proxy

var Module = fx.Options(fx.Invoke(func(p ProxyParams) error {

	if p.Config.Encryption.Enabled && p.Vault == nil {
		return fmt.Errorf("encryption is enabled but no vault was provided")
	}

	// Built once (not per upstream) so its collectors register with Prometheus
	// exactly once; a per-upstream build would panic on duplicate registration.
	var encReporter *Reporter
	if p.Vault != nil {
		encReporter = NewReporter(p.Factory.ForSubsystem("encryption"))
	}

	conns := make([]*connect.Conn, 0, len(p.Config.Upstreams))

	for i := range p.Config.Upstreams {
		up := &p.Config.Upstreams[i]
		if err := up.Validate(); err != nil {
			return fmt.Errorf("invalid upstream configuration: %w", err)
		}

		// Request-independent dial options: namespace translation and outbound
		// credentials. Per-request credentials are added by the resolver.
		var dialOpts []grpc.DialOption
		rules := &up.Namespaces.Rules
		if rules.Configured() {
			dialOpts = append(dialOpts, translationDialOptions(p.Translator, rules.Remote, rules.Local)...)
		}

		cp, err := outbound.CredentialProviderFor(up.Credentials)
		if err != nil {
			return fmt.Errorf("invalid credentials for upstream %q: %w", up.Name, err)
		}
		if cp != nil {
			dialOpts = append(dialOpts, outbound.DialOptions(cp)...)
		}

		if p.Vault != nil {
			enc, err := EncryptionInterceptor(p.Config.Encryption.Enabled, p.Vault, encReporter)
			if err != nil {
				return fmt.Errorf("failed to build encryption interceptor for upstream %q: %w", up.Name, err)
			}

			dialOpts = append(dialOpts, grpc.WithChainUnaryInterceptor(enc))
		}

		res, err := upstreamResolver(up, dialOpts)
		if err != nil {
			return err
		}

		conn, err := connect.NewConn(p.Pool.ConnOrCreate, res)
		if err != nil {
			return err
		}

		conns = append(conns, conn)

		var opts []Option
		if p.Logger != nil {
			opts = append(opts, WithLogger(p.Logger))
		}

		svr, err := New(up.Listen.HostPort, conn, opts...)
		if err != nil {
			return fmt.Errorf("failed to create proxy for upstream %q: %w", up.Name, err)
		}

		p.Lifecycle.Append(fx.Hook{
			OnStart: func(context.Context) error {

				lis, err := svr.Listen(p.Context)
				if err != nil {
					return fmt.Errorf("failed to start proxy for upstream %q: %w", up.Name, err)
				}

				go func() {
					defer func() { _ = lis.Close() }()

					if err := svr.Start(p.Context, lis); err != nil {

						_ = p.Shutdowner.Shutdown(fx.ExitCode(1))
					}
				}()

				return nil
			},
			OnStop: svr.Stop,
		})
	}

	p.Lifecycle.Append(fx.StartHook(func(ctx context.Context) error {
		if err := connect.WaitReady(ctx, conns...); err != nil {
			return fmt.Errorf("upstream connection not ready: %w", err)
		}

		return nil
	}))

	return nil
}))