egressproxy

type Decision struct {
	Allow bool
	Match MatchType
}

type MatchType string

type Policy struct {
	// SandboxID records which sandbox this policy was pushed for. Informational
	// (surfaced in logs/metrics); the proxy enforces whatever is present.
	SandboxID string `json:"sandboxId,omitempty"`

	// Enforce gates the whole filter. When false the policy is treated as
	// fail-closed (deny all). The control plane sets it true only after a
	// concrete ruleset has been resolved for a claimed sandbox.
	Enforce bool `json:"enforce"`

	// DisableEgress blocks all outbound traffic regardless of the allow lists
	// (DNS is still permitted so name resolution does not hang). Equivalent to
	// an empty allowlist.
	DisableEgress bool `json:"disableEgress,omitempty"`

	// AllowedDomains permits egress to matching hostnames (exact, "*", or
	// "*.example.com"). Domains only ever allow; there is no domain deny.
	AllowedDomains []string `json:"allowedDomains,omitempty"`

	// AllowedCIDRs / DeniedCIDRs are IP/CIDR allow/deny for traffic without a
	// usable hostname (non-80/443 TCP, or bare-IP connections).
	AllowedCIDRs []string `json:"allowedCIDRs,omitempty"`
	DeniedCIDRs  []string `json:"deniedCIDRs,omitempty"`

	// AllowPrivateNetworks disables the built-in anti-SSRF deny of private /
	// link-local / cloud-metadata ranges. Default false (baseline stays on).
	AllowPrivateNetworks bool `json:"allowPrivateNetworks,omitempty"`
}

type Proxy struct {
	// contains filtered or unexported fields
}

type RedirectConfig struct {
	ProxyUID  int // sidecar runs as this uid; its own egress is exempted (no loop)
	HTTPPort  int
	TLSPort   int
	OtherPort int
}

type ServeConfig struct {
	PolicyPath string
	HTTPPort   int
	TLSPort    int
	OtherPort  int
	Logger     *slog.Logger
}