config

type Config struct {
	Secrets  map[string]string `toml:"secrets"` // name = "secret"
	BindTo   string            `toml:"bind-to"`
	LogLevel string            `toml:"log-level"` // trace, debug, info, warn, error

	TLSFronting TLSFrontingConfig `toml:"tls-fronting"`
	Performance PerformanceConfig `toml:"performance"`
}

type Duration time.Duration

type PerformanceConfig struct {
	TCPBufferKB   int      `toml:"tcp-buffer-kb"`
	NumEventLoops int      `toml:"num-event-loops"` // gnet event loops (0 = auto, uses all cores)
	PreferIP      string   `toml:"prefer-ip"`
	IdleTimeout   Duration `toml:"idle-timeout"`
	PprofAddr     string   `toml:"pprof-addr"` // pprof HTTP server address (e.g., "localhost:6060")
}

type TLSFrontingConfig struct {
	MaskHost string `toml:"mask-host"` // Domain to mimic (SNI validation, proxy links)
	MaskPort int    `toml:"mask-port"` // Default port (default: 443)

	// Certificate fetching - where to connect to get real TLS cert
	// Defaults to mask-host:mask-port if not set
	// Useful when cert must be fetched from local nginx bypassing front proxy
	CertHost string `toml:"cert-host"`
	CertPort int    `toml:"cert-port"`

	// Splice target - where to forward unrecognized clients
	// Defaults to mask-host:mask-port if not set
	SpliceHost          string `toml:"splice-host"`
	SplicePort          int    `toml:"splice-port"`
	SpliceProxyProtocol int    `toml:"splice-proxy-protocol"` // 0=off, 1=v1, 2=v2
}