Layer 4 SNI-based proxy

[selfhoster1312]

It's often useful to have a reverse proxy which doesn't terminate TLS connections because some services really insist on having their own certificates.

On nginx this is done with streams. Is this feature planned for ferron? Or if not planned, is it welcome to make a PR for this?

I'm not sure how we could match SNI from rustls in server.rs:accept_connection but i'm sure it's technically possible.

[DorianNiemiecSVRJS]

Well, I haven't planned this feature for Ferron. I have rather designed it to be a web server than a layer 4 TCP proxy...

[selfhoster1312]

Is a PR for this welcome?

It's a very common pattern in selfhosting circles to have different VMs/machines handle their own certificates, and having the HTTP reverse proxy tunnel everything without terminating TLS.

I'm not suggesting ferron should be a generic Layer 4 proxy and implement all the protocols, simply HTTPS, though by matching ALPN (or lack thereof) we could support more protocols like SSH/XMPP.

[DorianNiemiecSVRJS]

Is a PR for this welcome?

Yes, a PR to add this feature would be welcome. I would suggest to open it against the develop-2.x branch (where Ferron 2 is developed).