Reverse Proxy

將 Fluxheim 放喺 application server 前面。Fluxheim 會處理 TLS、headers、limits 同 upstream 選擇。

Basic proxy

[[vhosts]]
name = "app"
hosts = ["app.example.com"]

[[vhosts.routes]]
path_prefix = "/"
action = "proxy"
upstreams = ["127.0.0.1:3000"]

route 選擇

功能	以下情況使用
`path_exact`	一個URL需要一個精確的路由。
`path_prefix`	A whole URL subtree goes to one 後端.
`strip_prefix`	The 後端 should not see the 公開 prefix.
`rewrite_prefix`	The 後端 expects a different internal prefix.
`methods`	路由應該只接受選定的 HTTP 方法。

路徑重寫範例

[[vhosts.routes]]
name = "api"
path_prefix = "/api/"
strip_prefix = "/api/"
rewrite_prefix = "/internal/"

[vhosts.routes.proxy]
upstreams = ["10.0.0.20:8080"]
connect_timeout_secs = 5
read_timeout_secs = 30
send_timeout_secs = 30

瀏覽器應用程式嘅 CORS

只有當已知來源嘅瀏覽器應用程式必須調用呢條路由嗰陣先啟用 CORS 。

[headers.cors]
enabled = true
allow_origins = ["https://app.example.com"]
allow_methods = ["GET", "HEAD", "POST"]
allow_headers = ["authorization", "content-type"]
allow_credentials = true
max_age_secs = 600

Fluxheim 會喺本機回應有效嘅預檢請求；被拒絕嘅預檢會喺未到應用程式之前回傳 403。
唔好將通配符來源同憑證結合。
CORS 唔係認證、授權或者 CSRF 保護。

Production 注意事項

將應用程式保留喺 loopback 或私有網絡。
開放 upload 前先設定 request body limits。
Use trusted proxy settings only for networks you control.
Prefer explicit routes over one large fallback when different paths need different 安全ty rules.