mirror of
https://github.com/coder/coder.git
synced 2026-10-28 02:42:54 +08:00
Susana Ferreira
7546e94534
## Description Improves logging in `aibridgeproxyd` to provide better observability for proxy requests. Adds structured logging with request correlation IDs and propagates request context through the proxy chain. ## Changes * Add `requestContext` struct to propagate metadata (token, provider, session ID) through the proxy request/response chain * ~Add `handleTunnelRequest` to log passthrough requests for non-allowlisted domains at debug level~ (removed due to verbosity) * Add `handleResponse` to log responses from `aibridged` * Log MITM requests routed to `aibridged` at info level, tunneled requests at debug level Related to: https://github.com/coder/internal/issues/1185
AI Bridge Proxy
A MITM (Man-in-the-Middle) proxy server for intercepting and decrypting HTTPS requests to AI providers.
Overview
The AI Bridge Proxy intercepts HTTPS traffic, decrypts it using a configured CA certificate, and forwards requests to AI Bridge for processing.
Configuration
Certificate Setup
Generate a CA key pair for MITM:
1. Generate a new private key
openssl genrsa -out mitm.key 2048
chmod 400 mitm.key
2. Create a self-signed CA certificate
openssl req -new -x509 -days 365 \
-key mitm.key \
-out mitm.crt \
-subj "/CN=Coder AI Bridge Proxy CA"
Configuration options
| Environment Variable | Description | Default |
|---|---|---|
CODER_AIBRIDGE_PROXY_ENABLED |
Enable the AI Bridge Proxy | false |
CODER_AIBRIDGE_PROXY_LISTEN_ADDR |
Address the proxy listens on | :8888 |
CODER_AIBRIDGE_PROXY_CERT_FILE |
Path to the CA certificate file | - |
CODER_AIBRIDGE_PROXY_KEY_FILE |
Path to the CA private key file | - |
Client Configuration
Clients must trust the proxy's CA certificate and authenticate with their Coder session token.
CA Certificate
Clients need to trust the MITM CA certificate:
# Node.js
export NODE_EXTRA_CA_CERTS="/path/to/mitm.crt"
# Python (requests, httpx)
export REQUESTS_CA_BUNDLE="/path/to/mitm.crt"
export SSL_CERT_FILE="/path/to/mitm.crt"
# Go
export SSL_CERT_FILE="/path/to/mitm.crt"
Proxy Authentication
Clients authenticate with the proxy using their Coder session token in the Proxy-Authorization header via HTTP Basic Auth.
The token is passed as the password (username is ignored):
export HTTP_PROXY="http://ignored:<coder-session-token>@<proxy-host>:<proxy-port>"
export HTTPS_PROXY="http://ignored:<coder-session-token>@<proxy-host>:<proxy-port>"
For example:
export HTTP_PROXY="http://coder:${CODER_SESSION_TOKEN}@localhost:8888"
export HTTPS_PROXY="http://coder:${CODER_SESSION_TOKEN}@localhost:8888"
Most HTTP clients and AI SDKs will automatically use these environment variables.