rustfs_config/constants/proxy.rs
1// Copyright 2024 RustFS Team
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15use crate::DEFAULT_LOG_LEVEL;
16
17// ==================== Base Proxy Configuration ====================
18/// Environment variable to enable the trusted proxy middleware.
19pub const ENV_TRUSTED_PROXY_ENABLED: &str = "RUSTFS_TRUSTED_PROXY_ENABLED";
20/// Trusted proxy middleware is enabled by default.
21pub const DEFAULT_TRUSTED_PROXY_ENABLED: bool = true;
22
23/// Environment variable to select the trusted proxy implementation.
24pub const ENV_TRUSTED_PROXY_IMPLEMENTATION: &str = "RUSTFS_TRUSTED_PROXY_IMPLEMENTATION";
25/// The simplified implementation is used by default.
26pub const DEFAULT_TRUSTED_PROXY_IMPLEMENTATION: &str = "simple";
27
28/// Environment variable for the proxy validation mode.
29pub const ENV_TRUSTED_PROXY_VALIDATION_MODE: &str = "RUSTFS_TRUSTED_PROXY_VALIDATION_MODE";
30/// Default validation mode is "hop_by_hop".
31pub const DEFAULT_TRUSTED_PROXY_VALIDATION_MODE: &str = "hop_by_hop";
32
33/// Environment variable to enable RFC 7239 "Forwarded" header support.
34pub const ENV_TRUSTED_PROXY_ENABLE_RFC7239: &str = "RUSTFS_TRUSTED_PROXY_ENABLE_RFC7239";
35/// RFC 7239 support is enabled by default.
36pub const DEFAULT_TRUSTED_PROXY_ENABLE_RFC7239: bool = true;
37
38/// Environment variable for the maximum allowed proxy hops.
39pub const ENV_TRUSTED_PROXY_MAX_HOPS: &str = "RUSTFS_TRUSTED_PROXY_MAX_HOPS";
40/// Default maximum hops is 10.
41pub const DEFAULT_TRUSTED_PROXY_MAX_HOPS: usize = 10;
42
43/// Environment variable to enable proxy chain continuity checks.
44pub const ENV_TRUSTED_PROXY_CHAIN_CONTINUITY_CHECK: &str = "RUSTFS_TRUSTED_PROXY_CHAIN_CONTINUITY_CHECK";
45/// Continuity checks are enabled by default.
46pub const DEFAULT_TRUSTED_PROXY_CHAIN_CONTINUITY_CHECK: bool = true;
47
48/// Environment variable to enable logging of failed proxy validations.
49pub const ENV_TRUSTED_PROXY_LOG_FAILED_VALIDATIONS: &str = "RUSTFS_TRUSTED_PROXY_LOG_FAILED_VALIDATIONS";
50/// Logging of failed validations is enabled by default.
51pub const DEFAULT_TRUSTED_PROXY_LOG_FAILED_VALIDATIONS: bool = true;
52
53// ==================== Trusted Proxy Networks ====================
54/// Environment variable for the list of trusted proxy networks (comma-separated IP/CIDR).
55pub const ENV_TRUSTED_PROXY_PROXIES: &str = "RUSTFS_TRUSTED_PROXY_NETWORKS";
56/// Default trusted networks are loopback-only. Private/RFC1918 ranges are not
57/// trusted by default: an operator must explicitly add the specific proxy
58/// addresses in front of this server to have forwarding headers honored.
59pub const DEFAULT_TRUSTED_PROXY_PROXIES: &str = "127.0.0.1,::1";
60
61/// Environment variable for additional trusted proxy networks (production specific).
62pub const ENV_TRUSTED_PROXY_EXTRA_PROXIES: &str = "RUSTFS_TRUSTED_PROXY_EXTRA_NETWORKS";
63/// No extra trusted networks by default.
64pub const DEFAULT_TRUSTED_PROXY_EXTRA_PROXIES: &str = "";
65
66/// Environment variable for individual trusted proxy IPs.
67pub const ENV_TRUSTED_PROXY_IPS: &str = "RUSTFS_TRUSTED_PROXY_IPS";
68/// No individual trusted IPs by default.
69pub const DEFAULT_TRUSTED_PROXY_IPS: &str = "";
70
71/// Environment variable for private network ranges used in internal validation.
72pub const ENV_TRUSTED_PROXY_PRIVATE_NETWORKS: &str = "RUSTFS_TRUSTED_PROXY_PRIVATE_NETWORKS";
73/// Default private networks include common RFC 1918 and RFC 4193 ranges.
74pub const DEFAULT_TRUSTED_PROXY_PRIVATE_NETWORKS: &str = "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fd00::/8";
75
76// ==================== Cache Configuration ====================
77/// Environment variable for the proxy validation cache capacity.
78pub const ENV_TRUSTED_PROXY_CACHE_CAPACITY: &str = "RUSTFS_TRUSTED_PROXY_CACHE_CAPACITY";
79/// Default cache capacity is 10,000 entries.
80pub const DEFAULT_TRUSTED_PROXY_CACHE_CAPACITY: usize = 10_000;
81
82/// Environment variable for the cache entry time-to-live (TTL) in seconds.
83pub const ENV_TRUSTED_PROXY_CACHE_TTL_SECONDS: &str = "RUSTFS_TRUSTED_PROXY_CACHE_TTL_SECONDS";
84/// Default cache TTL is 300 seconds (5 minutes).
85pub const DEFAULT_TRUSTED_PROXY_CACHE_TTL_SECONDS: u64 = 300;
86
87/// Environment variable for the cache cleanup interval in seconds.
88pub const ENV_TRUSTED_PROXY_CACHE_CLEANUP_INTERVAL: &str = "RUSTFS_TRUSTED_PROXY_CACHE_CLEANUP_INTERVAL";
89/// Default cleanup interval is 60 seconds.
90pub const DEFAULT_TRUSTED_PROXY_CACHE_CLEANUP_INTERVAL: u64 = 60;
91
92// ==================== Monitoring Configuration ====================
93/// Environment variable to enable Prometheus metrics.
94pub const ENV_TRUSTED_PROXY_METRICS_ENABLED: &str = "RUSTFS_TRUSTED_PROXY_METRICS_ENABLED";
95/// Metrics are enabled by default.
96pub const DEFAULT_TRUSTED_PROXY_METRICS_ENABLED: bool = true;
97
98/// Environment variable for the application log level.
99pub const ENV_TRUSTED_PROXIES_LOG_LEVEL: &str = "RUSTFS_TRUSTED_PROXY_LOG_LEVEL";
100/// Default log level is "info".
101pub const DEFAULT_TRUSTED_PROXIES_LOG_LEVEL: &str = DEFAULT_LOG_LEVEL;
102
103/// Environment variable to enable structured JSON logging.
104pub const ENV_TRUSTED_PROXY_STRUCTURED_LOGGING: &str = "RUSTFS_TRUSTED_PROXY_STRUCTURED_LOGGING";
105/// Structured logging is disabled by default.
106pub const DEFAULT_TRUSTED_PROXY_STRUCTURED_LOGGING: bool = false;
107
108/// Environment variable to enable distributed tracing.
109pub const ENV_TRUSTED_PROXY_TRACING_ENABLED: &str = "RUSTFS_TRUSTED_PROXY_TRACING_ENABLED";
110/// Tracing is enabled by default.
111pub const DEFAULT_TRUSTED_PROXY_TRACING_ENABLED: bool = true;
112
113// ==================== Cloud Integration ====================
114/// Environment variable to enable automatic cloud metadata discovery.
115pub const ENV_TRUSTED_PROXY_CLOUD_METADATA_ENABLED: &str = "RUSTFS_TRUSTED_PROXY_CLOUD_METADATA_ENABLED";
116/// Cloud metadata discovery is disabled by default.
117pub const DEFAULT_TRUSTED_PROXY_CLOUD_METADATA_ENABLED: bool = false;
118
119/// Environment variable for the cloud metadata request timeout in seconds.
120pub const ENV_TRUSTED_PROXY_CLOUD_METADATA_TIMEOUT: &str = "RUSTFS_TRUSTED_PROXY_CLOUD_METADATA_TIMEOUT";
121/// Default cloud metadata timeout is 5 seconds.
122pub const DEFAULT_TRUSTED_PROXY_CLOUD_METADATA_TIMEOUT: u64 = 5;
123
124/// Environment variable to enable Cloudflare IP range integration.
125pub const ENV_TRUSTED_PROXY_CLOUDFLARE_IPS_ENABLED: &str = "RUSTFS_TRUSTED_PROXY_CLOUDFLARE_IPS_ENABLED";
126/// Cloudflare integration is disabled by default.
127pub const DEFAULT_TRUSTED_PROXY_CLOUDFLARE_IPS_ENABLED: bool = false;
128
129/// Environment variable to force a specific cloud provider (overrides auto-detection).
130pub const ENV_TRUSTED_PROXY_CLOUD_PROVIDER_FORCE: &str = "RUSTFS_TRUSTED_PROXY_CLOUD_PROVIDER_FORCE";
131/// No forced provider by default.
132pub const DEFAULT_TRUSTED_PROXY_CLOUD_PROVIDER_FORCE: &str = "";