Suggestion: Add support to unix domain socket in proxy addr
- Dominant language
- Go
- Stars
- 2.1k
- Forks
- 274
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 106
Description
## Is your feature request related to a problem? Please describe.
This could be a security and performance enhancement of ocis, especially when deployed without docker (dpkg packages, etc.). The ocis processes can be in a namespace / container with full network isolation and optional partial filesystem isolation, using a socket as a bridge between reverse proxies and ocis (with proper user/group settings to grant rw to proxy and ocis), preventing unexpected off-proxy accesses to many unprotected ports (#5844)
My current setting: A namespace is set in systemd (separated network, same filesystem) so that no listened port will be exposed to any user other than the ocis service user. A socat process is managed by systemd, started before ocis, listening to a socket (permission is u=www-data g=ocis 0660) and set proxy addr to that socket in nginx. This works fine mostly, but sometimes the socat service fails and won't start without a system reboot.
## Describe the solution you'd like
Allow setting something like `PROXY_HTTP_ADDR=unix:///var/run/ocis.sock`.
## Additional context
Reissues #11840 .
Contributor guide
Research direction
Begin with the code that parses PROXY_HTTP_ADDR and configures the proxy listener; compare the requested behavior with reissue #11840. Done means a unix:///var/run/ocis.sock value is accepted for the proxy address and allows the reverse proxy to connect through the Unix socket.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend, networking
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100