mirror of
https://github.com/pomerium/pomerium.git
synced 2025-06-01 18:33:19 +02:00
53 lines
1.8 KiB
Go
53 lines
1.8 KiB
Go
package envoyconfig
|
|
|
|
import (
|
|
"strconv"
|
|
|
|
envoy_config_cluster_v3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
|
|
envoy_config_endpoint_v3 "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3"
|
|
envoy_config_listener_v3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
|
|
|
|
"github.com/pomerium/pomerium/config"
|
|
)
|
|
|
|
// Pomerium implements the ACME TLS-ALPN protocol by adding a filter chain to the main HTTPS listener
|
|
// that matches the acme-tls/1 application protocol on incoming requests and forwards them to a listener
|
|
// started in the `autocert` package. The proxying is done using TCP so that the Go listener can terminate
|
|
// the TLS connection using the certmagic package.
|
|
|
|
const (
|
|
acmeTLSALPNApplicationProtocol = "acme-tls/1"
|
|
acmeTLSALPNClusterName = "pomerium-acme-tls-alpn"
|
|
)
|
|
|
|
func (b *Builder) buildACMETLSALPNCluster(
|
|
cfg *config.Config,
|
|
) *envoy_config_cluster_v3.Cluster {
|
|
port, _ := strconv.Atoi(cfg.ACMETLSALPNPort)
|
|
return &envoy_config_cluster_v3.Cluster{
|
|
Name: acmeTLSALPNClusterName,
|
|
LoadAssignment: &envoy_config_endpoint_v3.ClusterLoadAssignment{
|
|
ClusterName: acmeTLSALPNClusterName,
|
|
Endpoints: []*envoy_config_endpoint_v3.LocalityLbEndpoints{{
|
|
LbEndpoints: []*envoy_config_endpoint_v3.LbEndpoint{{
|
|
HostIdentifier: &envoy_config_endpoint_v3.LbEndpoint_Endpoint{
|
|
Endpoint: &envoy_config_endpoint_v3.Endpoint{
|
|
Address: buildAddress("127.0.0.1", port),
|
|
},
|
|
},
|
|
}},
|
|
}},
|
|
},
|
|
}
|
|
}
|
|
|
|
func (b *Builder) buildACMETLSALPNFilterChain() *envoy_config_listener_v3.FilterChain {
|
|
return &envoy_config_listener_v3.FilterChain{
|
|
FilterChainMatch: &envoy_config_listener_v3.FilterChainMatch{
|
|
ApplicationProtocols: []string{acmeTLSALPNApplicationProtocol},
|
|
},
|
|
Filters: []*envoy_config_listener_v3.Filter{
|
|
TCPProxyFilter(acmeTLSALPNClusterName),
|
|
},
|
|
}
|
|
}
|