构建 TLS 反向代理

项目概述

本项目实现一个面向 tls termination 的完整系统，核心要解决的问题是 terminating TLS at the edge and forwarding plain HTTP upstream while preserving client identity。整体由 TLS context、SNI router、Cert loader、Header injector、Upstream forwarder 五个模块组成，每个模块单一职责、可独立测试，最后通过集成测试验证端到端正确性。设计上把 a certificate that expires without renewal and causes every handshake to fail at once 作为第一类需求先行处理，而非事后再补。

架构与关键决策

数据模型为 a map of server names to TLS contexts loaded from disk, with SNI selecting the context per connection。TLS context 定义其余阶段共同依赖的数据形状并在边界处校验输入；SNI router 承载 tls termination 的正确性逻辑；Cert loader 专门处理 a certificate that expires without renewal and causes every handshake to fail at once，在失败路径上给出明确的拒绝、重试或降级策略；Header injector 提供可观测性，每次操作输出带关联 id 的结构化事件；Upstream forwarder 在过载时按既定方式降级，避免过载演变为数据损坏。配置与代码分离，使风险变更可经 diff 审阅。

实施与测试

按五个阶段依次实现 TLS context、SNI router、Cert loader、Header injector、Upstream forwarder，每阶段配套聚焦单测。集成测试组合各模块并驱动真实 tls termination 场景：先验证正常路径，再刻意触发 a certificate that expires without renewal and causes every handshake to fail at once 并断言系统降级而非损坏。所有依赖均在进程内或被桩替换，用例在 CI 中确定可复现。

限制与后续

• 单区域设计，多区域复制超出范围。
• TLS context 默认进程内，未水平共享。
• 无鉴权层，假定部署在强制身份的边缘之后。

代码示例

# setup for reverse-proxy-tls
pnpm init
pnpm add fastify undici
pnpm add -D typescript tsx vitest

reverse_proxy_tls/
├── src/index.ts
├── src/tls-context.ts
├── src/sni-router.ts
├── tests/reverse_proxy_tls.test.ts
└── package.json

// TLS context: tls termination core
export function tlscontext(input: TlscontextInput): TlscontextResult {
  // Build the tls context that anchors tls termination and defines the core data shape.
  return processTlscontext(input);
}

// SNI router — handles tls termination Add the sni router so
export class Snirouter {
  constructor(private opts: SnirouterOptions) {}
  async run(ctx: Context): Promise<SnirouterOutput> {
    return this.execute(ctx);
  }
}

// Cert loader: tls termination stage
export const certloader = (next: Next) => async (req: Request) => {
  const out = await transform(req);
  return next(out);
};

// Header injector for tls termination
export async function headerinjector(stream: AsyncIterable<Chunk>): Promise<Aggregate> {
  let acc = init();
  for await (const c of stream) acc = merge(acc, c);
  return acc;
}

// Upstream forwarder: tls termination finalization
export function upstreamforwarder(state: State): Result {
  validate(state);
  return finalize(state);
}

# run the tls termination test suite
pnpm vitest run