Module backend 

Per-backend credential routing and network isolation (pillar 4).

Each backend has a name, URL, authentication policy, and a set of tools it serves. The router resolves a tool name to its backend and constructs the appropriate credential header. Backend URLs come only from config; redirects are not followed.

Structs

BackendRouter

Routes tool names to backends. Built once at startup from config.

PrivateOnlyResolver

DNS resolver for the backend client under require_private_backends: a backend host must resolve only to private addresses, checked on every connection (so a DNS change after boot cannot redirect tool traffic to the internet). A host with any public address is refused outright rather than filtered, because mixed answers indicate a misconfiguration or a rebinding attempt.

ResolvedBackend

Resolved backend with its credential.

Enums

BackendAuthMode

Simplified auth mode for runtime decisions.

Constants

DEFAULT_BACKEND_NAME

Name of the implicit backend built from tool_upstream_url. It is also the audience of intent tokens sent to that upstream.

Functions

is_private_ip

True for an address that is not reachable from the public internet: loopback, RFC 1918, shared (CGNAT, RFC 6598), link-local, and IPv6 unique-local or link-local addresses (including IPv4-mapped forms).