# 来源在可信网段或提供 API Key，任一方法通过即可。
version: 1
security: {requireProtectionOnPublicListen: true}
distribution:
  enabled: true
  listen: 0.0.0.0:8081
  auth:
    mode: any
    methods:
      - mode: ipWhitelist
        cidrs: [10.0.0.0/8]
      - mode: apiKey
        header: X-API-Key
        value: "${DISTRIBUTION_API_KEY}"
  clientIdentification: {mode: authenticatedClientOrSourceIP}
  limits: {requestsPerMinute: 600, requestsPerMinutePerClient: 60}
  extraction: {fulfillment: partial, maxCountPerRequest: 20, minRemainingTTL: 30s, maxHealthCheckAge: 15s, reserveForGateway: 0}
routing:
  - name: extract
    enabled: true
    purpose: extract
    match: {hostRegex: '.*'}
    upstreams: [provider-a]
    strategy: {type: random}
    onUnavailable: {action: reject}
upstreams:
  provider-a:
    enabled: true
    exposure: [extract]
    provider: {billingMode: fetch, protocols: [http]}
    api: {url: https://provider-a.example/proxies, method: GET, auth: {type: none}, template: '{{.}}'}
    proxyAuth: {type: response}
    pool: {maxSize: 500}
    capacity: {maxConcurrencyPerProxy: 1}
    refill: {reconcileInterval: 1s, minimumAvailableSlots: 25, targetAvailableSlots: 50}
    lifecycle: {ttl: 2m, allocationSafetyMargin: 15s}
    fetch: {estimatedIPsPerCall: 10, requestInterval: 1s, timeout: 3s, maxAttempts: 3, maxInFlight: 1, maxTotal: 10000}
    check: {interval: 15s, jitter: 20, maxInFlight: 100, timeout: 2s, maxAttempts: 2, maxConsecutiveFailures: 3}