Rust

use std::collections::HashSet;
use std::net::ToSocketAddrs;

#[derive(Debug)]
pub struct Held(pub String);

fn block_addrs() -> HashSet<String> {
    std::env::var("SECURD_BLOCK_ADDRS")
        .unwrap_or_default()
        .split(',')
        .filter(|s| !s.is_empty())
        .map(|s| s.to_string())
        .collect()
}

pub fn guard(host: &str, agent_role: &str) -> Result<(), Held> {
    let addrs = (host, 443u16)
        .to_socket_addrs()
        .map_err(|_| Held(format!("{host} did not resolve inside {agent_role}")))?;
    let blocked = block_addrs();
    for a in addrs {
        if blocked.contains(&a.ip().to_string()) {
            return Err(Held(format!("{host} is held or blocked for {agent_role}")));
        }
    }
    Ok(())
}

if let Err(held) = securd::guard("api.example.com", "indexer-agent") {
    tracing::warn!(reason = %held.0, "securd.held");
    return Ok(());
}
let body = reqwest::get("https://api.example.com/v1").await?.text().await?;