aibridgeproxyd

type CertCache struct {
	// contains filtered or unexported fields
}

type Metrics struct {

	// ConnectSessionsTotal counts CONNECT sessions established.
	// Labels: type (mitm/tunneled)
	ConnectSessionsTotal *prometheus.CounterVec

	// MITMRequestsTotal counts MITM requests handled by the proxy.
	// Labels: provider
	MITMRequestsTotal *prometheus.CounterVec

	// InflightMITMRequests tracks the number of MITM requests currently being processed.
	// Labels: provider
	InflightMITMRequests *prometheus.GaugeVec

	// MITMResponsesTotal counts MITM responses by HTTP status code.
	// Labels: code (HTTP status code), provider
	// Cardinality is bounded: ~100 used status codes x few providers.
	MITMResponsesTotal *prometheus.CounterVec
	// contains filtered or unexported fields
}

type Options struct {
	// ListenAddr is the address the proxy server will listen on.
	ListenAddr string
	// TLSCertFile is the path to the TLS certificate file for the proxy listener.
	TLSCertFile string
	// TLSKeyFile is the path to the TLS private key file for the proxy listener.
	TLSKeyFile string
	// CoderAccessURL is the URL of the Coder deployment where aibridged is running.
	// Requests to supported AI providers are forwarded here.
	CoderAccessURL string
	// MITMCertFile is the path to the CA certificate file used for MITM.
	MITMCertFile string
	// MITMKeyFile is the path to the CA private key file used for MITM.
	MITMKeyFile string
	// AllowedPorts is the list of ports allowed for CONNECT requests.
	// Defaults to ["80", "443"] if empty.
	AllowedPorts []string
	// CertStore is an optional certificate cache for MITM. If nil, a default
	// cache is created. Exposed for testing.
	CertStore goproxy.CertStorage
	// DomainAllowlist is the list of domains to intercept and route through AI Bridge.
	// Only requests to these domains will be MITM'd and forwarded to aibridged.
	// Requests to other domains will be tunneled directly without decryption.
	DomainAllowlist []string
	// AIBridgeProviderFromHost maps a hostname to a known aibridge provider
	// name. Must be non-nil; the caller derives it from the configured
	// provider list.
	AIBridgeProviderFromHost func(host string) string
	// UpstreamProxy is the URL of an upstream HTTP proxy to chain tunneled
	// (non-allowlisted) requests through. If empty, tunneled requests connect
	// directly to their destinations.
	// Format: http://[user:pass@]host:port or https://[user:pass@]host:port
	UpstreamProxy string
	// UpstreamProxyCA is the path to a PEM-encoded CA certificate file to trust
	// for the upstream proxy's TLS connection. Only needed for HTTPS upstream
	// proxies with certificates not trusted by the system. If empty, the system
	// certificate pool is used.
	UpstreamProxyCA string
	// AllowedPrivateCIDRs is a list of CIDR ranges that are permitted even
	// though they fall within blocked private/reserved IP ranges. This allows
	// access to specific internal networks while keeping all other private
	// ranges blocked. If empty, all private ranges are blocked.
	AllowedPrivateCIDRs []string
	// Metrics is the prometheus metrics instance for recording proxy metrics.
	// If nil, metrics will not be recorded.
	Metrics *Metrics
}

type Server struct {
	// contains filtered or unexported fields
}