proxy_https

This escaper reaches the target through an upstream HTTPS proxy.

The following interfaces are supported:

  • tcp connect

  • http(s) forward

The following egress path selection value is supported:

  • egress upstream

    If matched, the addr field overrides proxy_addr for this request.

    Added in version 1.13.0.

The following common keys are supported:

proxy_addr

required, type: upstream str | seq

Set the target proxy address. The default port is 3128 and may be omitted.

If a seq is used, each element must be a weighted upstream addr.

If any configured proxy address uses a domain name, resolver becomes required.

proxy_addr_pick_policy

optional, type: selective pick policy

Set the policy used to select the next proxy address.

The key for ketama/rendezvous/jump hash is <client-ip>[-<username>]-<upstream-host>.

default: random

tls_client

required, type: openssl tls client config

Set TLS parameters for the local TLS client. If set to an empty map, the default TLS client configuration is used.

alias: tls

tls_name

optional, type: tls name

Set the TLS server name used to verify peer certificates.

If not set, the host part of each peer address is used.

default: not set

proxy_username

optional, type: username

Set the proxy username. Basic authentication is used by default.

alias: proxy_user

Note

This conflicts with pass_proxy_userid.

proxy_password

optional, type: password

Set the proxy password. Required if username is present.

alias: proxy_passwd

bind_ipv4

optional, type: ipv4 addr str

Set the bind IP address for IPv4 sockets.

default: not set

bind_ipv6

optional, type: ipv6 addr str

Set the bind IP address for IPv6 sockets.

default: not set

http_forward_capability

optional, type: http forward capability

Set the HTTP forwarding capabilities supported by the next proxy.

default: all capability disabled

http_connect_rsp_header_max_size

optional, type: humanize usize

Set the maximum header size accepted for CONNECT responses.

default: 4KiB

tcp_keepalive

optional, type: tcp keepalive

Configure TCP keepalive.

User-level TCP keepalive settings are not applied.

default: no keepalive set

use_proxy_protocol

optional, type: proxy protocol version

Set the PROXY protocol version to use after the TCP connection to the peer is established.

default: not set, which means PROXY protocol won’t be used

Example:

- name: corp-https-proxy
  type: proxy_https
  proxy_addr: proxy.example.net:3128
  resolver: local-dns
  tls: {}
  tls_name: proxy.example.net
  proxy_user: service-user
  proxy_passwd: secret