feat: implement selective MITM with configurable domain allowlist in aibridgeproxyd (#21473)

mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00

## Description

Implements selective MITM (Man-in-the-Middle) in `aibridgeproxyd` so
that only requests to allowlisted domains are intercepted and decrypted.
Requests to all other domains are tunneled directly without decryption.

## Changes

* New config option: `CODER_AIBRIDGE_PROXY_DOMAIN_ALLOWLIST` (default:
`api.anthropic.com`,`api.openai.com`)
* Selective MITM: Uses `goproxy.ReqHostIs()` to only intercept `CONNECT`
requests to allowlisted hosts
* Certificate caching: Now only generates/caches certificates for
allowlisted domains
* Validation: Startup fails if domain allowlist is empty or contains
invalid entries

Closes: https://github.com/coder/internal/issues/1182

This commit is contained in:

Susana Ferreira

2026-01-13 11:30:51 +00:00

committed by

GitHub

parent 64e7a77983

commit 74b6d12a8a

10 changed files with 473 additions and 178 deletions

									
										site/src/api/typesGenerated.ts
									
Generated

		+1
		
												View File
												
				@@ -71,6 +71,7 @@ export interface AIBridgeProxyConfig {

					readonly listen_addr: string;

					readonly cert_file: string;

					readonly key_file: string;

					readonly domain_allowlist: string;

				}

				// From codersdk/aibridge.go