mirror of https://github.com/coder/coder.git synced 2026-10-28 02:42:54 +08:00

Files

T

Susana Ferreira 74b6d12a8a feat: implement selective MITM with configurable domain allowlist in aibridgeproxyd (#21473 )

## Description

Implements selective MITM (Man-in-the-Middle) in `aibridgeproxyd` so
that only requests to allowlisted domains are intercepted and decrypted.
Requests to all other domains are tunneled directly without decryption.

## Changes

* New config option: `CODER_AIBRIDGE_PROXY_DOMAIN_ALLOWLIST` (default:
`api.anthropic.com`,`api.openai.com`)
* Selective MITM: Uses `goproxy.ReqHostIs()` to only intercept `CONNECT`
requests to allowlisted hosts
* Certificate caching: Now only generates/caches certificates for
allowlisted domains
* Validation: Startup fails if domain allowlist is empty or contains
invalid entries

Closes: https://github.com/coder/internal/issues/1182

2026-01-13 11:30:51 +00:00

aibridgeproxyd_test.go

feat: implement selective MITM with configurable domain allowlist in aibridgeproxyd (#21473 )

2026-01-13 11:30:51 +00:00

aibridgeproxyd.go

feat: implement selective MITM with configurable domain allowlist in aibridgeproxyd (#21473 )

2026-01-13 11:30:51 +00:00

certcache_test.go

feat: add certificate caching for AI Bridge Proxy (#21344 )

2025-12-29 16:16:31 +00:00

certcache.go

feat: add certificate caching for AI Bridge Proxy (#21344 )

2025-12-29 16:16:31 +00:00

README.md

chore: remove experimental endpoints (#21390 )

2025-12-29 16:17:46 +00:00

README.md

AI Bridge Proxy

A MITM (Man-in-the-Middle) proxy server for intercepting and decrypting HTTPS requests to AI providers.

Overview

The AI Bridge Proxy intercepts HTTPS traffic, decrypts it using a configured CA certificate, and forwards requests to AI Bridge for processing.

Configuration

Certificate Setup

Generate a CA key pair for MITM:

1. Generate a new private key

openssl genrsa -out mitm.key 2048
chmod 400 mitm.key

2. Create a self-signed CA certificate

openssl req -new -x509 -days 365 \
  -key mitm.key \
  -out mitm.crt \
  -subj "/CN=Coder AI Bridge Proxy CA"

Configuration options

Environment Variable	Description	Default
`CODER_AIBRIDGE_PROXY_ENABLED`	Enable the AI Bridge Proxy	`false`
`CODER_AIBRIDGE_PROXY_LISTEN_ADDR`	Address the proxy listens on	`:8888`
`CODER_AIBRIDGE_PROXY_CERT_FILE`	Path to the CA certificate file	-
`CODER_AIBRIDGE_PROXY_KEY_FILE`	Path to the CA private key file	-

Client Configuration

Clients must trust the proxy's CA certificate and authenticate with their Coder session token.

CA Certificate

Clients need to trust the MITM CA certificate:

# Node.js
export NODE_EXTRA_CA_CERTS="/path/to/mitm.crt"

# Python (requests, httpx)
export REQUESTS_CA_BUNDLE="/path/to/mitm.crt"
export SSL_CERT_FILE="/path/to/mitm.crt"

# Go
export SSL_CERT_FILE="/path/to/mitm.crt"

Proxy Authentication

Clients authenticate with the proxy using their Coder session token in the Proxy-Authorization header via HTTP Basic Auth. The token is passed as the password (username is ignored):

export HTTP_PROXY="http://ignored:<coder-session-token>@<proxy-host>:<proxy-port>"
export HTTPS_PROXY="http://ignored:<coder-session-token>@<proxy-host>:<proxy-port>"

For example:

export HTTP_PROXY="http://coder:${CODER_SESSION_TOKEN}@localhost:8888"
export HTTPS_PROXY="http://coder:${CODER_SESSION_TOKEN}@localhost:8888"

Most HTTP clients and AI SDKs will automatically use these environment variables.