config

package
v0.1.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 31, 2026 License: Apache-2.0 Imports: 7 Imported by: 0

Documentation

Overview

Package config defines pano's on-disk layout under ~/.pano and its configuration file (config.toml), with defaults that are safe out of the box.

Index

Constants

This section is empty.

Variables

View Source
var DefaultNever = []string{
	"*.push.apple.com", "*.icloud.com", "*.icloud-content.com", "*.apple-cloudkit.com", "*.ls.apple.com",
}

DefaultNever lists the hosts that are never decrypted out of the box: the macOS daemons that pin certificates and visibly break under interception (push notifications, iCloud sync, CloudKit, Maps). Deliberately minimal — anything else that pins shows up under "rejected" for the user to decide.

Functions

func Save

func Save(p Paths, cfg Config) error

Save writes the config atomically.

func WriteAtomic

func WriteAtomic(path string, b []byte, mode os.FileMode) error

WriteAtomic writes b to path via a temp file + rename.

Types

type Breakpoints

type Breakpoints struct {
	HoldTimeout Duration `toml:"hold_timeout"`
}

Breakpoints configures held-request behaviour.

type Capture

type Capture struct {
	Enabled          bool  `toml:"enabled"`
	MaxBodyBytes     int64 `toml:"max_body_bytes"`
	MaxInflightBytes int64 `toml:"max_inflight_bytes"`
	WebSocketFrames  bool  `toml:"websocket_frames"`
	RingSize         int   `toml:"ring_size"`
}

Capture configures what is recorded. Everything captured is held in memory only: RingSize bounds how many flows are kept (oldest evicted) and nothing survives a daemon restart.

type Config

type Config struct {
	Proxy       Proxy       `toml:"proxy"`
	Decrypt     Decrypt     `toml:"decrypt"`
	Capture     Capture     `toml:"capture"`
	Redaction   Redaction   `toml:"redaction"`
	Views       Views       `toml:"views"`
	Breakpoints Breakpoints `toml:"breakpoints"`
	MCP         MCP         `toml:"mcp"`
	SystemProxy SystemProxy `toml:"system_proxy"`
	Limits      Limits      `toml:"limits"`
	Updates     Updates     `toml:"updates"`
}

Config is the full pano configuration. Zero values are replaced by Default() before use; the TOML file only needs to list overrides.

func Default

func Default() Config

Default returns the built-in configuration.

func Load

func Load(p Paths) (Config, error)

Load reads config.toml over Default(). A missing file is not an error. Deprecated keys are migrated in memory (see LoadWithWarnings).

func LoadWithWarnings

func LoadWithWarnings(p Paths) (Config, []string, error)

LoadWithWarnings is Load plus one human-readable line per migrated or deprecated key, for the daemon log and `pano config get`.

func (Config) Validate

func (c Config) Validate() error

Validate checks ranges.

type Decrypt

type Decrypt struct {
	Mode  string   `toml:"mode"`
	Only  []string `toml:"only"`
	Never []string `toml:"never"`
}

Decrypt says which HTTPS tunnels are TLS-terminated. Never wins in every mode; Only is consulted only when Mode is "only". Entries are hosts (which also cover their subdomains) or globs.

type Duration

type Duration struct{ time.Duration }

Duration is a time.Duration that marshals as a human string ("7d", "90s").

func (Duration) MarshalText

func (d Duration) MarshalText() ([]byte, error)

MarshalText renders the duration.

func (*Duration) UnmarshalText

func (d *Duration) UnmarshalText(b []byte) error

UnmarshalText parses durations, accepting a trailing "d" for days.

type Limits

type Limits struct {
	MaxConns int `toml:"max_conns"`
}

Limits bounds resource usage.

type MCP

type MCP struct {
	ExposeHTTP bool `toml:"expose_http"`
}

MCP configures the MCP server.

type Paths

type Paths struct {
	Dir string
}

Paths locates pano's files. All live under Dir (default ~/.pano, override with $PANO_HOME).

func DefaultPaths

func DefaultPaths() (Paths, error)

DefaultPaths returns the standard layout.

func (Paths) AuditLog

func (p Paths) AuditLog() string

AuditLog records secret reveals and system changes.

func (Paths) CACert

func (p Paths) CACert() string

CACert is the root certificate (PEM).

func (Paths) CAKey

func (p Paths) CAKey() string

CAKey is the root private key (PEM, 0600).

func (Paths) CertCache

func (p Paths) CertCache() string

CertCache holds minted leaf certificates.

func (Paths) ConfigFile

func (p Paths) ConfigFile() string

ConfigFile is config.toml.

func (Paths) Ensure

func (p Paths) Ensure() error

Ensure creates Dir (0700) if missing.

func (Paths) LeafKey

func (p Paths) LeafKey() string

LeafKey is the shared leaf private key.

func (Paths) LogFile

func (p Paths) LogFile() string

LogFile is the daemon log.

func (Paths) PIDFile

func (p Paths) PIDFile() string

PIDFile holds the daemon pid.

func (Paths) RulesFile

func (p Paths) RulesFile() string

RulesFile persists rules.

func (Paths) SimulatorState added in v0.1.1

func (p Paths) SimulatorState() string

SimulatorState is the record of which iOS Simulators pano's CA has been installed into (and which asked not to be suggested again).

func (Paths) Socket

func (p Paths) Socket() string

Socket is the control API Unix socket.

func (Paths) SysProxyState

func (p Paths) SysProxyState() string

SysProxyState is the system proxy snapshot.

func (Paths) Token

func (p Paths) Token() string

Token is the bearer token for the TCP control listener.

func (Paths) UpdateState

func (p Paths) UpdateState() string

UpdateState caches the last release check (internal/update).

type Proxy

type Proxy struct {
	Port    int    `toml:"port"`
	MCPPort int    `toml:"mcp_port"`
	Bind    string `toml:"bind"`
	// Bypass is the pre-[decrypt] name of Decrypt.Never. Load migrates it and
	// Save never writes it back.
	Bypass []string `toml:"bypass,omitempty"`
}

Proxy configures the listening proxy.

type Redaction

type Redaction struct {
	Enabled       bool     `toml:"enabled"`
	ExtraPatterns []string `toml:"extra_patterns"`
	ExtraHeaders  []string `toml:"extra_headers"`
}

Redaction controls secret masking in views.

type SystemProxy

type SystemProxy struct {
	RestoreOnExit bool `toml:"restore_on_exit"`
}

SystemProxy configures macOS system proxy integration.

type Updates

type Updates struct {
	Check bool `toml:"check"`
}

Updates controls the once-a-day release check. It only ever prints a hint (never downloads or installs); see internal/update for every other way to turn it off.

type Views

type Views struct {
	DefaultMaxBytes int `toml:"default_max_bytes"`
	ListPageSize    int `toml:"list_page_size"`
	StringTruncate  int `toml:"string_truncate"`
}

Views sets default token budgets for body rendering.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL