Comment on Best way to get IPv4 connectivity to my self-hosted services
hank_and_deans@lemmy.ca 3 weeks agoOr just use Nginx stream proxy, and all the encryption happens on the endpoints. No need for certs on the proxy at all.
This is how I make https and mqtts available on ipv4.
2xsaiko@discuss.tchncs.de 3 weeks ago
Oh interesting, I’ll have to look into that. Is this with that “proxy protocol” I’ve seen mentioned? If not, does this preserve it pass through the client socket address?
hank_and_deans@lemmy.ca 3 weeks ago
It’s merely a tcp proxy. It doesn’t even have to be http since it has no idea. The trick with tls is that it can extract the requested host name via SNI.
2xsaiko@discuss.tchncs.de 3 weeks ago
Hm, okay, that does sound like the real client IP will get lost and every connection will appear to come from the proxy then. It would be good if that were passed somehow. My current setup adds the X-Forwarded-For header for example.
hank_and_deans@lemmy.ca 3 weeks ago
That is correct. There is a trick where you can set the source ip to the ipv6 mapped ipv4 ip it originally came from. I have implemented that in a transparent tcp proxy I worked on some years ago, but I am not sure if nginx supports that.
I should look into that actually. It would be useful to me as well.