mirror of
https://github.com/yusing/godoxy.git
synced 2026-03-27 03:21:09 +01:00
93263eedbf
Add `relay_proxy_protocol_header` configuration option for TCP routes that enables forwarding the original client IP address to upstream services via PROXY protocol v2 headers. This feature is only available for TCP routes and includes validation to prevent misuse on UDP routes. - Add RelayProxyProtocolHeader field to Route struct with JSON tag - Implement writeProxyProtocolHeader in stream package to craft v2 headers - Update TCPTCPStream to conditionally send PROXY header to upstream - Add validation ensuring feature is TCP-only - Include tests for both enabled/disabled states and incoming proxy header relay
113 lines
2.6 KiB
YAML
113 lines
2.6 KiB
YAML
example: # matching `example.y.z`
|
|
scheme: http
|
|
host: 10.0.0.254
|
|
port: 80
|
|
bind: 0.0.0.0
|
|
relay_proxy_protocol_header: false # tcp only, sends PROXY header to upstream
|
|
root: /var/www/example
|
|
spa: true
|
|
index: index.html
|
|
no_tls_verify: true
|
|
disable_compression: false
|
|
response_header_timeout: 30s
|
|
ssl_server_name: "" # empty uses target hostname, "off" disables SNI
|
|
ssl_trusted_certificate: /etc/ssl/certs/ca-certificates.crt
|
|
ssl_certificate: /etc/ssl/client.crt
|
|
ssl_certificate_key: /etc/ssl/client.key
|
|
ssl_protocols:
|
|
- tlsv1.2
|
|
- tlsv1.3
|
|
path_patterns: # Check https://pkg.go.dev/net/http#hdr-Patterns-ServeMux for syntax
|
|
- GET / # accept any GET request
|
|
- POST /auth # for /auth and /auth/* accept only POST
|
|
- GET /home/{$} # for exactly /home
|
|
rules:
|
|
- name: default
|
|
do: pass
|
|
- name: block-admin
|
|
on: path /admin
|
|
do: error 403 Forbidden
|
|
rule_file: embed://webui.yml
|
|
healthcheck:
|
|
disabled: false
|
|
use_get: true
|
|
path: /
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: -1 # -1: immediate fail, 0: use default, >0: retry count
|
|
load_balance:
|
|
link: app # link to another route alias
|
|
mode: roundrobin # roundrobin, leastconn, iphash
|
|
weight: 1
|
|
sticky: false
|
|
sticky_max_age: 1h
|
|
options:
|
|
header: X-Forwarded-For
|
|
middlewares:
|
|
cidr_whitelist:
|
|
allow:
|
|
- 127.0.0.1
|
|
- 10.0.0.0/8
|
|
status_code: 403
|
|
message: IP not allowed
|
|
homepage:
|
|
show: true
|
|
name: Example App
|
|
icon: "@selfhst/adguard-home.png"
|
|
description: An example app
|
|
category: example
|
|
access_log:
|
|
path: /var/log/example.log
|
|
stdout: false
|
|
retention:
|
|
days: 30
|
|
rotate_interval: 24h
|
|
format: combined # common, combined, json
|
|
filters:
|
|
status_codes:
|
|
values:
|
|
- 200-299
|
|
- 101
|
|
method:
|
|
values:
|
|
- GET
|
|
host:
|
|
values:
|
|
- example.y.z
|
|
headers:
|
|
negative: true
|
|
values:
|
|
- foo=bar
|
|
- baz
|
|
cidr:
|
|
values:
|
|
- 192.168.10.0/24
|
|
fields:
|
|
headers:
|
|
default: drop
|
|
config:
|
|
foo: redact
|
|
authorization: drop
|
|
query:
|
|
default: keep
|
|
config:
|
|
foo: keep
|
|
password: redact
|
|
cookies:
|
|
default: drop
|
|
config:
|
|
session: keep
|
|
idlewatcher:
|
|
idle_timeout: 30m
|
|
wake_timeout: 30s
|
|
stop_timeout: 1m
|
|
stop_method: stop # pause, stop, kill
|
|
stop_signal: SIGTERM
|
|
start_endpoint: /api/wake
|
|
depends_on:
|
|
- other-service
|
|
no_loading_page: false
|
|
docker:
|
|
container_id: abc123
|
|
container_name: example-app
|