The HTTP proxy dialed by Host header and looped back through Fly.
- commit
- df69f8bd82b528fcc7f762b99ecf39f06fc0f2ea
- parent
- 0de728c560b549a170626d1526e941c7bcf3b344
- author
- Dami <dami.etoile@gmail.com>
| M | deploy/ | 4 | ++-- |
| M | deploy/ | 5 | +++-- |
@@ -8,11 +8,11 @@
88 99 # Fly's proxy terminates TLS and forwards HTTP here with the original Host1010 # and X-Forwarded-Proto. Upstream traffic reaches the relay host over the11-# tailnet through tailscaled's local CONNECT proxy.11+# tailnet through tailscaled's local SOCKS5 proxy, which dials by address.1212 :8080 {1313 reverse_proxy http://{$RELAY_TAILNET_HOST}:8080 {1414 transport http {15- network_proxy http://127.0.0.1:105515+ network_proxy url socks5://127.0.0.1:10551616 }1717 }1818 }@@ -1,12 +1,13 @@
11 22 # Join the tailnet in userspace mode, expose an HTTP CONNECT proxy for Caddy,3-# then run Caddy. TS_AUTHKEY comes from a Fly secret and is only needed the3+# then run Caddy. tailscaled dials upstreams by address through SOCKS5 so the4+# Host header passes through untouched. TS_AUTHKEY comes from a Fly secret and is only needed the45 # first time; afterwards the identity persists on the state volume.56 set -eu67 STATE="${TS_STATE_DIR:-/var/lib/tailscale}"78 mkdir -p /var/run/tailscale "$STATE"89 tailscaled --state="$STATE/tailscaled.state" --socket=/var/run/tailscale/tailscaled.sock \9- --tun=userspace-networking --outbound-http-proxy-listen=127.0.0.1:1055 &10+ --tun=userspace-networking --socks5-server=127.0.0.1:1055 &1011 until [ -S /var/run/tailscale/tailscaled.sock ]; do sleep 1; done1112 if [ -n "${TS_AUTHKEY:-}" ]; then1213 tailscale --socket=/var/run/tailscale/tailscaled.sock up --authkey="$TS_AUTHKEY" --hostname="${TS_HOSTNAME:-tiny-edge}" --accept-dns=false