ingress

type CertLoader struct {
	// contains filtered or unexported fields
}

type ClientCARegistry struct {
	// contains filtered or unexported fields
}

type Config struct {
	// Router is the live host -> service table. Required.
	Router *Router

	// Challenges serves HTTP-01 ACME challenge tokens. Required.
	// Reads come on the HTTP listener; writes are made by the
	// ACME orchestrator.
	Challenges *MemChallengeStore

	// Certs is the TLS certificate loader. Required.
	Certs *CertLoader

	// ClientCAs holds per-host client-CA pools for inbound mTLS
	// (origin hardening). Optional; nil disables client-cert
	// verification entirely. When set, hosts with a registered pool
	// require + verify a client cert at the handshake.
	ClientCAs *ClientCARegistry

	// HTTPAddr is the bind address for the plain HTTP listener.
	// Default ":80". Use ":8080" or similar in dev mode to avoid
	// requiring CAP_NET_BIND_SERVICE.
	HTTPAddr string

	// HTTPSAddr is the bind address for the HTTPS listener.
	// Default ":443". Use ":8443" in dev mode. Empty disables TLS.
	HTTPSAddr string

	// UpstreamResolver maps (namespace, service, port) to a dial
	// target ("ip:port"). Returning an empty string means the
	// service is not currently reachable; the listener will return
	// 503. The data plane normally satisfies this via the local
	// VIP (RUNE-041); a stub returning vip:port is fine.
	UpstreamResolver UpstreamResolver

	// Logger is the structured logger. Defaults to "ingress".
	Logger log.Logger

	// ReadyTimeout caps how long Start blocks waiting for the
	// listeners to bind. Defaults to 5s.
	ReadyTimeout time.Duration
}

type FuncResolver func(namespace, service string, port int) (string, bool)

type MemChallengeStore struct {
	// contains filtered or unexported fields
}

type Route struct {
	// Host is the lowercased exact-match hostname.
	Host string
	// Namespace + Service identify the upstream service.
	Namespace string
	Service   string
	// Port is the service-level port to dial.
	Port int
	// Path is an optional path prefix; empty matches all.
	Path string
	// AllowCIDRs, when non-empty, restricts inbound connections to these
	// parsed source networks (matched against the real TCP peer). Empty =
	// no restriction. Parsed once at Apply time so the request path does no
	// parsing. See RUNE-0XX-Expose-Origin-Hardening-Design.md.
	AllowCIDRs []*net.IPNet
	// RequireClientCert is true when the service declares expose.clientCert
	// (inbound mTLS). Carried on the route — independent of whether the CA
	// pool has loaded — so the listener can fail CLOSED: refuse plaintext
	// (:80) and refuse :443 when the per-host CA pool isn't registered yet,
	// instead of serving the origin unauthenticated.
	RequireClientCert bool
}

type Router struct {
	// contains filtered or unexported fields
}

type Subsystem struct {
	// contains filtered or unexported fields
}

type UpstreamResolver interface {
	Resolve(namespace, service string, port int) (target string, ok bool)
}