Documentation
¶
Overview ¶
Package transport provides the outbound HTTP building blocks an agent needs to call back into its controller: a constant-bearer round-tripper and a pooled *http.Transport that (optionally) rewrites the dial target to a local reverse proxy while preserving the URL authority as the Host header + TLS SNI. That rewrite is what lets an agent address the controller by its public name while the bytes actually go to a sidecar proxy on the same host, which is where mutual TLS is attached.
It exists because two agents had built the same client independently and differed only in a few pool knobs. Those differences are quoted in NewRouterTransport so adopting this package is a deliberate behavioural-parity decision rather than an accident.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrCrossOriginRedirect = errors.New("transport: refusing cross-origin or scheme-downgrading redirect")
ErrCrossOriginRedirect is returned (wrapped in *url.Error by http.Client) when a redirect hop would leave the origin of the ORIGINAL request or downgrade https to http. Agents only ever call their controller; a redirect elsewhere is a misconfiguration or a compromise, and following it would hand the credential and (for 307/308) the replayed request body to that host.
Functions ¶
func NewBearerRoundTripper ¶
func NewBearerRoundTripper(base http.RoundTripper, token string) http.RoundTripper
NewBearerRoundTripper returns a RoundTripper that sets "Authorization: Bearer <token>" on every request whose Authorization header is empty, then delegates to base. A caller-set Authorization header is never overwritten (so per-request overrides still work). If base is nil, http.DefaultTransport is used. A redirect hop that leaves the original request's origin (host:port) or downgrades https to http is refused with ErrCrossOriginRedirect: neither the token nor the body follows it.
func NewRouterClient ¶
func NewRouterClient(cfg RouterClientConfig) *http.Client
NewRouterClient composes NewRouterTransport with the canonical client timeout and, when cfg.BearerToken is set, an outer NewBearerRoundTripper. Whatever the token, the client refuses any redirect that leaves the original request's origin (ErrCrossOriginRedirect). The returned client is safe for concurrent use and should be process-global (its transport owns the connection pool).
func NewRouterTransport ¶
NewRouterTransport builds a pooled *http.Transport with the canonical pool settings above. Two dial modes:
Direct mode (traefikDockerDNS == ""): the URL host is dialed normally. Used where the agent can itself reach the destination (tests, k3s nodes dialing cluster DNS/CNI).
Traefik-rewrite mode (traefikDockerDNS != ""): DialContext ignores the URL's host:port and dials <traefikDockerDNS>:<traefikDialPort> instead — the local docker Traefik container, resolved via the docker network's embedded DNS. The HTTP Host header and TLS SNI stay as the URL authority so Traefik matches its inbound rule and forwards into the cluster over its site-specific mTLS ServersTransport. Traefik is re-dialed on every connect so a Traefik restart is picked up without an agent restart.
Types ¶
type RouterClientConfig ¶
type RouterClientConfig struct {
// TraefikDockerDNS, when non-empty, rewrites every dial target to
// <TraefikDockerDNS>:<TraefikDialPort> (see NewRouterTransport).
TraefikDockerDNS string
// TraefikDialPort is the port dialed on TraefikDockerDNS in rewrite mode.
TraefikDialPort string
// BearerToken, when non-empty, is attached as "Authorization: Bearer …"
// on every request that does not already carry an Authorization header.
BearerToken string
}
RouterClientConfig configures NewRouterClient. It is deliberately generic — no gdrive/duplicacy-specific fields — so any agent can compose it.
Source Files