opnsense / plugins

OPNsense plugin collection
https://opnsense.org/
BSD 2-Clause "Simplified" License
849 stars 645 forks source link

Caddy: support h2c protocol for reverse_proxy #4368

Open oliverpool opened 9 hours ago

oliverpool commented 9 hours ago

Important notices

Is your feature request related to a problem? Please describe.

I would like to have a gRPC streaming handler, with the TLS managed by Caddy. For this the upstream connection must use h2c (gRPC streams require http/2, but I don't want to have a certificate, hence "unencrypted http/2" a.k.a. h2c).

According to the Caddy docs, the resulting config should look like:

reverse_proxy {
    to h2c://127.0.0.201:7777
}

Describe the solution you'd like I would like to be able to select h2c:// as upstream protocol (currently only http:// and https:// are available).

Describe alternatives you've considered Using a Layer4 config should work, but I am not sure how to enable the TLS termination.

Additional context

The template should be adapted around the following lines:

https://github.com/opnsense/plugins/blob/8cd1be1adbf33c4d04d4b77406c0b84f1de0a42e/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile#L447

The model should be expanded as well:

https://github.com/opnsense/plugins/blob/8cd1be1adbf33c4d04d4b77406c0b84f1de0a42e/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml#L358

cc @Monviech who originally created the Caddy plugin, I believe (thanks for the great work BTW!)

Monviech commented 9 hours ago

That seems easy to add, I will put it on my list.

Btw TLS termination will come here: https://github.com/opnsense/plugins/pull/4364