Files

glm-5.1 7efc142406 Expand architecture: multi-site Phase 1, multi-domain TLS, fix review issues

Promote multi-site support from Phase 2 to Phase 1 (ADR-010): the proxy
must support git.alk.dev and alk.dev from initial release. Add multi-domain
TLS configuration (ADR-011): acme_domains array replaces acme_domain string,
single SAN certificate via rustls-acme.

Key changes:
- ADR-010: Multi-site in Phase 1 — avoids config format migration later
- ADR-011: Multi-domain TLS — single SAN cert, acme_domains Vec<String>
- ADR-002: Updated rationale for multi-site (one upstream per domain)
- overview.md: Phase 1 now includes multi-site, alk.dev pass-through,
  dual licensing (MIT OR Apache-2.0), real IP removed
- config.md: acme_domain → acme_domains, TOML example shows both sites,
  validation adds unique host check, real IP replaced with 203.0.113.10
- tls.md: Multi-domain SNI section moved from Future to current, manual
  mode uses ResolvesServerCert for SNI mapping, TOML header fixed
- proxy.md: Updated for multi-site, removed single-domain language
- operations.md: RFC 5737 documentation IPs, clarified rate limit eviction
  semantics (distinct scan interval vs eviction age)
- open-questions.md: OQ-05 resolved (single bind_addr sufficient), new
  OQ-07 (per-site TLS overrides)

Review fixes:
- acme_domains (plural) consistently used across all docs and diagram
- ADR-011 clearly scopes acme_domain as previous design
- Inline decision rationale extracted: tls.md hot-reload → ADR-004 ref,
  config.md static/dynamic → ADR-008 ref
- TOML section headers consistent (server.tls)

2026-06-11 08:50:03 +00:00

3.4 KiB

Raw Blame History

status, last_updated

status	last_updated
draft	2026-06-11

Reverse Proxy — Architecture

Current State

Phase 0 (Exploration) — Complete. Phase 1 (Architecture) — In progress.

This project replaces our vulnerable nginx 1.24.0 installation with a memory-safe Rust/axum reverse proxy. The primary motivation is CVE-2026-42945 (unauthenticated RCE in nginx's rewrite module) and the broader pattern of memory corruption bugs in nginx's C codebase.

The proxy supports multiple domains from initial release (git.alk.dev and alk.dev), with per-domain host-based routing and a single multi-domain SAN certificate via ACME.

Architecture Documents

Document	Status	Description
overview.md	Draft	Vision, scope, crate dependencies, exports
proxy.md	Draft	Reverse proxy handler, request flow, header injection
tls.md	Draft	TLS termination, ACME, manual certs, SNI
config.md	Draft	TOML config format, static/dynamic split, ArcSwap reload
operations.md	Draft	Rate limiting, logging, health check, systemd, shutdown

ADR Table

ADR	Title	Status
001	Rust with Axum	Accepted
002	Custom Proxy Handler	Accepted
003	TOML Configuration Format	Accepted
004	ACME-Primary Certificate Management	Accepted
005	tokio-rustls Directly, Not axum-server	Accepted
006	Token Bucket Rate Limiting	Accepted
007	Custom Structured Log Format	Accepted
008	Static/Dynamic Config Split with ArcSwap	Accepted
009	Signal Handling Strategy	Accepted
010	Multi-Site Support in Phase 1	Accepted
011	Multi-Domain TLS Configuration	Accepted

Open Questions

See open-questions.md for the full tracker.

OQ	Question	Priority	Status
OQ-01	Should cipher suites be restricted beyond rustls defaults?	medium	open
~~OQ-02~~	~~What log format should fail2ban consume?~~	~~high~~	resolved (ADR-007)
OQ-03	Should the health check endpoint be on a separate port?	low	open
OQ-04	Config reload: SIGHUP only or also Unix socket API?	low	open
~~OQ-05~~	~~Should the proxy bind to multiple addresses?~~	~~low~~	resolved (single bind_addr sufficient)
OQ-06	Should upstream timeouts be configurable per-site?	low	open
OQ-07	Should per-site TLS overrides be supported for mixed ACME/manual domains?	low	open

Document Lifecycle

Status	Meaning	Transitions
`draft`	Under active development. May change significantly.	→ `reviewed` when open questions are resolved
`reviewed`	Architecture is final. Implementation may begin.	→ `stable` when implementation is complete
`stable`	Locked. Changes require review and may warrant an ADR.	→ `deprecated` when superseded
`deprecated`	Superseded. Kept for reference.	Removed when no longer referenced

3.4 KiB Raw Blame History