phase2 / docker-https-proxy Goto Github PK

Not sure if this project has been abandoned?

I've made a fork here:

https://github.com/RTC1/docker-https-proxy

Added AltName support so the generated certs work in Chrome

Goal

In order to proxy URLs that encode key parameter details as part of the domain, we need better built-in support for multiple domains or wildcard domains.

Environment

Local development, wherein the "multiple URL" nature leans on the implicit "wildcarding" provided by Outrigger DNSDock. For example, api.projectname.vm, fr.api.rojectname.vm, de.api.projectname.vm will all be routed to the same container.

Required Actions

Populated X-Forwarded-Host with the Request Domain

Provide instructions on how to get variable domains registered in the X-Forwarded-Host header so the upstream can examine the downstream request host, embedded with key request parameters.

Preferred: nginx-only (Not Working)

In our target environment context, the "wildcard DNS" approach works but I have not found how to populate the X-Forwarded-Host header with the full request domain, it is reduced to the actual DNS entry. nginx proxy requests are sent with an Origin header that includes the correct domain.

Fallback: nginx & docker-compose (Working)

• nginx.conf.tmpl: Replace X-Forwarded-Host configuration of {{ getenv "PROXY_DOMAIN"}} with $host. In this way the forwarded host should use whatever reaches it. (This was not sufficient for the nginx-only approach above.)

• docker-compose.yml: Add com.dnsdock.aliases, with comma-delimited entries for each variant domain

labels:
  com.dnsdock.aliases: fr.api.rojectname.vm, de.api.projectname.vm

Wildcard/Multi-domain CSR Certificate

Still researching.

Would it be possible to change X-Forwarded-Port to an environment var instead of statically set to 443?

I run multiple docker instances and usually have them on non-standard ports.

Thanks,

https://blog.cloudflare.com/deprecating-old-tls-versions-on-cloudflare-dashboard-and-api/

These are old versions of TLS and deprecated for good security reasons. Let's drop support to support forward looking practices by default.