Documentation
¶
Overview ¶
Package httpproxy resolves the proxy that outbound HTTP requests should travel through, and constructs *http.Client instances that route through that resolver.
Two resolvers are exposed: System(), which delegates to the host's native proxy machinery (Windows IE/WinHTTP settings, including PAC scripts; environment variables on Unix); and Static(), which pins every request to a single proxy URL supplied by the caller (e.g. from a YAML configuration).
Per-request evaluation is preserved by both forms — http.Transport invokes the resolver once per outbound request, so a PAC script that returns DIRECT for one host and a proxy for another is honoured. The Static() resolver is intentionally all-or-nothing: it represents the caller's explicit "use this proxy" choice and overrides any system-level configuration.
On macOS, native CFNetwork-based proxy detection requires CGO, which dotvault avoids for static cross-compiled binaries. System() therefore falls back to environment-variable detection on Darwin, matching the Linux behaviour. Users who need macOS-native PAC handling can set HTTPS_PROXY in the daemon environment or supply a Static() override.
Index ¶
- Variables
- func ClientFromSettings(settings map[string]any, timeout time.Duration) (*http.Client, error)
- func NewClient(resolver func(*http.Request) (*url.URL, error), timeout time.Duration) *http.Client
- func OverrideFromSettings(settings map[string]any) (string, error)
- func Static(override string) (func(*http.Request) (*url.URL, error), error)
- func System() func(*http.Request) (*url.URL, error)
Constants ¶
This section is empty.
Variables ¶
var SettingsKeys = []string{"https_proxy", "http_proxy"}
SettingsKeys is the list of YAML map keys that carry a proxy URL in an enrolment engine's settings block. Both names are accepted as aliases: dotvault's HTTP-based engines only ever talk HTTPS, and YAML authors reach for whichever name matches their mental model. The first non-empty value wins, and lookup order is fixed for deterministic precedence (https_proxy > http_proxy).
Functions ¶
func ClientFromSettings ¶
ClientFromSettings is the convenience entry point engines use to build their outbound HTTP client. When the settings carry an https_proxy / http_proxy override every request is pinned to that URL; otherwise the host's native proxy machinery resolves on a per-request basis (System()).
Lifts the per-engine plumbing out of internal/enrol so JFrog, the Vault client, and future HTTP-talking packages share one source of truth for the YAML key contract.
func NewClient ¶
NewClient builds an *http.Client whose transport routes every outbound request through resolver. The transport is cloned from http.DefaultTransport so unrelated tuning — TLS handshake timeouts, connection pooling, HTTP/2 negotiation — keeps the standard-library defaults; only the Proxy field is replaced.
A nil resolver defers to System().
func OverrideFromSettings ¶
OverrideFromSettings extracts a manually-configured proxy URL from an engine's settings map, applying SettingsKeys in order. Returns ("", nil) when no override is configured; returns an error if a matching key holds a non-string value.
func Static ¶
Static parses override into a per-request proxy resolver that always returns the same URL, regardless of the target host. Intended for the case where the caller has been explicitly told which proxy to use (e.g. a `https_proxy:` YAML setting pinning a corporate Squid).
Accepted schemes are http, https, socks5, and socks5h — the same set http.Transport will actually dial. Schemeless or unsupported-scheme inputs error out at configuration time so a misconfigured proxy surfaces before the first outbound request.
PAC-style per-URL routing is not applied to a Static resolver — the override is a deliberate "use this proxy" instruction. Callers that want host-conditional routing should fall back to System() instead.
func System ¶
System returns a per-request proxy resolver that reads HTTP_PROXY, HTTPS_PROXY, and NO_PROXY (and their lowercase variants) from the process environment. On Linux this matches what corporate clients expect; on macOS it is a deliberate fallback in lieu of the native CFNetwork integration, which requires CGO.
Types ¶
This section is empty.
Source Files