pub struct ServerCfg {
pub port: u16,
pub app_port: u16,
pub upstream: String,
pub trust_forwarded_for: bool,
pub admin_port: u16,
pub admin_addr: String,
}Fields§
§port: u16Public listen port. Overridden by the PORT env var.
app_port: u16Internal port the wrapped/upstream app listens on. Overridden by APP_PORT.
upstream: StringFull upstream base URL. Overridden by UPSTREAM. If empty, derived from app_port.
trust_forwarded_for: boolTrust the X-Forwarded-For header for client identity. Enable ONLY when
EdgeGuard sits behind a trusted proxy/load balancer that sets it (e.g. a PaaS
edge). When false (default) the peer socket address is used, so clients can’t
spoof their IP to defeat per-IP rate limiting or forge access-log entries.
admin_port: u16Private listener port for the internal /__edgeguard/* ops endpoints (health,
readiness, metrics). 0 (default) keeps them on the public port. When non-zero,
EdgeGuard binds a second, plain-HTTP listener on admin_addr:admin_port that serves
those endpoints, and the public port serves only the proxy (plus the browser-facing CSP
report sink) — so metrics/health aren’t exposed on the internet. Overridden by
ADMIN_PORT. (Point your platform’s health check at this port when you enable it.)
admin_addr: StringAddress the private admin listener binds when admin_port is set. Defaults to
127.0.0.1 (same-host only — e.g. a sidecar scraper); set to 0.0.0.0 to expose it on
a private network interface (rely on your network policy to keep it off the internet).