)

func (*TypePreferIP) Set 

func (t *TypePreferIP) Set(value string) error

func (TypePreferIP) String 

func (t TypePreferIP) String() string

func (*TypePreferIP) UnmarshalText 

func (t *TypePreferIP) UnmarshalText(data []byte) error

type TypeProxyURL 

type TypeProxyURL struct {
	Value *url.URL
}

func (*TypeProxyURL) Get 

func (t *TypeProxyURL) Get(defaultValue *url.URL) *url.URL

func (TypeProxyURL) MarshalText 

func (t TypeProxyURL) MarshalText() ([]byte, error)

func (TypeProxyURL) Redacted added in v1.10.0 

func (t TypeProxyURL) Redacted() string

Redacted is the URL as a log line or a message may show it: the user and the address stay, so that it still says which upstream is meant, and the password does not (url.URL.Redacted: it becomes "xxxxx"). String keeps the password, because the config is written back from it and the dialer needs it.

func (*TypeProxyURL) Set 

func (t *TypeProxyURL) Set(value string) error

Set takes a proxy URL, which may carry the proxy's credentials (socks5://user:password@host). A refusal therefore never quotes the text it was given: url.Parse's own error holds the whole URL, so only its reason is kept, and a URL that did parse is shown with its password redacted.

func (TypeProxyURL) String 

func (t TypeProxyURL) String() string

func (*TypeProxyURL) UnmarshalText 

func (t *TypeProxyURL) UnmarshalText(data []byte) error

type TypeQuotaReset 

type TypeQuotaReset struct {
	Value string
}

TypeQuotaReset is a per-secret data-quota reset policy: "none" (default) or "monthly".

func (TypeQuotaReset) Get 

func (t TypeQuotaReset) Get(defaultValue string) string

func (TypeQuotaReset) MarshalText 

func (t TypeQuotaReset) MarshalText() ([]byte, error)

func (*TypeQuotaReset) Set 

func (t *TypeQuotaReset) Set(value string) error

func (TypeQuotaReset) String 

func (t TypeQuotaReset) String() string

func (*TypeQuotaReset) UnmarshalText 

func (t *TypeQuotaReset) UnmarshalText(data []byte) error

type TypeSecretMode added in v1.1.0 

type TypeSecretMode struct {
	Value mtglib.SecretMode
}

TypeSecretMode is one entry of a [[listener]] accept list: "dd", "ee" or "plain". Parsing it here turns a typo like accept = ["eee"] into a config error naming the value, instead of a socket that silently honours nothing.

func (TypeSecretMode) Get added in v1.1.0 

func (t TypeSecretMode) Get() mtglib.SecretMode

Get returns the parsed mode. There is no default: SecretMode's zero value is a real mode ("ee"), so an unset one cannot be told from an explicit one, and accept is a required key anyway.

func (TypeSecretMode) MarshalText added in v1.1.0 

func (t TypeSecretMode) MarshalText() ([]byte, error)

func (*TypeSecretMode) Set added in v1.1.0 

func (t *TypeSecretMode) Set(value string) error

func (TypeSecretMode) String added in v1.1.0 

func (t TypeSecretMode) String() string

func (*TypeSecretMode) UnmarshalText added in v1.1.0 

func (t *TypeSecretMode) UnmarshalText(data []byte) error

type TypeSpeed added in v1.6.0 

type TypeSpeed struct {
	Value int64
}

TypeSpeed is a per-user speed limit as the config file spells it: "5mbit", "500kbit", "1MB/s". It parses through the same function the management API uses, so a spelling the file accepts is one the API accepts and the two can never drift. The value is bytes per second; zero is unlimited.

func (TypeSpeed) Get added in v1.6.0 

func (t TypeSpeed) Get(defaultValue int64) int64

Get returns the limit in bytes per second, or the default when none is set.

func (TypeSpeed) MarshalText added in v1.6.0 

func (t TypeSpeed) MarshalText() ([]byte, error)

func (*TypeSpeed) Set added in v1.6.0 

func (t *TypeSpeed) Set(value string) error

func (TypeSpeed) String added in v1.6.0 

func (t TypeSpeed) String() string

String renders the limit in a form Set accepts back, so the value survives the config's own round trip. Empty is unlimited.

func (*TypeSpeed) UnmarshalText added in v1.6.0 

func (t *TypeSpeed) UnmarshalText(data []byte) error

type TypeStatsdTagFormat 

type TypeStatsdTagFormat struct {
	Value string
}

func (TypeStatsdTagFormat) Get 

func (t TypeStatsdTagFormat) Get(defaultValue string) string

func (*TypeStatsdTagFormat) MarshalText 

func (t *TypeStatsdTagFormat) MarshalText() ([]byte, error)

func (*TypeStatsdTagFormat) Set 

func (t *TypeStatsdTagFormat) Set(value string) error

func (*TypeStatsdTagFormat) String 

func (t *TypeStatsdTagFormat) String() string

func (*TypeStatsdTagFormat) UnmarshalText 

func (t *TypeStatsdTagFormat) UnmarshalText(data []byte) error

type TypeUnknownSecretAction added in v1.1.0 

type TypeUnknownSecretAction struct {
	Value string
}

TypeUnknownSecretAction is the disposal of a connection no secret matches. The value is validated at parse time so that a misspelled policy cannot leave a public listener answering probes in a way the operator did not choose.

func (TypeUnknownSecretAction) Get added in v1.1.0 

func (t TypeUnknownSecretAction) Get(defaultValue string) string

func (TypeUnknownSecretAction) MarshalText added in v1.1.0 

func (t TypeUnknownSecretAction) MarshalText() ([]byte, error)

func (*TypeUnknownSecretAction) Set added in v1.1.0 

func (t *TypeUnknownSecretAction) Set(value string) error

func (TypeUnknownSecretAction) String added in v1.1.0 

func (t TypeUnknownSecretAction) String() string

func (*TypeUnknownSecretAction) UnmarshalText added in v1.1.0 

func (t *TypeUnknownSecretAction) UnmarshalText(data []byte) error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.