workerdv1

type ApplyDNSRequest struct {

	// SandboxID identifies the target sandbox. It must belong to the tenant
	// whose socket this request arrived on; a foreign id is rejected.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Generation orders applies: the pusher's monotonically increasing config
	// generation. A stale generation is not applied.
	Generation uint64 `protobuf:"varint,2,opt,name=generation,proto3" json:"generation,omitempty"`
	// AuthoritativeZones get an authoritative NXDOMAIN for unbound names
	// within them ("tun.apoxy.net" today); names outside every zone fall
	// through to the resolver's upstream chain.
	AuthoritativeZones []string `protobuf:"bytes,3,rep,name=authoritative_zones,json=authoritativeZones,proto3" json:"authoritative_zones,omitempty"`
	// Bindings is the full desired binding set for the resident; it replaces
	// the prior set atomically.
	Bindings []*Binding `protobuf:"bytes,4,rep,name=bindings,proto3" json:"bindings,omitempty"`
	// contains filtered or unexported fields
}

type ApplyDNSResponse struct {

	// AppliedGeneration is the generation now in effect for the sandbox — the
	// request's generation if it was applied, or the newer retained one if the
	// request was stale.
	AppliedGeneration uint64 `protobuf:"varint,1,opt,name=applied_generation,json=appliedGeneration,proto3" json:"applied_generation,omitempty"`
	// contains filtered or unexported fields
}

type ApplyEgressRequest struct {

	// SandboxID identifies the target sandbox. It must belong to the tenant
	// whose socket this request arrived on; a foreign id is rejected.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// InvocationID is stamped on egress connections (PROXY v2 TLV) dialed
	// through this sandbox, for attribution.
	InvocationId string `protobuf:"bytes,4,opt,name=invocation_id,json=invocationId,proto3" json:"invocation_id,omitempty"`
	// Generation orders applies: the reconciler's monotonically increasing
	// config generation. A stale generation is not applied.
	Generation uint64 `protobuf:"varint,5,opt,name=generation,proto3" json:"generation,omitempty"`
	// Services is the full desired set of per-Service egress planes for the
	// resident; it replaces the prior set atomically.
	Services []*ServiceEgressConfig `protobuf:"bytes,6,rep,name=services,proto3" json:"services,omitempty"`
	// contains filtered or unexported fields
}

type ApplyEgressResponse struct {

	// AppliedGeneration is the generation now in effect for the sandbox — the
	// request's generation if it was applied, or the newer retained one if the
	// request was stale.
	AppliedGeneration uint64 `protobuf:"varint,1,opt,name=applied_generation,json=appliedGeneration,proto3" json:"applied_generation,omitempty"`
	// contains filtered or unexported fields
}

type BackendListener struct {

	// Name mirrors the EgressListener name from the CRD; used for logs and for
	// EgressRoute parentRef.sectionName matching.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Addr is the host:port the sandbox dials. Empty means "listener exists but
	// its data plane isn't ready yet" — the dialer skips it.
	Addr string `protobuf:"bytes,2,opt,name=addr,proto3" json:"addr,omitempty"`
	// Shape is the on-the-wire protocol selector ("tls-terminate",
	// "tls-passthrough", "tcp", "http", "https").
	Shape string `protobuf:"bytes,3,opt,name=shape,proto3" json:"shape,omitempty"`
	// MatchPort, when non-zero, narrows this listener to the sandbox's
	// destination port. Zero = catch-all for this shape.
	MatchPort int32 `protobuf:"varint,4,opt,name=match_port,json=matchPort,proto3" json:"match_port,omitempty"`
	// Priority is the precomputed shape rank used as a tiebreaker when multiple
	// listeners match the same dst port. Higher wins.
	Priority int32 `protobuf:"varint,5,opt,name=priority,proto3" json:"priority,omitempty"`
	// contains filtered or unexported fields
}

type Binding struct {

	// Fqdn is the name this binding answers for, authoritatively (no trailing
	// dot, e.g. "my-tunnel.tun.apoxy.net").
	Fqdn string `protobuf:"bytes,1,opt,name=fqdn,proto3" json:"fqdn,omitempty"`
	// Addrs are the addresses the name resolves to (answered as A or AAAA by
	// address family; VPC overlay ULAs today).
	Addrs []string `protobuf:"bytes,2,rep,name=addrs,proto3" json:"addrs,omitempty"`
	// DelegateSubdomains forwards sub-names (x.<fqdn>) to a resolver at this
	// binding's addrs instead of answering locally. Tunnel endpoints set this
	// (recursive tunnel resolution); Services won't.
	DelegateSubdomains bool `protobuf:"varint,3,opt,name=delegate_subdomains,json=delegateSubdomains,proto3" json:"delegate_subdomains,omitempty"`
	// Ttl for answers in seconds; 0 = resolver default.
	Ttl uint32 `protobuf:"varint,4,opt,name=ttl,proto3" json:"ttl,omitempty"`
	// ReachableCidrs are carved out of the egress SSRF backstop for this
	// binding — explicit rather than derived from addrs, so a binding can
	// expose a wider window (a tunnel endpoint's whole /96) or none at all (a
	// Service resolving to a public IP contributes no carve-out).
	ReachableCidrs []string `protobuf:"bytes,5,rep,name=reachable_cidrs,json=reachableCidrs,proto3" json:"reachable_cidrs,omitempty"`
	// contains filtered or unexported fields
}

type DNSConfigClient interface {
	// ApplyDNS installs the resident's full VPC name plane: the bindings the
	// project's workers can resolve and reach, plus the zones the resolver is
	// authoritative for. The request carries the WHOLE desired state — a
	// binding absent from the request is deleted, so the pusher stays
	// level-triggered and deletions need no tombstones. Idempotent; a request
	// whose generation is older than the last applied one is ignored (the
	// response echoes the retained generation).
	ApplyDNS(ctx context.Context, in *ApplyDNSRequest, opts ...grpc.CallOption) (*ApplyDNSResponse, error)
}

type DNSConfigServer interface {
	// ApplyDNS installs the resident's full VPC name plane: the bindings the
	// project's workers can resolve and reach, plus the zones the resolver is
	// authoritative for. The request carries the WHOLE desired state — a
	// binding absent from the request is deleted, so the pusher stays
	// level-triggered and deletions need no tombstones. Idempotent; a request
	// whose generation is older than the last applied one is ignored (the
	// response echoes the retained generation).
	ApplyDNS(context.Context, *ApplyDNSRequest) (*ApplyDNSResponse, error)
	// contains filtered or unexported methods
}

type EgressConfigClient interface {
	// ApplyEgress installs the full egress config for one sandbox: the
	// per-Service egress planes (each Service's dialable EgressGateway backend
	// listeners and its authorization policy) plus the invocation id stamped on
	// egress connections for attribution. The request carries the WHOLE desired
	// state for the resident — a Service absent from the request has no egress
	// plane (its config is dropped), so the reconciler stays level-triggered
	// and deletions need no tombstones. Idempotent; a request whose generation
	// is older than the last applied one is ignored (the response echoes the
	// retained generation).
	ApplyEgress(ctx context.Context, in *ApplyEgressRequest, opts ...grpc.CallOption) (*ApplyEgressResponse, error)
}

type EgressConfigServer interface {
	// ApplyEgress installs the full egress config for one sandbox: the
	// per-Service egress planes (each Service's dialable EgressGateway backend
	// listeners and its authorization policy) plus the invocation id stamped on
	// egress connections for attribution. The request carries the WHOLE desired
	// state for the resident — a Service absent from the request has no egress
	// plane (its config is dropped), so the reconciler stays level-triggered
	// and deletions need no tombstones. Idempotent; a request whose generation
	// is older than the last applied one is ignored (the response echoes the
	// retained generation).
	ApplyEgress(context.Context, *ApplyEgressRequest) (*ApplyEgressResponse, error)
	// contains filtered or unexported methods
}

type EgressPolicy struct {

	// DefaultDeny denies destinations not matched by any rule. False (with no
	// rules) is allow-all.
	DefaultDeny bool `protobuf:"varint,1,opt,name=default_deny,json=defaultDeny,proto3" json:"default_deny,omitempty"`
	// Rules are the compiled per-destination allow rules. Dimensions within a
	// rule are ANDed; rules are ORed (each rule is one compiled
	// EgressRouteMatch).
	Rules []*EgressRule `protobuf:"bytes,2,rep,name=rules,proto3" json:"rules,omitempty"`
	// contains filtered or unexported fields
}

type EgressRule struct {

	// DestinationCIDRs match the destination IP. Single IPs are /32 or /128.
	DestinationCidrs []string `protobuf:"bytes,1,rep,name=destination_cidrs,json=destinationCidrs,proto3" json:"destination_cidrs,omitempty"`
	// DestinationHostnames match the DNS-bound destination name; exact or
	// single-label wildcard ("*.example.com").
	DestinationHostnames []string `protobuf:"bytes,2,rep,name=destination_hostnames,json=destinationHostnames,proto3" json:"destination_hostnames,omitempty"`
	// Ports match the destination port. Single ports have start == end.
	Ports []*PortRange `protobuf:"bytes,3,rep,name=ports,proto3" json:"ports,omitempty"`
	// Protocol is the L4 protocol ("TCP"); empty matches any. UDP is rejected
	// at admission and never compiled.
	Protocol string `protobuf:"bytes,4,opt,name=protocol,proto3" json:"protocol,omitempty"`
	// Listeners are the BackendListener names this rule routes via, from the
	// route's parentRef.sectionName. Empty = all of the gateway's listeners.
	Listeners []string `protobuf:"bytes,5,rep,name=listeners,proto3" json:"listeners,omitempty"`
	// contains filtered or unexported fields
}

type PortRange struct {
	Start int32 `protobuf:"varint,1,opt,name=start,proto3" json:"start,omitempty"`
	End   int32 `protobuf:"varint,2,opt,name=end,proto3" json:"end,omitempty"`
	// contains filtered or unexported fields
}

type ServiceEgressConfig struct {

	// Service is the compute Service name this plane belongs to.
	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
	// Backends replaces the Service's dialable EgressGateway listener set.
	Backends []*BackendListener `protobuf:"bytes,2,rep,name=backends,proto3" json:"backends,omitempty"`
	// Policy replaces the Service's egress authorization plane. Absent means
	// allow-all (no enforcement) — the implicit built-in "default" gateway.
	Policy *EgressPolicy `protobuf:"bytes,3,opt,name=policy,proto3" json:"policy,omitempty"`
	// contains filtered or unexported fields
}

type UnimplementedDNSConfigServer struct{}

type UnimplementedEgressConfigServer struct{}

type UnsafeDNSConfigServer interface {
	// contains filtered or unexported methods
}

type UnsafeEgressConfigServer interface {
	// contains filtered or unexported methods
}