# 内网关闭认证，但用来源 CIDR 独立保护两个入口。
version: 1
security: {requireProtectionOnPublicListen: true}
gateway:
  enabled: true
  listen: 0.0.0.0:8080
  access: {allowCIDRs: [10.0.0.0/8, 192.168.0.0/16]}
  auth: {mode: none}
distribution:
  enabled: true
  listen: 0.0.0.0:8081
  access:
    allowCIDRs: [10.0.0.0/8, 192.168.0.0/16]
    trustedProxies: [10.10.0.10/32]
  auth: {mode: none}
  clientIdentification: {mode: sourceIP}
  limits: {requestsPerMinutePerClient: 30}
  extraction: {fulfillment: partial, maxCountPerRequest: 10, minRemainingTTL: 30s, maxHealthCheckAge: 15s, reserveForGateway: 10}
routing:
  - name: shared-gateway
    enabled: true
    purpose: gateway
    match: {hostRegex: '.*'}
    upstreams: [provider-a]
    strategy: {type: leastConnections}
    onUnavailable: {action: reject}
  - name: shared-extract
    enabled: true
    purpose: extract
    match: {hostRegex: '.*'}
    upstreams: [provider-a]
    strategy: {type: random}
    onUnavailable: {action: reject}
upstreams:
  provider-a:
    enabled: true
    exposure: [gateway, extract]
    provider: {billingMode: subscription, protocols: [http]}
    api: {url: https://provider-a.example/proxies, method: GET, auth: {type: none}, template: '{{.}}'}
    proxyAuth: {type: response}
    pool: {maxSize: 1000}
    capacity: {maxConcurrencyPerProxy: 10}
    lifecycle: {ttl: 2m, allocationSafetyMargin: 15s}
    fetch: {requestInterval: 1s, timeout: 3s, maxAttempts: 3, maxInFlight: 1}
    check: {interval: 20s, jitter: 20, maxInFlight: 100, timeout: 2s, maxAttempts: 2, maxConsecutiveFailures: 3}