feat: in-binary TLS proxy library (with honest re-scope of ADR-003 #4) - #32
Merged
Conversation
Adds opengateway.mojo_bridge.tls_proxy: a stdlib-ssl TLS-terminating proxy that accepts TLS on a public port and proxies bytes to a cleartext loopback listener. Three tests (round-trip, cleartext rejection, multi-chunk forwarding) pass in pure Python. The proxy is a vetted building block but is **not wired into main.mojo** in this commit — the Mojo runtime's daemon-thread + GILReleased interaction does not let the proxy's pump threads forward bytes from the TLS socket to the upstream socket (the handshake completes inside the binary, but recv stalls). Reactor-native TLS serving in flare is a separate deferred upstream follow-up (the STATE_TLS_HANDSHAKE state machine is gated on a future Mojo nightly, and the server-side FFI has no SSL_read / SSL_write data path because the reactor integration was never wired). ADR-003 #4 is updated to reflect both blockers honestly. The proxy remains the in-binary stand-in ready for when the underlying concurrency interaction is understood; production continues to terminate TLS at the edge LB (the standard gateway deployment shape). Co-authored-by: opencode-agent <noreply@opencode.ai>
johnnyhuy
added a commit
that referenced
this pull request
Aug 9, 2026
Adds opengateway.mojo_bridge.tls_proxy: a stdlib-ssl TLS-terminating proxy that accepts TLS on a public port and proxies bytes to a cleartext loopback listener. Three tests (round-trip, cleartext rejection, multi-chunk forwarding) pass in pure Python. The proxy is a vetted building block but is **not wired into main.mojo** in this commit — the Mojo runtime's daemon-thread + GILReleased interaction does not let the proxy's pump threads forward bytes from the TLS socket to the upstream socket (the handshake completes inside the binary, but recv stalls). Reactor-native TLS serving in flare is a separate deferred upstream follow-up (the STATE_TLS_HANDSHAKE state machine is gated on a future Mojo nightly, and the server-side FFI has no SSL_read / SSL_write data path because the reactor integration was never wired). ADR-003 #4 is updated to reflect both blockers honestly. The proxy remains the in-binary stand-in ready for when the underlying concurrency interaction is understood; production continues to terminate TLS at the edge LB (the standard gateway deployment shape). Co-authored-by: opencode-agent[bot] <219766164+opencode-agent[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
opengateway/mojo_bridge/tls_proxy.py: a stdlib-ssl TLS-terminating proxy (accept TLS, proxy to cleartext loopback). Three pytest tests prove the proxy works in pure Python (round-trip, cleartext rejection, multi-chunk forwarding).main.mojoin this commit — the Mojo runtime's daemon-thread +GILReleasedinteraction prevents the proxy's pump threads from forwarding bytes between the TLS socket and the upstream socket inside the binary. The TLS handshake completes; the byte pump stalls.Consequences
STATE_TLS_HANDSHAKEgated on a future Mojo nightly; the server-side FFI ships handshake-only with noSSL_read/SSL_writedata path).main.mojobinds cleartext on the loopback address so an LB can proxy in without exposing cleartext to the network.tls_proxy.pyis kept in-tree as a reference implementation and a building block for when either blocker is resolved (flare reactor TLS or a deeper investigation of the Mojo GIL/threading interaction).Testing
uv run pytest tests/test_tls_proxy.py— 3 passed (round-trip, cleartext rejected, multi-chunk forwarding); 42 total pytest passed.make mojo-test— 8/8 passed.