egress

type Policy struct {
	// Hosts are the allowed hosts, with a port when not the default.
	Hosts []string
	// AllowPrefixes are ranges a request may reach although they are not
	// public, for a development or test destination: 127.0.0.0/8 for a local
	// fake, say, or the one private range a staging mock lives in. It is for
	// development and tests only. Link-local and cloud metadata addresses
	// are refused even when listed.
	AllowPrefixes []netip.Prefix
	// AllowPrivate permits every address that is not public except
	// link-local and cloud metadata addresses, which are always refused. It
	// is for development and tests only.
	//
	// Deprecated: list only the ranges a development setup needs in
	// AllowPrefixes.
	AllowPrivate bool
	// AllowHTTP permits plain HTTP. It is for development and tests only.
	AllowHTTP bool
	// Transport is the base transport, cloned. The default is a clone of
	// http.DefaultTransport. Its proxy and its dial functions (DialContext,
	// DialTLSContext, Dial and DialTLS) are replaced, so every connection is
	// made by the policy's dialer and checked; configure TLS, including
	// client certificates, through TLSClientConfig.
	Transport *http.Transport
	// Timeout bounds a whole request. Default 30 seconds.
	Timeout time.Duration
}