search

etherai / selfhosted-gateway

Self-hosted Docker native tunneling to localhost. Expose local docker containers to the public Internet via a simple docker compose interface.
https://fractalnetworks.co
GNU Affero General Public License v3.0
1.32k stars 66 forks source link

Fix Startup Problem from PR #31 #32

Closed Dotsch2005 closed 9 months ago

Dotsch2005 commented 9 months ago

Fixes #31

Change the Parameter from INSECURE to IN_SECURE_TLS. If the parameter is set when creating or starting, a boolean true/false is checked and enables only TLS or TLS_INSECURE_SKIP_VERIFY. IF the parameter is not set, nothing changes in the function for my pull (I hope).

I have tried several links and hopefully I was able to solve the problem.

Unfortunately I am not completely happy with the implementation. I have tried to adapt more to the actual coding style.

Therefore the following question, would it be more user-friendly if there were two parameters?

Once the parameter TLS to generally tell Caddy that the backend has a TLS connection? And if needed, the parameter IN_SECURE_TLS to skip the verification of the backend ssl certificate?

Otherwise I would extend the readme.

And once again sorry for the issue and my learning is to split the functions.

thebalaa commented 9 months ago

Thanks for the PR.

Can you help me understand why the $FORWARD_ONLY flag doesn't accomplish the desired result?

It seems that if you want caddy to proxy to TLS backend the $FORWARD_ONLY flag is sufficient?

Dotsch2005 commented 9 months ago

The FORWARD_ONLY is used to forward without a caddy.

My problem is that the software itself requires a certificate and this is self-signed and without Caddy as a reverse proxy, the LetsEncrypt certificate is also omitted. Which would then have to be done by the linked software.

The second use case is that when using an internal CA and the call is only handled in the internal network and not via the Internet.

With TLS/TLS Insecure, you can take advantage of the Caddy software and renew your SSL certificates.

thebalaa commented 9 months ago

That makes sense, thanks.

I agree with your suggestion that this should be implemented as 2 separate environments:

$CADDY_TLS_PROXY: connection to target uses TLS

$CADDY_TLS_INSECURE: allow insecure TLS connect to target

Does it make sense?

Thanks again for the contribution. Really like how you solved the random port number issue!