feat(server): enable proxy protocol support with PROXY_PROTO

Signed-off-by: Xe Iaso <[e-mail]>

cmd/hythlodaeus/main.go

···
 	grpcKey                  = flag.String("grpc-key", "./var/tls.key", "the TLS key to serve grpc")
 	httpBind                 = flag.String("http-bind", ":80", "the host:port to bind plain HTTP")
 	httpsBind                = flag.String("https-bind", ":443", "the host:port to bind secure HTTPS")
+	proxyProto               = flag.Bool("proxy-proto", false, "if true, use haproxy proxy protocol")
 	telemetryEnable          = flag.Bool("telemetry-enable", false, "if true, enable request telemetry bundling to object storage")
 	telemetryBucket          = flag.String("telemetry-bucket", "relayd-logs", "object storage bucket to dump logs to")
 	telemetryPathStyle       = flag.Bool("telemetry-path-style", false, "if true, use s3 path style")
···
 		server.WithGRPCKey(*grpcKey),
 		server.WithHTTPBind(*httpBind),
 		server.WithHTTPSBind(*httpsBind),
+		server.WithProxyProto(*proxyProto),
 		server.WithTelemetryConfig(telemetry.Config{
 			Bucket:          *telemetryBucket,
 			PathStyle:       *telemetryPathStyle,

go.mod

···
 	github.com/felixge/httpsnoop v1.0.4
 	github.com/google/uuid v1.6.0
 	github.com/joho/godotenv v1.5.1
+	github.com/pires/go-proxyproto v0.8.1
 	github.com/prometheus/client_golang v1.22.0
 	golang.org/x/net v0.40.0
 	golang.org/x/sync v0.14.0

go.sum

···
 github.com/onsi/ginkgo/v2 v2.21.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
 github.com/onsi/gomega v1.35.1 h1:Cwbd75ZBPxFSuZ6T+rN/WCb/gOc6YgFBXLlZLhC7Ds4=
 github.com/onsi/gomega v1.35.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
+github.com/pires/go-proxyproto v0.8.1 h1:9KEixbdJfhrbtjpz/ZwCdWDD2Xem0NZ38qMYaASJgp0=
+github.com/pires/go-proxyproto v0.8.1/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g3Jf+slqQVcuU=
 github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4=
 github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=

server/config.go

···
 	grpcInsecure    bool
 	httpBind        string
 	httpsBind       string
+	proxyProto      bool
 	telemetryConfig telemetry.Config
 }
 
···
 		grpcKey:      "",
 		httpBind:     ":80",
 		httpsBind:    ":443",
+		proxyProto:   false,
 	}
 }
 
···
 func WithHTTPSBind(httpsBind string) Option {
 	return func(cfg *config) {
 		cfg.httpsBind = httpsBind
+	}
+}
+
+func WithProxyProto(proxyProto bool) Option {
+	return func(cfg *config) {
+		cfg.proxyProto = proxyProto
 	}
 }
 

server/server.go

···
 	"git.xeserv.us/Techaro/hythlodaeus/telemetry"
 	"git.xeserv.us/Techaro/hythlodaeus/watcher"
 	"github.com/exaring/ja4plus"
+	"github.com/pires/go-proxyproto"
 	"golang.org/x/net/http2"
 	"golang.org/x/sync/errgroup"
 	"google.golang.org/grpc"
···
 	})
 
 	eg.Go(func() error {
+		tc := &tls.Config{
+			GetCertificate: func(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
+				return s.routingTable.Load().(*RoutingTable).GetCertificate(hello.ServerName)
+			},
+			GetConfigForClient: func(chi *tls.ClientHelloInfo) (*tls.Config, error) {
+				s.ja4m.StoreFingerprintFromClientHello(chi)
+				return nil, nil
+			},
+		}
+
 		srv := http.Server{
 			Addr:      s.cfg.httpsBind,
 			Handler:   s.ja4m.Wrap(s.sink.Middleware(s)),
 			ConnState: s.ja4m.ConnStateCallback,
-			TLSConfig: &tls.Config{
-				GetCertificate: func(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
-					return s.routingTable.Load().(*RoutingTable).GetCertificate(hello.ServerName)
-				},
-				GetConfigForClient: func(chi *tls.ClientHelloInfo) (*tls.Config, error) {
-					s.ja4m.StoreFingerprintFromClientHello(chi)
-					return nil, nil
-				},
-			},
+			TLSConfig: tc,
 		}
 
 		slog.Info("starting server", "protocol", "https", "addr", srv.Addr)
 
 		healthSrv.SetServingStatus("https", healthv1.HealthCheckResponse_SERVING)
 
-		err := srv.ListenAndServeTLS("", "")
+		lis, err := net.Listen("tcp", s.cfg.httpsBind)
+		if err != nil {
+			return fmt.Errorf("error listening on %s: %v", s.cfg.httpsBind, err)
+		}
+		defer lis.Close()
+
+		if s.cfg.proxyProto {
+			lis = &proxyproto.Listener{Listener: lis}
+		}
+		lis = tls.NewListener(lis, tc)
+
+		err = srv.Serve(lis)
 		if err != nil {
 			return fmt.Errorf("error serving tls: %w", err)
 		}
···
 
 		healthSrv.SetServingStatus("http", healthv1.HealthCheckResponse_SERVING)
 
-		err := srv.ListenAndServe()
+		lis, err := net.Listen("tcp", s.cfg.httpsBind)
+		if err != nil {
+			return fmt.Errorf("error listening on %s: %v", s.cfg.httpsBind, err)
+		}
+		defer lis.Close()
+
+		if s.cfg.proxyProto {
+			lis = &proxyproto.Listener{Listener: lis}
+		}
+
+		err = srv.Serve(lis)
 		if err != nil {
 			return fmt.Errorf("error serving non-tls: %w", err)
 		}