llmgw/internal/config/firewall.go

package config

import (
	"fmt"
	"net/netip"
	"strings"
)

// FirewallAllow reads firewall_networks: networks, or single addresses.
func (s Server) FirewallAllow() ([]netip.Prefix, error) {
	var out []netip.Prefix
	for i, n := range s.FirewallNetworks {
		n = strings.TrimSpace(n)
		if p, err := netip.ParsePrefix(n); err == nil {
			out = append(out, p.Masked())
			continue
		}
		a, err := netip.ParseAddr(n)
		if err != nil {
			return nil, fmt.Errorf("firewall_networks[%d] is %q: a network (10.0.1.0/24) or an address", i, n)
		}
		out = append(out, netip.PrefixFrom(a, a.BitLen()))
	}
	return out, nil
}

// EnginePorts is the range engines listen in on every node.
func (s Server) EnginePorts() (int, int) {
	if len(s.Control.PortRange) == 2 {
		return s.Control.PortRange[0], s.Control.PortRange[1]
	}
	d := Default().Control.PortRange
	return d[0], d[1]
}