Documentation
¶
Index ¶
- Variables
- func NormalizePath(path string) string
- type CaddyConfig
- type CaddyProxy
- type DockerResolver
- type IPAccessHandler
- type MockProxy
- type Proxy
- type RateLimitConfig
- type RateLimitHandler
- type RateLimiterRegistry
- func (reg *RateLimiterRegistry) Allow(host string, r *http.Request) bool
- func (reg *RateLimiterRegistry) AllowFor(domain string, r *http.Request) bool
- func (reg *RateLimiterRegistry) Remove(domain string)
- func (reg *RateLimiterRegistry) Replace(cfgs map[string]*RateLimitConfig)
- func (reg *RateLimiterRegistry) Set(domain string, cfg *RateLimitConfig)
- type RequestMetrics
- type RequestStatEvent
- type Route
- type UpstreamResolver
Constants ¶
This section is empty.
Variables ¶
var IPAccessRules = newIPAccessRegistry()
IPAccessRules is the package-level registry used by the Caddy handler.
var RateLimiters = &RateLimiterRegistry{ limiters: make(map[string]*domainLimiter), }
RateLimiters is the package-level registry used by the Caddy handler.
var RequestStatsCh chan<- RequestStatEvent
RequestStatsCh is set before Caddy starts; metrics are sent here.
Functions ¶
func NormalizePath ¶
NormalizePath replaces dynamic path segments (numeric IDs, UUIDs) with {id}.
Types ¶
type CaddyConfig ¶
type CaddyConfig struct {
ListenAddr string // e.g. ":443"
HTTPListenAddr string // optional HTTP listener for plain-HTTP to HTTPS redirect, e.g. ":80"
ExtraListenAddrs []string // optional extra listeners for the main server, e.g. [":50051"]; same routes and TLS
TLSMode string // "auto", "custom", "off", "local"
TLSEmail string // ACME email, used when TLSMode is "auto"
DataDir string // data directory for Caddy storage
}
CaddyConfig holds configuration for a CaddyProxy.
type CaddyProxy ¶
type CaddyProxy struct {
// contains filtered or unexported fields
}
CaddyProxy is a Proxy backed by Caddy.
func NewCaddyProxy ¶
func NewCaddyProxy(cfg CaddyConfig) *CaddyProxy
NewCaddyProxy creates a CaddyProxy from the given config.
func (*CaddyProxy) BuildConfigJSON ¶
func (c *CaddyProxy) BuildConfigJSON() ([]byte, error)
BuildConfigJSON builds and returns the Caddy JSON config. Exported for testing.
func (*CaddyProxy) ForceReload ¶ added in v1.4.1
func (c *CaddyProxy) ForceReload() error
ForceReload reloads Caddy with the current routes even if the generated config is unchanged. Use after files referenced by the config change on disk (e.g. a custom cert upload rewrites the same path).
func (*CaddyProxy) SetRoutes ¶
func (c *CaddyProxy) SetRoutes(routes []Route) error
SetRoutes stores routes, configures rate limiters and IP allowlists, and reloads Caddy config. Routes with an invalid domain, or on a domain another app serves, are dropped with a warning (see claimDomains), so one app's bad endpoint cannot block route updates for every other app. If the new config fails to load, routes, domain owners and rules revert to the set Caddy is still running.
type DockerResolver ¶
type DockerResolver struct {
Client dockerInspector
}
DockerResolver resolves <service>:<port> upstreams to <container-ip>:<port> via Docker API, using compose project/service labels.
func (*DockerResolver) ContainerIP ¶
func (r *DockerResolver) ContainerIP(project, service, netName string) (string, error)
ContainerIP returns the IP of the first running container matching the given compose project and service, on the given docker network. Returns "" (no error) when the container exists but is not yet attached to the network, or when no container matches. Returns a non-nil error only on Docker failures.
type IPAccessHandler ¶
type IPAccessHandler struct {
// Domain is the route domain whose allowlist applies. buildConfig sets
// it so the handler uses its own route's rules even when several route
// domains (e.g. two wildcards) match the request host. Empty falls back
// to resolving the request Host against the registry.
Domain string `json:"domain,omitempty"`
}
IPAccessHandler is a Caddy middleware that enforces per-domain IP allowlists.
func (IPAccessHandler) CaddyModule ¶
func (IPAccessHandler) CaddyModule() caddy.ModuleInfo
func (*IPAccessHandler) ServeHTTP ¶
func (h *IPAccessHandler) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyhttp.Handler) error
func (*IPAccessHandler) Validate ¶
func (h *IPAccessHandler) Validate() error
type MockProxy ¶
type MockProxy struct {
// contains filtered or unexported fields
}
MockProxy is an in-memory Proxy for testing.
type RateLimitConfig ¶
RateLimitConfig holds parsed rate-limit settings for a route.
type RateLimitHandler ¶
type RateLimitHandler struct {
// Domain is the route domain whose limiter applies. buildConfig sets it
// so the handler uses its own route's limiter even when several route
// domains (e.g. two wildcards) match the request host. Empty falls back
// to resolving the request Host against the registry.
Domain string `json:"domain,omitempty"`
}
RateLimitHandler is a Caddy middleware that enforces per-domain rate limits.
func (RateLimitHandler) CaddyModule ¶
func (RateLimitHandler) CaddyModule() caddy.ModuleInfo
func (*RateLimitHandler) ServeHTTP ¶
func (h *RateLimitHandler) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyhttp.Handler) error
func (*RateLimitHandler) Validate ¶
func (h *RateLimitHandler) Validate() error
type RateLimiterRegistry ¶
type RateLimiterRegistry struct {
// contains filtered or unexported fields
}
RateLimiterRegistry maps normalized route domains to their limiter.
func (*RateLimiterRegistry) Allow ¶
func (reg *RateLimiterRegistry) Allow(host string, r *http.Request) bool
Allow returns true if the request should be allowed for host (a request Host header; port and case are ignored). host is matched against the registered domains the way Caddy's host matcher routes it: exact domain first, then the most specific wildcard. Returns true when no limiter is configured for the domain.
func (*RateLimiterRegistry) AllowFor ¶ added in v1.4.3
func (reg *RateLimiterRegistry) AllowFor(domain string, r *http.Request) bool
AllowFor is like Allow but uses the limiter registered for exactly the route domain (no wildcard resolution). Used by handlers bound to a route.
func (*RateLimiterRegistry) Remove ¶ added in v1.4.3
func (reg *RateLimiterRegistry) Remove(domain string)
Remove deletes the limiter for domain.
func (*RateLimiterRegistry) Replace ¶ added in v1.4.3
func (reg *RateLimiterRegistry) Replace(cfgs map[string]*RateLimitConfig)
Replace atomically swaps the whole set of limiters for cfgs (domain -> config). Domains not in cfgs lose their limiter. A domain whose config is unchanged keeps its limiter, so a route refresh does not reset counters.
func (*RateLimiterRegistry) Set ¶
func (reg *RateLimiterRegistry) Set(domain string, cfg *RateLimitConfig)
Set registers or replaces the rate limit config for domain (case-insensitive; wildcard domains such as "*.example.com" are allowed).
type RequestMetrics ¶
type RequestMetrics struct{}
RequestMetrics is a Caddy middleware that records request stats.
func (RequestMetrics) CaddyModule ¶
func (RequestMetrics) CaddyModule() caddy.ModuleInfo
func (*RequestMetrics) ServeHTTP ¶
func (m *RequestMetrics) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyhttp.Handler) error
func (*RequestMetrics) Validate ¶
func (m *RequestMetrics) Validate() error
type RequestStatEvent ¶
type RequestStatEvent struct {
Domain string
StatusCode int
LatencyMs float64
Method string
Path string
}
RequestStatEvent carries per-request stats.
type Route ¶
type Route struct {
AppSlug string
AppID int64 // store ID; lowest wins a domain several apps claim (see claimDomains)
Domain string
Upstream string // "localhost:{port}"
TLS string // "auto", "custom", "off"
CertDir string // directory containing certs for custom TLS
RateLimit *RateLimitConfig
AllowedIPs []string // validated IPs and CIDRs
Protocol string // "http" (default), "h2c" or "grpc"
Path string // optional Caddy path matcher, e.g. "/ws*"
}
Route holds routing config for a deployed app.
func ResolveRoutes ¶
func ResolveRoutes(app *compose.AppConfig, resolver UpstreamResolver) ([]Route, error)
ResolveRoutes derives Routes from an AppConfig (one per endpoint). Returns empty slice if no endpoints are defined (no error). If resolver is non-nil, endpoints without a published host port try to resolve to <container-ip>:<port> via Docker API and fall back to DNS on failure or empty result.
type UpstreamResolver ¶
UpstreamResolver resolves a compose service+port to a concrete upstream host string. Implementations may use Docker API lookups to map a service name to a container IP on the shared network. A nil resolver disables container-IP resolution and callers fall through to DNS.
Source Files