rust-rpxy with docker

[shoutmarble]

I roughed in my first example with rust-rpxy✅

root@server:~/rpxy# cat config.toml 

listen_port = 80
listen_port_tls = 443

[apps.whoami]
server_name = 'whoami.example.com'
tls = { https_redirection = true, tls_cert_path = '/certs/server.pem', tls_cert_key_path = '/certs/server.key' }

reverse_proxy = [{ upstream = [{ location = 'whoami:80' }] }]
# reverse_proxy = [{ upstream = [{ location = 'whoami.example.com:80' }] }] ✅
# reverse_proxy = [{ upstream = [{ location = '192.168.168.230:80' }] }] ✅

[apps.hello]
server_name = 'hello.example.com'
tls = { https_redirection = true, tls_cert_path = '/certs/server.pem', tls_cert_key_path = '/certs/server.key' }

reverse_proxy = [{ upstream = [{ location = 'hello:8000' }] }]

root@server:~/rpxy# cat docker-compose.yml

networks:
    hap-network:
        name: "hap-network"
        driver: bridge
        ipam:
            driver: default
            config:
            - subnet: "192.168.168.0/24"
              gateway: "192.168.168.1"


services:
    rpxy:
        image: jqtype/rpxy:latest-slim
        environment:
            - WATCH=true
        ports:
          - 0.0.0.0:80:80
          - 0.0.0.0:443:443
        networks:
            hap-network:
                ipv4_address: 192.168.168.200
        volumes:
          - ./config.toml:/rpxy/config/rpxy-config/rpxy.toml
          - ./config.toml:/etc/rpxy.toml
          - ./certificates/example.com.crt:/certs/server.crt:ro
          - ./certificates/example.com.key:/certs/server.key:ro
          - ./certificates/example.com.pem:/certs/server.pem:ro


    whoami:
        image: traefik/whoami
        container_name: whoami
        hostname: whoami
        # hostname: whoami.example.com
        restart: unless-stopped
        ports:
            - 8080:80
        networks:
            hap-network:
                ipv4_address: 192.168.168.230



    hello:
        image: crccheck/hello-world
        container_name: hello
        hostname: hello
        restart: unless-stopped
        ports:
            - 8088:8000
        networks:
            hap-network:
                ipv4_address: 192.168.168.240

PS C:\Users\*******\Downloads> curl -L http://whoami.example.com ✅
PS C:\Users\*******\Downloads> curl https://whoami.example.com ✅
PS C:\Users\*******\Downloads> curl http://whoami.example.com:8080 ❎ pulls page but probably shouldn't

PS C:\Users\Terry\Downloads> curl https://hello.example.com ✅
PS C:\Users\Terry\Downloads> curl -L http://hello.example.com ✅
PS C:\Users\Terry\Downloads> curl http://hello.example.com:8088 ❎ pulls page but probably shouldn't

I will investigate why I'm having an open port not exposed to TLS through Rust-Rpxy.

[shoutmarble]

Would I be able to do TLS/SNI Layer4 termination as it is done with caddy-l4 in rust-rpxy.

I got livekit working with Caddy-L4 on my VPS using this version of Livekit.

However, it has a rather complex Caddy-L4 TLS/SNI Layer-4 termination file which I would like to simplify
with rust-rpxy. Would this be possible with rust-rpxy?

I would also use this solution to host stalwart-mail-server and other greedy host networking web-apps/servers that consume the entire VPS network.

livekit-meet-docker caddy-l4.yml

apps:
  tls:
    certificates:
      automate:
        - "#{$LIVEKIT_MEET_FQDN}"
        - "#{$LIVEKIT_SERVER_FQDN}"
        - "#{$LIVEKIT_TURN_FQDN}"
  layer4:
    servers:
      main:
        listen: [":443"]
        routes:
          - match:
              - tls:
                  sni:
                    - "#{$LIVEKIT_MEET_FQDN}"
            handle:
              - handler: tls
                connection_policies:
                  - alpn: ["http/1.1", "http/2"]
              - handler: proxy
                upstreams:
                  - dial: ["livekit-meet:3000"]
          - match:
              - tls:
                  sni:
                    - "#{$LIVEKIT_SERVER_FQDN}"
            handle:
              - handler: tls
                connection_policies:
                  - alpn: ["http/1.1"]
              - handler: proxy
                upstreams:
                  - dial: ["livekit-server:7880"]
          - match:
              - tls:
                  sni:
                    - "#{$LIVEKIT_TURN_FQDN}"
            handle:
              - handler: tls
              - handler: proxy
                upstreams:
                  - dial: ["livekit-server:5349"]

env.example

# 1. Copy this file and save it as '.env'.
# 2. Update the environment variables listed below as needed.
# 3. Edit the 'keys' and 'turn.domain' sections in the 'livekit.yaml' to match the values from this file.

# To generate a new API key and secret, run the 'generate_keypair.py' script.
# Usage: python generate_keypair.py

# Environment Variables:
LIVEKIT_API_KEY=7e510eafd39852bee31c4d5bfa87847e
LIVEKIT_API_SECRET=083ca120732019b2cf4a350d1c928173
LIVEKIT_URL=wss://livekit-server.example.com

LIVEKIT_MEET_FQDN=livekit-meet.example.com
LIVEKIT_SERVER_FQDN=livekit-server.example.com
LIVEKIT_TURN_FQDN=livekit-turn.example.com

[junkurihara]

Hi @shoutmarble, rpxy does not support L4 proxy (TCP proxy) at this point. So unfortunately it doesn't support forwarding TCP stream by terminating TLS at rpxy.

The functionality seems to be "technically" possible with some modification of the code, and may be supported in future.

[airmarkes]

Hi, @junkurihara, I start using rpxy successfully (thank you for that), however I cant send email (contact smtp google) with the lettre crate via proxy. It seems to be because it needs a L4 proxy (TCP), right? Do you intend to implement this functionality any time soon, or if at all? Thanks again!

[junkurihara]

Hi, I just made my rpxy-l4 project public yesterday! It is actually an L4 reverse proxy with protocol multiplexer functions. It may be the one you needed.

At this point, I have no plan to integrate rpxy with rpxy-l4. But rpxy is flawlessly working behind rpxy-l4 at my side :-)

[shoutmarble]

May you stub in an example on rust-rpxy-l4

Using the image: traefik/whoami:latest to possibly see the proxy-protocol re-write headers?

And, how you're using rust-rpxy behind rust-rpxy-l4 using the same example with traefik/whoami

This above rust-rpxy-l4 example is the scenario that I would want to run livekit and stalwart.

networks:
    rpxy-net:
        driver: bridge
        ipam:
            config:
                - subnet: 10.5.0.0/16
                  gateway: 10.5.0.1

services:
    rpxy-l4:
        image: jqtype/rpxy-l4:latest
        container_name: rpxy-l4
.
.
.

    whoami:
        image: traefik/whoami:latest
        container_name: whoami
        restart: always
        expose:
            - 80
        networks:
            rpxy-net:
                ipv4_address: 10.5.0.5

[airmarkes]

What a timing.. kkk. I found a workaround solution to my problem, though.. which is to send the notification mail from my app to a free tier mail service called mailtrap.io through http API.. so I have no pressure to check out rust-rpxy-l4 to see if it would work out for my previous case.. However, I think I'd need the SMTP protocol through some 'HAproxy' type proxy (didn't look deeper), which I dont know if the TCP raw proxy would work out... I will check this in the future.. thanks again ^^

[junkurihara]

@shoutmarble Here are my simple docker-compose examples of rpxy-l4, collocated with rpxy, and located behind rpxy. In both scenarios, rpxy-l4 routes incoming tcp/udp traffic towards other containers (rpxy in the former. another container, e.g., smtp server, in the latter).

1. collocation scenario (serve non-http/https port by rpxy-l4, then forwards such traffic to another container in net-rpxy. in this scenario, rpxy-l4 works independently from rpxy. rpxy is responsible to serve http/https, and rpxy-l4 is so to serve services for another.)

services:
  rpxy-l4:
    image: jqtype/rpxy-l4:nightly
    container_name: rpxy-l4
    ports:
      - ${EXPOSED_TCP_PORT_FOR_NON_HTTPS}:8448/tcp
      - ${EXPOSED_UDP_PORT_FOR_NON_HTTPS}:8448/udp
    environment:
      ...
    volumes:
      - ./log/rpxy-l4:/rpxy-l4/log:rw
      - ./config/rpxy-l4:/rpxy-l4/config:ro
    networks:
      net-rpxy:

  rpxy:
    image: jqtype/rpxy:nightly-slim
    container_name: rpxy
    ports:
      - 443:443/tcp
      - 443:443/udp
      - 80:80/tcp
    environment:
      ...
    volumes:
      ...
    networks:
      net-http:
        ipv4_address: 192.168.0.10

networks:
  net-rpxy:
    name: net-rpxy
    ipam:
      config:
        - subnet: 192.168.0.0/24
          gateway: 192.168.0.1

2. scenario of serially-connected rpxy and rpxy-l4 (serve only QUIC/TLS traffics by rpxy-l4, then forwards them to rpxy)

services:
  rpxy-l4:
    image: jqtype/rpxy-l4:nightly
    container_name: rpxy-l4
    ports:
      - 443:8448/tcp
      - 443:8448/udp
    environment:
      ...
    volumes:
      - ./log/rpxy-l4:/rpxy-l4/log:rw
      - ./config/rpxy-l4:/rpxy-l4/config:ro
    networks:
      net-rpxy:

  rpxy:
    image: jqtype/rpxy:nightly-slim
    container_name: rpxy
    expose:
      - 443/tcp
      - 443/udp
    environment:
      ...
    volumes:
      ...
    networks:
      net-http:
        ipv4_address: 192.168.0.10

networks:
  net-rpxy:
    name: net-rpxy
    ipam:
      config:
        - subnet: 192.168.0.0/24
          gateway: 192.168.0.1

We have the third scenario using rpxy-l4, serving HTTPS and another service like SSH on the same port, i.e., port 443, by using the protocol multiplexer function. Anyways, I do not fully understand your concern at this point (I don't know traefik, stalwart, nor livekit.). I not sure if I did answer your question. So please check rpxy-l4 repo, and try it first if you are interested in using rpxy-l4 for your solution.

[shoutmarble]

Thank you, I will try this out and give feedback once I'm set.