TCP/UDP level redirection

[eliottness]

I love this project but putting my IoT Kubernetes cluster behind it cannot be done right now I think. First because it would be very troublesome to give access to all those let's encrypt auto-renewed certificates to this app and restart it when one changes and second because it does not support one target having multiple TLS certs depending on the SNI.

So my question is: Would it be possible to go one layer below TLS and do socket level sendfile(2) to forward the packets without decrypting the content. Do you think this would be possible?

Thanks for the project already

[darksworm]

It sounds like a reasonable suggestion and I would be open for reviewing contributions in this direction.

I cannot promise building it myself, I am spending my efforts elsewhere, so I'm hoping to keep this project community-driven.

[darksworm]

The project is called doormouse now, same repo, just renamed. We've also added raw TCP routes, which should cover what you asked for.

A TCP route forwards the connection without decrypting it. Your certificates stay in the cluster where cert-manager already renews them, and your ingress picks the cert by SNI exactly as it does today. Nothing to mount, nothing to restart on renewal. See "Route types" in the README for how to set one up.

UDP is not implemented yet, so QUIC and HTTP/3 will not pass. Happy to keep this open for that part.