mirror of
https://github.com/sadoyan/aralez.git
synced 2026-04-30 23:08:40 +08:00
Compare commits
12 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
60b7b3aa7a | ||
|
|
569db8e18d | ||
|
|
4126249bcd | ||
|
|
0779f97277 | ||
|
|
b047331e6a | ||
|
|
a341fa30db | ||
|
|
9d604d62e7 | ||
|
|
4a21700552 | ||
|
|
f0157b6e8f | ||
|
|
1370396ae8 | ||
|
|
64ef4e14af | ||
|
|
ffc2bab79f |
208
Cargo.lock
generated
208
Cargo.lock
generated
@@ -110,6 +110,42 @@ dependencies = [
|
|||||||
"windows-sys 0.59.0",
|
"windows-sys 0.59.0",
|
||||||
]
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "aralez"
|
||||||
|
version = "0.9.1"
|
||||||
|
dependencies = [
|
||||||
|
"arc-swap",
|
||||||
|
"async-trait",
|
||||||
|
"axum",
|
||||||
|
"axum-server",
|
||||||
|
"base16ct",
|
||||||
|
"base64",
|
||||||
|
"dashmap",
|
||||||
|
"env_logger",
|
||||||
|
"futures",
|
||||||
|
"jsonwebtoken",
|
||||||
|
"lazy_static",
|
||||||
|
"log",
|
||||||
|
"mimalloc",
|
||||||
|
"notify",
|
||||||
|
"openssl",
|
||||||
|
"pingora",
|
||||||
|
"pingora-core",
|
||||||
|
"pingora-http",
|
||||||
|
"pingora-proxy",
|
||||||
|
"prometheus 0.14.0",
|
||||||
|
"rand 0.9.1",
|
||||||
|
"reqwest",
|
||||||
|
"rustls-pemfile",
|
||||||
|
"serde",
|
||||||
|
"serde_yaml 0.9.34+deprecated",
|
||||||
|
"sha2",
|
||||||
|
"tokio",
|
||||||
|
"tonic",
|
||||||
|
"urlencoding",
|
||||||
|
"x509-parser",
|
||||||
|
]
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
name = "arc-swap"
|
name = "arc-swap"
|
||||||
version = "1.7.1"
|
version = "1.7.1"
|
||||||
@@ -122,6 +158,45 @@ version = "0.7.6"
|
|||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
|
checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "asn1-rs"
|
||||||
|
version = "0.7.1"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "56624a96882bb8c26d61312ae18cb45868e5a9992ea73c58e45c3101e56a1e60"
|
||||||
|
dependencies = [
|
||||||
|
"asn1-rs-derive",
|
||||||
|
"asn1-rs-impl",
|
||||||
|
"displaydoc",
|
||||||
|
"nom",
|
||||||
|
"num-traits",
|
||||||
|
"rusticata-macros",
|
||||||
|
"thiserror 2.0.12",
|
||||||
|
"time",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "asn1-rs-derive"
|
||||||
|
version = "0.6.0"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c"
|
||||||
|
dependencies = [
|
||||||
|
"proc-macro2",
|
||||||
|
"quote",
|
||||||
|
"syn 2.0.100",
|
||||||
|
"synstructure",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "asn1-rs-impl"
|
||||||
|
version = "0.2.0"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
|
||||||
|
dependencies = [
|
||||||
|
"proc-macro2",
|
||||||
|
"quote",
|
||||||
|
"syn 2.0.100",
|
||||||
|
]
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
name = "async-stream"
|
name = "async-stream"
|
||||||
version = "0.3.6"
|
version = "0.3.6"
|
||||||
@@ -232,6 +307,26 @@ dependencies = [
|
|||||||
"tracing",
|
"tracing",
|
||||||
]
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "axum-server"
|
||||||
|
version = "0.7.2"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "495c05f60d6df0093e8fb6e74aa5846a0ad06abaf96d76166283720bf740f8ab"
|
||||||
|
dependencies = [
|
||||||
|
"arc-swap",
|
||||||
|
"bytes",
|
||||||
|
"fs-err",
|
||||||
|
"http",
|
||||||
|
"http-body",
|
||||||
|
"hyper",
|
||||||
|
"hyper-util",
|
||||||
|
"openssl",
|
||||||
|
"pin-project-lite",
|
||||||
|
"tokio",
|
||||||
|
"tokio-openssl",
|
||||||
|
"tower-service",
|
||||||
|
]
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
name = "backtrace"
|
name = "backtrace"
|
||||||
version = "0.3.74"
|
version = "0.3.74"
|
||||||
@@ -536,6 +631,26 @@ dependencies = [
|
|||||||
"parking_lot_core",
|
"parking_lot_core",
|
||||||
]
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "data-encoding"
|
||||||
|
version = "2.9.0"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "2a2330da5de22e8a3cb63252ce2abb30116bf5265e89c0e01bc17015ce30a476"
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "der-parser"
|
||||||
|
version = "10.0.0"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "07da5016415d5a3c4dd39b11ed26f915f52fc4e0dc197d87908bc916e51bc1a6"
|
||||||
|
dependencies = [
|
||||||
|
"asn1-rs",
|
||||||
|
"displaydoc",
|
||||||
|
"nom",
|
||||||
|
"num-bigint",
|
||||||
|
"num-traits",
|
||||||
|
"rusticata-macros",
|
||||||
|
]
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
name = "deranged"
|
name = "deranged"
|
||||||
version = "0.4.0"
|
version = "0.4.0"
|
||||||
@@ -707,6 +822,16 @@ dependencies = [
|
|||||||
"percent-encoding",
|
"percent-encoding",
|
||||||
]
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "fs-err"
|
||||||
|
version = "3.1.1"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "88d7be93788013f265201256d58f04936a8079ad5dc898743aa20525f503b683"
|
||||||
|
dependencies = [
|
||||||
|
"autocfg",
|
||||||
|
"tokio",
|
||||||
|
]
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
name = "fsevent-sys"
|
name = "fsevent-sys"
|
||||||
version = "4.1.0"
|
version = "4.1.0"
|
||||||
@@ -805,38 +930,6 @@ dependencies = [
|
|||||||
"slab",
|
"slab",
|
||||||
]
|
]
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "gazan"
|
|
||||||
version = "0.1.0"
|
|
||||||
dependencies = [
|
|
||||||
"arc-swap",
|
|
||||||
"async-trait",
|
|
||||||
"axum",
|
|
||||||
"base16ct",
|
|
||||||
"base64",
|
|
||||||
"dashmap",
|
|
||||||
"env_logger",
|
|
||||||
"futures",
|
|
||||||
"jsonwebtoken",
|
|
||||||
"lazy_static",
|
|
||||||
"log",
|
|
||||||
"mimalloc",
|
|
||||||
"notify",
|
|
||||||
"pingora",
|
|
||||||
"pingora-core",
|
|
||||||
"pingora-http",
|
|
||||||
"pingora-proxy",
|
|
||||||
"prometheus 0.14.0",
|
|
||||||
"rand 0.9.1",
|
|
||||||
"reqwest",
|
|
||||||
"serde",
|
|
||||||
"serde_yaml 0.9.34+deprecated",
|
|
||||||
"sha2",
|
|
||||||
"tokio",
|
|
||||||
"tonic",
|
|
||||||
"urlencoding",
|
|
||||||
]
|
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
name = "generic-array"
|
name = "generic-array"
|
||||||
version = "0.14.7"
|
version = "0.14.7"
|
||||||
@@ -1508,6 +1601,12 @@ version = "0.3.17"
|
|||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
|
checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "minimal-lexical"
|
||||||
|
version = "0.2.1"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
name = "miniz_oxide"
|
name = "miniz_oxide"
|
||||||
version = "0.8.3"
|
version = "0.8.3"
|
||||||
@@ -1583,6 +1682,16 @@ dependencies = [
|
|||||||
"memoffset",
|
"memoffset",
|
||||||
]
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "nom"
|
||||||
|
version = "7.1.3"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
|
||||||
|
dependencies = [
|
||||||
|
"memchr",
|
||||||
|
"minimal-lexical",
|
||||||
|
]
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
name = "notify"
|
name = "notify"
|
||||||
version = "8.0.0"
|
version = "8.0.0"
|
||||||
@@ -1651,6 +1760,15 @@ dependencies = [
|
|||||||
"memchr",
|
"memchr",
|
||||||
]
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "oid-registry"
|
||||||
|
version = "0.8.1"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "12f40cff3dde1b6087cc5d5f5d4d65712f34016a03ed60e9c08dcc392736b5b7"
|
||||||
|
dependencies = [
|
||||||
|
"asn1-rs",
|
||||||
|
]
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
name = "once_cell"
|
name = "once_cell"
|
||||||
version = "1.20.2"
|
version = "1.20.2"
|
||||||
@@ -2379,6 +2497,15 @@ version = "0.1.24"
|
|||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
|
checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "rusticata-macros"
|
||||||
|
version = "4.1.0"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
|
||||||
|
dependencies = [
|
||||||
|
"nom",
|
||||||
|
]
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
name = "rustix"
|
name = "rustix"
|
||||||
version = "1.0.7"
|
version = "1.0.7"
|
||||||
@@ -3580,6 +3707,23 @@ version = "0.5.5"
|
|||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
checksum = "1e9df38ee2d2c3c5948ea468a8406ff0db0b29ae1ffde1bcf20ef305bcc95c51"
|
checksum = "1e9df38ee2d2c3c5948ea468a8406ff0db0b29ae1ffde1bcf20ef305bcc95c51"
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "x509-parser"
|
||||||
|
version = "0.17.0"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "4569f339c0c402346d4a75a9e39cf8dad310e287eef1ff56d4c68e5067f53460"
|
||||||
|
dependencies = [
|
||||||
|
"asn1-rs",
|
||||||
|
"data-encoding",
|
||||||
|
"der-parser",
|
||||||
|
"lazy_static",
|
||||||
|
"nom",
|
||||||
|
"oid-registry",
|
||||||
|
"rusticata-macros",
|
||||||
|
"thiserror 2.0.12",
|
||||||
|
"time",
|
||||||
|
]
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
name = "yaml-rust"
|
name = "yaml-rust"
|
||||||
version = "0.4.5"
|
version = "0.4.5"
|
||||||
|
|||||||
10
Cargo.toml
10
Cargo.toml
@@ -1,6 +1,6 @@
|
|||||||
[package]
|
[package]
|
||||||
name = "gazan"
|
name = "aralez"
|
||||||
version = "0.1.0"
|
version = "0.9.1"
|
||||||
edition = "2021"
|
edition = "2021"
|
||||||
|
|
||||||
[profile.release]
|
[profile.release]
|
||||||
@@ -25,6 +25,7 @@ log = "0.4.27"
|
|||||||
futures = "0.3.31"
|
futures = "0.3.31"
|
||||||
notify = "8.0.0"
|
notify = "8.0.0"
|
||||||
axum = { version = "0.8.4" }
|
axum = { version = "0.8.4" }
|
||||||
|
axum-server = { version = "0.7.2", features = ["tls-openssl"] }
|
||||||
reqwest = { version = "0.12.15", features = ["json", "native-tls-alpn"] }
|
reqwest = { version = "0.12.15", features = ["json", "native-tls-alpn"] }
|
||||||
#reqwest = { version = "0.12.15", features = ["json", "rustls-tls"] }
|
#reqwest = { version = "0.12.15", features = ["json", "rustls-tls"] }
|
||||||
#reqwest = { version = "0.12.15", default-features = false, features = ["rustls-tls", "json"] }
|
#reqwest = { version = "0.12.15", default-features = false, features = ["rustls-tls", "json"] }
|
||||||
@@ -42,4 +43,9 @@ arc-swap = "1.7.1"
|
|||||||
mimalloc = { version = "0.1.46", default-features = false }
|
mimalloc = { version = "0.1.46", default-features = false }
|
||||||
prometheus = "0.14.0"
|
prometheus = "0.14.0"
|
||||||
lazy_static = "1.5.0"
|
lazy_static = "1.5.0"
|
||||||
|
openssl = "0.10.72"
|
||||||
|
x509-parser = "0.17.0"
|
||||||
|
rustls-pemfile = "2.2.0"
|
||||||
|
|
||||||
|
#openssl = "0.10.72"
|
||||||
|
|
||||||
|
|||||||
48
METRICS.md
48
METRICS.md
@@ -1,30 +1,34 @@
|
|||||||
# 📈 Gazan Prometheus Metrics Reference
|
# 📈 Aralez Prometheus Metrics Reference
|
||||||
|
|
||||||
This document outlines Prometheus metrics for the [Gazan](https://github.com/sadoyan/gazan) reverse proxy.
|
This document outlines Prometheus metrics for the [Aralez](https://github.com/sadoyan/aralez) reverse proxy.
|
||||||
These metrics can be used for monitoring, alerting and performance analysis.
|
These metrics can be used for monitoring, alerting and performance analysis.
|
||||||
|
|
||||||
Exposed to `http://config_address/metrics`
|
Exposed to `http://config_address/metrics`
|
||||||
|
|
||||||
By default `http://127.0.0.1:3000/metrics`
|
By default `http://127.0.0.1:3000/metrics`
|
||||||
|
|
||||||
|
# 📊 Example Grafana dashboard during stress test :
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 🛠️ Prometheus Metrics
|
## 🛠️ Prometheus Metrics
|
||||||
|
|
||||||
### 1. `gazan_requests_total`
|
### 1. `aralez_requests_total`
|
||||||
|
|
||||||
- **Type**: `Counter`
|
- **Type**: `Counter`
|
||||||
- **Purpose**: Total amount requests served by Gazan.
|
- **Purpose**: Total amount requests served by Aralez.
|
||||||
|
|
||||||
**PromQL example:**
|
**PromQL example:**
|
||||||
|
|
||||||
```promql
|
```promql
|
||||||
rate(gazan_requests_total[5m])
|
rate(aralez_requests_total[5m])
|
||||||
```
|
```
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
### 2. `gazan_errors_total`
|
### 2. `aralez_errors_total`
|
||||||
|
|
||||||
- **Type**: `Counter`
|
- **Type**: `Counter`
|
||||||
- **Purpose**: Count of requests that resulted in an error.
|
- **Purpose**: Count of requests that resulted in an error.
|
||||||
@@ -32,12 +36,12 @@ rate(gazan_requests_total[5m])
|
|||||||
**PromQL example:**
|
**PromQL example:**
|
||||||
|
|
||||||
```promql
|
```promql
|
||||||
rate(gazan_errors_total[5m])
|
rate(aralez_errors_total[5m])
|
||||||
```
|
```
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
### 3. `gazan_responses_total{status="200"}`
|
### 3. `aralez_responses_total{status="200"}`
|
||||||
|
|
||||||
- **Type**: `CounterVec`
|
- **Type**: `CounterVec`
|
||||||
- **Purpose**: Count of responses by HTTP status code.
|
- **Purpose**: Count of responses by HTTP status code.
|
||||||
@@ -45,14 +49,14 @@ rate(gazan_errors_total[5m])
|
|||||||
**PromQL example:**
|
**PromQL example:**
|
||||||
|
|
||||||
```promql
|
```promql
|
||||||
rate(gazan_responses_total{status=~"5.."}[5m]) > 0
|
rate(aralez_responses_total{status=~"5.."}[5m]) > 0
|
||||||
```
|
```
|
||||||
|
|
||||||
> Useful for alerting on 5xx errors.
|
> Useful for alerting on 5xx errors.
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
### 4. `gazan_response_latency_seconds`
|
### 4. `aralez_response_latency_seconds`
|
||||||
|
|
||||||
- **Type**: `Histogram`
|
- **Type**: `Histogram`
|
||||||
- **Purpose**: Tracks the latency of responses in seconds.
|
- **Purpose**: Tracks the latency of responses in seconds.
|
||||||
@@ -60,13 +64,13 @@ rate(gazan_responses_total{status=~"5.."}[5m]) > 0
|
|||||||
**Example bucket output:**
|
**Example bucket output:**
|
||||||
|
|
||||||
```prometheus
|
```prometheus
|
||||||
gazan_response_latency_seconds_bucket{le="0.01"} 15
|
aralez_response_latency_seconds_bucket{le="0.01"} 15
|
||||||
gazan_response_latency_seconds_bucket{le="0.1"} 120
|
aralez_response_latency_seconds_bucket{le="0.1"} 120
|
||||||
gazan_response_latency_seconds_bucket{le="0.25"} 245
|
aralez_response_latency_seconds_bucket{le="0.25"} 245
|
||||||
gazan_response_latency_seconds_bucket{le="0.5"} 500
|
aralez_response_latency_seconds_bucket{le="0.5"} 500
|
||||||
...
|
...
|
||||||
gazan_response_latency_seconds_count 1023
|
aralez_response_latency_seconds_count 1023
|
||||||
gazan_response_latency_seconds_sum 42.6
|
aralez_response_latency_seconds_sum 42.6
|
||||||
```
|
```
|
||||||
|
|
||||||
| Metric | Meaning |
|
| Metric | Meaning |
|
||||||
@@ -87,14 +91,14 @@ gazan_response_latency_seconds_sum 42.6
|
|||||||
🔹 **95th percentile latency**
|
🔹 **95th percentile latency**
|
||||||
|
|
||||||
```promql
|
```promql
|
||||||
histogram_quantile(0.95, rate(gazan_response_latency_seconds_bucket[5m]))
|
histogram_quantile(0.95, rate(aralez_response_latency_seconds_bucket[5m]))
|
||||||
|
|
||||||
```
|
```
|
||||||
|
|
||||||
🔹 **Average latency**
|
🔹 **Average latency**
|
||||||
|
|
||||||
```promql
|
```promql
|
||||||
rate(gazan_response_latency_seconds_sum[5m]) / rate(gazan_response_latency_seconds_count[5m])
|
rate(aralez_response_latency_seconds_sum[5m]) / rate(aralez_response_latency_seconds_count[5m])
|
||||||
```
|
```
|
||||||
|
|
||||||
---
|
---
|
||||||
@@ -108,9 +112,9 @@ rate(gazan_response_latency_seconds_sum[5m]) / rate(gazan_response_latency_secon
|
|||||||
|
|
||||||
| Metric Name | Type | What it Tells You |
|
| Metric Name | Type | What it Tells You |
|
||||||
|---------------------------------------|------------|---------------------------|
|
|---------------------------------------|------------|---------------------------|
|
||||||
| `gazan_requests_total` | Counter | Total requests served |
|
| `aralez_requests_total` | Counter | Total requests served |
|
||||||
| `gazan_errors_total` | Counter | Number of failed requests |
|
| `aralez_errors_total` | Counter | Number of failed requests |
|
||||||
| `gazan_responses_total{status="200"}` | CounterVec | Response status breakdown |
|
| `aralez_responses_total{status="200"}` | CounterVec | Response status breakdown |
|
||||||
| `gazan_response_latency_seconds` | Histogram | How fast responses are |
|
| `aralez_response_latency_seconds` | Histogram | How fast responses are |
|
||||||
|
|
||||||
📘 *Last updated: May 2025*
|
📘 *Last updated: May 2025*
|
||||||
|
|||||||
282
README.md
282
README.md
@@ -1,38 +1,42 @@
|
|||||||
|
|
||||||
|
|
||||||
# Gazan - The beast-mode reverse proxy.
|
# Aralez (Արալեզ), Reverse proxy and service mesh built on top of Cloudflare's Pingora
|
||||||
|
|
||||||
Gazan is a Reverse proxy, service mesh based on Cloudflare's Pingora
|
**What Aralez means?**
|
||||||
|
<ins>Aralez = Արալեզ. Named after the legendary Armenian guardian spirit, winged dog-like creature, that descend upon fallen heroes to lick their wounds and resurrect them.</ins>.
|
||||||
|
|
||||||
**What Gazan means?**
|
Built on Rust, on top of **Cloudflare’s Pingora engine**, **Aralez** delivers world-class performance, security and scalability — right out of the box.
|
||||||
<ins>Gazan = Գազան = beast / wild animal in Armenian / Often used as a synonym to something great.</ins>.
|
|
||||||
|
|
||||||
Built on Rust, on top of **Cloudflare’s Pingora engine**, **Gazan** delivers world-class performance, security and scalability — right out of the box.
|
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 🔧 Key Features
|
## 🔧 Key Features
|
||||||
|
|
||||||
- **Dynamic Config Reloads** — Upstreams can be updated live via API, no restart required
|
- **Dynamic Config Reloads** — Upstreams can be updated live via API, no restart required.
|
||||||
- **TLS Termination** — Built-in OpenSSL support
|
- **TLS Termination** — Built-in OpenSSL support.
|
||||||
- **Upstreams TLS detection** — Gazan will automatically detect if upstreams uses secure connection
|
- **Upstreams TLS detection** — Aralez will automatically detect if upstreams uses secure connection.
|
||||||
- **Authentication** — Supports Basic Auth, API tokens, and JWT verification
|
- **Authentication** — Supports Basic Auth, API tokens, and JWT verification.
|
||||||
|
- **Basic Auth**
|
||||||
|
- **API Key** via `x-api-key` header
|
||||||
|
- **JWT Auth**, with tokens issued by Aralez itself via `/jwt` API
|
||||||
|
- ⬇️ See below for examples and implementation details.
|
||||||
- **Load Balancing Strategies**
|
- **Load Balancing Strategies**
|
||||||
- Round-robin
|
- Round-robin
|
||||||
- Failover with health checks
|
- Failover with health checks
|
||||||
- Sticky sessions via cookies
|
- Sticky sessions via cookies
|
||||||
- **Unified Port** — Serve HTTP and WebSocket traffic over the same connection
|
- **Unified Port** — Serve HTTP and WebSocket traffic over the same connection.
|
||||||
- **Memory Safe** — Created purely on Rust
|
- **Memory Safe** — Created purely on Rust.
|
||||||
- **High Performance** — Built with [Pingora](https://github.com/cloudflare/pingora) and tokio for async I/O
|
- **High Performance** — Built with [Pingora](https://github.com/cloudflare/pingora) and tokio for async I/O.
|
||||||
|
|
||||||
## 🌍 Highlights
|
## 🌍 Highlights
|
||||||
|
|
||||||
- ⚙️ **Upstream Providers:** Supports `file`-based static upstreams, dynamic service discovery via `Consul`.
|
- ⚙️ **Upstream Providers:**
|
||||||
|
- `file` Upstreams are declared in config file.
|
||||||
|
- `consul` Upstreams are dynamically updated from Hashicorp Consul.
|
||||||
- 🔁 **Hot Reloading:** Modify upstreams on the fly via `upstreams.yaml` — no restart needed.
|
- 🔁 **Hot Reloading:** Modify upstreams on the fly via `upstreams.yaml` — no restart needed.
|
||||||
- 🔮 **Automatic WebSocket Support:** Zero config — connection upgrades are handled seamlessly.
|
- 🔮 **Automatic WebSocket Support:** Zero config — connection upgrades are handled seamlessly.
|
||||||
- 🔮 **Automatic GRPC Support:** Zero config, Requires `ssl` to proxy, gRPC is handled seamlessly.
|
- 🔮 **Automatic GRPC Support:** Zero config, Requires `ssl` to proxy, gRPC handled seamlessly.
|
||||||
- 🔮 **Upstreams Session Stickiness:** Enable/Disable Sticky sessions.
|
- 🔮 **Upstreams Session Stickiness:** Enable/Disable Sticky sessions globally.
|
||||||
- 🔐 **TLS Termination:** Fully supports TLS for incoming and upstream traffic.
|
- 🔐 **TLS Termination:** Fully supports TLS for upstreams and downstreams.
|
||||||
- 🛡️ **Built-in Authentication** Basic Auth, JWT, API key.
|
- 🛡️ **Built-in Authentication** Basic Auth, JWT, API key.
|
||||||
- 🧠 **Header Injection:** Global and per-route header configuration.
|
- 🧠 **Header Injection:** Global and per-route header configuration.
|
||||||
- 🧪 **Health Checks:** Pluggable health check methods for upstreams.
|
- 🧪 **Health Checks:** Pluggable health check methods for upstreams.
|
||||||
@@ -57,15 +61,28 @@ Built on Rust, on top of **Cloudflare’s Pingora engine**, **Gazan** delivers w
|
|||||||
|
|
||||||
### 🔧 `main.yaml`
|
### 🔧 `main.yaml`
|
||||||
|
|
||||||
- `proxy_address_http`: `0.0.0.0:6193` (HTTP listener)
|
| Key | Example Value | Description |
|
||||||
- `proxy_address_tls`: `0.0.0.0:6194` (TLS listener, optional)
|
|----------------------------------|--------------------------------------|--------------------------------------------------------------------------------------------------|
|
||||||
- `config_address`: `0.0.0.0:3000` (HTTP API for remote config push)
|
| **threads** | 12 | Number of running daemon threads. Optional, defaults to 1 |
|
||||||
- `upstreams_conf`: `etc/upstreams.yaml` (location of upstreams config)
|
| **user** | aralez | Optional, Username for running aralez after dropping root privileges, requires to launch as root |
|
||||||
- `log_level`: `info` (verbosity of logs)
|
| **group** | aralez | Optional,Group for running aralez after dropping root privileges, requires to launch as root |
|
||||||
- `hc_method`: `HEAD`, `hc_interval`: `2s` (upstream health checks)
|
| **daemon** | false | Run in background (boolean) |
|
||||||
- `user` Optional. Drop privileges to regular user. To bind to privileged ports. Requires to start as root.
|
| **upstream_keepalive_pool_size** | 500 | Pool size for upstream keepalive connections |
|
||||||
- `group` Optional. Drop privileges to regular group
|
| **pid_file** | /tmp/aralez.pid | Path to PID file |
|
||||||
- Other defaults: thread count, keep-alive pool size, etc.
|
| **error_log** | /tmp/aralez_err.log | Path to error log file |
|
||||||
|
| **upgrade_sock** | /tmp/aralez.sock | Path to live upgrade socket file |
|
||||||
|
| **config_address** | 0.0.0.0:3000 | HTTP API address for pushing upstreams.yaml from remote location |
|
||||||
|
| **config_tls_address** | 0.0.0.0:3001 | HTTPS API address for pushing upstreams.yaml from remote location |
|
||||||
|
| **config_tls_certificate** | etc/server.crt | Certificate file path for API. Mandatory if proxy_address_tls is set, else optional |
|
||||||
|
| **config_tls_key_file** | etc/key.pem | Private Key file path. Mandatory if proxy_address_tls is set, else optional |
|
||||||
|
| **proxy_address_http** | 0.0.0.0:6193 | Aralez HTTP bind address |
|
||||||
|
| **proxy_address_tls** | 0.0.0.0:6194 | Aralez HTTPS bind address (Optional) |
|
||||||
|
| **proxy_certificates** | etc/certs/ | The directory containing certificate and key files. In a format {NAME}.crt, {NAME}.key. |
|
||||||
|
| **upstreams_conf** | etc/upstreams.yaml | The location of upstreams file |
|
||||||
|
| **log_level** | info | Log level , possible values : info, warn, error, debug, trace, off |
|
||||||
|
| **hc_method** | HEAD | Healthcheck method (HEAD, GET, POST are supported) UPPERCASE |
|
||||||
|
| **hc_interval** | 2 | Interval for health checks in seconds |
|
||||||
|
| **master_key** | 5aeff7f9-7b94-447c-af60-e8c488544a3e | Master key for working with API server and JWT Secret generation |
|
||||||
|
|
||||||
### 🌐 `upstreams.yaml`
|
### 🌐 `upstreams.yaml`
|
||||||
|
|
||||||
@@ -81,40 +98,40 @@ Built on Rust, on top of **Cloudflare’s Pingora engine**, **Gazan** delivers w
|
|||||||
|
|
||||||
## 🛠 Installation
|
## 🛠 Installation
|
||||||
|
|
||||||
Download the prebuilt binary for your architecture from releases section of [GitHub](https://github.com/sadoyan/gazan/releases) repo
|
Download the prebuilt binary for your architecture from releases section of [GitHub](https://github.com/sadoyan/aralez/releases) repo
|
||||||
Make the binary executable `chmod 755 ./gazan-VERSION` and run.
|
Make the binary executable `chmod 755 ./aralez-VERSION` and run.
|
||||||
|
|
||||||
File names:
|
File names:
|
||||||
|
|
||||||
| File Name | Description |
|
| File Name | Description |
|
||||||
|--------------------------|---------------------------------------------------------------|
|
|---------------------------|---------------------------------------------------------------|
|
||||||
| `gazan-x86_64-musl.gz` | Static Linux x86_64 binary, without any system dependency |
|
| `aralez-x86_64-musl.gz` | Static Linux x86_64 binary, without any system dependency |
|
||||||
| `gazan-x86_64-glibc.gz` | Dynamic Linux x86_64 binary, with minimal system dependencies |
|
| `aralez-x86_64-glibc.gz` | Dynamic Linux x86_64 binary, with minimal system dependencies |
|
||||||
| `gazan-aarch64-musl.gz` | Static Linux ARM64 binary, without any system dependency |
|
| `aralez-aarch64-musl.gz` | Static Linux ARM64 binary, without any system dependency |
|
||||||
| `gazan-aarch64-glibc.gz` | Dynamic Linux ARM64 binary, with minimal system dependencies |
|
| `aralez-aarch64-glibc.gz` | Dynamic Linux ARM64 binary, with minimal system dependencies |
|
||||||
|
|
||||||
## 🔌 Running the Proxy
|
## 🔌 Running the Proxy
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
./gazan -c path/to/main.yaml
|
./aralez -c path/to/main.yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
## 🔌 Systemd integration
|
## 🔌 Systemd integration
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
cat > /etc/systemd/system/gazan.service <<EOF
|
cat > /etc/systemd/system/aralez.service <<EOF
|
||||||
[Service]
|
[Service]
|
||||||
Type=forking
|
Type=forking
|
||||||
PIDFile=/run/gazan.pid
|
PIDFile=/run/aralez.pid
|
||||||
ExecStart=/bin/gazan -d -c /etc/gazan.conf
|
ExecStart=/bin/aralez -d -c /etc/aralez.conf
|
||||||
ExecReload=kill -QUIT $MAINPID
|
ExecReload=kill -QUIT $MAINPID
|
||||||
ExecReload=/bin/gazan -u -d -c /etc/gazan.conf
|
ExecReload=/bin/aralez -u -d -c /etc/aralez.conf
|
||||||
EOF
|
EOF
|
||||||
```
|
```
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
systemctl enable gazan.service.
|
systemctl enable aralez.service.
|
||||||
systemctl restart gazan.service.
|
systemctl restart aralez.service.
|
||||||
```
|
```
|
||||||
|
|
||||||
## 💡 Example
|
## 💡 Example
|
||||||
@@ -156,7 +173,7 @@ myhost.mydomain.com:
|
|||||||
- Sticky sessions are disabled globally. This setting applies to all upstreams. If enabled all requests will be 301 redirected to HTTPS.
|
- Sticky sessions are disabled globally. This setting applies to all upstreams. If enabled all requests will be 301 redirected to HTTPS.
|
||||||
- HTTP to HTTPS redirect disabled globally, but can be overridden by `to_https` setting per upstream.
|
- HTTP to HTTPS redirect disabled globally, but can be overridden by `to_https` setting per upstream.
|
||||||
- Requests to `myhost.mydomain.com/` will be proxied to `127.0.0.1` and `127.0.0.2`.
|
- Requests to `myhost.mydomain.com/` will be proxied to `127.0.0.1` and `127.0.0.2`.
|
||||||
- Plain HTTP to `myhost.mydomain.com/foo` will get 301 redirect to configured TLS port of Gazan.
|
- Plain HTTP to `myhost.mydomain.com/foo` will get 301 redirect to configured TLS port of Aralez.
|
||||||
- Requests to `myhost.mydomain.com/foo` will be proxied to `127.0.0.4` and `127.0.0.5`.
|
- Requests to `myhost.mydomain.com/foo` will be proxied to `127.0.0.4` and `127.0.0.5`.
|
||||||
- SSL/TLS for upstreams is detected automatically, no need to set any config parameter.
|
- SSL/TLS for upstreams is detected automatically, no need to set any config parameter.
|
||||||
- Assuming the `127.0.0.5:8443` is SSL protected. The inner traffic will use TLS.
|
- Assuming the `127.0.0.5:8443` is SSL protected. The inner traffic will use TLS.
|
||||||
@@ -189,10 +206,11 @@ To enable TLS for A proxy server: Currently only OpenSSL is supported, working o
|
|||||||
|
|
||||||
## 📡 Remote Config API
|
## 📡 Remote Config API
|
||||||
|
|
||||||
You can push new `upstreams.yaml` over HTTP to `config_address` (`:3000` by default). Useful for CI/CD automation or remote config updates.
|
Push new `upstreams.yaml` over HTTP to `config_address` (`:3000` by default). Useful for CI/CD automation or remote config updates.
|
||||||
|
URL parameter. `key=MASTERKEY` is required. `MASTERKEY` is the value of `master_key` in the `main.yaml`
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
curl -XPOST --data-binary @./etc/upstreams.txt 127.0.0.1:3000/conf
|
curl -XPOST --data-binary @./etc/upstreams.txt 127.0.0.1:3000/conf?key=${MASTERKEY}
|
||||||
```
|
```
|
||||||
|
|
||||||
---
|
---
|
||||||
@@ -203,18 +221,18 @@ curl -XPOST --data-binary @./etc/upstreams.txt 127.0.0.1:3000/conf
|
|||||||
- Only one method can be active at a time.
|
- Only one method can be active at a time.
|
||||||
- `basic` : Standard HTTP Basic Authentication requests.
|
- `basic` : Standard HTTP Basic Authentication requests.
|
||||||
- `apikey` : Authentication via `x-api-key` header, which should match the value in config.
|
- `apikey` : Authentication via `x-api-key` header, which should match the value in config.
|
||||||
- `jwt`: JWT authentication implemented via `gazantoken=` url parameter. `/some/url?gazantoken=TOKEN`
|
- `jwt`: JWT authentication implemented via `araleztoken=` url parameter. `/some/url?araleztoken=TOKEN`
|
||||||
- `jwt`: JWT authentication implemented via `Authorization: Bearer <token>` header.
|
- `jwt`: JWT authentication implemented via `Authorization: Bearer <token>` header.
|
||||||
- To obtain JWT token, you should send **generate** request to built in api server's `/jwt` endpoint.
|
- To obtain JWT a token, you should send **generate** request to built in api server's `/jwt` endpoint.
|
||||||
- `masterkey`: should match configured `masterkey` in `main.yaml` and `upstreams.yaml`.
|
- `master_key`: should match configured `masterkey` in `main.yaml` and `upstreams.yaml`.
|
||||||
- `owner` : Just a placeholder, can be anything.
|
- `owner` : Just a placeholder, can be anything.
|
||||||
- `valid` : Time in minutes during which the generated token will be valid.
|
- `valid` : Time in minutes during which the generated token will be valid.
|
||||||
|
|
||||||
**Example JWT token generateion request**
|
**Example JWT token generation request**
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
PAYLOAD='{
|
PAYLOAD='{
|
||||||
"masterkey": "910517d9-f9a1-48de-8826-dbadacbd84af-cb6f830e-ab16-47ec-9d8f-0090de732774",
|
"master_key": "910517d9-f9a1-48de-8826-dbadacbd84af-cb6f830e-ab16-47ec-9d8f-0090de732774",
|
||||||
"owner": "valod",
|
"owner": "valod",
|
||||||
"valid": 10
|
"valid": 10
|
||||||
}'
|
}'
|
||||||
@@ -234,7 +252,7 @@ curl -H "Authorization: Bearer ${TOK}" -H 'Host: myip.mydomain.com' http://127.0
|
|||||||
With URL parameter (Very useful if you want to generate and share temporary links)
|
With URL parameter (Very useful if you want to generate and share temporary links)
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
curl -H 'Host: myip.mydomain.com' "http://127.0.0.1:6193/?gazantoken=${TOK}`"
|
curl -H 'Host: myip.mydomain.com' "http://127.0.0.1:6193/?araleztoken=${TOK}`"
|
||||||
```
|
```
|
||||||
|
|
||||||
**Example Request with API Key**
|
**Example Request with API Key**
|
||||||
@@ -264,4 +282,164 @@ curl -u username:password -H 'Host: myip.mydomain.com' http://127.0.0.1:6193/
|
|||||||
- Transparent, fully automatic WebSocket upgrade support.
|
- Transparent, fully automatic WebSocket upgrade support.
|
||||||
- Transparent, fully automatic gRPC proxy.
|
- Transparent, fully automatic gRPC proxy.
|
||||||
- Sticky session support.
|
- Sticky session support.
|
||||||
- HTTP2 ready.
|
- HTTP2 ready.
|
||||||
|
|
||||||
|
📊 Why Choose Aralez? – Feature Comparison
|
||||||
|
|
||||||
|
| Feature | **Aralez** | **Nginx** | **HAProxy** | **Traefik** |
|
||||||
|
|----------------------------|----------------------------------------------------------------------|--------------------------|-------------------------|-----------------|
|
||||||
|
| **Hot Reload** | ✅ Yes (live, API/file) | ⚠️ Reloads config | ⚠️ Reloads config | ✅ Yes (dynamic) |
|
||||||
|
| **JWT Auth** | ✅ Built-in | ❌ External scripts | ❌ External Lua or agent | ⚠️ With plugins |
|
||||||
|
| **WebSocket Support** | ✅ Automatic | ⚠️ Manual config | ✅ Yes | ✅ Yes |
|
||||||
|
| **gRPC Support** | ✅ Automatic (no config) | ⚠️ Manual + HTTP/2 + TLS | ⚠️ Complex setup | ✅ Native |
|
||||||
|
| **TLS Termination** | ✅ Built-in (OpenSSL) | ✅ Yes | ✅ Yes | ✅ Yes |
|
||||||
|
| **TLS Upstream Detection** | ✅ Automatic | ❌ | ❌ | ❌ |
|
||||||
|
| **HTTP/2 Support** | ✅ Automatic | ⚠️ Requires extra config | ⚠️ Requires build flags | ✅ Native |
|
||||||
|
| **Sticky Sessions** | ✅ Cookie-based | ⚠️ In plus version only | ✅ | ✅ |
|
||||||
|
| **Prometheus Metrics** | ✅ [Built in](https://github.com/sadoyan/aralez/blob/main/METRICS.md) | ⚠️ With Lua or exporter | ⚠️ With external script | ✅ Native |
|
||||||
|
| **Built With** | 🦀 Rust | C | C | Go |
|
||||||
|
|
||||||
|
## 💡 Simple benchmark by [Oha](https://github.com/hatoo/oha)
|
||||||
|
|
||||||
|
⚠️ These benchmarks use :
|
||||||
|
|
||||||
|
- 3 async Rust echo servers on a local network with 1Gbit as upstreams.
|
||||||
|
- A dedicated server for running **Aralez**
|
||||||
|
- A dedicated server for running **Oha**
|
||||||
|
- The following upstreams configuration.
|
||||||
|
- 9 test URLs from simple `/` to nested up to 7 subpaths.
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
myhost.mydomain.com:
|
||||||
|
paths:
|
||||||
|
"/":
|
||||||
|
to_https: false
|
||||||
|
headers:
|
||||||
|
- "X-Proxy-From:Aralez"
|
||||||
|
servers:
|
||||||
|
- "192.168.211.211:8000"
|
||||||
|
- "192.168.211.212:8000"
|
||||||
|
- "192.168.211.213:8000"
|
||||||
|
"/ping":
|
||||||
|
to_https: false
|
||||||
|
headers:
|
||||||
|
- "X-Some-Thing:Yaaaaaaaaaaaaaaa"
|
||||||
|
- "X-Proxy-From:Aralez"
|
||||||
|
servers:
|
||||||
|
- "192.168.211.211:8000"
|
||||||
|
- "192.168.211.212:8000"
|
||||||
|
```
|
||||||
|
|
||||||
|
## 💡 Results reflect synthetic performance under optimal conditions.
|
||||||
|
|
||||||
|
- CPU : Intel(R) Xeon(R) CPU E3-1270 v6 @ 3.80GHz
|
||||||
|
- 300 : simultaneous connections
|
||||||
|
- Duration : 10 Minutes
|
||||||
|
- Binary : aralez-x86_64-glibc
|
||||||
|
|
||||||
|
```
|
||||||
|
Summary:
|
||||||
|
Success rate: 100.00%
|
||||||
|
Total: 600.0027 secs
|
||||||
|
Slowest: 0.2138 secs
|
||||||
|
Fastest: 0.0002 secs
|
||||||
|
Average: 0.0023 secs
|
||||||
|
Requests/sec: 129777.3838
|
||||||
|
|
||||||
|
Total data: 0 B
|
||||||
|
Size/request: 0 B
|
||||||
|
Size/sec: 0 B
|
||||||
|
|
||||||
|
Response time histogram:
|
||||||
|
0.000 [1] |
|
||||||
|
0.022 [77668026] |■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■
|
||||||
|
0.043 [190362] |
|
||||||
|
0.064 [7908] |
|
||||||
|
0.086 [319] |
|
||||||
|
0.107 [4] |
|
||||||
|
0.128 [0] |
|
||||||
|
0.150 [0] |
|
||||||
|
0.171 [0] |
|
||||||
|
0.192 [0] |
|
||||||
|
0.214 [4] |
|
||||||
|
|
||||||
|
Response time distribution:
|
||||||
|
10.00% in 0.0012 secs
|
||||||
|
25.00% in 0.0016 secs
|
||||||
|
50.00% in 0.0020 secs
|
||||||
|
75.00% in 0.0026 secs
|
||||||
|
90.00% in 0.0033 secs
|
||||||
|
95.00% in 0.0040 secs
|
||||||
|
99.00% in 0.0078 secs
|
||||||
|
99.90% in 0.0278 secs
|
||||||
|
99.99% in 0.0434 secs
|
||||||
|
|
||||||
|
|
||||||
|
Details (average, fastest, slowest):
|
||||||
|
DNS+dialup: 0.0161 secs, 0.0002 secs, 0.0316 secs
|
||||||
|
DNS-lookup: 0.0000 secs, 0.0000 secs, 0.0000 secs
|
||||||
|
|
||||||
|
Status code distribution:
|
||||||
|
[200] 77866624 responses
|
||||||
|
|
||||||
|
Error distribution:
|
||||||
|
[158] aborted due to deadline
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- CPU : Intel(R) Xeon(R) CPU E3-1270 v6 @ 3.80GHz
|
||||||
|
- 300 : simultaneous connections
|
||||||
|
- Duration : 10 Minutes
|
||||||
|
- Binary : aralez-x86_64-musl
|
||||||
|
|
||||||
|
```
|
||||||
|
Summary:
|
||||||
|
Success rate: 100.00%
|
||||||
|
Total: 600.0021 secs
|
||||||
|
Slowest: 0.2182 secs
|
||||||
|
Fastest: 0.0002 secs
|
||||||
|
Average: 0.0024 secs
|
||||||
|
Requests/sec: 123870.5820
|
||||||
|
|
||||||
|
Total data: 0 B
|
||||||
|
Size/request: 0 B
|
||||||
|
Size/sec: 0 B
|
||||||
|
|
||||||
|
Response time histogram:
|
||||||
|
0.000 [1] |
|
||||||
|
0.022 [74254679] |■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■
|
||||||
|
0.044 [61400] |
|
||||||
|
0.066 [5911] |
|
||||||
|
0.087 [385] |
|
||||||
|
0.109 [0] |
|
||||||
|
0.131 [0] |
|
||||||
|
0.153 [0] |
|
||||||
|
0.175 [0] |
|
||||||
|
0.196 [0] |
|
||||||
|
0.218 [1] |
|
||||||
|
|
||||||
|
Response time distribution:
|
||||||
|
10.00% in 0.0012 secs
|
||||||
|
25.00% in 0.0016 secs
|
||||||
|
50.00% in 0.0021 secs
|
||||||
|
75.00% in 0.0028 secs
|
||||||
|
90.00% in 0.0037 secs
|
||||||
|
95.00% in 0.0045 secs
|
||||||
|
99.00% in 0.0077 secs
|
||||||
|
99.90% in 0.0214 secs
|
||||||
|
99.99% in 0.0424 secs
|
||||||
|
|
||||||
|
|
||||||
|
Details (average, fastest, slowest):
|
||||||
|
DNS+dialup: 0.0066 secs, 0.0002 secs, 0.0210 secs
|
||||||
|
DNS-lookup: 0.0000 secs, 0.0000 secs, 0.0000 secs
|
||||||
|
|
||||||
|
Status code distribution:
|
||||||
|
[200] 74322377 responses
|
||||||
|
|
||||||
|
Error distribution:
|
||||||
|
[228] aborted due to deadline
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
@@ -1,17 +1,19 @@
|
|||||||
# Main configuration file , applied on startup
|
# Main configuration file , applied on startup
|
||||||
threads: 12 # Nubber of daemon threads default setting
|
threads: 12 # Nubber of daemon threads default setting
|
||||||
#user: pastor # Username for running gazan after dropping root privileges, requires program to start as root
|
#user: pastor # Username for running aralez after dropping root privileges, requires program to start as root
|
||||||
#group: pastor # Group for running gazan after dropping root privileges, requires program to start as root
|
#group: pastor # Group for running aralez after dropping root privileges, requires program to start as root
|
||||||
daemon: false # Run in background
|
daemon: false # Run in background
|
||||||
upstream_keepalive_pool_size: 500 # Pool size for upstream keepalive connections
|
upstream_keepalive_pool_size: 500 # Pool size for upstream keepalive connections
|
||||||
pid_file: /tmp/gazan.pid # Path to PID file
|
pid_file: /tmp/aralez.pid # Path to PID file
|
||||||
error_log: /tmp/gazan_err.log # Path to error log
|
error_log: /tmp/aralez_err.log # Path to error log
|
||||||
upgrade_sock: /tmp/gazan.sock # Path to socket file
|
upgrade_sock: /tmp/aralez.sock # Path to socket file
|
||||||
config_address: 0.0.0.0:3000 # HTTP API address for pushing upstreams.yaml from remote location
|
config_address: 0.0.0.0:3000 # HTTP API address for pushing upstreams.yaml from remote location
|
||||||
|
config_tls_address: 0.0.0.0:3001 # HTTP TLS API address for pushing upstreams.yaml from remote location
|
||||||
|
config_tls_certificate: etc/server.crt # Mandatory if config_tls_address is set
|
||||||
|
config_tls_key_file: etc/key.pem # Mandatory if config_tls_address is set
|
||||||
proxy_address_http: 0.0.0.0:6193 # Proxy HTTP bind address
|
proxy_address_http: 0.0.0.0:6193 # Proxy HTTP bind address
|
||||||
proxy_address_tls: 0.0.0.0:6194 # Optional, Proxy TLS bind address
|
proxy_address_tls: 0.0.0.0:6194 # Optional, Proxy TLS bind address
|
||||||
tls_certificate: etc/server.crt # Mandatory if proxy_address_tls is set
|
proxy_certificates: etc/yoyo # Mandatory if proxy_address_tls set, should contain certificate and key files strictly in a format {NAME}.crt, {NAME}.key.
|
||||||
tls_key_file: etc/key.pem # Mandatory if proxy_address_tls is set
|
|
||||||
upstreams_conf: etc/upstreams.yaml # the location of upstreams file
|
upstreams_conf: etc/upstreams.yaml # the location of upstreams file
|
||||||
log_level: info # info, warn, error, debug, trace, off
|
log_level: info # info, warn, error, debug, trace, off
|
||||||
hc_method: HEAD # Healthcheck method (HEAD, GET, POST are supported) UPPERCASE
|
hc_method: HEAD # Healthcheck method (HEAD, GET, POST are supported) UPPERCASE
|
||||||
|
|||||||
@@ -11,7 +11,7 @@ upstreams:
|
|||||||
"/":
|
"/":
|
||||||
ssl: false
|
ssl: false
|
||||||
headers:
|
headers:
|
||||||
- "X-Proxy-From:Gazan"
|
- "X-Proxy-From:Aralez"
|
||||||
servers:
|
servers:
|
||||||
- "192.168.221.213:8000"
|
- "192.168.221.213:8000"
|
||||||
- "192.168.221.214:8000"
|
- "192.168.221.214:8000"
|
||||||
|
|||||||
@@ -7,4 +7,5 @@ pub mod jwt;
|
|||||||
pub mod metrics;
|
pub mod metrics;
|
||||||
pub mod parceyaml;
|
pub mod parceyaml;
|
||||||
pub mod structs;
|
pub mod structs;
|
||||||
|
pub mod tls;
|
||||||
pub mod tools;
|
pub mod tools;
|
||||||
|
|||||||
@@ -37,7 +37,7 @@ impl AuthValidator for ApiKeyAuth<'_> {
|
|||||||
impl AuthValidator for JwtAuth<'_> {
|
impl AuthValidator for JwtAuth<'_> {
|
||||||
fn validate(&self, session: &Session) -> bool {
|
fn validate(&self, session: &Session) -> bool {
|
||||||
let jwtsecret = self.0;
|
let jwtsecret = self.0;
|
||||||
if let Some(tok) = get_query_param(session, "gazantoken") {
|
if let Some(tok) = get_query_param(session, "araleztoken") {
|
||||||
return check_jwt(tok.as_str(), jwtsecret);
|
return check_jwt(tok.as_str(), jwtsecret);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -11,6 +11,9 @@ pub struct FromFileProvider {
|
|||||||
pub struct APIUpstreamProvider {
|
pub struct APIUpstreamProvider {
|
||||||
pub address: String,
|
pub address: String,
|
||||||
pub masterkey: String,
|
pub masterkey: String,
|
||||||
|
pub tls_address: Option<String>,
|
||||||
|
pub tls_certificate: Option<String>,
|
||||||
|
pub tls_key_file: Option<String>,
|
||||||
}
|
}
|
||||||
|
|
||||||
pub struct ConsulProvider {
|
pub struct ConsulProvider {
|
||||||
@@ -25,7 +28,7 @@ pub trait Discovery {
|
|||||||
#[async_trait]
|
#[async_trait]
|
||||||
impl Discovery for APIUpstreamProvider {
|
impl Discovery for APIUpstreamProvider {
|
||||||
async fn start(&self, toreturn: Sender<Configuration>) {
|
async fn start(&self, toreturn: Sender<Configuration>) {
|
||||||
webserver::run_server(self.address.clone(), self.masterkey.clone(), toreturn).await;
|
webserver::run_server(self, toreturn).await;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -75,7 +75,7 @@ pub async fn hc2(upslist: Arc<UpstreamsDashMap>, fullist: Arc<UpstreamsDashMap>,
|
|||||||
if first_run == 1 {
|
if first_run == 1 {
|
||||||
info!("Performing initial hatchecks and upstreams ssl detection");
|
info!("Performing initial hatchecks and upstreams ssl detection");
|
||||||
clone_idmap_into(&totest, &idlist);
|
clone_idmap_into(&totest, &idlist);
|
||||||
info!("Gazan is up and ready to serve requests, the upstreams list is:");
|
info!("Aralez is up and ready to serve requests, the upstreams list is:");
|
||||||
print_upstreams(&totest)
|
print_upstreams(&totest)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -1,37 +1,67 @@
|
|||||||
|
use pingora_http::Version;
|
||||||
use prometheus::{register_histogram, register_int_counter, register_int_counter_vec, Histogram, IntCounter, IntCounterVec};
|
use prometheus::{register_histogram, register_int_counter, register_int_counter_vec, Histogram, IntCounter, IntCounterVec};
|
||||||
use std::time::Duration;
|
use std::time::Duration;
|
||||||
|
|
||||||
|
pub struct MetricTypes {
|
||||||
|
pub method: String,
|
||||||
|
pub code: String,
|
||||||
|
pub latency: Duration,
|
||||||
|
pub version: Version,
|
||||||
|
}
|
||||||
lazy_static::lazy_static! {
|
lazy_static::lazy_static! {
|
||||||
pub static ref REQUEST_COUNT: IntCounter = register_int_counter!(
|
pub static ref REQUEST_COUNT: IntCounter = register_int_counter!(
|
||||||
"gazan_requests_total",
|
"aralez_requests_total",
|
||||||
"Total number of requests handled by Gazan"
|
"Total number of requests handled by Aralez"
|
||||||
).unwrap();
|
).unwrap();
|
||||||
pub static ref RESPONSE_CODES: IntCounterVec = register_int_counter_vec!(
|
pub static ref RESPONSE_CODES: IntCounterVec = register_int_counter_vec!(
|
||||||
"gazan_responses_total",
|
"aralez_responses_total",
|
||||||
"Responses grouped by status code",
|
"Responses grouped by status code",
|
||||||
&["status"]
|
&["status"]
|
||||||
).unwrap();
|
).unwrap();
|
||||||
pub static ref REQUEST_LATENCY: Histogram = register_histogram!(
|
pub static ref REQUEST_LATENCY: Histogram = register_histogram!(
|
||||||
"gazan_request_latency_seconds",
|
"aralez_request_latency_seconds",
|
||||||
"Request latency in seconds",
|
"Request latency in seconds",
|
||||||
vec![0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1.0, 2.5, 5.0]
|
vec![0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1.0, 2.5, 5.0]
|
||||||
).unwrap();
|
).unwrap();
|
||||||
pub static ref RESPONSE_LATENCY: Histogram = register_histogram!(
|
pub static ref RESPONSE_LATENCY: Histogram = register_histogram!(
|
||||||
"gazan_response_latency_seconds",
|
"aralez_response_latency_seconds",
|
||||||
"Response latency in seconds",
|
"Response latency in seconds",
|
||||||
vec![0.01, 0.05, 0.1, 0.25, 0.5, 1.0, 2.0, 5.0]
|
vec![0.01, 0.05, 0.1, 0.25, 0.5, 1.0, 2.0, 5.0]
|
||||||
).unwrap();
|
).unwrap();
|
||||||
pub static ref REQUESTS_BY_METHOD: IntCounterVec = register_int_counter_vec!(
|
pub static ref REQUESTS_BY_METHOD: IntCounterVec = register_int_counter_vec!(
|
||||||
"gazan_requests_by_method_total",
|
"aralez_requests_by_method_total",
|
||||||
"Number of requests by HTTP method",
|
"Number of requests by HTTP method",
|
||||||
&["method"]
|
&["method"]
|
||||||
).unwrap();
|
).unwrap();
|
||||||
|
pub static ref REQUESTS_BY_VERSION: IntCounterVec = register_int_counter_vec!(
|
||||||
|
"aralez_requests_by_version_total",
|
||||||
|
"Number of requests by HTTP versions",
|
||||||
|
&["version"]
|
||||||
|
).unwrap();
|
||||||
pub static ref ERROR_COUNT: IntCounter = register_int_counter!(
|
pub static ref ERROR_COUNT: IntCounter = register_int_counter!(
|
||||||
"gazan_errors_total",
|
"aralez_errors_total",
|
||||||
"Total number of errors"
|
"Total number of errors"
|
||||||
).unwrap();
|
).unwrap();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
pub fn calc_metrics(metric_types: &MetricTypes) {
|
||||||
|
REQUEST_COUNT.inc();
|
||||||
|
let timer = REQUEST_LATENCY.start_timer();
|
||||||
|
timer.observe_duration();
|
||||||
|
|
||||||
|
let version_str = match &metric_types.version {
|
||||||
|
&Version::HTTP_11 => "HTTP/1.1",
|
||||||
|
&Version::HTTP_2 => "HTTP/2.0",
|
||||||
|
&Version::HTTP_3 => "HTTP/3.0",
|
||||||
|
&Version::HTTP_10 => "HTTP/1.0",
|
||||||
|
_ => "Unknown",
|
||||||
|
};
|
||||||
|
REQUESTS_BY_VERSION.with_label_values(&[&version_str]).inc();
|
||||||
|
RESPONSE_CODES.with_label_values(&[&metric_types.code.to_string()]).inc();
|
||||||
|
REQUESTS_BY_METHOD.with_label_values(&[&metric_types.method]).inc();
|
||||||
|
RESPONSE_LATENCY.observe(metric_types.latency.as_secs_f64());
|
||||||
|
}
|
||||||
|
/*
|
||||||
pub fn calc_metrics(method: String, code: u16, latency: Duration) {
|
pub fn calc_metrics(method: String, code: u16, latency: Duration) {
|
||||||
REQUEST_COUNT.inc();
|
REQUEST_COUNT.inc();
|
||||||
let timer = REQUEST_LATENCY.start_timer();
|
let timer = REQUEST_LATENCY.start_timer();
|
||||||
@@ -41,7 +71,6 @@ pub fn calc_metrics(method: String, code: u16, latency: Duration) {
|
|||||||
RESPONSE_LATENCY.observe(latency.as_secs_f64());
|
RESPONSE_LATENCY.observe(latency.as_secs_f64());
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
|
||||||
tokio::spawn(async move {
|
tokio::spawn(async move {
|
||||||
let mut interval = tokio::time::interval(std::time::Duration::from_secs(5));
|
let mut interval = tokio::time::interval(std::time::Duration::from_secs(5));
|
||||||
loop {
|
loop {
|
||||||
|
|||||||
@@ -150,5 +150,15 @@ pub fn parce_main_config(path: &str) -> AppConfig {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
};
|
};
|
||||||
|
// match cfo.config_tls_address.clone() {
|
||||||
|
// Some(tls_cert) => {
|
||||||
|
// if let Some((ip, port_str)) = tls_cert.split_once(':') {
|
||||||
|
// if let Ok(port) = port_str.parse::<u16>() {
|
||||||
|
// cfo.local_tls_server = Option::from((ip.to_string(), port));
|
||||||
|
// }
|
||||||
|
// }
|
||||||
|
// }
|
||||||
|
// None => {}
|
||||||
|
// };
|
||||||
cfo
|
cfo
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -65,12 +65,16 @@ pub struct AppConfig {
|
|||||||
pub hc_method: String,
|
pub hc_method: String,
|
||||||
pub upstreams_conf: String,
|
pub upstreams_conf: String,
|
||||||
pub log_level: String,
|
pub log_level: String,
|
||||||
|
pub master_key: String,
|
||||||
pub config_address: String,
|
pub config_address: String,
|
||||||
pub proxy_address_http: String,
|
pub proxy_address_http: String,
|
||||||
pub master_key: String,
|
pub config_tls_address: Option<String>,
|
||||||
|
pub config_tls_certificate: Option<String>,
|
||||||
|
pub config_tls_key_file: Option<String>,
|
||||||
pub proxy_address_tls: Option<String>,
|
pub proxy_address_tls: Option<String>,
|
||||||
pub proxy_port_tls: Option<u16>,
|
pub proxy_port_tls: Option<u16>,
|
||||||
pub tls_certificate: Option<String>,
|
// pub tls_certificate: Option<String>,
|
||||||
pub tls_key_file: Option<String>,
|
// pub tls_key_file: Option<String>,
|
||||||
pub local_server: Option<(String, u16)>,
|
pub local_server: Option<(String, u16)>,
|
||||||
|
pub proxy_certificates: Option<String>,
|
||||||
}
|
}
|
||||||
|
|||||||
176
src/utils/tls.rs
Normal file
176
src/utils/tls.rs
Normal file
@@ -0,0 +1,176 @@
|
|||||||
|
use openssl::ssl::{select_next_proto, AlpnError, NameType, SniError, SslAlert, SslContext, SslFiletype, SslMethod, SslRef};
|
||||||
|
use rustls_pemfile::{read_one, Item};
|
||||||
|
use serde::Deserialize;
|
||||||
|
use std::collections::HashSet;
|
||||||
|
use std::fs::File;
|
||||||
|
use std::io::BufReader;
|
||||||
|
use x509_parser::extensions::GeneralName;
|
||||||
|
use x509_parser::nom::Err as NomErr;
|
||||||
|
use x509_parser::prelude::*;
|
||||||
|
|
||||||
|
#[derive(Clone, Deserialize, Debug)]
|
||||||
|
pub struct CertificateConfig {
|
||||||
|
pub cert_path: String,
|
||||||
|
pub key_path: String,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Debug)]
|
||||||
|
struct CertificateInfo {
|
||||||
|
common_names: Vec<String>,
|
||||||
|
alt_names: Vec<String>,
|
||||||
|
ssl_context: SslContext,
|
||||||
|
#[allow(dead_code)]
|
||||||
|
cert_path: String, // Only used for logging
|
||||||
|
#[allow(dead_code)]
|
||||||
|
key_path: String, // Only used for logging
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Debug)]
|
||||||
|
pub struct Certificates {
|
||||||
|
configs: Vec<CertificateInfo>,
|
||||||
|
pub default_cert_path: String,
|
||||||
|
pub default_key_path: String,
|
||||||
|
}
|
||||||
|
|
||||||
|
impl Certificates {
|
||||||
|
pub fn new(configs: &Vec<CertificateConfig>) -> Self {
|
||||||
|
let default_cert = configs.first().expect("atleast one TLS certificate required");
|
||||||
|
let mut cert_infos = Vec::new();
|
||||||
|
for config in configs {
|
||||||
|
cert_infos.push(
|
||||||
|
load_cert_info(&config.cert_path, &config.key_path)
|
||||||
|
.unwrap_or_else(|| panic!("unable to load certificate info | public: {}, private: {}", &config.cert_path, &config.key_path)),
|
||||||
|
);
|
||||||
|
}
|
||||||
|
Self {
|
||||||
|
configs: cert_infos,
|
||||||
|
default_cert_path: default_cert.cert_path.clone(),
|
||||||
|
default_key_path: default_cert.key_path.clone(),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fn find_ssl_context(&self, server_name: &str) -> Option<&SslContext> {
|
||||||
|
for config in &self.configs {
|
||||||
|
// Exact name match
|
||||||
|
if config.common_names.contains(&server_name.to_string()) || config.alt_names.contains(&server_name.to_string()) {
|
||||||
|
return Some(&config.ssl_context);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Wildcard match
|
||||||
|
for name in &config.common_names {
|
||||||
|
if name.starts_with("*.") && server_name.ends_with(&name[1..]) {
|
||||||
|
return Some(&config.ssl_context);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
for name in &config.alt_names {
|
||||||
|
if name.starts_with("*.") && server_name.ends_with(&name[1..]) {
|
||||||
|
return Some(&config.ssl_context);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
None
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn server_name_callback(&self, ssl_ref: &mut SslRef, ssl_alert: &mut SslAlert) -> Result<(), SniError> {
|
||||||
|
let server_name = ssl_ref.servername(NameType::HOST_NAME);
|
||||||
|
log::debug!("TLS connect: server_name = {:?}, ssl_ref = {:?}, ssl_alert = {:?}", server_name, ssl_ref, ssl_alert);
|
||||||
|
if let Some(name) = server_name {
|
||||||
|
match self.find_ssl_context(name) {
|
||||||
|
Some(ctx) => {
|
||||||
|
ssl_ref.set_ssl_context(ctx).map_err(|_| SniError::ALERT_FATAL)?;
|
||||||
|
}
|
||||||
|
None => {
|
||||||
|
log::debug!("No matching server name found");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fn load_cert_info(cert_path: &str, key_path: &str) -> Option<CertificateInfo> {
|
||||||
|
let mut common_names = HashSet::new();
|
||||||
|
let mut alt_names = HashSet::new();
|
||||||
|
|
||||||
|
let file = File::open(cert_path);
|
||||||
|
match file {
|
||||||
|
Err(e) => {
|
||||||
|
log::error!("Failed to open certificate file: {:?}", e);
|
||||||
|
return None;
|
||||||
|
}
|
||||||
|
Ok(file) => {
|
||||||
|
let mut reader = BufReader::new(file);
|
||||||
|
match read_one(&mut reader) {
|
||||||
|
Err(e) => {
|
||||||
|
log::error!("Failed to decode PEM from certificate file: {:?}", e);
|
||||||
|
return None;
|
||||||
|
}
|
||||||
|
Ok(leaf) => match leaf {
|
||||||
|
Some(Item::X509Certificate(cert)) => match X509Certificate::from_der(&cert) {
|
||||||
|
Err(NomErr::Error(e)) | Err(NomErr::Failure(e)) => {
|
||||||
|
log::error!("Failed to parse certificate: {:?}", e);
|
||||||
|
return None;
|
||||||
|
}
|
||||||
|
Err(_) => {
|
||||||
|
log::error!("Unknown error while parsing certificate");
|
||||||
|
return None;
|
||||||
|
}
|
||||||
|
Ok((_, x509)) => {
|
||||||
|
let subject = x509.subject();
|
||||||
|
for attr in subject.iter_common_name() {
|
||||||
|
if let Ok(cn) = attr.as_str() {
|
||||||
|
common_names.insert(cn.to_string());
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if let Ok(Some(san)) = x509.subject_alternative_name() {
|
||||||
|
for name in san.value.general_names.iter() {
|
||||||
|
if let GeneralName::DNSName(dns) = name {
|
||||||
|
let dns_string = dns.to_string();
|
||||||
|
if !common_names.contains(&dns_string) {
|
||||||
|
alt_names.insert(dns_string);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
_ => {
|
||||||
|
log::error!("Failed to read certificate");
|
||||||
|
return None;
|
||||||
|
}
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if let Ok(ssl_context) = create_ssl_context(cert_path, key_path) {
|
||||||
|
Some(CertificateInfo {
|
||||||
|
cert_path: cert_path.to_string(),
|
||||||
|
key_path: key_path.to_string(),
|
||||||
|
common_names: common_names.into_iter().collect(),
|
||||||
|
alt_names: alt_names.into_iter().collect(),
|
||||||
|
ssl_context,
|
||||||
|
})
|
||||||
|
} else {
|
||||||
|
log::error!("Failed to create SSL context from cert paths");
|
||||||
|
None
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fn create_ssl_context(cert_path: &str, key_path: &str) -> Result<SslContext, Box<dyn std::error::Error>> {
|
||||||
|
let mut ctx = SslContext::builder(SslMethod::tls())?;
|
||||||
|
|
||||||
|
ctx.set_certificate_chain_file(cert_path)?;
|
||||||
|
ctx.set_private_key_file(key_path, SslFiletype::PEM)?;
|
||||||
|
ctx.set_alpn_select_callback(prefer_h2);
|
||||||
|
let built = ctx.build();
|
||||||
|
Ok(built)
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn prefer_h2<'a>(_ssl: &mut SslRef, alpn_in: &'a [u8]) -> Result<&'a [u8], AlpnError> {
|
||||||
|
match select_next_proto("\x02h2\x08http/1.1".as_bytes(), alpn_in) {
|
||||||
|
Some(p) => Ok(p),
|
||||||
|
_ => Err(AlpnError::NOACK),
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -1,9 +1,11 @@
|
|||||||
use crate::utils::structs::{UpstreamsDashMap, UpstreamsIdMap};
|
use crate::utils::structs::{UpstreamsDashMap, UpstreamsIdMap};
|
||||||
|
use crate::utils::tls;
|
||||||
use dashmap::DashMap;
|
use dashmap::DashMap;
|
||||||
use sha2::{Digest, Sha256};
|
use sha2::{Digest, Sha256};
|
||||||
use std::any::type_name;
|
use std::any::type_name;
|
||||||
use std::collections::HashSet;
|
use std::collections::{HashMap, HashSet};
|
||||||
use std::fmt::Write;
|
use std::fmt::Write;
|
||||||
|
use std::fs;
|
||||||
use std::sync::atomic::AtomicUsize;
|
use std::sync::atomic::AtomicUsize;
|
||||||
|
|
||||||
#[allow(dead_code)]
|
#[allow(dead_code)]
|
||||||
@@ -146,3 +148,33 @@ pub fn clone_idmap_into(original: &UpstreamsDashMap, cloned: &UpstreamsIdMap) {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
pub fn listdir(dir: String) -> Vec<tls::CertificateConfig> {
|
||||||
|
let mut f = HashMap::new();
|
||||||
|
let mut certificate_configs: Vec<tls::CertificateConfig> = vec![];
|
||||||
|
let paths = fs::read_dir(dir).unwrap();
|
||||||
|
for path in paths {
|
||||||
|
let path_str = path.unwrap().path().to_str().unwrap().to_owned();
|
||||||
|
if path_str.ends_with(".crt") {
|
||||||
|
let name = path_str.replace(".crt", "");
|
||||||
|
let mut inner = vec![];
|
||||||
|
let domain = name.split("/").collect::<Vec<&str>>();
|
||||||
|
inner.push(name.clone() + ".crt");
|
||||||
|
inner.push(name.clone() + ".key");
|
||||||
|
f.insert(domain[domain.len() - 1].to_owned(), inner);
|
||||||
|
let y = tls::CertificateConfig {
|
||||||
|
cert_path: name.clone() + ".crt",
|
||||||
|
key_path: name.clone() + ".key",
|
||||||
|
};
|
||||||
|
certificate_configs.push(y);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
for (_, v) in f.iter() {
|
||||||
|
let y = tls::CertificateConfig {
|
||||||
|
cert_path: v[0].clone(),
|
||||||
|
key_path: v[1].clone(),
|
||||||
|
};
|
||||||
|
certificate_configs.push(y);
|
||||||
|
}
|
||||||
|
certificate_configs
|
||||||
|
}
|
||||||
|
|||||||
@@ -34,6 +34,9 @@ impl BackgroundService for LB {
|
|||||||
let api_load = APIUpstreamProvider {
|
let api_load = APIUpstreamProvider {
|
||||||
address: self.config.config_address.clone(),
|
address: self.config.config_address.clone(),
|
||||||
masterkey: self.config.master_key.clone(),
|
masterkey: self.config.master_key.clone(),
|
||||||
|
tls_address: self.config.config_tls_address.clone(),
|
||||||
|
tls_certificate: self.config.config_tls_certificate.clone(),
|
||||||
|
tls_key_file: self.config.config_tls_key_file.clone(),
|
||||||
};
|
};
|
||||||
let tx_api = tx.clone();
|
let tx_api = tx.clone();
|
||||||
let _ = tokio::spawn(async move { api_load.start(tx_api).await });
|
let _ = tokio::spawn(async move { api_load.start(tx_api).await });
|
||||||
|
|||||||
@@ -4,9 +4,11 @@ use crate::utils::structs::{AppConfig, Extraparams, Headers, UpstreamsDashMap, U
|
|||||||
use crate::web::gethosts::GetHost;
|
use crate::web::gethosts::GetHost;
|
||||||
use arc_swap::ArcSwap;
|
use arc_swap::ArcSwap;
|
||||||
use async_trait::async_trait;
|
use async_trait::async_trait;
|
||||||
|
use axum::body::Bytes;
|
||||||
use log::{debug, warn};
|
use log::{debug, warn};
|
||||||
use pingora::http::{RequestHeader, ResponseHeader, StatusCode};
|
use pingora::http::{RequestHeader, ResponseHeader, StatusCode};
|
||||||
use pingora::prelude::*;
|
use pingora::prelude::*;
|
||||||
|
use pingora::ErrorSource::Upstream;
|
||||||
use pingora_core::listeners::ALPN;
|
use pingora_core::listeners::ALPN;
|
||||||
use pingora_core::prelude::HttpPeer;
|
use pingora_core::prelude::HttpPeer;
|
||||||
use pingora_proxy::{ProxyHttp, Session};
|
use pingora_proxy::{ProxyHttp, Session};
|
||||||
@@ -95,7 +97,7 @@ impl ProxyHttp for LB {
|
|||||||
if let Some(addr) = session.server_addr() {
|
if let Some(addr) = session.server_addr() {
|
||||||
if let Some((host, _)) = addr.to_string().split_once(':') {
|
if let Some((host, _)) = addr.to_string().split_once(':') {
|
||||||
let uri = session.req_header().uri.path_and_query().map_or("/", |pq| pq.as_str());
|
let uri = session.req_header().uri.path_and_query().map_or("/", |pq| pq.as_str());
|
||||||
let port = self.config.proxy_port_tls.unwrap_or(443);
|
let port = self.config.proxy_port_tls.unwrap_or(403);
|
||||||
ctx.to_https = true;
|
ctx.to_https = true;
|
||||||
ctx.redirect_to = format!("https://{}:{}{}", host, port, uri);
|
ctx.redirect_to = format!("https://{}:{}{}", host, port, uri);
|
||||||
}
|
}
|
||||||
@@ -108,14 +110,26 @@ impl ProxyHttp for LB {
|
|||||||
Ok(peer)
|
Ok(peer)
|
||||||
}
|
}
|
||||||
None => {
|
None => {
|
||||||
warn!("Upstream not found. Host: {:?}, Path: {}", hostname, session.req_header().uri);
|
session.respond_error_with_body(502, Bytes::from("502 Bad Gateway\n")).await.expect("Failed to send error");
|
||||||
Ok(return_no_host(&self.config.local_server))
|
Err(Box::new(Error {
|
||||||
|
etype: HTTPStatus(502),
|
||||||
|
esource: Upstream,
|
||||||
|
retry: RetryType::Decided(false),
|
||||||
|
cause: None,
|
||||||
|
context: Option::from(ImmutStr::Static("Upstream not found")),
|
||||||
|
}))
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
None => {
|
None => {
|
||||||
warn!("Upstream not found. Host: {:?}, Path: {}", host_name, session.req_header().uri);
|
session.respond_error_with_body(502, Bytes::from("502 Bad Gateway\n")).await.expect("Failed to send error");
|
||||||
Ok(return_no_host(&self.config.local_server))
|
Err(Box::new(Error {
|
||||||
|
etype: HTTPStatus(502),
|
||||||
|
esource: Upstream,
|
||||||
|
retry: RetryType::Decided(false),
|
||||||
|
cause: None,
|
||||||
|
context: None,
|
||||||
|
}))
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -186,11 +200,13 @@ impl ProxyHttp for LB {
|
|||||||
async fn logging(&self, session: &mut Session, _e: Option<&pingora::Error>, ctx: &mut Self::CTX) {
|
async fn logging(&self, session: &mut Session, _e: Option<&pingora::Error>, ctx: &mut Self::CTX) {
|
||||||
let response_code = session.response_written().map_or(0, |resp| resp.status.as_u16());
|
let response_code = session.response_written().map_or(0, |resp| resp.status.as_u16());
|
||||||
debug!("{}, response code: {response_code}", self.request_summary(session, ctx));
|
debug!("{}, response code: {response_code}", self.request_summary(session, ctx));
|
||||||
|
let m = &MetricTypes {
|
||||||
let method = session.req_header().method.to_string();
|
method: session.req_header().method.to_string(),
|
||||||
let status = session.response_written().map(|resp| resp.status.as_u16()).unwrap_or(0);
|
code: session.response_written().map(|resp| resp.status.as_str().to_owned()).unwrap_or("0".to_string()),
|
||||||
let latency = ctx.start_time.elapsed();
|
latency: ctx.start_time.elapsed(),
|
||||||
calc_metrics(method, status, latency);
|
version: session.req_header().version,
|
||||||
|
};
|
||||||
|
calc_metrics(m);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -211,9 +227,9 @@ fn return_header_host(session: &Session) -> Option<&str> {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
fn return_no_host(inp: &Option<(String, u16)>) -> Box<HttpPeer> {
|
// fn return_no_host(inp: &Option<(String, u16)>) -> Box<HttpPeer> {
|
||||||
match inp {
|
// match inp {
|
||||||
Some(t) => Box::new(HttpPeer::new(t, false, String::new())),
|
// Some(t) => Box::new(HttpPeer::new(t, false, String::new())),
|
||||||
None => Box::new(HttpPeer::new(("0.0.0.0", 0), false, String::new())),
|
// None => Box::new(HttpPeer::new(("0.0.0.0", 0), false, String::new())),
|
||||||
}
|
// }
|
||||||
}
|
// }
|
||||||
|
|||||||
@@ -1,9 +1,13 @@
|
|||||||
// use rustls::crypto::ring::default_provider;
|
// use rustls::crypto::ring::default_provider;
|
||||||
use crate::utils::structs::Extraparams;
|
use crate::utils::structs::Extraparams;
|
||||||
|
use crate::utils::tls;
|
||||||
|
use crate::utils::tools::listdir;
|
||||||
use crate::web::proxyhttp::LB;
|
use crate::web::proxyhttp::LB;
|
||||||
use arc_swap::ArcSwap;
|
use arc_swap::ArcSwap;
|
||||||
use dashmap::DashMap;
|
use dashmap::DashMap;
|
||||||
use log::info;
|
use log::info;
|
||||||
|
use openssl::ssl::{SslAlert, SslRef};
|
||||||
|
use pingora_core::listeners::tls::TlsSettings;
|
||||||
use pingora_core::prelude::{background_service, Opt};
|
use pingora_core::prelude::{background_service, Opt};
|
||||||
use pingora_core::server::Server;
|
use pingora_core::server::Server;
|
||||||
use std::env;
|
use std::env;
|
||||||
@@ -77,13 +81,22 @@ pub fn run() {
|
|||||||
let bind_address_http = cfg.proxy_address_http.clone();
|
let bind_address_http = cfg.proxy_address_http.clone();
|
||||||
|
|
||||||
let bind_address_tls = cfg.proxy_address_tls.clone();
|
let bind_address_tls = cfg.proxy_address_tls.clone();
|
||||||
|
// let foo = crate::utils::tls::build_ssl_context_builder();
|
||||||
match bind_address_tls {
|
match bind_address_tls {
|
||||||
Some(bind_address_tls) => {
|
Some(bind_address_tls) => {
|
||||||
info!("Running TLS listener on :{}", bind_address_tls);
|
info!("Running TLS listener on :{}", bind_address_tls);
|
||||||
let cert_path = cfg.tls_certificate.clone().unwrap();
|
// let cert_path = cfg.tls_certificate.clone().unwrap();
|
||||||
let key_path = cfg.tls_key_file.clone().unwrap();
|
// let key_path = cfg.tls_key_file.clone().unwrap();
|
||||||
let mut tls_settings = pingora_core::listeners::tls::TlsSettings::intermediate(&cert_path, &key_path).unwrap();
|
// let mut tls_settings = tls::TlsSettings::intermediate(&cert_path, &key_path).unwrap();
|
||||||
|
// tls_settings.enable_h2();
|
||||||
|
// proxy.add_tls_with_settings(&bind_address_tls, None, tls_settings);
|
||||||
|
|
||||||
|
let certificate_configs = listdir(cfg.proxy_certificates.clone().unwrap());
|
||||||
|
let certificates = tls::Certificates::new(&certificate_configs);
|
||||||
|
let mut tls_settings = TlsSettings::intermediate(&certificates.default_cert_path, &certificates.default_key_path).expect("unable to load or parse cert/key");
|
||||||
tls_settings.enable_h2();
|
tls_settings.enable_h2();
|
||||||
|
tls_settings.set_servername_callback(move |ssl_ref: &mut SslRef, ssl_alert: &mut SslAlert| certificates.server_name_callback(ssl_ref, ssl_alert));
|
||||||
|
tls_settings.set_alpn_select_callback(tls::prefer_h2);
|
||||||
proxy.add_tls_with_settings(&bind_address_tls, None, tls_settings);
|
proxy.add_tls_with_settings(&bind_address_tls, None, tls_settings);
|
||||||
}
|
}
|
||||||
None => {}
|
None => {}
|
||||||
|
|||||||
@@ -1,16 +1,20 @@
|
|||||||
|
use crate::utils::discovery::APIUpstreamProvider;
|
||||||
use crate::utils::structs::Configuration;
|
use crate::utils::structs::Configuration;
|
||||||
use axum::body::Body;
|
use axum::body::Body;
|
||||||
use axum::extract::State;
|
use axum::extract::{Query, State};
|
||||||
use axum::http::{Response, StatusCode};
|
use axum::http::{Response, StatusCode};
|
||||||
use axum::response::IntoResponse;
|
use axum::response::IntoResponse;
|
||||||
use axum::routing::{delete, get, head, post, put};
|
use axum::routing::{get, post};
|
||||||
use axum::{Json, Router};
|
use axum::{Json, Router};
|
||||||
|
use axum_server::tls_openssl::OpenSSLConfig;
|
||||||
use futures::channel::mpsc::Sender;
|
use futures::channel::mpsc::Sender;
|
||||||
use futures::SinkExt;
|
use futures::SinkExt;
|
||||||
use jsonwebtoken::{encode, EncodingKey, Header};
|
use jsonwebtoken::{encode, EncodingKey, Header};
|
||||||
use log::{error, info, warn};
|
use log::{error, info, warn};
|
||||||
use prometheus::{gather, Encoder, TextEncoder};
|
use prometheus::{gather, Encoder, TextEncoder};
|
||||||
use serde::{Deserialize, Serialize};
|
use serde::{Deserialize, Serialize};
|
||||||
|
use std::collections::HashMap;
|
||||||
|
use std::net::SocketAddr;
|
||||||
use std::time::{Duration, SystemTime, UNIX_EPOCH};
|
use std::time::{Duration, SystemTime, UNIX_EPOCH};
|
||||||
use tokio::net::TcpListener;
|
use tokio::net::TcpListener;
|
||||||
|
|
||||||
@@ -26,48 +30,62 @@ struct OutToken {
|
|||||||
token: String,
|
token: String,
|
||||||
}
|
}
|
||||||
|
|
||||||
#[allow(unused_mut)]
|
#[derive(Clone)]
|
||||||
pub async fn run_server(bindaddress: String, master_key: String, mut to_return: Sender<Configuration>) {
|
struct AppState {
|
||||||
let mut tr = to_return.clone();
|
master_key: String,
|
||||||
let app = Router::new()
|
config_sender: Sender<Configuration>,
|
||||||
.route("/{*wildcard}", get(senderror))
|
}
|
||||||
.route("/{*wildcard}", post(senderror))
|
|
||||||
.route("/{*wildcard}", put(senderror))
|
|
||||||
.route("/{*wildcard}", head(senderror))
|
|
||||||
.route("/{*wildcard}", delete(senderror))
|
|
||||||
.route("/jwt", post(jwt_gen))
|
|
||||||
.route("/metrics", get(metrics))
|
|
||||||
.with_state(master_key.clone())
|
|
||||||
.route(
|
|
||||||
"/conf",
|
|
||||||
post(|up: String| async move {
|
|
||||||
let serverlist = crate::utils::parceyaml::load_configuration(up.as_str(), "content");
|
|
||||||
|
|
||||||
match serverlist {
|
#[allow(unused_mut)]
|
||||||
Some(serverlist) => {
|
pub async fn run_server(config: &APIUpstreamProvider, mut to_return: Sender<Configuration>) {
|
||||||
let _ = tr.send(serverlist).await.unwrap();
|
let app_state = AppState {
|
||||||
Response::builder().status(StatusCode::CREATED).body(Body::from("Config, conf file, updated!\n")).unwrap()
|
master_key: config.masterkey.clone(),
|
||||||
}
|
config_sender: to_return.clone(),
|
||||||
None => Response::builder()
|
};
|
||||||
.status(StatusCode::INTERNAL_SERVER_ERROR)
|
let app = Router::new()
|
||||||
.body(Body::from("Failed to parce config file!\n"))
|
// .route("/{*wildcard}", get(senderror))
|
||||||
.unwrap(),
|
// .route("/{*wildcard}", post(senderror))
|
||||||
}
|
// .route("/{*wildcard}", put(senderror))
|
||||||
})
|
// .route("/{*wildcard}", head(senderror))
|
||||||
.with_state("state"),
|
// .route("/{*wildcard}", delete(senderror))
|
||||||
);
|
.route("/jwt", post(jwt_gen))
|
||||||
let listener = TcpListener::bind(bindaddress.clone()).await.unwrap();
|
.route("/conf", post(conf))
|
||||||
info!("Starting the API server on: {}", bindaddress);
|
.route("/metrics", get(metrics))
|
||||||
|
.with_state(app_state);
|
||||||
|
|
||||||
|
if let Some(value) = &config.tls_address {
|
||||||
|
let cf = OpenSSLConfig::from_pem_file(config.tls_certificate.clone().unwrap(), config.tls_key_file.clone().unwrap()).unwrap();
|
||||||
|
let addr: SocketAddr = value.parse().expect("Unable to parse socket address");
|
||||||
|
let tls_app = app.clone();
|
||||||
|
tokio::spawn(async move {
|
||||||
|
if let Err(e) = axum_server::bind_openssl(addr, cf).serve(tls_app.into_make_service()).await {
|
||||||
|
eprintln!("TLS server failed: {}", e);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
info!("Starting the TLS API server on: {}", value);
|
||||||
|
}
|
||||||
|
|
||||||
|
let listener = TcpListener::bind(config.address.clone()).await.unwrap();
|
||||||
|
info!("Starting the API server on: {}", config.address);
|
||||||
axum::serve(listener, app).await.unwrap();
|
axum::serve(listener, app).await.unwrap();
|
||||||
}
|
}
|
||||||
|
|
||||||
#[allow(dead_code)]
|
async fn conf(State(mut st): State<AppState>, Query(params): Query<HashMap<String, String>>, content: String) -> impl IntoResponse {
|
||||||
async fn senderror() -> impl IntoResponse {
|
if let Some(s) = params.get("key") {
|
||||||
Response::builder().status(StatusCode::BAD_GATEWAY).body(Body::from("No live upstream found!\n")).unwrap()
|
if s.to_owned() == st.master_key.to_owned() {
|
||||||
|
if let Some(serverlist) = crate::utils::parceyaml::load_configuration(content.as_str(), "content") {
|
||||||
|
st.config_sender.send(serverlist).await.unwrap();
|
||||||
|
return Response::builder().status(StatusCode::OK).body(Body::from("Config, conf file, updated !\n")).unwrap();
|
||||||
|
} else {
|
||||||
|
return Response::builder().status(StatusCode::BAD_GATEWAY).body(Body::from("Failed to parse config!\n")).unwrap();
|
||||||
|
};
|
||||||
|
}
|
||||||
|
}
|
||||||
|
Response::builder().status(StatusCode::FORBIDDEN).body(Body::from("Access Denied !\n")).unwrap()
|
||||||
}
|
}
|
||||||
|
|
||||||
async fn jwt_gen(State(master_key): State<String>, Json(payload): Json<InputKey>) -> (StatusCode, Json<OutToken>) {
|
async fn jwt_gen(State(state): State<AppState>, Json(payload): Json<InputKey>) -> (StatusCode, Json<OutToken>) {
|
||||||
if payload.master_key == master_key {
|
if payload.master_key == state.master_key {
|
||||||
let now = SystemTime::now() + Duration::from_secs(payload.valid * 60);
|
let now = SystemTime::now() + Duration::from_secs(payload.valid * 60);
|
||||||
let a = now.duration_since(UNIX_EPOCH).unwrap().as_secs();
|
let a = now.duration_since(UNIX_EPOCH).unwrap().as_secs();
|
||||||
let claim = crate::utils::jwt::Claims { user: payload.owner, exp: a };
|
let claim = crate::utils::jwt::Claims { user: payload.owner, exp: a };
|
||||||
@@ -111,3 +129,8 @@ async fn metrics() -> impl IntoResponse {
|
|||||||
.body(Body::from(buffer))
|
.body(Body::from(buffer))
|
||||||
.unwrap()
|
.unwrap()
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// #[allow(dead_code)]
|
||||||
|
// async fn senderror() -> impl IntoResponse {
|
||||||
|
// Response::builder().status(StatusCode::BAD_GATEWAY).body(Body::from("No live upstream found!\n")).unwrap()
|
||||||
|
// }
|
||||||
|
|||||||
Reference in New Issue
Block a user