Documentation
¶
Overview ¶
Package l7 provides an HTTP CONNECT forward proxy for name-based egress.
Product intent: clients direct listed app domains to an egress gateway over the mesh (WireGuard underlay). The gateway runs this server, matches CONNECT targets against a domain policy, and dials the internet by hostname — avoiding brittle domain→IP→route collection used for L3 egress ranges.
This package does not own Netmaker control-plane config, PAC generation, or WireGuard. See docs/PROXY_L7_EGRESS.md.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( ErrServerClosed = errors.New("l7: server closed") ErrForbidden = errors.New("l7: destination not allowed") ErrBadRequest = errors.New("l7: bad CONNECT request") )
Common errors returned by the L7 proxy.
Functions ¶
This section is empty.
Types ¶
type AllowAll ¶
type AllowAll struct{}
AllowAll permits any non-empty host (useful for tests; not for production egress).
type Allowlist ¶
type Allowlist struct {
// Domains are exact names (example.com) or wildcards (*.example.com).
Domains []string
}
Allowlist matches exact hostnames and optional "*.suffix" wildcards (one or more labels). Matching is case-insensitive. Empty Allowlist denies all hosts.
type ConnectTarget ¶
ConnectTarget is the host:port from an HTTP CONNECT request.
func (ConnectTarget) HostPort ¶
func (t ConnectTarget) HostPort() string
HostPort returns host:port for dialing.
type Dialer ¶
type Dialer interface {
DialContext(ctx context.Context, network, address string) (net.Conn, error)
}
Dialer dials TCP destinations for CONNECT tunnels.
type DomainMatcher ¶
type DomainMatcher interface {
// Allow returns nil if host (and optional port) may be dialed; otherwise a reason error.
Allow(host, port string) error
}
DomainMatcher decides whether a CONNECT destination is allowed. Implementations are supplied by the integrator (e.g. netclient from control-plane lists).
type Logger ¶
type Logger interface {
Debug(msg string, kv ...any)
Info(msg string, kv ...any)
Warn(msg string, kv ...any)
Error(msg string, kv ...any)
}
Logger is a minimal structured logging facade.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server is an HTTP CONNECT forward proxy intended to listen on a mesh address of an egress gateway.
func NewServer ¶
func NewServer(opts ServerOptions) (*Server, error)
NewServer validates options and returns a Server. Does not listen until Start.
type ServerOptions ¶
type ServerOptions struct {
// ListenAddr is the TCP address to bind (typically a mesh IP:port on the egress GW).
ListenAddr string
// Matcher decides whether a CONNECT target is allowed (required).
Matcher DomainMatcher
// Dialer is optional; nil uses net.Dialer with DialTimeout.
Dialer Dialer
// Logger is optional; nil uses a no-op logger.
Logger Logger
// DialTimeout bounds outbound dials and CONNECT header read (default 15s).
DialTimeout time.Duration
// IdleTimeout is the max lifetime of an established tunnel (default 5m).
IdleTimeout time.Duration
}
ServerOptions configures the CONNECT forward proxy.
Source Files