glm-5.1
13b0991fb8
Resolved all 11 open questions based on project guidance: Transport: - OQ-01/OQ-07: ACME/Let's Encrypt with domain + IP paths (ADR-008) - OQ-02: Default to n0 relay, --iroh-relay override (ADR-009) - OQ-05: Transport chaining supported natively (ADR-010) Client: - OQ-06: Programmatic-first API, no ~/.ssh/config (ADR-011) Server: - OQ-04: Ed25519 + OpenSSH cert-authority, no password auth (ADR-012) - OQ-08: fail2ban-friendly logging + built-in rate limiting (ADR-013) TUN: - OQ-03/OQ-09: Deferred entirely, recommend tun2proxy (ADR-014) - tun-shim.md marked deprecated NAPI: - OQ-10: Expose both connect() and serve() (ADR-016) - OQ-11: Use napi-rs for FFI bridge (ADR-015) Additional ADRs created during review: - ADR-006: No logging of tunnel destinations (was phantom reference) - ADR-017: Stealth mode protocol multiplexing - ADR-018: Control channel for pubsub over SSH Fixed: ADR-002 status → Superseded, ADR-007 title typo, WRAUTH_SERVER typo, ADR-005 stale wraith-tun refs, undefined ACL feature removed from server.md, --proxy semantic difference documented.
33 lines
1.5 KiB
Markdown
33 lines
1.5 KiB
Markdown
# ADR-010: Transport Chaining in CLI
|
|
|
|
## Status
|
|
Accepted
|
|
|
|
## Context
|
|
Transport chaining allows combining iroh with an upstream proxy, e.g.:
|
|
|
|
```bash
|
|
wraith connect --transport iroh --proxy socks5://127.0.0.1:1080
|
|
```
|
|
|
|
This routes iroh's outbound TCP connections through a SOCKS5 proxy, which could itself be another wraith instance. This is important for:
|
|
- Nested tunnel topologies
|
|
- Environments where iroh needs to go through an existing proxy
|
|
- Composing transports in flexible ways
|
|
|
|
iroh's `Endpoint::builder` supports proxy configuration natively. The implementation is straightforward — pass the proxy URL to iroh's builder.
|
|
|
|
## Decision
|
|
Support `--transport iroh --proxy socks5://...` natively in the CLI. This works because iroh's endpoint builder accepts a proxy configuration, so the implementation is minimal: parse the proxy URL and pass it to the endpoint builder.
|
|
|
|
For other transport combinations (TCP+TLS is already implicit — TLS wraps TCP), the `--proxy` flag applies to outbound connections from the SSH client or iroh endpoint.
|
|
|
|
## Consequences
|
|
- **Positive**: Flexible transport composition without requiring separate manual configuration.
|
|
- **Positive**: Matches user expectation from the overview doc's transport chaining example.
|
|
- **Positive**: Implementation is minimal — iroh already supports proxy config.
|
|
- **Negative**: Slightly more CLI surface area (`--proxy` interaction with `--transport`).
|
|
|
|
## References
|
|
- [transport.md](../transport.md)
|
|
- [OQ-05](../open-questions.md) — resolved by this ADR |