didericis/bot-bottle
1
0
Fork 0
Code Issues 32 Pull Requests 4 Actions Packages Releases Wiki Activity

refactor(egress): make TLS inspection explicit

Browse Source
This commit is contained in:
didericis (codex)
2026-07-23 17:38:08 +00:00
parent ce7a7c9915
commit 7d401a68c5
14 changed files with 311 additions and 216 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bot_bottle/supervise_server.py
+10 -9
View File
@@ -168,15 +168,16 @@ _ROUTES_YAML_DESCRIPTION = (
"Full proposed /etc/egress/routes.yaml content. "
"Each route entry accepts these keys:\n"
" host: <hostname> (required)\n"
" auth_scheme: Bearer|token (must pair with token_env)\n"
" token_env: <ENV_VAR_NAME> (must pair with auth_scheme)\n"
" matches: (optional list of match entries)\n"
" - paths: [{type: prefix|exact|regex, value: /...}]\n"
" methods: [GET, POST, ...]\n"
" headers: [{name: X-Hdr, value: val, type: exact|regex}]\n"
" git: (optional; omit to block git clone/fetch)\n"
" fetch: true\n"
" dlp: (optional DLP scanner overrides)\n"
" inspect: false (opaque whole-host TLS tunnel; no HTTP controls)\n"
" inspect: (omit for inspected defaults)\n"
" auth_scheme: Bearer|token (must pair with token_env)\n"
" token_env: <ENV_VAR_NAME> (must pair with auth_scheme)\n"
" matches: (optional list of match entries)\n"
" - paths: [{type: prefix|exact|regex, value: /...}]\n"
" methods: [GET, POST, ...]\n"
" headers: [{name: X-Hdr, value: val, type: exact|regex}]\n"
" git: (optional; omit to block git clone/fetch)\n"
" fetch: true\n"
" outbound_detectors: [token_patterns, known_secrets]\n"
" inbound_detectors: [naive_injection_detection]\n"
" outbound_on_match: block|redact|supervise (default supervise)\n"