config

type AccessLog struct {
	On       bool
	MaxSize  int64
	MaxFiles int
}

type Config struct {
	Iface   string
	Addr    netip.Prefix // static address of Iface, with prefix length
	Gateway netip.Addr
	DNS     []netip.Addr
	Tunnel  string // the fqdn: SNI dark nodes and operators connect to
	// Disk is the device boot mounted at /var; not part of the config.
	Disk string
	// NTP are the time servers, host or host:port, which the clock keeps
	// to while the edge runs (internal/clock).
	NTP  []string
	ACME string // ACME directory URL; empty is Let's Encrypt
	// ACMECA is the PEM trust anchor for the directory's TLS certificate.
	// Empty uses the system roots. Set, it is the only pool the ACME client trusts.
	ACMECA []byte
	// RenewInterval is how often every ACME certificate is checked, and
	// renewed once it is due (the last third of its life, or when the CA
	// says so through ARI).
	RenewInterval time.Duration
	QUIC          bool // dark-node QUIC on UDP 443
	// ClientCA is the PEM trust anchor from fortress.yml (client_ca) for
	// dark-node, operator, and log-reader certificates.
	ClientCA []byte
	// ClientCAPath is the file listeners load this boot. Set after boot
	// resolves client_ca; not part of fortress.yml.
	ClientCAPath string
	Policy
}

type InvalidError struct{ Err error }

type Limits struct {
	ConnsPerSource    int           // open connections
	RequestsPerSecond int           // sustained
	RequestBurst      int           // at once
	NewConnsPerSecond int           // TCP SYNs, dropped in XDP
	NewConnBurst      int           // SYNs at once
	Ban               time.Duration // XDP ban for a source that keeps being refused; 0 never bans
	BanAfter          int           // refusals within BanWindow that earn a ban
	BanWindow         time.Duration
	MaxConns          int   // all sources, per port; 0 sizes it from memory
	MaxHeaderBytes    int   // request line and headers
	MaxURIBytes       int   // request target
	MaxBodyBytes      int64 // request body; 0: no limit
	MaxHTTP2Streams   int   // concurrent streams per HTTP/2 connection
	// ResponseHeaderTimeout is how long a request waits for the origin's
	// response headers; a stream that sends them with its first event
	// (server-sent events, long polling) is cut after it. Whole seconds.
	ResponseHeaderTimeout time.Duration
}

type Policy struct {
	Block []netip.Prefix // XDP drop list; host or CIDR
	// Exempt are sources the per-address limits and bans skip: a load
	// generator, a monitoring probe, an office behind one address.
	Exempt []netip.Prefix
	Limits Limits
	// AccessLog is the access log for every site, unless Sites turns it
	// off or on for one.
	AccessLog AccessLog
	Trace     Trace
	// TunnelGrace is how long a site whose tunnel left, or that a dark
	// node published before a boot, is answered 503 before it goes silent
	// like any name the edge does not serve. 0 never answers it.
	TunnelGrace time.Duration
	// Sites are settings for one site, by the name its dark node publishes
	// (app.example.com, *.example.com) or a name a wildcard covers.
	Sites map[string]SitePolicy
}

type Site struct {
	AccessLog             bool
	MaxBodyBytes          int64 // 0: no limit
	ResponseHeaderTimeout time.Duration
}

type SitePolicy struct {
	AccessLog             *bool
	MaxBodyBytes          *int64 // 0: no limit
	ResponseHeaderTimeout time.Duration
}

type Trace struct {
	// TrustIncoming continues a visitor's valid traceparent. Off, every
	// request starts a new trace, and the visitor's is only logged, as a
	// link: an outsider cannot choose the trace a request lands in.
	TrustIncoming bool
}