Skip to content

Latest commit

 

History

History
206 lines (177 loc) · 6.01 KB

README.md

File metadata and controls

206 lines (177 loc) · 6.01 KB
Raw

p3y: Micro Reverse Proxy

p3y is a small (3.5M Container) single binary reverse proxy written in go. It was developed for use in Kubernetes, to wrap services like Prometheus with simple BasicAuth and TLS encryption. p3y exposes its operational metrics on port 2112 by default and tracks number of requests, authentication failures and latency.

Quick Docker Example

Proxy your local port 8080 to site https://example.com.

docker run --rm -p 8080:8080 -p 2112:2112 txn2/p3y \
    -backend https://example.com:443 \
    -username test \
    -password test

Open http://localhost:8080 to view the site or http://localhost:2112 to view metrics.

Install p3y on a Mac

If you are running MacOS and use homebrew you can install kubefwd directly from the txn2 tap:

# install
brew install txn2/tap/kubefwd

# ... or upgrade
brew upgrade p3y

CLI & ENV Options

Note: The environment variables SKIP_VERIFY and TLS expect values "true" or "false" if explicitly set.

Flag Environment Variable Description
-help Display help.
-version Display version.
-backend BACKEND Backend server. (default "http://example.com:80")
-skip-verify SKIP_VERIFY Skip backend tls verify.
-ip IP Server IP address to bind to. (default "0.0.0.0")
-port PORT Server port. (default "8080")
-logout LOGOUT log output stdout (default "stdout")
-metrics_port METRICS_PORT Metrics server port. (default "2112")
-username USERNAME BasicAuth username to secure Proxy.
-password PASSWORD BasicAuth password to secure Proxy.
-tls TLS TLS Support (requires crt and key)
-crt CRT Path to cert. (enable --tls) (default "./example.crt")
-key KEY Path to private key. (enable --tls (default "./example.key")
-tlsCfg TLSCFG TLS config file path.

Kubernetes Example

The following sets up two services, one for the p3y proxy exposed on NodePort 30090, this should now be accessible from outside the cluster. Metrics for the proxy are available inside the cluster at **http://prom-proxy-metrics:2112/metrics.

Example Services:

apiVersion: v1
kind: Service
metadata:
  name: prom-proxy
  namespace: example
  labels:
    app: prom-proxy
spec:
  selector:
    app: prom-proxy
  ports:
    - protocol: "TCP"
      port: 9090
      nodePort: 30090
      targetPort: 9090
  type: NodePort
---
apiVersion: v1
kind: Service
metadata:
  name: prom-proxy-metrics
  namespace: example
  labels:
    app: prom-proxy
spec:
  selector:
    app: prom-proxy
  ports:
    - protocol: "TCP"
      port: 80
      targetPort: 2112
  type: ClusterIP

Example Deployment:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: prom-proxy
  namespace: example
  labels:
    app: prom-proxy
spec:
  replicas: 1
  selector:
    matchLabels:
      app: prom-proxy
  template:
    metadata:
      labels:
        app: prom-proxy
        component: idx
    spec:
      containers:
        - name: prom-proxy
          image: txn2/p3y:1.0.0
          imagePullPolicy: IfNotPresent
          args: [
            "-port=9090",
            "-backend=http://prometheus:9090",
            "-username=somebody",
            "-password=goodlongpassword",
            "-tls",
            "-crt=/cert/server.crt",
            "-key=/cert/server.key"
          ]
          ports:
            - name: http
              containerPort: 9090
            - name: metrics
              containerPort: 2112
          volumeMounts:
            - name: prom-proxy-cert
              mountPath: "/cert"
      volumes:
        - name: prom-proxy-cert
          secret:
            secretName: prom-proxy-cert

TLS Configuration

If you have specific TLS requirements you can specify them in a configuration file. p3y proxy supports TLS 1.0 (VersionTLS10), 1.1 (VersionTLS11) and 1.2 (VersionTLS12).

Example:

-tlsCfg /cfg/tls.yml

tls.yml:

min: VersionTLS12
max: VersionTLS12
curvePreferences:
  - CurveP521
  - CurveP384
  - CurveP256
ciphers:
  - TLS_RSA_WITH_RC4_128_SHA
  - TLS_RSA_WITH_3DES_EDE_CBC_SHA
  - TLS_RSA_WITH_AES_128_CBC_SHA
  - TLS_RSA_WITH_AES_256_CBC_SHA
  - TLS_RSA_WITH_AES_128_CBC_SHA256
  - TLS_RSA_WITH_AES_128_GCM_SHA256
  - TLS_RSA_WITH_AES_256_GCM_SHA384
  - TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
  - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
  - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
  - TLS_ECDHE_RSA_WITH_RC4_128_SHA
  - TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
  - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
  - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
  - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
  - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
  - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
  - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
  - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305

Development

Test Release

goreleaser --skip-publish --rm-dist --skip-validate

Release

GITHUB_TOKEN=$GITHUB_TOKEN goreleaser --rm-dist