Struct EgressProxy 

pub struct EgressProxy { /* private fields */ }

A running egress proxy: accept loop + per-connection tunnel tasks, all torn down by EgressProxy::shutdown.

Implementations

impl EgressProxy

pub async fn start( allowlist: Vec<String>, denial_file: PathBuf, ) -> Result<EgressProxy>

Bind an ephemeral 127.0.0.1 port and start serving. allowlist is the raw host:port strings (strictly parsed — a bad entry fails closed); denial_file is created/appended, fsynced per record.

pub async fn start_bound( addr: SocketAddr, allowlist: Vec<String>, denial_file: PathBuf, ) -> Result<EgressProxy>

EgressProxy::start on an explicit address — the seam tests use to force a bind conflict (fail-closed proof).

pub async fn start_authenticated_bound( addr: SocketAddr, allowlist: Vec<String>, denial_file: PathBuf, relay_authority: String, ) -> Result<EgressProxy>

Bind an explicit address and require Proxy-Authorization: Bearer … on every CONNECT. The Docker relay owns the token; the worker never sees it. Authentication failure returns 407 and never records a host denial, so an unauthenticated peer cannot forge grant requests.

pub fn addr(&self) -> SocketAddr

The address the proxy actually bound (ephemeral port read back).

pub fn port(&self) -> u16

pub async fn shutdown(self) -> Vec<EgressDenial>

Stop accepting and abort any in-flight tunnels, then return the denials THIS proxy recorded (first-seen order). Called once the run’s session stream has closed, so the returned vec is complete for the run.

Trait Implementations

impl Debug for EgressProxy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Drop for EgressProxy

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.