Rocksolid Light

Welcome to RetroBBS

mail  files  register  newsreader  groups  login

Message-ID:  

Lead me not into temptation... I can find it myself.


devel / comp.unix.programmer / Apache reverse-proxying to AF_UNIX servers

SubjectAuthor
o Apache reverse-proxying to AF_UNIX serversRainer Weikusat

1
Apache reverse-proxying to AF_UNIX servers

<87v8r8w0c8.fsf@doppelsaurus.mobileactivedefense.com>

  copy mid

https://www.rocksolidbbs.com/devel/article-flat.php?id=17227&group=comp.unix.programmer#17227

  copy link   Newsgroups: comp.unix.programmer
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!3.eu.feeder.erje.net!feeder.erje.net!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: rweikusat@talktalk.net (Rainer Weikusat)
Newsgroups: comp.unix.programmer
Subject: Apache reverse-proxying to AF_UNIX servers
Date: Thu, 04 Aug 2022 15:27:19 +0100
Lines: 23
Message-ID: <87v8r8w0c8.fsf@doppelsaurus.mobileactivedefense.com>
Mime-Version: 1.0
Content-Type: text/plain
X-Trace: individual.net ag4snxTMRBm7cBThlVL8SQxawwt2dOO/ji3FVgvSsNqPQ8Ipo=
Cancel-Lock: sha1:l6L75Z9msVW0uVRXzflJ8cK5Mak= sha1:/xoTfTYVkK72slU33EWFm1eRNhI=
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux)
 by: Rainer Weikusat - Thu, 4 Aug 2022 14:27 UTC

A handy feature Apache has gained fairly recently is acting as reverse
proxy for servers listening on AF_UNIX sockets (referred to as UDS
sockets in the code, presumably Unix Domain Sockets). As far as I can
tell, the exact syntax for this isn't documented anywhere (except in
form of unexplained examples), so, I'll put it here:

unix:</path/to/socket>|<url scheme>:

ie, the literal string unix: followed by the path of the server socket,
followed by a pipe symbol and an absolute URL. The scheme part of this
URL is used to select a proxy module, eg, ws: for reverse-proxying
WebSocket traffic. Other parts (server, port, path etc) may but need not
appear.

Related gotcha: In the interest of enhance suckurity, ie, generally
making programming the system suck more, apache get a so-called private
tmp (/tmp and /var/tmp) directories when being started from systemd (on
Debian, but that's just the kind of misfeature every suckurity guy is
absolutely going to love, hence, the defect presumably exists everywhere
where the root cause - systemd - has also infected the system).

This means it won't have access to anything other processes put into
/tmp (like AF_UNIX sockets).

1
server_pubkey.txt

rocksolid light 0.9.81
clearnet tor