stats-gateway/configs/tunnel.yaml at 731b60863a7d40b5c814c646ed04dc55711beb18 - stats-gateway - Gitea (projectshitpost)

bergamot/stats-gateway

Files

T

bergamot 731b60863a feat: tunnel JWT auth

Tunnel method now requires Bearer JWT (HMAC-HS256) in gRPC metadata.
   - internal/auth: pure-stdlib verifier + issuer + revoked-jti list
   - internal/tunnel: per-target rate limiter + egress allowlist with
     wildcard support + crypto/rand frame padding to {1KB, 4KB, 16KB}
   - cmd/server reads /etc/stats-gateway/{jwt.key,tunnel.yaml,revoked.txt}
     via --config-dir flag
   - cmd/issue-token Go binary wraps auth.Issue
   - configs/tunnel.yaml example with projectshitpost wildcard


Tests: 13 PASS across 5 packages.

2026-05-05 21:28:37 +05:00

7 lines

236 B

YAML

Raw Blame History

 egress:
   allowed:
     - "192.0.2.10:8443"          # FL xray inbound (production)
     - "*.projectshitpost.fun:443" # any subdomain HTTPS
     # TODO: add PL1 IP:port once confirmed (controller to fill in during deploy)
   rate_mbps: 50