Struct RouteConfig 

pub struct RouteConfig {

    pub prefix: String,
    pub upstream: String,
    pub credential_key: Option<String>,
    pub inject_mode: InjectMode,
    pub inject_header: String,
    pub credential_format: String,
    pub path_pattern: Option<String>,
    pub path_replacement: Option<String>,
    pub query_param_name: Option<String>,
    pub env_var: Option<String>,
    pub endpoint_rules: Vec<EndpointRule>,
    pub tls_ca: Option<String>,
    pub tls_client_cert: Option<String>,
    pub tls_client_key: Option<String>,
}

Configuration for a reverse proxy credential route.

Fields

prefix: String

Path prefix for routing (e.g., “openai”). Must NOT include leading or trailing slashes — it is a bare service name, not a URL path.

upstream: String

Upstream URL to forward to (e.g., “https://api.openai.com”)

credential_key: Option<String>

Keystore account name to load the credential from. If None, no credential is injected.

inject_mode: InjectMode

Injection mode (default: “header”)

inject_header: String

HTTP header name for the credential (default: “Authorization”) Only used when inject_mode is “header”.

credential_format: String

Format string for the credential value. {} is replaced with the secret. Default: “Bearer {}” Only used when inject_mode is “header”.

path_pattern: Option<String>

Pattern to match in incoming URL path. Use {} as placeholder for phantom token. Example: “/bot{}/” matches “/bot/getMe” Only used when inject_mode is “url_path”.

path_replacement: Option<String>

Pattern for outgoing URL path. Use {} as placeholder for real credential. Defaults to same as path_pattern if not specified. Only used when inject_mode is “url_path”.

query_param_name: Option<String>

Name of the query parameter to add/replace with the credential. Only used when inject_mode is “query_param”.

env_var: Option<String>

Explicit environment variable name for the phantom token (e.g., “OPENAI_API_KEY”).

When set, this is used as the SDK API key env var name instead of deriving it from credential_key.to_uppercase(). Required when credential_key is a URI manager reference (e.g., op://, apple-password://) which would otherwise produce a nonsensical env var name.

endpoint_rules: Vec<EndpointRule>

Optional L7 endpoint rules for method+path filtering.

When non-empty, only requests matching at least one rule are allowed (default-deny). When empty, all method+path combinations are permitted (backward compatible).

tls_ca: Option<String>

Optional path to a PEM-encoded CA certificate file for upstream TLS.

When set, the proxy trusts this CA in addition to the system roots when connecting to the upstream for this route. This is required for upstreams that use self-signed or private CA certificates (e.g., Kubernetes API servers).

tls_client_cert: Option<String>

Optional path to a PEM-encoded client certificate for upstream mTLS.

When set together with tls_client_key, the proxy presents this certificate to the upstream during TLS handshake. Required for upstreams that enforce mutual TLS (e.g., Kubernetes API servers configured with client-certificate authentication).

tls_client_key: Option<String>

Optional path to a PEM-encoded private key for upstream mTLS.

Must be set together with tls_client_cert. The key must correspond to the certificate in tls_client_cert.

Trait Implementations

impl Clone for RouteConfig

fn clone(&self) -> RouteConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RouteConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for RouteConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for RouteConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.