Add proxy command #56
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
|
|
I have signed the CLA and added the commit email address. Do I need to do something else to get the above checks okayed? |
aelg
force-pushed
the
proxy-cmd
branch
2 times, most recently
from
14c955d to
7c37a55
Compare
Adds a command for running pomerium cli as a proxy. Requests matching a domain will be proxied over a tcp tunnel via pomerium. All other connections will be transparently proxied.
wasaga
approved these changes
May 12, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adds a command for running pomerium-cli as a proxy.
Requests matching a domain will be proxied over a tcp tunnel via
pomerium.
All other connections will be transparently proxied.
Summary
This feature solves some of the problems of running https-based services behind Pomerium.
For example when running a docker repository the docker daemon cannot perform authentication with Pomerium.
The same issue is there if running a python registry to be used by for example pip.
The proxy command implemented here solves some of these issues by letting pomerium-cli act as a https-proxy.
Many of these kinds of services support configuring a proxy either natively or by using the
HTTPS_PROXYenvironment variable.Caveats
This proxy sidesteps the normal audit trail of Pomerium, since the HTTPS service is served over a TCP tunnel individual request will not have an audit trail, only the setup of the tunnel will.
The service behind pomerium needs it's own TLS certificate as Pomerium is not terminating TLS in the tunnel.
Currently there seems to be a bug, most likely in envoy, that prevents tcp tunnels with frontend port 443 to work.
This PR just have a hardcoded rewrite of port 443 to port 8000 when setting up the tunnel, which is not ideal.
Related issues
This approach was suggested in issue #1837 and is based on the implementation suggested there.