Close immediately closes the server.

Close closes underlying writer if it is a file.

New returns a new admin server. addr specifies the address the server listens on. cfg provides the initial configuration served at /config; it may be

Load reads and validates the HCL configuration from path.

LoadHCL loads rules from an HCL file.

New creates a Server that listens on listenAddr and forwards to upstreamURL. A self-signed certificate is generated if certFile and keyFile are empty.

Close stops the parser's background goroutine.

New creates a Logger writing to path. If path is empty, stdout is used.

ExtractClientHello decrypts a QUIC Initial datagram (v1 or v2) and returns a TLS-style ClientHello record ready for fingerprinting.

withRange appends line and column information to an error using the provided range.

EnumerateRuleSets returns info for all rule files referenced by cfg. The returned slice is sorted by path and stable across invocations.

NewHub creates a Hub.

AbsFromCWD resolves p against the current working directory when not already absolute and returns a canonical absolute path.

NewLoader creates a Loader for the given default rule action.

Publish sends the event to all subscribers, dropping it for any subscriber whose buffer is full.

Watch monitors path for modifications and invokes onChange on each change. It continues watching even if the file or directory is recreated, using exp

LoadFromFile loads rule definitions from an HCL file.

NewServer creates a new SSE server bound to addr.

Shutdown gracefully stops the server.

Subscribe registers a new subscriber with the given buffer size. The returned channel is closed when the context is done.

Eval finds the first matching rule for the request context. If no rule matches, ActionAllow and empty ruleID are returned.

Load replaces the engine rule set atomically.

watchConfig watches the provided config file for changes and reloads rule engines and Suricata sets via the given Loader when updates occur.

LoadEngine loads rules from path and watches for changes.

rangeFromDiags returns the first diagnostic's subject range, if any.

New extracts fingerprint information from the request context. When the context lacks metadata from fingerproxy, fingerprint fields remain empty and n

Start begins listening for connections.

SynthesiseFromFlags builds a config for quick mode from a cli.Command.

Validate checks that cfg contains all mandatory fields and no duplicate listener IDs.

Flush calls Flush on fl and returns any FlushErr result.

RemoveWatch is an alias for CancelWatcher for backward compatibility.

SetGalahOptions updates Galah cache and event logging settings.

extractClientHelloFrames is a helper used in tests to parse CRYPTO frames from a QUIC Initial payload and assemble the contained ClientHello bytes.

runServe parses args using the serve flags and returns the resulting config after applying overrides or synthesis. It mirrors serveAction without star

LoadSuricata loads Suricata rules from dir and watches for changes.

Log writes the event as a single JSON line.

Merge applies CLI overrides to cfg according to precedence rules.

ResolvePaths updates all path fields in cfg to be absolute by joining them with baseDir when they are not already absolute. baseDir is resolved to its

selfSignedCert creates a temporary self-signed certificate.

EvalComposite evaluates the request against a listener-specific engine first and then the global engine. The global engine's DefaultAction is used whe

SetGalahService stores svc atomically and updates the rule handler.

WriteJSON writes cfg encoded as JSON to path.

echoHandler serves fingerprint details of the client.