chore: initial commit

internal/config/config.go

@@ -0,0 +1,76 @@
+package config
+
+import (
+	"fmt"
+	"io"
+	"net/netip"
+	"os"
+	"strings"
+
+	"gopkg.in/yaml.v3"
+)
+
+type Config struct {
+	Server struct {
+		TrustedProxies []string `yaml:"trusted_proxies"`
+		Listen         string   `yaml:"listen"`
+		PublicOrigin   string   `yaml:"public_origin"`
+	} `yaml:"server"`
+	Admin struct {
+		Password string `yaml:"password"`
+	} `yaml:"admin"`
+	Storage struct {
+		LogRetentionDays int    `yaml:"log_retention_days"`
+		Path             string `yaml:"path"`
+	} `yaml:"storage"`
+	Limits struct {
+		RequestsPerMinute int `yaml:"requests_per_minute"`
+		PerKeyConcurrency int `yaml:"per_key_concurrency"`
+		GlobalConcurrency int `yaml:"global_concurrency"`
+	} `yaml:"limits"`
+}
+
+func Load(path string) (Config, error) {
+	var c Config
+	c.Limits.RequestsPerMinute = 120
+	c.Limits.PerKeyConcurrency = 8
+	c.Limits.GlobalConcurrency = 64
+	c.Server.Listen = "127.0.0.1:8080"
+	c.Storage.Path = "./data/router.db"
+	f, err := os.Open(path)
+	if err != nil {
+		return c, err
+	}
+	defer f.Close()
+	dec := yaml.NewDecoder(f)
+	dec.KnownFields(true)
+	if err = dec.Decode(&c); err != nil {
+		return c, fmt.Errorf("invalid config: %w", err)
+	}
+	var extra any
+	if err = dec.Decode(&extra); err != io.EOF {
+		return c, fmt.Errorf("config must contain exactly one YAML document")
+	}
+	if len(c.Admin.Password) < 12 || strings.HasPrefix(c.Admin.Password, "CHANGE-ME") {
+		return c, fmt.Errorf("admin.password must be a non-placeholder password of at least 12 characters")
+	}
+	if c.Server.Listen == "" || c.Storage.Path == "" {
+		return c, fmt.Errorf("server.listen and storage.path must not be empty")
+	}
+	if c.Limits.RequestsPerMinute <= 0 || c.Limits.PerKeyConcurrency <= 0 || c.Limits.GlobalConcurrency <= 0 {
+		return c, fmt.Errorf("limits must be positive integers")
+	}
+	if c.Storage.LogRetentionDays < 0 {
+		return c, fmt.Errorf("storage.log_retention_days must be nonnegative")
+	}
+	for _, cidr := range c.Server.TrustedProxies {
+		p, err := netip.ParsePrefix(cidr)
+		if err != nil {
+			return c, fmt.Errorf("invalid trusted proxy CIDR %q: %w", cidr, err)
+		}
+		if p.Bits() == 0 {
+			return c, fmt.Errorf("trusted proxy CIDR must not trust all addresses")
+		}
+	}
+	return c, nil
+}

internal/config/config_test.go

@@ -0,0 +1,66 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestLoad(t *testing.T) {
+	for _, tt := range []struct {
+		name, body string
+		wantErr    bool
+	}{
+		{"valid", "admin:\n  password: a-long-test-password\n", false},
+		{"short", "admin:\n  password: short\n", true},
+		{"multiple documents", "admin:\n  password: a-long-test-password\n---\nadmin:\n  password: ignored-password\n", true},
+		{"placeholder", "admin:\n  password: CHANGE-ME-use-a-long-random-password\n", true},
+		{"unknown", "admin:\n  password: a-long-test-password\nunknown: true\n", true},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "config.yaml")
+			if err := os.WriteFile(path, []byte(tt.body), 0600); err != nil {
+				t.Fatal(err)
+			}
+			c, err := Load(path)
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("error=%v, wantErr=%v", err, tt.wantErr)
+			}
+			if err == nil && (c.Server.Listen != "127.0.0.1:8080" || c.Storage.Path != "./data/router.db") {
+				t.Fatal("defaults missing")
+			}
+		})
+	}
+}
+
+func TestSecurityConfig(t *testing.T) {
+	for _, tt := range []struct {
+		body    string
+		invalid bool
+	}{
+		{"", false},
+		{"limits:\n  requests_per_minute: 0\n", true},
+		{"limits:\n  per_key_concurrency: -1\n", true},
+		{"limits:\n  global_concurrency: 0\n", true},
+		{"limits:\n  requests_per_minute: nope\n", true},
+		{"server:\n  trusted_proxies: [not-a-cidr]\n", true},
+		{"server:\n  trusted_proxies: [0.0.0.0/0]\n", true},
+		{"server:\n  trusted_proxies: ['::/0']\n", true},
+		{"server:\n  trusted_proxies: [10.0.0.0/8, '::1/128']\n", false},
+		{"storage:\n  log_retention_days: -1\n", true},
+	} {
+		t.Run(tt.body, func(t *testing.T) {
+			p := filepath.Join(t.TempDir(), "config.yaml")
+			if err := os.WriteFile(p, []byte("admin:\n  password: a-long-test-password\n"+tt.body), 0600); err != nil {
+				t.Fatal(err)
+			}
+			c, err := Load(p)
+			if (err != nil) != tt.invalid {
+				t.Fatalf("error=%v", err)
+			}
+			if err == nil && (c.Limits.RequestsPerMinute != 120 || c.Limits.PerKeyConcurrency != 8 || c.Limits.GlobalConcurrency != 64 || c.Storage.LogRetentionDays != 0) {
+				t.Fatal("security defaults missing")
+			}
+		})
+	}
+}