a4eb4d4c3a
Split the monolithic config.go (~120KB) into focused modules: - auth.go: JWT, TOTP, Turnstile, RateLimit configs - billing.go: Billing and Pricing configs - database.go: Database and Redis configs - gateway.go: Gateway and Upstream configs - gateway_sub.go: Gateway sub-configurations - ops_and_cache.go: Ops and Cache configs - platforms.go: Platform-specific configs - security.go: Security-related configs - server.go: Server configuration - config_defaults.go: Default values - config_defaults_detail.go: Detailed defaults - config_helpers.go: Helper functions - config_validate.go: Validation logic - config_validate_gateway.go: Gateway validation This improves: - Code maintainability and readability - Faster compilation (smaller files) - Easier navigation and debugging - Better separation of concerns
49 lines
2.0 KiB
Go
49 lines
2.0 KiB
Go
package config
|
||
|
||
// SecurityConfig 安全相关配置
|
||
type SecurityConfig struct {
|
||
URLAllowlist URLAllowlistConfig `mapstructure:"url_allowlist"`
|
||
ResponseHeaders ResponseHeaderConfig `mapstructure:"response_headers"`
|
||
CSP CSPConfig `mapstructure:"csp"`
|
||
ProxyFallback ProxyFallbackConfig `mapstructure:"proxy_fallback"`
|
||
ProxyProbe ProxyProbeConfig `mapstructure:"proxy_probe"`
|
||
}
|
||
|
||
// URLAllowlistConfig URL 白名单配置
|
||
type URLAllowlistConfig struct {
|
||
Enabled bool `mapstructure:"enabled"`
|
||
UpstreamHosts []string `mapstructure:"upstream_hosts"`
|
||
PricingHosts []string `mapstructure:"pricing_hosts"`
|
||
CRSHosts []string `mapstructure:"crs_hosts"`
|
||
AllowPrivateHosts bool `mapstructure:"allow_private_hosts"`
|
||
// 关闭 URL 白名单校验时，是否允许 http URL（默认只允许 https）
|
||
AllowInsecureHTTP bool `mapstructure:"allow_insecure_http"`
|
||
}
|
||
|
||
// ResponseHeaderConfig 安全响应头配置
|
||
type ResponseHeaderConfig struct {
|
||
Enabled bool `mapstructure:"enabled"`
|
||
AdditionalAllowed []string `mapstructure:"additional_allowed"`
|
||
ForceRemove []string `mapstructure:"force_remove"`
|
||
}
|
||
|
||
// CSPConfig Content-Security-Policy 配置
|
||
type CSPConfig struct {
|
||
Enabled bool `mapstructure:"enabled"`
|
||
Policy string `mapstructure:"policy"`
|
||
}
|
||
|
||
// ProxyFallbackConfig 代理回退配置
|
||
type ProxyFallbackConfig struct {
|
||
// AllowDirectOnError 当辅助服务的代理初始化失败时是否允许回退直连。
|
||
// 仅影响非 AI 账号连接的辅助服务（GitHub Release 更新检查、定价数据拉取）。
|
||
// 不影响 AI 账号网关连接，这些关键路径的代理失败始终返回错误。
|
||
// 默认 false：避免因代理配置错误导致服务器真实 IP 泄露。
|
||
AllowDirectOnError bool `mapstructure:"allow_direct_on_error"`
|
||
}
|
||
|
||
// ProxyProbeConfig 代理探测配置
|
||
type ProxyProbeConfig struct {
|
||
InsecureSkipVerify bool `mapstructure:"insecure_skip_verify"` // 已禁用：禁止跳过 TLS 证书验证
|
||
}
|