ateomtunnel

type ActorEgress struct {
	// contains filtered or unexported fields
}

type Config struct {
	// ListenAddress serves actor ingress HTTPS.
	ListenAddress string
	// ConnectListenAddress serves actor ingress mTLS CONNECT.
	ConnectListenAddress string
	// CredentialBundle holds the worker Pod certificate and key, used for
	// inbound serving, outbound mTLS, and authentication to the atelet broker.
	CredentialBundle string
	// TrustBundle verifies router clients and the node-local atelet.
	TrustBundle string
	// ClientIdentity is the SPIFFE ID allowed to call actor ingress HTTPS.
	ClientIdentity string
	// BrokerIdentity is the SPIFFE ID the node-local atelet must present on the
	// credential broker connection. It names atelet's namespace, not this
	// worker's, so it is configured rather than derived from the downward API.
	BrokerIdentity string
	// EgressListenAddress receives transparently intercepted actor egress TCP.
	EgressListenAddress string
	// EgressTrustBundle verifies the remote egress gateway's serving cert.
	EgressTrustBundle string
	// DNSEgressPolicy selects the DNS egress policy enforcement mode.
	DNSEgressPolicy string
}

type FlagSet interface {
	StringVar(p *string, name, value, usage string)
}

type Tunnel struct {
	// Ingress proxies router traffic to the active actors.
	Ingress *atunnel.Server
	// Egress tunnels the active actors' outbound TCP to the egress gateway.
	Egress *atunnel.Egress
	// EgressPort is the local atunnel listener used as the target of the
	// actor network's transparent TCP redirect.
	EgressPort uint16
	// DNSRelay answers the sandbox's DNS from inside its own namespace.
	DNSRelay *dns.Relay
	// contains filtered or unexported fields
}