foxIngress

Host-based HTTP(S) router. It can determine the target hostname (and route) connections using the following protocols.

For this, it does not need knowledge of any private keys, even for HTTPS and QUIC (which is the goal of this proxy)

• HTTP: Host header
• HTTPS: Client Hello SNI
• QUIC: Initial Packet SNI

By default it looks for a file called config.yml in the working directory, but this can be influenced with the CONFIG_FILE environment variable.

See config.example.yml for an example config.

Testing

go test ./... -race

The end-to-end suite in e2e starts real listeners on ephemeral loopback ports against a generated config and drives them with real clients, covering all three protocols:

• HTTP and HTTPS talk to real origin servers. The HTTPS tests complete a genuine TLS handshake at the backend, which is what proves the sniffed ClientHello was replayed byte for byte.
• QUIC substitutes a trivial line-based host sniffer for the Client Initial Packet parser, via udp.RegisterSniffer. The tests cover foxIngress's own demultiplexing, forwarding and flow lifetime rather than re-testing clienthellod.

The harness lives in internal/testenv. It decodes the PROXY protocol with its own independent implementation, so the header format is genuinely verified rather than round-tripped through the code that wrote it.

MIT licensed