Initial commit

.github/FUNDING.yml

@@ -0,0 +1 @@
+github: cesbit

.github/workflows/ci.yml

@@ -0,0 +1,23 @@
+name: CI
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+        - main
+
+jobs:
+  golangci:
+    name: lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v4
+        with:
+          go-version: '1.21'
+          cache: false
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v3
+        with:
+          version: latest

.github/workflows/deploy.yml

@@ -0,0 +1,47 @@
+name: Deploy
+
+on:
+  push:
+    tags:
+      - "v*-*"  # v1.2.3-alpha0 etc.
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build-and-push-image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v2
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          images: ${{ env.REGISTRY }}/cesbit/tlsproxy
+
+      - name: Get the version
+        id: get_version
+        run: echo "VERSION=$(echo $GITHUB_REF | cut -d / -f 3)" >> $GITHUB_OUTPUT
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          push: true
+          file: Dockerfile
+          tags: ghcr.io/cesbit/tlsproxy:${{ steps.get_version.outputs.VERSION }}
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/release.yml

@@ -0,0 +1,48 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+      - "!v*-*"  # v1.2.3-alphd0
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build-and-push-image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v2
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          images: ${{ env.REGISTRY }}/cesbit/tlsproxy
+
+      - name: Get the version
+        id: get_version
+        run: echo "VERSION=$(echo $GITHUB_REF | cut -d / -f 3)" >> $GITHUB_OUTPUT
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          push: true
+          file: Dockerfile
+          tags: ghcr.io/cesbit/tlsproxy:${{ steps.get_version.outputs.VERSION }},ghcr.io/cesbit/tlsproxy:latest
+          labels: ${{ steps.meta.outputs.labels }}

.gitignore

@@ -0,0 +1,5 @@
+# Test build
+tlsproxy
+
+# Certificates
+certificates/

Dockerfile

@@ -0,0 +1,32 @@
+# syntax=docker/dockerfile:1
+
+FROM golang:1.21
+
+# Set destination for COPY
+WORKDIR /app
+
+# Download Go modules
+COPY go.mod go.sum ./
+RUN go mod download
+
+# Copy the source code. Note the slash at the end, as explained in
+# https://docs.docker.com/engine/reference/builder/#copy
+COPY *.go ./
+
+# Build
+RUN CGO_ENABLED=0 GOOS=linux go build -o /tlsproxy
+
+# Expose (accept client connections)
+EXPOSE 443
+EXPOSE 8000
+
+ENV TLSPROXY_TARGET "localhost"
+ENV TLSPROXY_PORTS "443:80,8000"
+ENV TLSPROXY_CERT_FILE "certificates/server.crt"
+ENV TLSPROXY_KEY_FILE "certificates/server.key"
+
+VOLUME "/certificates"
+
+# Run
+WORKDIR /
+CMD ["/tlsproxy"]

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Cesbit
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,57 @@
+[![CI](https://github.com/cesbit/tlsproxy/workflows/CI/badge.svg)](https://github.com/cesbit/tlsproxy/actions)
+[![Release Version](https://img.shields.io/github/release/cesbit/tlsproxy)](https://github.com/cesbit/tlsproxy/releases)
+
+# TLS Proxy
+
+## Installation
+
+Just clone the project and make a build
+
+```
+git clone [email protected]:cesbit/tlsproxy.git
+cd tlsproxy
+go build
+```
+
+## Example usage
+
+The following assumes a server.crt and server.key and will forward 443->80 and 8000->8000 to just-a-host.local
+
+```
+TLSPROXY_TARGET=just-a-host.local \
+TLSPROXY_PORTS=443:80,8000 \
+TLSPROXY_CERT_FILE=server.crt \
+TLSPROXY_KEY_FILE=server.key \
+tlsproxy
+```
+
+## Environment variable
+
+Environment             | Description
+----------------------- | -----------
+`TLSPROXY_TARGET`       | Address of the host.
+`TLSPROXY_PORTS`        | Specify the ports you want to secure with TLS. You can list multiple ports separated by commas. Use the following syntax: `<outside>:<inside>` _(example `443:80`)_. If the outside and inside ports are the same, you can simply specify the port number _(example `8000`)_.
+`TLSPROXY_CERT_FILE`    | Path to the certificate file _(example `/certs/server.crt`)_.
+`TLSPROXY_KEY_FILE`     | Path to the key file _(example `/certs/server.key`)_.
+`TLSPROXY_DEBUG`        | A value of `1` or `enable` will enable debug logging.
+## Certificates
+
+For testing, one can create certificates using the following commands:
+
+Generate private key (.key)
+Key considerations for algorithm "RSA" ≥ 2048-bit
+```
+openssl genrsa -out server.key 2048
+```
+Key considerations for algorithm "ECDSA" (X25519 || ≥ secp384r1)
+https://safecurves.cr.yp.to/
+List ECDSA the supported curves (openssl ecparam -list_curves)
+```
+openssl ecparam -genkey -name secp384r1 -out server.key
+```
+Generation of self-signed(x509) public key (PEM-encodings .pem|.crt) based on the private (.key)
+```
+openssl req -new -x509 -sha256 -key server.key -out server.crt -days 3650
+```
+
+

go.mod

@@ -0,0 +1,3 @@
+module github.com/cesbit/tlsproxy
+
+go 1.21.4