Init

internal/config/config.go

@@ -0,0 +1,145 @@
+package config
+
+import (
+	"fmt"
+	"net/netip"
+	"net/url"
+	"os"
+	"regexp"
+	"strings"
+
+	"gopkg.in/yaml.v3"
+)
+
+var aliasRe = regexp.MustCompile(`^[a-z0-9][a-z0-9_-]*$`)
+
+// Config is the gateway YAML configuration.
+type Config struct {
+	Listen         string   `yaml:"listen"`
+	AllowAll       bool     `yaml:"allow_all"`
+	WhitelistCIDRs []string `yaml:"whitelist_cidrs"`
+	TrustedProxies []string `yaml:"trusted_proxies"`
+	Servers        []Server `yaml:"servers"`
+}
+
+// Server maps a URL alias to an upstream base URL.
+type Server struct {
+	Alias            string `yaml:"alias"`
+	BaseURL          string `yaml:"base_url"`
+	PathPrefix       string `yaml:"path_prefix"`
+	AuthorizationEnv string `yaml:"authorization_env"`
+}
+
+// Load reads and validates configuration from path.
+func Load(path string) (*Config, error) {
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("read config: %w", err)
+	}
+	var c Config
+	if err := yaml.Unmarshal(raw, &c); err != nil {
+		return nil, fmt.Errorf("parse yaml: %w", err)
+	}
+	if err := c.Validate(); err != nil {
+		return nil, err
+	}
+	return &c, nil
+}
+
+// Validate checks required fields and formats.
+func (c *Config) Validate() error {
+	if c.Listen == "" {
+		c.Listen = ":8080"
+	}
+	seen := make(map[string]struct{})
+	for i := range c.Servers {
+		s := &c.Servers[i]
+		if s.Alias == "" {
+			return fmt.Errorf("servers[%d]: alias is required", i)
+		}
+		if !aliasRe.MatchString(s.Alias) {
+			return fmt.Errorf("servers[%d]: alias %q must match %s", i, s.Alias, aliasRe.String())
+		}
+		if _, ok := seen[s.Alias]; ok {
+			return fmt.Errorf("duplicate alias %q", s.Alias)
+		}
+		seen[s.Alias] = struct{}{}
+		if s.BaseURL == "" {
+			return fmt.Errorf("servers[%d]: base_url is required", i)
+		}
+		u, err := url.Parse(s.BaseURL)
+		if err != nil || u.Scheme == "" || u.Host == "" {
+			return fmt.Errorf("servers[%d]: invalid base_url %q", i, s.BaseURL)
+		}
+		if s.PathPrefix == "" {
+			s.PathPrefix = "/v1"
+		}
+		s.PathPrefix = strings.TrimSuffix(s.PathPrefix, "/")
+		if !strings.HasPrefix(s.PathPrefix, "/") {
+			s.PathPrefix = "/" + s.PathPrefix
+		}
+	}
+	if len(c.Servers) == 0 {
+		return fmt.Errorf("at least one server entry is required")
+	}
+	for i, s := range c.WhitelistCIDRs {
+		if _, err := netip.ParsePrefix(strings.TrimSpace(s)); err != nil {
+			return fmt.Errorf("whitelist_cidrs[%d]: %w", i, err)
+		}
+	}
+	for i, s := range c.TrustedProxies {
+		if _, err := netip.ParsePrefix(strings.TrimSpace(s)); err != nil {
+			return fmt.Errorf("trusted_proxies[%d]: %w", i, err)
+		}
+	}
+	return nil
+}
+
+// Parsed holds compiled CIDR lists and server map.
+type Parsed struct {
+	Config           *Config
+	Whitelist        []netip.Prefix
+	Trusted          []netip.Prefix
+	ByAlias          map[string]*Server
+	AuthByAlias      map[string]string // non-empty Authorization value per alias
+}
+
+// Parse compiles CIDRs and resolves authorization from environment.
+func (c *Config) Parse() (*Parsed, error) {
+	var wl []netip.Prefix
+	for _, s := range c.WhitelistCIDRs {
+		p, err := netip.ParsePrefix(strings.TrimSpace(s))
+		if err != nil {
+			return nil, err
+		}
+		wl = append(wl, p)
+	}
+	var tr []netip.Prefix
+	for _, s := range c.TrustedProxies {
+		p, err := netip.ParsePrefix(strings.TrimSpace(s))
+		if err != nil {
+			return nil, err
+		}
+		tr = append(tr, p)
+	}
+	by := make(map[string]*Server, len(c.Servers))
+	auth := make(map[string]string)
+	for i := range c.Servers {
+		s := &c.Servers[i]
+		by[s.Alias] = s
+		if s.AuthorizationEnv != "" {
+			v := os.Getenv(s.AuthorizationEnv)
+			if v == "" {
+				return nil, fmt.Errorf("server %q: env %q is empty or unset", s.Alias, s.AuthorizationEnv)
+			}
+			auth[s.Alias] = v
+		}
+	}
+	return &Parsed{
+		Config:      c,
+		Whitelist:   wl,
+		Trusted:     tr,
+		ByAlias:     by,
+		AuthByAlias: auth,
+	}, nil
+}

internal/config/config_test.go

@@ -0,0 +1,44 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestLoadExample(t *testing.T) {
+	dir := t.TempDir()
+	p := filepath.Join(dir, "cfg.yaml")
+	if err := os.WriteFile(p, []byte(`
+listen: ":0"
+allow_all: true
+servers:
+  - alias: main_srv
+    base_url: http://127.0.0.1:9091
+`), 0644); err != nil {
+		t.Fatal(err)
+	}
+	c, err := Load(p)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c.Listen != ":0" {
+		t.Fatalf("listen: %q", c.Listen)
+	}
+	_, err = c.Parse()
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestValidateDuplicateAlias(t *testing.T) {
+	c := &Config{
+		Servers: []Server{
+			{Alias: "a", BaseURL: "http://x:1"},
+			{Alias: "a", BaseURL: "http://y:2"},
+		},
+	}
+	if err := c.Validate(); err == nil {
+		t.Fatal("expected error")
+	}
+}

internal/proxy/reverse.go

@@ -0,0 +1,33 @@
+package proxy
+
+import (
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"strings"
+)
+
+// NewReverseProxy builds a reverse proxy to target base URL with path rewriting:
+// stripPrefix (/api/{alias}) + pathPrefix (/v1) + remainder.
+func NewReverseProxy(target *url.URL, stripPrefix, pathPrefix string, setAuth string) *httputil.ReverseProxy {
+	proxy := httputil.NewSingleHostReverseProxy(target)
+	orig := proxy.Director
+	proxy.Director = func(req *http.Request) {
+		orig(req)
+		p := req.URL.Path
+		if strings.HasPrefix(p, stripPrefix) {
+			rest := strings.TrimPrefix(p, stripPrefix)
+			rest = strings.TrimPrefix(rest, "/")
+			if rest == "" {
+				req.URL.Path = pathPrefix
+			} else {
+				req.URL.Path = pathPrefix + "/" + rest
+			}
+			req.URL.RawPath = ""
+		}
+		if setAuth != "" {
+			req.Header.Set("Authorization", setAuth)
+		}
+	}
+	return proxy
+}

internal/proxy/reverse_test.go

@@ -0,0 +1,26 @@
+package proxy
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+)
+
+func TestReverseProxyPathRewrite(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v1/health" {
+			t.Fatalf("path %q", r.URL.Path)
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+	up, _ := url.Parse(srv.URL)
+	rp := NewReverseProxy(up, "/api/main_srv", "/v1", "")
+	req := httptest.NewRequest(http.MethodGet, "/api/main_srv/health", nil)
+	rec := httptest.NewRecorder()
+	rp.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d", rec.Code)
+	}
+}

internal/server/clientip.go

@@ -0,0 +1,65 @@
+package server
+
+import (
+	"net"
+	"net/http"
+	"net/netip"
+	"strings"
+)
+
+// ClientIP returns the client address for access control, using X-Forwarded-For /
+// X-Real-IP only when the direct peer is in trusted CIDRs.
+func ClientIP(r *http.Request, trusted []netip.Prefix) netip.Addr {
+	host, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		host = r.RemoteAddr
+	}
+	peer, err := netip.ParseAddr(host)
+	if err != nil {
+		return netip.Addr{}
+	}
+	if !containsIP(trusted, peer) {
+		return peer
+	}
+	if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
+		parts := strings.Split(xff, ",")
+		for _, p := range parts {
+			p = strings.TrimSpace(p)
+			if p == "" {
+				continue
+			}
+			if a, err := netip.ParseAddr(p); err == nil {
+				return a
+			}
+		}
+	}
+	if xr := strings.TrimSpace(r.Header.Get("X-Real-IP")); xr != "" {
+		if a, err := netip.ParseAddr(xr); err == nil {
+			return a
+		}
+	}
+	return peer
+}
+
+func containsIP(prefixes []netip.Prefix, addr netip.Addr) bool {
+	for _, p := range prefixes {
+		if p.Contains(addr) {
+			return true
+		}
+	}
+	return false
+}
+
+// Allowed reports whether addr matches whitelist rules.
+func Allowed(addr netip.Addr, allowAll bool, whitelist []netip.Prefix) bool {
+	if !addr.IsValid() {
+		return false
+	}
+	if allowAll {
+		return true
+	}
+	if len(whitelist) == 0 {
+		return false
+	}
+	return containsIP(whitelist, addr)
+}

internal/server/clientip_test.go

@@ -0,0 +1,34 @@
+package server
+
+import (
+	"net/http"
+	"net/netip"
+	"testing"
+)
+
+func TestAllowed(t *testing.T) {
+	p, _ := netip.ParsePrefix("127.0.0.1/32")
+	a := netip.MustParseAddr("127.0.0.1")
+	if !Allowed(a, false, []netip.Prefix{p}) {
+		t.Fatal("expected allowed")
+	}
+	if Allowed(a, false, nil) {
+		t.Fatal("empty whitelist should deny")
+	}
+	if !Allowed(a, true, nil) {
+		t.Fatal("allow_all")
+	}
+}
+
+func TestClientIPTrustedXFF(t *testing.T) {
+	trusted, _ := netip.ParsePrefix("10.0.0.1/32")
+	r := &http.Request{
+		Header: http.Header{},
+		RemoteAddr: "10.0.0.1:12345",
+	}
+	r.Header.Set("X-Forwarded-For", "203.0.113.5, 10.0.0.1")
+	ip := ClientIP(r, []netip.Prefix{trusted})
+	if ip.String() != "203.0.113.5" {
+		t.Fatalf("got %v", ip)
+	}
+}

internal/server/gateway.go

@@ -0,0 +1,221 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+
+	"github.com/telemt/telemt-api/internal/config"
+	"github.com/telemt/telemt-api/internal/proxy"
+)
+
+// Gateway serves health, metrics, and proxied API routes.
+type Gateway struct {
+	parsed        *config.Parsed
+	proxies       map[string]*httputil.ReverseProxy
+	log           *slog.Logger
+	transport     *http.Transport
+	promHandler   http.Handler
+}
+
+// NewGateway builds handlers and reverse proxies from parsed config.
+func NewGateway(p *config.Parsed, log *slog.Logger) (*Gateway, error) {
+	t := &http.Transport{
+		Proxy:                 http.ProxyFromEnvironment,
+		MaxIdleConns:          64,
+		IdleConnTimeout:       90 * time.Second,
+		TLSHandshakeTimeout:   10 * time.Second,
+		ExpectContinueTimeout: 1 * time.Second,
+		DialContext:           (&net.Dialer{Timeout: 5 * time.Second, KeepAlive: 30 * time.Second}).DialContext,
+		ResponseHeaderTimeout: 120 * time.Second,
+	}
+	g := &Gateway{
+		parsed:      p,
+		proxies:     make(map[string]*httputil.ReverseProxy),
+		log:         log,
+		transport:   t,
+		promHandler: promhttp.Handler(),
+	}
+	for i := range p.Config.Servers {
+		s := &p.Config.Servers[i]
+		u, err := url.Parse(s.BaseURL)
+		if err != nil {
+			return nil, err
+		}
+		auth := p.AuthByAlias[s.Alias]
+		strip := "/api/" + s.Alias
+		rp := proxy.NewReverseProxy(u, strip, s.PathPrefix, auth)
+		rp.Transport = t
+		rp.ErrorHandler = func(w http.ResponseWriter, r *http.Request, err error) {
+			log.Error("upstream error", "alias", s.Alias, "err", err)
+			w.Header().Set("Content-Type", "application/json; charset=utf-8")
+			w.WriteHeader(http.StatusBadGateway)
+			_ = json.NewEncoder(w).Encode(map[string]any{
+				"ok":    false,
+				"error": map[string]string{"code": "bad_gateway", "message": "upstream unreachable"},
+			})
+		}
+		g.proxies[s.Alias] = rp
+	}
+	return g, nil
+}
+
+// Handler returns the root HTTP handler with middleware.
+func (g *Gateway) Handler() http.Handler {
+	var h http.Handler = http.HandlerFunc(g.serve)
+	h = g.withWhitelist(h)
+	h = g.withAccessLog(h)
+	h = g.withMetrics(h)
+	return h
+}
+
+func (g *Gateway) withWhitelist(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/health" {
+			next.ServeHTTP(w, r)
+			return
+		}
+		ip := ClientIP(r, g.parsed.Trusted)
+		if !Allowed(ip, g.parsed.Config.AllowAll, g.parsed.Whitelist) {
+			w.Header().Set("Content-Type", "application/json; charset=utf-8")
+			w.WriteHeader(http.StatusForbidden)
+			_ = json.NewEncoder(w).Encode(map[string]any{
+				"ok":    false,
+				"error": map[string]string{"code": "forbidden", "message": "source address not allowed"},
+			})
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+func (g *Gateway) withAccessLog(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		rid := r.Header.Get("X-Request-Id")
+		if rid == "" {
+			rid = randomID()
+			r.Header.Set("X-Request-Id", rid)
+		}
+		w.Header().Set("X-Request-Id", rid)
+		start := time.Now()
+		lw := &statusWriter{ResponseWriter: w, status: http.StatusOK}
+		next.ServeHTTP(lw, r)
+		g.log.Info("request",
+			"request_id", rid,
+			"method", r.Method,
+			"path", r.URL.Path,
+			"status", lw.status,
+			"duration_ms", time.Since(start).Milliseconds(),
+			"remote", r.RemoteAddr,
+		)
+	})
+}
+
+func (g *Gateway) withMetrics(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/health" {
+			next.ServeHTTP(w, r)
+			return
+		}
+		httpInFlight.Inc()
+		start := time.Now()
+		alias := routeAlias(r.URL.Path)
+		lw := &statusWriter{ResponseWriter: w, status: http.StatusOK}
+		defer observeRequest(r.Method, alias, lw.status, start)
+		next.ServeHTTP(lw, r)
+	})
+}
+
+func routeAlias(path string) string {
+	const pfx = "/api/"
+	if !strings.HasPrefix(path, pfx) {
+		if path == "/metrics" {
+			return "metrics"
+		}
+		return "_"
+	}
+	rest := strings.TrimPrefix(path, pfx)
+	if rest == "" {
+		return "_"
+	}
+	i := strings.IndexByte(rest, '/')
+	if i < 0 {
+		return rest
+	}
+	return rest[:i]
+}
+
+func (g *Gateway) serve(w http.ResponseWriter, r *http.Request) {
+	switch r.URL.Path {
+	case "/health":
+		if r.Method != http.MethodGet {
+			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json; charset=utf-8")
+		_ = json.NewEncoder(w).Encode(map[string]any{"status": "ok"})
+		return
+	case "/metrics":
+		if r.Method != http.MethodGet {
+			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+			return
+		}
+		g.promHandler.ServeHTTP(w, r)
+		return
+	}
+	const prefix = "/api/"
+	if !strings.HasPrefix(r.URL.Path, prefix) {
+		http.NotFound(w, r)
+		return
+	}
+	trim := strings.TrimPrefix(r.URL.Path, prefix)
+	if trim == "" {
+		http.NotFound(w, r)
+		return
+	}
+	var alias string
+	if i := strings.IndexByte(trim, '/'); i >= 0 {
+		alias = trim[:i]
+	} else {
+		alias = trim
+	}
+	if alias == "" {
+		http.NotFound(w, r)
+		return
+	}
+	rp, ok := g.proxies[alias]
+	if !ok {
+		w.Header().Set("Content-Type", "application/json; charset=utf-8")
+		w.WriteHeader(http.StatusNotFound)
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"ok":    false,
+			"error": map[string]string{"code": "not_found", "message": "unknown alias"},
+		})
+		return
+	}
+	rp.ServeHTTP(w, r)
+}
+
+type statusWriter struct {
+	http.ResponseWriter
+	status int
+}
+
+func (s *statusWriter) WriteHeader(code int) {
+	s.status = code
+	s.ResponseWriter.WriteHeader(code)
+}
+
+// Shutdown idle connections on the shared transport.
+func (g *Gateway) Shutdown(ctx context.Context) error {
+	g.transport.CloseIdleConnections()
+	return nil
+}

internal/server/metrics.go

@@ -0,0 +1,31 @@
+package server
+
+import (
+	"strconv"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promauto"
+)
+
+var (
+	httpInFlight = promauto.NewGauge(prometheus.GaugeOpts{
+		Name: "telemt_gateway_http_in_flight",
+		Help: "Current requests being served.",
+	})
+	httpRequests = promauto.NewCounterVec(prometheus.CounterOpts{
+		Name: "telemt_gateway_http_requests_total",
+		Help: "HTTP requests by status, method, alias.",
+	}, []string{"code", "method", "alias"})
+	httpDuration = promauto.NewHistogramVec(prometheus.HistogramOpts{
+		Name:    "telemt_gateway_http_request_duration_seconds",
+		Help:    "Request duration in seconds.",
+		Buckets: prometheus.DefBuckets,
+	}, []string{"method", "alias"})
+)
+
+func observeRequest(method, alias string, status int, started time.Time) {
+	httpInFlight.Dec()
+	httpRequests.WithLabelValues(strconv.Itoa(status), method, alias).Inc()
+	httpDuration.WithLabelValues(method, alias).Observe(time.Since(started).Seconds())
+}

internal/server/rand_id.go

@@ -0,0 +1,14 @@
+package server
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+)
+
+func randomID() string {
+	var b [16]byte
+	if _, err := rand.Read(b[:]); err != nil {
+		return "unknown"
+	}
+	return hex.EncodeToString(b[:])
+}