Mercurial > prosody-modules

comparison mod_net_proxy/README.md @ 6348:9d3e6d2f25c7

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_net_proxy: Add support for `proxy_out` and `proxy_secure`
author moparisthebest <admin@moparisthebest.com>
date Fri, 14 Nov 2025 02:06:22 -0400
parents fe081789f7b5
children
comparison
equal deleted inserted replaced
6347:7ed4627ba65d 6348:9d3e6d2f25c7
22 You can find more information about the PROXY protocol on 22 You can find more information about the PROXY protocol on
23 [the official website](https://www.haproxy.com/blog/haproxy/proxy-protocol/) 23 [the official website](https://www.haproxy.com/blog/haproxy/proxy-protocol/)
24 or within 24 or within
25 [the official protocol specifications.](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) 25 [the official protocol specifications.](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)
26 26
27 It also allows to set an outgoing (s2s) proxy, and optionally mark any of these connections secure.
27 28
28 Usage 29 Usage
29 ===== 30 =====
30 31
31 Copy the plugin into your prosody's modules directory. And add it 32 Copy the plugin into your prosody's modules directory. And add it
62 only configure the appropriate mappings with "proxy_port_mappings", which will 63 only configure the appropriate mappings with "proxy_port_mappings", which will
63 automatically start listening on all mapped ports. 64 automatically start listening on all mapped ports.
64 65
65 Example: proxy_ports = { 15222, 15269 } 66 Example: proxy_ports = { 15222, 15269 }
66 ]]-- 67 ]]--
68
69 -- make all outgoing s2s connections directly to here instead
70 proxy_out = { "192.168.10.1", 15270 }
71
72 --[[
73 Mark incoming/outgoing connections from/to proxy as secure.
74 This is just shorthand to override `proxy_secure_in` and `proxy_secure_out` below.
75 ]]--
76 proxy_secure = true
77
78 --[[
79 Mark incoming connections from proxy as secure.
80 The proxy must guarantee this by requiring encryption and properly validating
81 incoming s2s certs.
82 ]]--
83 proxy_secure_in = true
84
85 --[[
86 Mark outgoing connections to proxy as secure.
87 The proxy must guarantee this by requiring encryption, and sending client cert
88 for s2s connections.
89 ]]--
90 proxy_secure_out = true
67 ``` 91 ```
68 92
69 The above example configuration, which needs to be placed in the global section, 93 The above example configuration, which needs to be placed in the global section,
70 would listen on both tcp/15222 and tcp/15269. All incoming connections have to 94 would listen on both tcp/15222 and tcp/15269. All incoming connections have to
71 originate from trusted hosts/networks (configured by _proxy_trusted_proxies_) and 95 originate from trusted hosts/networks (configured by _proxy_trusted_proxies_) and
171 Compatibility 195 Compatibility
172 ============= 196 =============
173 197
174 ----- ----- 198 ----- -----
175 trunk Works 199 trunk Works
200 13 Works
176 0.12 Works 201 0.12 Works
177 0.11 Works 202 0.11 Works
178 0.10 Works 203 0.10 Works
179 ----- ----- 204 ----- -----