Reverse proxy

Reverse proxy

warden already knows every service by name, kind, project and port. A reverse proxy in front of them needs exactly that and nothing else, and without this somebody retypes it — once when the service is registered, and again every time a port moves.

$ warden export caddy --domain example.com
# Written by `warden export` from the warden on hub. Regenerate it; do not edit it.

shop-api.example.com {
	reverse_proxy 127.0.0.1:8000
}

shop-web.example.com {
	reverse_proxy 127.0.0.1:8001
}

Three shapes: caddy, nginx, traefik. The Traefik one is dynamic configuration, ready for a file provider.

Choosing what goes in

Flag	Meaning
--project	Only this project
--kind	Only this kind of service
--domain	Names become <service>.<domain>
--all	The whole fleet, each service at the machine it runs on

Without --domain the service name is used bare, which suits a hosts file or an internal resolver. A service that carries a domain in its metadata keeps that name whatever the flag says — the service knows better than the person exporting.

warden register shop-api --kind backend --meta domain=shop.example.com

With --all, a service registered on another machine points at that machine's address rather than the loopback address it is registered under, which would be no use from anywhere else. A node that could not be asked is named on stderr, so it can neither land in the file you redirected this into nor go unnoticed.

Using it

warden export caddy --domain example.com > /etc/caddy/warden.caddyfile
systemctl reload caddy

warden export nginx --project shop > /etc/nginx/conf.d/shop.conf
nginx -t && systemctl reload nginx

warden export traefik --all > /etc/traefik/dynamic/warden.yml

It prints and stops. Nothing is written in place and no proxy is reloaded: where the configuration belongs, and when the proxy should pick it up, are decisions warden has no business making. That also makes it safe to run and read before anything is committed to.

Why the header carries no timestamp

Because this output belongs in a repository, and a line that changes on every run turns every regeneration into a diff worth reviewing. Services come out sorted for the same reason: the same registry renders the same bytes twice.