Refactor: Separate proxy data-planes from a shared proxy shim layer
Open
@huang195 is already working on this.
Since Jul 20, 2026.
nice to have
- Dominant language
- Go
- Stars
- 13
- Forks
- 40
- Avg merge
- 12h 17m
- Merged PRs (30d)
- 156
Description
Summary
Rearchitect Cortex to cleanly separate the concrete proxy data-planes from a shared "proxy shim" layer. The shim owns the cross-cutting concerns so each proxy (Go proxy, Envoy, Praxies) becomes a thin data-plane implementation rather than a duplicate of the same plumbing.
The shim layer should handle
- TLS termination
- mTLS
- Session correlation
- Protocol bridging
- Support for both transparent and forward proxy modes
Motivation
Cross-cutting concerns (TLS/mTLS, session correlation, protocol bridging, transparent-vs-forward proxy handling) are currently entangled with the individual proxy implementations. Extracting them into a shim layer:
- makes adding a new proxy (e.g. Praxies) a matter of implementing a thin data-plane against the shim;
- gives one place for TLS/mTLS and session-correlation behavior across all proxies;
- unifies transparent + forward proxy support.
Related
- Part of epic: Cortex Phase 1 (rossoctl/rossoctl#2244)
- Enables: Add Praxies as a third proxy (sibling issue)
- Related: transparent inbound interception — rossoctl/cortex#330
Design to be expanded.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.