opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: implement selective MITM with configurable domain allowlist in aibridgeproxyd (#21473)

Browse Source 
## Description

Implements selective MITM (Man-in-the-Middle) in `aibridgeproxyd` so
that only requests to allowlisted domains are intercepted and decrypted.
Requests to all other domains are tunneled directly without decryption.

## Changes

* New config option: `CODER_AIBRIDGE_PROXY_DOMAIN_ALLOWLIST` (default:
`api.anthropic.com`,`api.openai.com`)
* Selective MITM: Uses `goproxy.ReqHostIs()` to only intercept `CONNECT`
requests to allowlisted hosts
* Certificate caching: Now only generates/caches certificates for
allowlisted domains
* Validation: Startup fails if domain allowlist is empty or contains
invalid entries

Closes: https://github.com/coder/internal/issues/1182
This commit is contained in:
Susana Ferreira
2026-01-13 11:30:51 +00:00
committed by GitHub
parent 64e7a77983
commit 74b6d12a8a
10 changed files with 473 additions and 178 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/api/general.md
Generated
+3
View File
@@ -164,6 +164,9 @@ curl -X GET http://coder-server:8080/api/v2/deployment/config \
"ai": {
"aibridge_proxy": {
"cert_file": "string",
"domain_allowlist": [
"string"
],
"enabled": true,
"key_file": "string",
"listen_addr": "string"
docs/reference/api/schemas.md
Generated
+19 -6
View File
@@ -597,6 +597,9 @@
```json
{
"cert_file": "string",
"domain_allowlist": [
"string"
],
"enabled": true,
"key_file": "string",
"listen_addr": "string"
@@ -605,12 +608,13 @@
### Properties
| Name | Type | Required | Restrictions | Description |
|---------------|---------|----------|--------------|-------------|
| `cert_file` | string | false | | |
| `enabled` | boolean | false | | |
| `key_file` | string | false | | |
| `listen_addr` | string | false | | |
| Name | Type | Required | Restrictions | Description |
|--------------------|-----------------|----------|--------------|-------------|
| `cert_file` | string | false | | |
| `domain_allowlist` | array of string | false | | |
| `enabled` | boolean | false | | |
| `key_file` | string | false | | |
| `listen_addr` | string | false | | |
## codersdk.AIBridgeTokenUsage
@@ -712,6 +716,9 @@
{
"aibridge_proxy": {
"cert_file": "string",
"domain_allowlist": [
"string"
],
"enabled": true,
"key_file": "string",
"listen_addr": "string"
@@ -2624,6 +2631,9 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
"ai": {
"aibridge_proxy": {
"cert_file": "string",
"domain_allowlist": [
"string"
],
"enabled": true,
"key_file": "string",
"listen_addr": "string"
@@ -3165,6 +3175,9 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
"ai": {
"aibridge_proxy": {
"cert_file": "string",
"domain_allowlist": [
"string"
],
"enabled": true,
"key_file": "string",
"listen_addr": "string"