Skip to content

[Feat]: Allow compatibility with TCP(SSL) multiplexing behind a reverse proxy (Traefik) #21691

@FarDust

Description

@FarDust

Problem

Currently the Netdata Child agent in streaming mode is not sending the SNI, besides being defined in the stream.conf

Description

I would like that Netdata Child be able to send the HostSNI to be able to complete the TLS handshake, specially on scenarios where the certificate was issued for an specific domain.

Importance

nice to have

Value proposition

  1. It allow configurations in local setups were al traffic is routed trough a DNS to a single port using a hostname.
  2. Whit this feature we can avoid hours of troubleshooting, even AIs cannot figure it out

Proposed implementation

The child client must send the HostSNI to the parent if available in the conf file, not the raw resolved IP or simply add in the docs that the SNI is not being sent from the child to avoid long troubleshooting periods, or if is already posible trough configuration make it easier to find.

To test this you required a minimal setup of a reverse proxy that supports TCP multiplexing and TLS, assign the shared port for the services you are hosting, add a rule to route connections to the parent netadata service ensuring that maches only tcp connections with SNI headers. The child must be set to sent an SSL connection using <host>:<port>:SSL and the parent should be serving the certificate issued for that particular Host. It doesn't matter if the parent verifies or not the certificate, it would fail anyways.

Metadata

Metadata

Assignees

Labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions