degradedMiddleware serves the degraded error page on all routes when the database schema version doesn't match the server version.

encodePathAttributes serializes a slice of path attributes into wire format.

ensurePrefixIDs upserts the given (already masked) prefixes into the prefixes dictionary and returns their ids, in batches.

findBestMatch returns the (modeID, category, service) for the original route that best contains the filtered prefix. This handles the case where rout

genCommunities generates communities for categories and services that don't have one yet. If existing is non-nil, it's used as the set of already-assi

handleConnection processes a new incoming TCP connection.

hiddenSelectedCategories returns categories the user has selected whose entries are now entirely hidden (feed disabled) — these must be preserved acro

hiddenSelectedServices is hiddenSelectedCategories' service-level counterpart — see its doc comment.

intersectCIDRs computes the intersection of multiple CIDR groups. Each group is a list of CIDR prefixes. The result is the set of prefixes contained i

isAllDigits reports whether s is non-empty and consists only of ASCII digits — used to keep a legacy name-derived key from ever being mistaken for ano

legacyAdapterKey reconstructs the key that feed_adapters.key used to be auto-assigned before that column was dropped, so backup files written under th

mergeAllowedHosts adds host to a comma-separated hosts string if not already present.

mergeHosts adds host to a comma-separated hosts string if not already present.

newCSRFToken returns a fresh random token for the CSRF cookie.

panicRecovery recovers from panics and returns a 500 error

parseCIDRs parses comma-separated CIDR strings into []netip.Prefix.

prefixToRange returns the inclusive [network address, broadcast address] range covered by a masked prefix, as big.Int for uniform 32/128-bit math.

purgeLoop periodically removes old metric snapshots based on metrics_history_days.

rangeToPrefixes decomposes an inclusive [start, end] address range into the minimal list of properly-aligned CIDR blocks that exactly cover it.

readIPSetAsCIDRs reads an IP set from an SRS rule and returns CIDR strings.

reset resets the circuit breaker (internal, assumes lock is held).

resetSetting calls Reset on the typed setting.

securityHeaders adds security headers to HTTP responses

serveDegraded starts an HTTP server that only shows the DB version mismatch page.

setSetting parses raw JSON and calls the typed Set method on the setting.

setTCPMD5OnConn sets the TCP MD5 signature on an already-connected socket. Used for passive (accepted) connections. Skips loopback addresses because m

skipItemPayload skips the payload of a single SRS item by type.

sortRoutes sorts routes by prefix string for stable comparison.

statusAuthorized checks whether the request is authorized to access /status. Authorization is granted by IP whitelist or Bearer token.

store returns the Store from the first non-nil setting field. All fields share the same store, so we just pick the first one.

sweepLocked removes IPs with no timestamps left inside the window. Callers must hold rl.mu. No-op if less than a full window has passed since the last

toCatalogEntries converts adapter entries to the store's external catalog-entry form; the store resolves names and CIDRs onto its dictionary tables in

trailingZeroBits returns the number of trailing zero bits in v, treated as a fixed-width bitLen-bit unsigned integer (v == 0 is handled by the caller,

v032SeedDictionaries fills categories and services from every table that still carries the old TEXT columns. Selections and communities are included a

v033FilterModeInt folds the old (filter_mode TEXT, filter_override_enabled) pair into the integer enum, replicating store.normalizeFilterMode: a valid

v034Rebuild is the migration 32 state machine for column-presence detected tables.

validateSettingKey reports whether setSetting/resetSetting would accept this key/value, without calling either — mirrors setSetting's case list exactl

AlwaysRetry returns true for any error (except context cancellation).