mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-31 07:44:57 +08:00
Piotr Mlocek
769273f096
* feat(middleware): implement HTTP response processing Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * fix(middleware): allow one-byte response stream units Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * feat(examples): separate content guard from middleware protocol demos Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * fix(middleware): address HTTP response review findings Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * refactor(examples): defer protocol demo to a separate PR Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * refactor(middleware): keep response body timeout local Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * fix(middleware): honor fail-open for unrepresentable responses Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * docs(middleware): trim runtime docs and extract troubleshooting reference Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * chore(middleware): split build fix and simplify test and skill guidance Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * refactor(middleware): isolate HTTP response processing Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * fix(middleware): hide response credential headers Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * fix(middleware): end invalid preflight streams Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * docs(middleware): remove hard-wrapped prose Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * fix(middleware): use protobuf request timeouts Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> --------- Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
63 lines
1.4 KiB
YAML
63 lines
1.4 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
version: 1
|
|
|
|
network_middlewares:
|
|
prototype-content-guard:
|
|
name: Prototype content guard
|
|
middleware: content-guard-example
|
|
order: 10
|
|
config:
|
|
mode: redact
|
|
terms:
|
|
- prototype-secret
|
|
- internal-only
|
|
replacement: "[FILTERED]"
|
|
on_error: fail_closed
|
|
endpoints:
|
|
include:
|
|
- httpbin.org
|
|
- host.openshell.internal
|
|
|
|
network_policies:
|
|
httpbin:
|
|
name: httpbin
|
|
endpoints:
|
|
- host: httpbin.org
|
|
port: 443
|
|
protocol: rest
|
|
rules:
|
|
- allow:
|
|
method: POST
|
|
path: /anything
|
|
binaries:
|
|
- path: /usr/bin/curl
|
|
httpbingo:
|
|
name: httpbingo
|
|
endpoints:
|
|
- host: httpbingo.org
|
|
port: 443
|
|
protocol: rest
|
|
rules:
|
|
- allow:
|
|
method: POST
|
|
path: /anything
|
|
binaries:
|
|
- path: /usr/bin/curl
|
|
guard-responses:
|
|
name: Guard responses
|
|
endpoints:
|
|
- host: host.openshell.internal
|
|
port: 18081
|
|
protocol: rest
|
|
rules:
|
|
- allow:
|
|
method: GET
|
|
path: /clean
|
|
- allow:
|
|
method: GET
|
|
path: /sensitive
|
|
binaries:
|
|
- path: /usr/bin/curl
|