dmsgweb

type Config struct {
	// DomainSuffix is the domain extension that the SOCKS5 resolver
	// treats as DMSG (e.g. ".dmsg"). Defaults to DefaultDomainSuffix.
	DomainSuffix string

	// WebPorts are the localhost TCP listener ports. Used only in mode 2
	// (fixed-mapping); ignored in SOCKS5 mode. One entry per ResolveAddr.
	WebPorts []uint

	// ProxyAddr is the host the SOCKS5 proxy listens on. Empty means
	// loopback ("127.0.0.1") — the safe default. Set to "0.0.0.0" or a
	// specific LAN IP to serve OTHER devices on the network, e.g. a board
	// acting as a `.dmsg` gateway for a home router's LAN. Binding a
	// non-loopback address exposes the proxy to the LAN; only do so on a
	// trusted network.
	ProxyAddr string
	// ProxyPort is the SOCKS5 proxy listener port. Zero disables the
	// SOCKS5 proxy (useful when the runtime is embedded inside an
	// app that already provides its own SOCKS5 front-end).
	ProxyPort uint

	// ResolveAddr is a parallel slice of (pk, dmsgPort) fixed targets.
	// Enables mode 2; must be the same length as WebPorts when set.
	ResolveAddr []DmsgTarget

	// UpstreamSOCKS, when non-empty, sends non-matching CONNECT
	// requests through this upstream SOCKS5 (e.g. "127.0.0.1:1080").
	// Matches the existing `--addproxy` CLI flag.
	UpstreamSOCKS string
	// UpstreamRules send chosen domains to a different upstream, or
	// "direct", ahead of UpstreamSOCKS.
	UpstreamRules []proxyroute.Rule

	// Requests, when non-nil, records every .dmsg dial with the path it took,
	// for the status pages. The visor shares one log across its resolvers.
	Requests *proxystatus.RequestLog
	// Stats, when non-nil, is updated for every SOCKS5 dial. The visor
	// layer allocates one per resolver lifetime so counters persist
	// across Start/Stop cycles.
	Stats *Stats

	// TLSMITM enables on-the-fly TLS termination for browser
	// connections to <pk>.dmsg on the TLSPort, using LeafMinter to
	// produce per-host leaf certs signed by a locally-installed CA.
	// When false the runtime behaves exactly as before — pure SOCKS5
	// byte splice. See pkg/skynetca for the trust model.
	TLSMITM bool
	// TLSPort selects the destination port treated as TLS for MITM.
	// Defaults to 443. Ignored when TLSMITM is false.
	TLSPort uint16
	// TLSUpstreamPort is the destination port a MITM'd TLS connection is
	// sent to once decrypted. Defaults to 80, where visors serve HTTP.
	TLSUpstreamPort uint16
	// LeafMinter mints per-host leaf certs. Required when TLSMITM
	// is true; ignored otherwise.
	LeafMinter skynetca.LeafMinter

	// LocalPK is this visor's public key, used to detect self-lookups for the
	// SelfLoopback short-circuit.
	LocalPK cipher.PubKey
	// SelfLoopback, when true (the default), serves a request whose destination
	// is LocalPK from the local service in-process via SelfDial, instead of
	// dialing out over dmsg back to self (a wasteful, 202-prone round-trip).
	// Set false to force the full transport path — e.g. to test self-transports.
	SelfLoopback bool
	// SelfDial returns an in-process connection to the local service registered
	// on the given dmsg port. Used only when SelfLoopback short-circuits a
	// self-destined request. Nil disables the short-circuit.
	SelfDial func(port uint16) (net.Conn, error)
	// Aliases maps a destination label to a PK (e.g. "skywire" -> LocalPK), so
	// "skywire.dmsg" resolves exactly like "<pk>.dmsg".
	Aliases map[string]cipher.PubKey

	// HomePage, when set, renders the home directory instead of the alias
	// list alone, so the proxy shows the same page as the visor.
	HomePage func(suffix string) []byte

	// DirectClient is an optional dmsg client that reaches servers by their
	// configured address rather than via discovery. A dest in DirectServerPKs
	// is dialed through it by self-rendezvous (EnsureAndObtainSession(dest) +
	// DialStream(dest:port)), which makes non-discovery dmsg SERVERS — they
	// serve /health etc. over dmsg but never register a client entry, so the
	// discovery client cannot resolve them — reachable by name. Nil disables
	// this path (dests fall through to the normal discovery dial).
	DirectClient *dmsg.Client
	// DirectServerPKs is the set of destination PKs to dial via DirectClient.
	DirectServerPKs map[cipher.PubKey]struct{}
	// SkynetDial, when set, is tried before the dmsg dial for an ordinary
	// .dmsg destination: it reaches the peer over the visor's skynet
	// transports (direct, else through a peer that has one), and returns an
	// error to fall back to dmsg. The visor sets it only when this resolver
	// runs under the visor's own key, whose transports those are.
	SkynetDial func(ctx context.Context, pk cipher.PubKey, port uint16) (net.Conn, error)

	// StatusProvider, when non-nil, enables the reserved in-process status hosts
	// served through this proxy — a read-only diagnostic page (logs +
	// route/transport events + per-leg mux view) for a surface. Nil disables the
	// status hosts (they fall through to a normal resolve / upstream forward).
	// See pkg/proxystatus.
	StatusProvider proxystatus.Provider
	// StatusSurface scopes which reserved status host THIS proxy layer owns and
	// answers for (e.g. SurfaceDmsg → only http(s)://status.dmsg/). A status host
	// matching a DIFFERENT surface is NOT served here — it falls through so the
	// request continues up the proxy chain to the layer that owns it. Empty means
	// "serve any matched surface" (the pre-scoping behavior), kept so standalone
	// runtimes and tests need no wiring. Ignored when StatusProvider is nil.
	StatusSurface proxystatus.Surface

	// Publish, when non-nil, is called once with a handler that serves ONE
	// already-established connection exactly as the listener would, protocol
	// sniff included. The visor registers it as an in-process local service so
	// an app on this visor reaches this resolver over the data plane it already
	// holds, with no second SOCKS hop on localhost. The handler stays valid
	// until Run returns.
	Publish func(serve func(net.Conn))
}

type DmsgTarget struct {
	PK   cipher.PubKey
	Port uint16
}

type HomeLists struct {
	// Managed are the visors this one manages as a hypervisor, shown with
	// their sites only to the visor's own user.
	Managed []cipher.PubKey
	// Visors are every visor the deployment knows.
	Visors []cipher.PubKey
}

type SkynetVia struct {
	// contains filtered or unexported fields
}

type Stats struct {
	// contains filtered or unexported fields
}

type StatsSnapshot struct {
	StartedAt     time.Time  `json:"started_at,omitempty"`
	UptimeSec     int64      `json:"uptime_sec,omitempty"`
	TotalRequests uint64     `json:"total_requests"`
	Successful    uint64     `json:"successful"`
	Failed        uint64     `json:"failed"`
	Active        int64      `json:"active"`
	LastRequestAt *time.Time `json:"last_request_at,omitempty"`
	LastSuccessAt *time.Time `json:"last_success_at,omitempty"`
	LastFailureAt *time.Time `json:"last_failure_at,omitempty"`
	LastError     string     `json:"last_error,omitempty"`
}