tlsserver

Overview ¶

Package main provides a proxyproto + TLS server example.

It demonstrates the common wrapping order: the upstream sends the PROXY protocol header in cleartext BEFORE the TLS handshake (e.g. AWS NLB with proxy protocol v2, or HAProxy "send-proxy" in front of a TLS listener). The proxyproto listener must therefore sit INSIDE the TLS listener, so it can read the header from cleartext before TLS decrypts the rest of the stream:

tls.NewListener(&proxyproto.Listener{Listener: l}, cfg) // proxyproto INNER, tls OUTER

If your upstream instead sends the PROXY header INSIDE the TLS session (after the handshake), invert the wrapping so TLS is decrypted first:

&proxyproto.Listener{Listener: tls.NewListener(l, cfg)} // tls INNER, proxyproto OUTER

Run this alongside the tlsclient example.