Struct ProxyConfig 

pub struct ProxyConfig {

    pub bind: String,
    pub upstream_anthropic: String,
    pub upstream_openai: String,
    pub db_path: String,
    pub tenant_id: String,
    pub require_auth: bool,
    pub tenant_keys: TenantKeys,
    pub prompt_salt: String,
    pub mode: Mode,
    pub routing: Option<Config>,
    pub prices: PriceTable,
    pub max_concurrency: usize,
    pub tenant_rate_per_sec: Option<NonZeroU32>,
}

Runtime configuration for the proxy.

Fields

bind: String

Address to bind the HTTP server to, e.g. 127.0.0.1:8080.

upstream_anthropic: String

Base URL of the upstream Anthropic-compatible API.

upstream_openai: String

Base URL of the upstream OpenAI-compatible API.

db_path: String

Path to the SQLite trace database.

tenant_id: String

Tenant identifier stamped on every trace when require_auth is off (single-operator default). When require_auth is on, the per-request tenant comes from the verified API key instead, and this is only the fallback for operator-scoped tooling.

require_auth: bool

Multi-tenant auth gate (ADR 0004 §D1). Default false — single-operator behavior is byte-identical: no auth checks, tenant is the static Self::tenant_id. Set via FIRSTPASS_REQUIRE_AUTH. Experimental / pre-external-review (ADR 0004 §D7).

tenant_keys: TenantKeys

Per-tenant Argon2id API-key hashes (ADR 0004 §D1). Empty unless configured via FIRSTPASS_TENANT_KEYS (path to a JSON { tenant_id: hash }) or FIRSTPASS_TENANT_KEYS_JSON (inline JSON). Only consulted when require_auth is on.

The stored hash is the Argon2id hash of a tenant’s secret (make one with TenantKeys::hash_key). A tenant then authenticates with the key <tenant_id>.<secret> — the tenant id names which hash to verify, so a request does exactly one Argon2 check. Tenant ids must not contain a . (the first . splits id from secret).

prompt_salt: String

Salt mixed into the prompt hash so raw prompt text never touches storage.

mode: Mode

Default mode when no routing config matches (observe unless overridden).

routing: Option<Config>

Optional declarative routing config (§8.4). When present, its routes decide the mode, ladder, and gates per request; enforce routes activate the escalation engine.

prices: PriceTable

Model pricing table used to cost each attempt.

max_concurrency: usize

Max in-flight requests before new ones queue behind the concurrency limiter (FIRSTPASS_MAX_CONCURRENCY, default 512). A load-shed valve, not a timeout — it never severs an in-flight SSE stream.

tenant_rate_per_sec: Option<NonZeroU32>

Per-tenant request rate limit, requests/sec (ADR 0004 §D6). None (the default) means unlimited — single-operator and existing deployments are unaffected. Set via FIRSTPASS_TENANT_RATE_PER_SEC; only enforced when configured.

Implementations

impl ProxyConfig

pub fn from_env() -> Result<Self, ConfigError>

Load configuration from environment variables, falling back to local defaults.

Errors

ConfigError::UnsupportedMode for an unknown FIRSTPASS_MODE; ConfigError::Config if the FIRSTPASS_CONFIG routing file cannot be read or parsed.

pub fn from_lookup( lookup: impl Fn(&str) -> Option<String>, ) -> Result<Self, ConfigError>

Load configuration from an arbitrary key lookup — the seam from_env uses, exposed so tests can exercise defaulting/validation without touching real process env vars. The routing config is supplied inline via the FIRSTPASS_CONFIG_TOML key.

Errors

ConfigError::UnsupportedMode for an unknown FIRSTPASS_MODE; ConfigError::Config if the inline routing TOML fails to parse.

Trait Implementations

impl Clone for ProxyConfig

fn clone(&self) -> ProxyConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ProxyConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.