Reverse Proxy

Poġġi Fluxheim quddiem server tal-applikazzjoni. Fluxheim jittratta TLS, headers, limiti u għażla ta’ upstream.

Basic proxy

[[vhosts]]
name = "app"
hosts = ["app.example.com"]

[[vhosts.routes]]
path_prefix = "/"
action = "proxy"
upstreams = ["127.0.0.1:3000"]

Għażliet tar-rotta

Karatteristika	Użah meta
`path_exact`	One URL needs a precise rotta.
`path_prefix`	Subtree tal-URL kollu jmur għal backend wieħed.
`strip_prefix`	The backend should not see the pubbliku prefix.
`rewrite_prefix`	Il-backend jistenna prefiss intern differenti.
`methods`	A rotta should biss accept selected HTTP methods.

Eżempju ta’ rewrite tal-path

[[vhosts.routes]]
name = "api"
path_prefix = "/api/"
strip_prefix = "/api/"
rewrite_prefix = "/internal/"

[vhosts.routes.proxy]
upstreams = ["10.0.0.20:8080"]
connect_timeout_secs = 5
read_timeout_secs = 30
send_timeout_secs = 30

CORS għall-apps tal-browser

Ippermetti CORS biss meta l-applikazzjonijiet tal-browser fuq oriġini magħrufa jridu jsejħu din ir-rotta.

[headers.cors]
enabled = true
allow_origins = ["https://app.example.com"]
allow_methods = ["GET", "HEAD", "POST"]
allow_headers = ["authorization", "content-type"]
allow_credentials = true
max_age_secs = 600

Fluxheim iwieġeb lokalment għal talbiet CORS preflight validi; talbiet preflight miċħuda jirritornaw 403 mingħajr ma jilħqu l-applikazzjoni.
Tgħaqqadx oriġini wildcard mal-kredenzjali.
CORS mhijiex awtentikazzjoni, awtorizzazzjoni, jew protezzjoni CSRF.

Noti tal-produzzjoni

Żomm l-applikazzjoni fuq loopback jew netwerk privat.
Issettja limiti għall-body tat-talba qabel tesponi uploads.
Use trusted proxy settings only for networks you control.
Prefer explicit rotot over one large fallback when different paths need different safety rules.