Documentation
¶
Overview ¶
Package config loads and validates Turnwire configuration.
Index ¶
- func DefaultConfigPath() string
- func DefaultDataDir() string
- func Write(path string, cfg Config, force bool) error
- func WriteGuarded(path string, cfg Config, force bool, guard DestinationGuard) error
- type Config
- type DeploymentConfig
- type DestinationGuard
- type GuardConfig
- type IdentityConfig
- type LimitsConfig
- type PeerConfig
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DefaultConfigPath ¶
func DefaultConfigPath() string
DefaultConfigPath returns the per-user JSON configuration path.
func DefaultDataDir ¶
func DefaultDataDir() string
DefaultDataDir returns the per-user directory for durable relay state.
func Write ¶
Write creates a restrictive JSON config file. Existing files are replaced only when force is true.
func WriteGuarded ¶
func WriteGuarded(path string, cfg Config, force bool, guard DestinationGuard) error
WriteGuarded writes a restrictive JSON config file only when guard accepts the destination selected by the same parent descriptor retained for the create or rename. Platforms without descriptor-secured writes fail closed.
Types ¶
type Config ¶
type Config struct {
Identity IdentityConfig `json:"identity"`
Deployment DeploymentConfig `json:"deployment"`
Guard GuardConfig `json:"guard"`
Limits LimitsConfig `json:"limits"`
AuditDir string `json:"audit_dir,omitempty"`
}
Config is the complete Turnwire configuration.
func Default ¶
func Default() Config
Default returns the fail-closed OpenAI guard configuration used by init.
type DeploymentConfig ¶
type DeploymentConfig struct {
ID string `json:"id"`
}
DeploymentConfig identifies the tunnel/app association represented in startup attestations and signed checkpoints.
type DestinationGuard ¶
DestinationGuard authorizes a config destination after its parent directory has been securely opened. The parent descriptor is borrowed and must not be closed by the guard.
type GuardConfig ¶
type GuardConfig struct {
API string `json:"api"`
Endpoint string `json:"endpoint"`
Model string `json:"model"`
APIKeyEnv string `json:"api_key_env"`
AllowRemote bool `json:"allow_remote"`
PolicyVersion string `json:"policy_version"`
Policy string `json:"policy"`
PromptCacheRetention string `json:"prompt_cache_retention"`
}
GuardConfig configures the mandatory OpenAI Responses policy classifier. Explicit empty and false values must be encoded because Load overlays defaults.
type IdentityConfig ¶
type IdentityConfig struct {
Name string `json:"name"`
Peers []PeerConfig `json:"peers"`
}
IdentityConfig names this endpoint and lists the public keys it trusts.
type LimitsConfig ¶
type LimitsConfig struct {
MaxMessageBytes int `json:"max_message_bytes"`
MaxAuditBytes int64 `json:"max_audit_bytes"`
Timeout string `json:"timeout"`
MaxMessageAge string `json:"max_message_age"`
MaxConcurrent int `json:"max_concurrent"`
MaxRequestsPerMinute int `json:"max_requests_per_minute"`
MaxGuardCallsPerHour int `json:"max_guard_calls_per_hour"`
}
LimitsConfig bounds message size, request duration, and concurrent work.
type PeerConfig ¶
PeerConfig binds a peer name to an Ed25519 public key.
Source Files