opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: add TLS listener support to aibridgeproxyd (#22411)

Browse Source 
## Description

Adds optional TLS support for the AI Bridge Proxy listener. When TLS cert and key files are provided, the proxy serves over HTTPS instead of plain HTTP.

## Changes

* New configuration options to enable TLS on the proxy listener 
* Wraps the TCP listener in `tls.NewListener` when configured
* Tests for validation errors, invalid files, and full integration (tunneled + MITM) through a TLS listener

Note: Documentation for TLS listener setup and client configuration will be handled in a follow-up PR.
Related to: https://github.com/coder/internal/issues/1335
This commit is contained in:
Susana Ferreira
2026-03-05 09:19:34 +00:00
committed by GitHub
parent 7bcd9f6de8
commit 21c91cebaa
13 changed files with 346 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cli/testdata/coder_server_--help.golden
Vendored
+8
View File
@@ -191,6 +191,14 @@ AI BRIDGE PROXY OPTIONS:
Path to the CA private key file used to intercept (MITM) HTTPS traffic
from AI clients.
--aibridge-proxy-tls-cert-file string, $CODER_AIBRIDGE_PROXY_TLS_CERT_FILE
Path to the TLS certificate file for the AI Bridge Proxy listener.
Must be set together with AI Bridge Proxy TLS Key File.
--aibridge-proxy-tls-key-file string, $CODER_AIBRIDGE_PROXY_TLS_KEY_FILE
Path to the TLS private key file for the AI Bridge Proxy listener.
Must be set together with AI Bridge Proxy TLS Certificate File.
--aibridge-proxy-upstream string, $CODER_AIBRIDGE_PROXY_UPSTREAM
URL of an upstream HTTP proxy to chain tunneled (non-allowlisted)
requests through. Format: http://[user:pass@]host:port or
cli/testdata/server-config.yaml.golden
Vendored
+8
View File
@@ -830,6 +830,14 @@ aibridgeproxy:
# The address the AI Bridge Proxy will listen on.
# (default: :8888, type: string)
listen_addr: :8888
# Path to the TLS certificate file for the AI Bridge Proxy listener. Must be set
# together with AI Bridge Proxy TLS Key File.
# (default: <unset>, type: string)
tls_cert_file: ""
# Path to the TLS private key file for the AI Bridge Proxy listener. Must be set
# together with AI Bridge Proxy TLS Certificate File.
# (default: <unset>, type: string)
tls_key_file: ""
# Path to the CA certificate file used to intercept (MITM) HTTPS traffic from AI
# clients. This CA must be trusted by AI clients for the proxy to decrypt their
# requests.