Codevault initial commit

internal/config/server.go

@@ -0,0 +1,37 @@
+package config
+
+import (
+	"fmt"
+	"net/netip"
+
+	"go.uber.org/multierr"
+)
+
+type ServerConfig struct {
+	Address string `yaml:"address"`
+
+	// TrustedProxies lists IPs/CIDRs (e.g. of a fronting nginx) allowed to set
+	// X-Forwarded-For/X-Real-IP when gin resolves the client IP. Empty means no
+	// forwarded header is trusted, and the raw remote address is used instead.
+	TrustedProxies []string `yaml:"trusted_proxies"`
+}
+
+func (sc *ServerConfig) Validate() error {
+	var err error
+
+	if sc.Address == "" {
+		err = multierr.Append(err, fmt.Errorf("address is missing"))
+	}
+
+	for _, proxy := range sc.TrustedProxies {
+		if _, parseErr := netip.ParsePrefix(proxy); parseErr == nil {
+			continue
+		}
+		if _, parseErr := netip.ParseAddr(proxy); parseErr == nil {
+			continue
+		}
+		err = multierr.Append(err, fmt.Errorf("invalid trusted_proxies entry %q: must be an IP or CIDR", proxy))
+	}
+
+	return err
+}