Module config 

YAML-based proxy configuration.

All product-specific behavior is driven by config, not code. Same binary, different YAML = different product proxy.

Structs

AliasConfig

Path alias (rewrite before routing).

AuthConfig

Auth configuration.

AuthzConfig

External authorization via the Envoy ext_authz gRPC contract (envoy.service.auth.v3.Authorization/Check). Interops with OPA and any ext_authz server.

ClientAddressConfig

How the client’s address is resolved, for every consumer of it at once (the rate limits, the hooks, the fallback, the upstream), and what the upstream receives of it.

ConcurrencyConfig

Request concurrency limit: requests past max_in_flight are answered UNAVAILABLE (503) at once instead of queueing.

CorsConfig

CORS configuration.

ForwardAuthConfig

Forward auth config.

ForwardConfig

What the upstream (and the fallback) receives of the client’s address.

GrpcWebConfig

How gRPC-Web calls reach the upstream.

HealthConfig

Health-probe endpoint configuration.

JwtCacheConfig

auth.jwt.cache: verified claims are reused until the earlier of the token’s exp and max_ttl_secs after verification. Applies to the built-in verifier only; an injected TokenVerifier is called every time.

JwtConfig

JWT validation config.

JwtLimitConfig

Claims that carry a key’s limit inside the JWT itself. A tier-name claim maps to a profiles entry (numbers stay tunable in config); direct numeric claims set the limit explicitly.

LimitProfileConfig

A named limit tier: a sustained rate plus an instantaneous burst capacity.

LimitServiceConfig

External limit-resolution service. The response names a tier or gives explicit numbers; results are cached and refreshed asynchronously, never on the request path.

ListenConfig

The listener ProxyServer::serve runs.

ListenTlsConfig

TLS for the listener.

LoggingConfig

Logging configuration.

MaintenanceConfig

Maintenance mode config.

MetricsClassConfig

Metrics endpoint classification.

MetricsConfig

Prometheus metrics endpoint configuration.

OidcDiscoveryConfig

OIDC discovery config.

OpenApiConfig

OpenAPI generation config.

ProxyConfig

Top-level proxy configuration (loaded from YAML).

RateRuleConfig

One rate-limit rule: a path pattern, how to key it, and an optional static profile. The rule’s phase (before or after auth) is derived from its key alone: a jwt_claim key needs validated claims so it runs after auth; ip and header keys run before auth so anonymous floods are shed before any signature verification. (jwt_limits therefore only takes effect on jwt_claim rules, the only ones running with claims available.)

RoutePolicyConfig

Route policy entry.

ScopeConfig

The traffic a guard covers, and optionally which paths and methods of it.

ServiceConfig

Service identity.

ShieldConfig

Shield (rate limiting) configuration.

SigningKeyConfig

Signing key config for JWKS endpoint.

StreamingConfig

Server-streaming response behavior.

SyncConfig

Asynchronous cross-instance reconciliation via a shared store.

TranscodeConfig

Which annotated RPCs are transcoded.

UpstreamConfig

Upstream gRPC service configuration.

Enums

ClientAuth

Whether a TLS client must present a certificate.

DescriptorSource

Descriptor loading source.

ForwardingHeader

The header trusted proxies report the client’s address in.

KeySourceConfig

How a rule derives its limit key. All sources fall back to the client IP when their value is absent, so a limit can’t be bypassed by omitting a header or authenticating anonymously. Written as a tagged map, e.g. key: { type: jwt_claim, claim: sub }; omitting key defaults to ip.

Traffic

A class of traffic the proxy tells apart before any guard runs.

XForwardedFor

What X-Forwarded-For carries upstream. X-Real-IP and Forwarded (RFC 7239) from the request reach the upstream only with preserve; in every other mode they are removed, since they would contradict it.

Functions

from_yaml

One config section from YAML, the way the config file reads it: for the sections an embedder hands to a builder method, such as ProxyServer::with_rate_limits.