Documentation
¶
Index ¶
- func ForwardedProto(r *http.Request) (string, bool)
- func WithOriginScheme(ctx context.Context, scheme string) context.Context
- type HealthCheck
- type HealthResponse
- type IngressConfig
- type Server
- func (h *Server) AcquireTunnel(ctx context.Context, hostname, path string) (*TunnelConn, error)
- func (h *Server) AllowCertificate(ctx context.Context, host string) (bool, error)
- func (h *Server) DeriveApp(host string) (string, bool)
- func (h *Server) DoRequest(ctx context.Context, req *httpingress_v1alpha.InternalHttpRequest) (*httpingress_v1alpha.InternalHttpResponse, error)
- func (h *Server) ServeHTTP(w http.ResponseWriter, req *http.Request)
- type TunnelConn
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ForwardedProto ¶ added in v0.16.0
ForwardedProto extracts the scheme a front proxy reported, preferring X-Forwarded-Proto over the RFC 7239 Forwarded header. Chained proxies append rather than replace, so only the first element of either header (the hop nearest the client) is consulted. Callers decide whether the peer is trusted; this only parses.
func WithOriginScheme ¶ added in v0.16.0
WithOriginScheme records the scheme a visitor used, as determined by a trusted in-process proxy that terminated their TLS (the Anywhere POP forwarder). requestScheme honors it ahead of headers and connection state, so it must only ever be set from code paths a client cannot reach directly. Anything other than http or https is not recorded, so requestScheme falls through to its other sources rather than building a baseURL from junk.
Types ¶
type HealthCheck ¶
HealthCheck represents a single component health check
type HealthResponse ¶
type HealthResponse struct {
Status string `json:"status"`
Checks map[string]HealthCheck `json:"checks"`
// Server.Ready is the boot-graph signal an upgrade waits for; Status stays
// the dependency check it always was.
Server *serverinfo.Info `json:"server,omitempty"`
}
HealthResponse represents the JSON response for /health endpoint
type IngressConfig ¶
type IngressConfig struct {
RequestTimeout time.Duration
DataPath string
WorkloadIssuer *workloadidentity.Issuer
// Instance, when set, adds process identity and readiness to /health.
Instance *serverinfo.Source
// TrustProxyHeaders honors X-Forwarded-Proto and Forwarded from the peer
// when deciding a request's original scheme. Only set this when every
// connection comes from a proxy that overwrites those headers; a client
// that can reach the listener directly could otherwise downgrade its own
// auth cookies to non-Secure.
TrustProxyHeaders bool
// TrustedProxyHops is the number of trusted proxies in front of Miren,
// including its immediate peer. It defaults to one when proxy headers are
// trusted.
TrustedProxyHops int
}
type Server ¶
func NewServer ¶
func NewServer( ctx context.Context, log *slog.Logger, config IngressConfig, rpcClient rpc.Client, aa activator.AppActivator, httpMetrics *metrics.HTTPMetrics, logWriter observability.LogWriter, ) *Server
func (*Server) AcquireTunnel ¶ added in v0.6.1
AcquireTunnel resolves a hostname to an app, acquires a lease to a running sandbox, and returns the sandbox URL. This is similar to DoRequest but doesn't execute a request — it gives the caller direct access to the sandbox URL for protocols that need custom connection handling (e.g., WebSocket tunneling).
The path parameter is checked against blocked paths (e.g., admin endpoints). If the route requires OIDC authentication, the tunnel is rejected since OIDC flows cannot be performed over tunneled connections.
func (*Server) AllowCertificate ¶ added in v0.16.0
AllowCertificate reports whether host deserves an on-demand certificate even though no route names it exactly. The name has to sit one label under a route, either through a wildcard ("foo.example.com" under "*.example.com") or as an ephemeral subdomain of a normal route ("pr-3.app.example.com" under "app.example.com"), and then one of two things has to vouch for it: a live ephemeral deploy of the route's app with that label, or a 200 from the route's tls_check path. Anything else is a name nothing will serve, so the answer is no.
A non-nil error means the answer is unknown, not that the name was refused: the entity store failed, or the app gave no clear answer (a 5xx or a timeout, as when it is still booting from zero). Callers should ask again rather than remember a refusal.
func (*Server) DoRequest ¶ added in v0.3.1
func (h *Server) DoRequest(ctx context.Context, req *httpingress_v1alpha.InternalHttpRequest) (*httpingress_v1alpha.InternalHttpResponse, error)
DoRequest handles internal HTTP requests to app sandboxes. This method reuses the same lease management infrastructure as the HTTP proxy but is called directly via Go method invocation rather than through the HTTP listener.
type TunnelConn ¶ added in v0.6.1
type TunnelConn struct {
// URL is the base URL of the sandbox (e.g., "http://10.0.0.5:8080").
URL string
AppID string
// contains filtered or unexported fields
}
TunnelConn represents a resolved connection to an app sandbox. The caller is responsible for calling Release when done to return the lease.
func (*TunnelConn) Release ¶ added in v0.6.1
func (tc *TunnelConn) Release()
Release returns the lease to the pool.
Source Files