[Question] Redirecting clients to distinct upstream servers

[achen353]

Hi,

I came across this amazing repo as I sought solutions to reroute HTTP requests from different users to distinct cloud-hosting containers listening on port 80 (one user per container due to the intrinsic limitation of the containerized application).

Essentially, I intend to add logic to identify every new client IP and create a new cloud instance to which the HTTP requests would be redirected. When inactivity of HTTP requests to a specific container is detected for a prolonged period of time, the instance would be deleted. It seems like RedirectToCustomServerPlugin is the most related plugin I could start off with.

Do you have any suggestions on how I could build my proxy server on top of this project? I'd also like to ask for clarification on this suggestion to not fork the project.

Thanks

[abhinavsingh]

Hello @achen353 , thanks for trying out proxy.py. Yes, a custom RedirectToCustomServerPlugin should would out well for your use case.

I'd also like to ask for clarification on this suggestion to not fork the project.

Reason I recommend not to fork

• Fork is equivalent to pinning your pip dependency on a specific commit of proxy.py
• As a result, by forking, you will loose automatic bug fixes, security patches, core enhancements, community contributions
• With aPlugin based architecture, fork is simply unnecessary

NOTE: proxy.py allows plugins to customize almost everything that it has to offer, including ability to tie into your own custom event loop or share proxy.py core event loop. If you ever find anything missing or run into a limitation, please report it on GH.

How to use proxy.py in standalone personal or company projects

1. Start by creating a vanilla Python project
2. Add proxy.py as dependency via requirements
3. Then, customize your app main to start with proxy.Proxy. Example:

if __name__ == '__main__':
  with proxy.Proxy(*args, **kwargs) as p:
    # optionally, continue bootstrapping the app or just sleep loop here
    proxy.sleep_loop()

4. Finally, *args and **kwargs is how one would customize and modify proxy.py. Example, most important bit is enabling your custom plugins.

   Here is how it looks like for one of the project:

   

Thats it!!!

You have a custom app running with your web server and proxy server plugins. Imagination is the only limitations from here on 🗡️ I personally pin my dependency to develop branch or GHCR:latest container (yep even for several production projects)

I hope this clarifies most of your doubts :). Let me know.

[abhinavsingh]

I came across this amazing repo as I sought solutions to reroute HTTP requests from different users to distinct cloud-hosting containers listening on port 80 (one user per container due to the intrinsic limitation of the containerized application).

Note that it's also important to understand how clients will communicate with your instance. Will they use it as a proxy or will they use it as a direct service endpoint. For the former you will need RedirectToCustomServerPlugin, for later you will want ReverseProxyPlugin.

[abhinavsingh]

I have added a skeleton app structure. See #1029 , once merged we will also update README to point to this app for standalone project usage instructions.

[achen353]

Thank you @abhinavsingh. The skeleton looks clear! I'm planning to have this standalone proxy.py Python project be my public-facing proxy and the instances (AWS EC2, actually) be the direct service endpoints. The Python project would likely communicate with the instances through EC2s' public IPs or internal IPs if I could put them in the same subnet. In this case, should I look at RedirectToCustomServerPlugin or ReverseProxyPlugin.

[achen353]

@abhinavsingh Since the idea is to isolate the containerized service to each user with distinct EC2 instances assigned to each client, without authentication, what would you recommend to use to identify different clients? Would IP addresses be sufficient? (The public URL wouldn't be known by many people so I'm looking to scale to around 10 users at most for now).

[achen353]

Thank you for the response. I'm not super familiar with networking so I greatly appreciate your patience. 🙏

For this case:

For this you will need reverse proxy plugin. Example, give each client /client_id as the endpoint and then within the plugin you can dynamically decide upstream EC2 endpoint for reverse proxy.

Would it be possible to have just for example my.ec2.public.dns.com available through which all users access the service without /client_id? And we handle the tasks of differentiating users and rerouting to upstream EC2 endpoint with this proxy.py-based Python project?

I suppose client_id is created upon receiving requests from a new user. How should I direct users to /client_id without authentication?

[abhinavsingh]

Well you need a way to differentiate clients. If not different endpoints then how do you plan to differentiate clients from each other?

[abhinavsingh]

Btw in #1033 I am moving reverse proxy core within the lib. Currently its spread around the plugin as you can see. Here is how your reverse proxy plugins will look like after PR merge https://github.com/abhinavsingh/proxy.py/blob/move-reverse-proxy-to-core/proxy/plugin/reverse_proxy.py

I tried it locally, it works. CI may take sometime :)

[achen353]

Well you need a way to differentiate clients. If not different endpoints then how do you plan to differentiate clients from each other?

Currently thinking about using IP addresses because authentication and databases for credential storage aren't our priority right now. Would this be a viable plan?

[abhinavsingh]

Yes, if IP Address based client detection is a trusted model within your project environment, this will work perfectly. Of-course you must be aware about NAT traversals. Read up about it to understand if IP Address based detection is right for you.

[achen353]

@abhinavsingh My apologies for the bombardment of questions. How should I handle concurrent requests with proxy.py if I'm building a project on top of the skeleton app. Thank you!

[abhinavsingh]

You don't need to do anything special to achieve concurrency. proxy.py core does that for you. Plugin instances are created for each incoming request and then necessary lifecycle callbacks are invoked as the request proceeds. Note that, plugin instance is created per request. So within your plugin, you can just write code as you would to handle a single request.

[achen353]

Hi @abhinavsingh,

So I decided to build a simple authentication with Django REST Framework + React Single Page Application. I'm embedding my main application below the "WhoAmI" and "Log out" buttons with some endpoint like localhost:9000/client_id via iframe.

I'm looking to direct requests made for localhost:9000/client_id to unique.instance.for.client_id.com. There will be some logic to handle the mapping of the two addresses. Currently, I've tried the simple rerouting from localhost:9000 to a public DNS with RedirectToCustomServer but couldn't seem to get it to work. Am I looking at the correct plugin?

[achen353]

@abhinavsingh No worries. I greatly appreciate all your help. However, my question here is related to proxy.py:

I tried using RedirectToCustomServerPlugin to direct traffic from localhost:9000 to localhost:8080 but got a 404 error. Would you mind confirming if this is how RedirectToCustomServerPlugin is supposed to work?

(I have a server running on localhost:8080 and reachable directly via the browser)

class MyProxyPlugin(HttpProxyBasePlugin):
    """Essentially the same code as RedirectToCustomServerPlugin"""

    UPSTREAM_SERVER = b'http://localhost:8080/'

    def before_upstream_connection(
            self, request: HttpParser,
    ) -> Optional[HttpParser]:
        # Redirect all non-https requests to inbuilt WebServer.
        if not request.is_https_tunnel:
            request.set_url(self.UPSTREAM_SERVER)
            # Update Host header too, otherwise upstream can reject our request
            if request.has_header(b'Host'):
                request.del_header(b'Host')
            request.add_header(
                b'Host', urlparse.urlsplit(
                    self.UPSTREAM_SERVER,
                ).netloc,
            )
        return request

[abhinavsingh]

• Doesn't log says anything about it? You will likely see upstream connection refused or similar errors.
• Does curl -v localhost:8080 works on the system where instance is running?

[achen353]

On my customproxy.py app it says:

% python -m app
2022-01-22 15:02:14,884 - pid:8207 [I] plugins.load:85 - Loaded plugin proxy.http.proxy.HttpProxyPlugin
2022-01-22 15:02:14,884 - pid:8207 [I] plugins.load:85 - Loaded plugin proxy.http.server.HttpWebServerPlugin
2022-01-22 15:02:14,888 - pid:8207 [I] plugins.load:85 - Loaded plugin app.plugins.MyProxyPlugin
2022-01-22 15:02:14,889 - pid:8207 [I] listener.setup:98 - Listening on 127.0.0.1:9000
2022-01-22 15:02:15,041 - pid:8207 [I] pool.setup:105 - Started 4 acceptors in threadless (local) mode
2022-01-22 15:02:44,499 - pid:8210 [I] web.access_log:278 - 127.0.0.1:56172 - GET / - curl/7.78.0 - 5.81ms

And as I use curl, it shows:

% curl -v localhost:8080    
*   Trying 127.0.0.1:8080...
* Connected to localhost (127.0.0.1) port 8080 (#0)
> GET / HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/7.78.0
> Accept: */*
> 
* Mark bundle as not supporting multiuse
* HTTP 1.0, assume close after body
< HTTP/1.0 200 OK
< Server: SimpleHTTP/0.6 Python/3.7.11
< Date: Sat, 22 Jan 2022 19:57:52 GMT
< Content-type: text/html
< Content-Length: 881
< Last-Modified: Thu, 13 Jan 2022 22:29:31 GMT
< 
* Closing connection 0
<!DOCTYPE html><html lang=""><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="icon" href="favicon.ico"><title>client</title><link href="css/app.a5739a38.css" rel="preload" as="style"><link href="css/chunk-vendors.7c85493c.css" rel="preload" as="style"><link href="js/app.5ad3361b.js" rel="preload" as="script"><link href="js/chunk-vendors.ad8a8257.js" rel="preload" as="script"><link href="css/chunk-vendors.7c85493c.css" rel="stylesheet"><link href="css/app.a5739a38.css" rel="stylesheet"></head><body><noscript><strong>We're sorry but client doesn't work properly without JavaScript enabled. Please enable it to continue.</strong></noscript><div id="app"></div><script src="js/chunk-vendors.ad8a8257.js"></script><script src="js/app.5ad3361b.js"></script></body></html>% 

% curl -v localhost:9000
*   Trying 127.0.0.1:9000...
* Connected to localhost (127.0.0.1) port 9000 (#0)
> GET / HTTP/1.1
> Host: localhost:9000
> User-Agent: curl/7.78.0
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 404 NOT FOUND
< Server: proxy.py v2.4.0rc8.dev5+g1569146
< Content-Length: 0
< Connection: close
< 
* Closing connection 0

[abhinavsingh]

Well this is what I mentioned in my comments earlier. Likely you don't understand what you are doing. Realize that you have implemented HttpProxyBasePlugin, but you are sending request to the web server :D

Why are you not using reverse proxy plugin as I recommended earlier. Reverse proxy plugin is a web server plugin and is what will work for you

[abhinavsingh]

Kindly reopen separate discussion or issue if you have further questions. Thank you & all the best :)