Module explain 

Rendering a policy, and what it would do to one hypothetical request.

Everything acme-proxy filter show and acme-proxy filter explain print lives here; crate::cli::filter marshals arguments and does nothing else. That split is the one the rest of the admin surface uses, and it is what would let the web panel serve this later without moving any logic — see the warning below for why it does not today.

explain really runs the policy

It executes the operator’s custom scripts and issues real IPAM and DNS requests, exactly as a request would, because a stubbed answer would be worse than nothing the first time it disagreed with production. It touches no database and creates nothing. Explanation::side_effects names the checks that reached outside the process, so the output says which parts of it were not free.

That is also why this is a host-only command. The inputs — a client address and a list of names — are chosen by the caller, so behind an admin session it would be script execution and outbound requests driven from one stolen cookie, on a listener that deliberately carries no filter chain and no admission control.

Structs

Explanation

What the whole request would get.

StageReport

One stage’s evaluation, plus the checks it never reached.

Subject

The request explain is asked about.

Functions

explain

Evaluates the policy at the connection stage and both identifier sub-stages, keeping every trace.

explanation_json

The --json rendering of explain.

render_explanation

The human rendering of explain.

render_policy

The resolved policy, as filter show prints it.