# switchboard: toybox's only way out. A forward proxy (HTTP and WebSocket)
# that toybox's Egress gateway reaches over a socket handed in with -S/-s.
#
# The network service is the switchboard's outer fence; under systemd,
# IPAddressAllow=/IPAddressDeny= narrow it further (see systemd/).
using Workerd = import "/workerd/workerd.capnp";

const config :Workerd.Config = (
  services = [
    (name = "main", worker = .switchboard),
    (name = "internet", network = (allow = ["public", "local"], tlsOptions = (trustBrowserCas = true))),
  ],
  sockets = [
    # proxy style: the request line carries the full URL, scheme included
    (name = "http", http = (style = proxy), service = "main"),
  ],
);

const switchboard :Workerd.Worker = (
  compatibilityDate = "2026-10-01",
  modules = [(name = "switchboard.js", esModule = embed "switchboard.js")],
  durableObjectNamespaces = [(className = "Switchboard", uniqueKey = "toybox-switchboard")],
  durableObjectStorage = (inMemory = void),
  bindings = [(name = "BOARD", durableObjectNamespace = "Switchboard")],
  globalOutbound = "internet",
);