Fluxheim/Doiciméid/Reverse Proxy

Reverse Proxy

Put Fluxheim in front of an application server. Fluxheim handles TLS, ceanntásca, teorainneacha, agus upstream selection.

Basic proxy

[[vhosts]]
name = "app"
hosts = ["app.example.com"]

[[vhosts.routes]]
path_prefix = "/"
action = "proxy"
upstreams = ["127.0.0.1:3000"]

Roghanna bealaigh

Gné	Úsáid é nuair
`path_exact`	One URL needs a precise bealach.
`path_prefix`	Téann fochrainn URL iomlán chuig inneall amháin.
`strip_prefix`	The backend should not see the poiblí prefix.
`rewrite_prefix`	Tá súil ag an inneall le réimír inmheánach eile.
`methods`	A bealach should amháin accept selected HTTP methods.

Sampla athscríobh cosáin

[[vhosts.routes]]
name = "api"
path_prefix = "/api/"
strip_prefix = "/api/"
rewrite_prefix = "/internal/"

[vhosts.routes.proxy]
upstreams = ["10.0.0.20:8080"]
connect_timeout_secs = 5
read_timeout_secs = 30
send_timeout_secs = 30

CORS le haghaidh apps brabhsálaí

Cumasaigh CORS ach amháin nuair is gá d’fheidhmchláir bhrabhsálaí ar bhunús aitheanta glaoch ar an mbealach seo.

[headers.cors]
enabled = true
allow_origins = ["https://app.example.com"]
allow_methods = ["GET", "HEAD", "POST"]
allow_headers = ["authorization", "content-type"]
allow_credentials = true
max_age_secs = 600

Freagraíonn Fluxheim iarratais bhailí CORS preflight go háitiúil; filleann iarratais preflight diúltaithe 403 gan an feidhmchlár a bhaint amach.
Ná comhcheangail tionscnamh saoróg le dintiúir.
Ní fíordheimhniú, údarú ná cosaint CSRF é CORS.

Nótaí táirgeachta

Keep the application on loopback nó a príobháideach network.
Set iarratas body teorainneacha roimh exposing uploads.
Use trusted proxy settings only for networks you control.
Prefer explicit bealaí over one large fallback when different cosáin need different safety rules.