# 公网 Gateway 使用用户名密码，并拒绝内网/回环目标。
version: 1
security: {requireProtectionOnPublicListen: true}
gateway:
  enabled: true
  listen: 0.0.0.0:8080
  auth:
    mode: usernamePassword
    username: "${GATEWAY_USER}"
    password: "${GATEWAY_PASSWORD}"
  limits: {maxConcurrentConnections: 50000}
  retry: {maxAttempts: 2, retryMethods: [GET, HEAD]}
  destinationPolicy:
    denyPrivateNetworks: true
    denyLoopback: true
    denyLinkLocal: true
    denyCIDRs: [169.254.169.254/32]
routing:
  - name: public-gateway
    enabled: true
    purpose: gateway
    match: {hostRegex: '.*'}
    upstreams: [provider-a]
    strategy: {type: leastConnections}
    onUnavailable: {action: reject}
upstreams:
  provider-a:
    enabled: true
    exposure: [gateway]
    provider: {billingMode: subscription, protocols: [http]}
    api: {url: https://provider-a.example/proxies, method: GET, auth: {type: none}, template: '{{.}}'}
    proxyAuth: {type: response}
    pool: {maxSize: 3000}
    capacity: {maxConcurrencyPerProxy: 20}
    lifecycle: {ttl: 5m, allocationSafetyMargin: 30s}
    fetch: {requestInterval: 1s, timeout: 3s, maxAttempts: 3, maxInFlight: 1}
    check: {interval: 30s, jitter: 20, maxInFlight: 200, timeout: 2s, maxAttempts: 2, maxConsecutiveFailures: 3}