Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

reverse_proxy: Add support for SRV backends #3180

Merged
merged 2 commits into from Mar 24, 2020
Merged

reverse_proxy: Add support for SRV backends #3180

merged 2 commits into from Mar 24, 2020

Conversation

@mholt
Copy link
Member

mholt commented Mar 23, 2020

This change allows you to specify the "lookup_srv" field on a proxy upstream to lookup a name's SRV records to get the upstream dial address. Resolves #3179.

In the Caddyfile, prefix proxy upstream addresses with srv+, for example:

reverse_proxy srv+example.com

or

reverse_proxy srv+https://example.com

(It's a little weird but that's how it goes I guess.)

@danlsgiga Can you please try this? Once the CI is finished, it should have a binary you can download and use, or you can just pull it yourself and build. Let me know!

mholt added 2 commits Mar 23, 2020
@francislavoie

This comment has been minimized.

Copy link
Member

francislavoie commented Mar 23, 2020

Why not srv/ like unix/?

@mholt

This comment has been minimized.

Copy link
Member Author

mholt commented Mar 23, 2020

Why not srv/ like unix/?

Because it's not a network type; you could in theory have TCP or UDP protocol for SRV lookups, see here: https://golang.org/pkg/net/#Resolver.LookupSRV

@danlsgiga

This comment has been minimized.

Copy link

danlsgiga commented Mar 24, 2020

@mholt, the SRV functionality works as expected. I can provide only the address without ports now and it can proxy requests successfully.

I see you added the https option for the Caddyfile, but how can I tell via json (using "lookup_srv") for the upstream to use https/tls and potentially insecure_skip_verify?

@mholt

This comment has been minimized.

Copy link
Member Author

mholt commented Mar 24, 2020

@danlsgiga Yay! That's awesome. Thanks for verifying!

If you use a Caddyfile with:

reverse_proxy srv+https://example.com {
    transport http {
        tls_insecure_skip_verify
    }
}

in it, you can get the resulting JSON with:

$ caddy adapt

and then you will see how TLS is enabled with the insecure option 😣

@danlsgiga

This comment has been minimized.

Copy link

danlsgiga commented Mar 24, 2020

Yeah, I know... sometimes we don't have an option but to not verify upstreams certs (self signed).

So, I did what you asked and:

adapt: parsing caddyfile tokens for 'reverse_proxy': Caddyfile:4 - Error during parsing: unrecognized subdirective insecure_skip_verify

That might not be supported yet :/

@mholt

This comment has been minimized.

Copy link
Member Author

mholt commented Mar 24, 2020

@danlsgiga I edited my comment a minute after I posted it :) The correct syntax is documented here: https://caddyserver.com/docs/caddyfile/directives/reverse_proxy

@mholt mholt merged commit e02117c into master Mar 24, 2020
7 checks passed
7 checks passed
test (ubuntu-latest, 1.14.x) test (ubuntu-latest, 1.14.x)
Details
Fuzzing (ubuntu-latest, 1.14.x) Fuzzing (ubuntu-latest, 1.14.x)
Details
test (macos-latest, 1.14.x) test (macos-latest, 1.14.x)
Details
test (windows-latest, 1.14.x) test (windows-latest, 1.14.x)
Details
runner / golangci-lint
Details
golangci reviewdog [golangci] report
Details
license/cla Contributor License Agreement is signed.
Details
@mholt mholt deleted the srv-proxy branch Mar 24, 2020
@danlsgiga

This comment has been minimized.

Copy link

danlsgiga commented Mar 24, 2020

Ha! it works!!!!!
It just needed the transport block. Awesome!!!!

                     "handle": [
                        {
                          "handler": "reverse_proxy",
                          "transport": {
                            "protocol": "http",
                            "tls": {
                              "insecure_skip_verify": true,
                              "server_name": "myapp.service.consul"
                            }
                          },
                          "upstreams": [
                            {
                              "lookup_srv": "app.service.consul"
                            }
                          ]
                        }
                      ]

One gotcha though: the json server_name is not documented in https://caddyserver.com/docs/caddyfile/directives/reverse_proxy

@mholt

This comment has been minimized.

Copy link
Member Author

mholt commented Mar 24, 2020

@danlsgiga That's a JSON option, not a Caddyfile option (the Caddyfile adapter sets that implicitly so that SNI works with the upstream.) https://caddyserver.com/docs/json/apps/http/servers/routes/handle/reverse_proxy/transport/http/tls/

@danlsgiga

This comment has been minimized.

Copy link

danlsgiga commented Mar 24, 2020

np... works fine for me! Thanks a lot!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

3 participants
You can’t perform that action at this time.