Struct Runtime 

pub struct Runtime {

    pub cfg: Arc<Config>,
    pub upstream_base: Arc<String>,
    pub upstream_routes: Vec<(String, Arc<String>)>,
    pub auth: AuthEngine,
    pub waf: WafEngine,
    pub cors: Option<CorsPolicy>,
    pub access: Option<AccessPolicy>,
    pub distributed: Option<DistributedLimiter>,
    pub ip_limiter: Option<Arc<KeyedLimiter>>,
    pub route_limiters: Vec<RouteLimiter>,
    pub key_limiter: Option<Arc<StrLimiter>>,
    pub max_body: usize,
    pub max_response_body: usize,
    pub max_header_bytes: usize,
    pub upstream_timeout: Option<Duration>,
    pub stream_passthrough: bool,
    pub websocket_passthrough: bool,
    pub llm: Arc<LlmRuntime>,
    pub budgets: Option<Arc<BudgetEngine>>,
    pub keyvault: Option<Arc<KeyVault>>,
    pub dlp: Option<Arc<DlpEngine>>,
    pub telemetry: Arc<TelemetryRuntime>,
    pub alerts: Arc<AlertRuntime>,
}

All request-handling policy derived from a Config. Rebuilt from scratch on reload and swapped in atomically.

Fields

cfg: Arc<Config>

upstream_base: Arc<String>

Default upstream base URL (the single server.upstream/app_port), used when no [[upstreams]] prefix matches.

upstream_routes: Vec<(String, Arc<String>)>

Per-path-prefix upstream overrides as (prefix, base); the longest matching prefix wins. Empty unless [[upstreams]] is configured.

auth: AuthEngine

waf: WafEngine

WAF-lite input screener. Inert (evaluate returns None) when waf.mode = "off".

cors: Option<CorsPolicy>

Compiled CORS policy; None when cors.enabled = false (the proxy then skips CORS).

access: Option<AccessPolicy>

Compiled IP allow/deny policy; None when both lists are empty (no IP gating).

distributed: Option<DistributedLimiter>

Shared-store (distributed) limiter, Some when ratelimit.store is memory/redis. When present it replaces the three governor limiters below (which are then None).

ip_limiter: Option<Arc<KeyedLimiter>>

Global per-client-IP limiter (None when rate limiting is disabled or distributed).

route_limiters: Vec<RouteLimiter>

Per-route limiters (also keyed per IP), checked instead of ip_limiter on a match.

key_limiter: Option<Arc<StrLimiter>>

Per-principal limiter (None when per-key limiting is disabled or distributed).

max_body: usize

max_response_body: usize

Cap on the buffered upstream response body; 0 means unbounded.

max_header_bytes: usize

Cap on total request header bytes; 0 means disabled.

upstream_timeout: Option<Duration>

Max time for the upstream request + body read; None disables the timeout.

stream_passthrough: bool

Forward text/event-stream responses unbuffered (SSE passthrough). See crate::config::ValidationCfg::stream_passthrough.

websocket_passthrough: bool

Tunnel WebSocket / Upgrade connections to the upstream. See crate::config::ValidationCfg::websocket_passthrough.

llm: Arc<LlmRuntime>

Compiled LLM token-metering runtime (price book + on/off). Inert when [llm] is disabled.

budgets: Option<Arc<BudgetEngine>>

Compiled LLM hard-budget engine (gateway L1). None when no [[llm.budgets]] are configured.

keyvault: Option<Arc<KeyVault>>

Compiled BYO-key vault (gateway L2). None when no [[llm.keys]] are configured; when set, every proxied request must present a known virtual key.

dlp: Option<Arc<DlpEngine>>

Compiled edge-DLP engine (gateway L3). None when [llm.dlp].mode = "off".

telemetry: Arc<TelemetryRuntime>

Compiled OTLP span emitter (gateway L4). Inert when [llm.telemetry].enabled = false or no endpoint is set; emits one OpenInference span per metered LLM request, fire-and-forget.

alerts: Arc<AlertRuntime>

Compiled outbound alerter (gateway L4). Inert when [alerts].enabled = false or no webhook is set; fires a Slack-compatible alert when a hard budget crosses its threshold, fire-and-forget.

Implementations

impl Runtime

pub fn pick_upstream(&self, path: &str) -> &str

The upstream base URL to forward path to: the longest matching [[upstreams]] prefix, or the default Runtime::upstream_base when none match.