4 ms·
Something I've wanted to do is run less trusted services on a private network but still have the reverse proxy connect to them. This way I can be sure that they
by kevincox 4y ago
Something I've wanted to do is run less trusted services on a private network but still have the reverse proxy connect to them. This way I can be sure that they only way to get to them from the outside is via the reverse proxy (which adds authentication). However I haven't found a decent way to manage that no network access paired with a loopback or similar that can be accessed by the reverse proxy.
- gdgghhhhh 4y agoJust share an open FD to a socks proxy with the isolated service.
- kevincox 4y agoThis depends on the service itself supporting inheriting sockets for proxies. Is this a common feature? Some services do support listening socket passing which does solve my problem as I can make it listen on a UNIX socket mounted on the host and accessible to the reverse proxy but many of the lower quality services that I want to give this treatment to don't support that either.
- hddqsb 3y agoAs another commenter says, you can use socat. Specifically, you can run it in double client mode (see http://www.dest-unreach.org/socat/doc/socat-gender.txt http://www.dest-unreach.org/socat/doc/socat-gender.txt) to connect the UNIX socket to the service.
- troyjfarrell 4y agoYou've just described Sandstorm. Sandstorm runs instances (called grains) of applications in a sandbox. The application gets a limited file system and a Cap'n Proto RPC connection to the outside world over a unix socket. Sandstorm runs the HTTPS server, which turns requests into RPC calls. Sandstorm authenticates the users and provides temporary subdomains and frames to sandbox the HTML side of it. https://sandstorm.io/ https://sandstorm.io/
- ranger_danger 4y agoOP's comments are all about Sandstorm FYI
- SahAssar 4y agoCan run it in a isolated namespace and communicate with unix sockets. If the service does not support listening on sockets you can use socat within the namespace to forward from the unix socket to a port on lo in the namespace. Most reverse proxies can forward to a unix socket. I've done similar things (and sometimes with a wireguard tunnel out to internet) for privacy reasons.
- hddqsb 3y agoHere is an example I linked in another comment: http://www.dest-unreach.org/socat/doc/socat-gender.txt http://www.dest-unreach.org/socat/doc/socat-gender.txt
- deleted 4y ago[deleted]
- zrail 4y agoI have less trusted services all listening on my Tailscale network. Network ACLs can then ensure they can't talk to each other and the only thing that can talk to them is the reverse proxy.
- Arnavion 4y agoCreate a veth pair. Move one end of the pair into a network namespace. Bind the untrusted service on that end. Have your proxy service connect to the other end.
- yrro 4y agoUse socket activation and run your service with PrivateNetwork=yes