Function NewOutboundHttpClient

pkg/gotenberg/outbound.go:392–404

NewOutboundHttpClient returns an [http.Client] that validates every outbound request URL via the same logic as [FilterOutboundURL] and pins the resulting dial to the resolved IPs. The client re-validates redirect targets automatically because the underlying [http.Client] invokes the wrapping [http.

(timeout time.Duration, allowList, denyList []*regexp2.Regexp, opts ...DecideOption)

// The default posture is permissive; callers pass [WithDenyPrivateIPs]
// or [WithDenyPublicIPs] to opt into IP-class rejection.
func NewOutboundHttpClient(timeout time.Duration, allowList, denyList []*regexp2.Regexp, opts ...DecideOption) *http.Client {
	base := http.DefaultTransport.(*http.Transport).Clone()
	base.DialContext = secureDialContext
	return &http.Client{
		Timeout: timeout,
		Transport: &outboundRoundTripper{
			base:      base,
			allowList: allowList,
			denyList:  denyList,
			opts:      opts,
		},
	}
}

// secureDialContext consumes the [OutboundDecision] stashed in ctx by
// [outboundRoundTripper]. When the decision is to bypass (allow-list