Re:Reverst: Reverse Tunnels in Go over HTTP/3 and QUIC
by GeorgeMac on Monday April 08, 2024 @11:59AM
(#39971008)
Would love a feature request GH issue for that! Seems totally doable!
Re:Reverst: Reverse Tunnels in Go over HTTP/3 and QUIC
by zilti on Monday April 08, 2024 @01:31PM
(#39971910)
But why http?
Re:Reverst: Reverse Tunnels in Go over HTTP/3 and QUIC
by yjftsjthsd-h on Monday April 08, 2024 @02:36PM
(#39972501)
Network effects? (No pun intended.) HTTP has a big ecosystem. Ex. Everyone already has curl installed.
Edit: This isn't hypothetical, either; I literally use curl regularly to query services. Sure, there are other options, but HTTP generally works, so...
Re:Reverst: Reverse Tunnels in Go over HTTP/3 and QUIC
by screamingninja on Monday April 08, 2024 @02:29PM
(#39972466)
Have you considered wireguard / tailscale?
Re:Reverst: Reverse Tunnels in Go over HTTP/3 and QUIC
by debarshri on Monday April 08, 2024 @04:38PM
(#39973457)
Generally people use Zerotier for this kind of usecase in the industry. It is pretty robust.
Re:Reverst: Reverse Tunnels in Go over HTTP/3 and QUIC
by irq-1 on Tuesday April 09, 2024 @01:20PM
(#39981704)
You can do SSH from the robot to a host, and keep it alive with autoSSH. Add a reverse tunnel for the web if you have a web interface on the device.
https://linux.die.net/man/1/autossh
Few notes: manually add host machine key on first use. I add the parameters:
autossh -M 0 -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3"
Many other reverse proxy / tunneling solutions use TCP-based protocols or require the target hosts to be accessible by the proxy server, but in this case QUIC connection migration avoids the reconnection handshakes needed for dropped TCP connections, and your client->server model allows the robots to register themselves from restrictive networks.
The only missing feature would be to allow some sort of auth plugin - perhaps as a sub-request made to an external auth service that contains the identifier of the client the request will be routed to, similar to nginx's auth_request (https://nginx.org/en/docs/http/ngx_http_auth_request_module....)