Documentation
¶
Overview ¶
Package proxy implements the gobeyond.builds/v2 middleware artifact: a separately-runnable reverse proxy that sits between the hosting supervisor and the app server (gobeyond-internal data-plane contracts §7). Per request it either responds itself (redirects, denials, synthetic responses) or forwards a possibly-rewritten request to the upstream app socket.
Wiring (§7.3):
supervisor -> GOBEYOND_LISTEN (middleware ingress, unix socket) middleware -> GOBEYOND_UPSTREAM (app socket, unix:///run/gobeyond/app.sock)
Header contract on the middleware -> app hop:
- Preserved verbatim: x-gobeyond-viewer-host, x-forwarded-proto, x-forwarded-for, x-origens-oidc-token. The proxy restores the inbound values after the Middleware hook runs, so they cannot be rewritten or dropped.
- Mutable: method, path (+query), body, and all other request headers; rewrites are expressed by forwarding a modified request.
- Additive auth context: x-gobeyond-auth-context may be set only by the middleware (base64url-encoded JSON, <= 8 KiB); any inbound value is stripped before the hook runs.
Index ¶
Constants ¶
const ( // EnvUpstream is the app socket the middleware forwards to // (unix://<absolute path> or tcp://<host:port>). EnvUpstream = "GOBEYOND_UPSTREAM" // AuthContextHeader carries middleware-asserted auth context to the // app. It is additive and set exclusively by the middleware. AuthContextHeader = "X-Gobeyond-Auth-Context" // MaxAuthContextBytes caps the encoded auth-context header value. MaxAuthContextBytes = 8 << 10 )
Variables ¶
var PreservedHeaders = []string{
"X-Gobeyond-Viewer-Host",
"X-Forwarded-Proto",
"X-Forwarded-For",
"X-Origens-Oidc-Token",
}
PreservedHeaders cross the middleware->app hop verbatim.
Functions ¶
func Serve ¶
func Serve(middleware Middleware) error
Serve runs middleware as the gobeyond-middleware artifact: it forwards to GOBEYOND_UPSTREAM and serves the listen contract (GOBEYOND_LISTEN, /_gobeyond/healthz, SIGTERM drain) via adapters/listen.
func SetAuthContext ¶
SetAuthContext encodes value as base64url JSON and sets it on header, enforcing the <= 8 KiB encoded budget.
func ValidateAuthContext ¶
ValidateAuthContext checks a candidate x-gobeyond-auth-context value: base64url (padded or unpadded) decoding to JSON, <= 8 KiB encoded.
Types ¶
type Handler ¶
type Handler struct {
// contains filtered or unexported fields
}
Handler is the middleware reverse proxy.
type Middleware ¶
Middleware decides one request. Returning a non-nil Response answers the request without contacting the app (redirects, denials, synthetic bodies). Returning nil forwards the request - including any mutations made to it - upstream.
Source Files