[nuclearcat]

Log connection-derived TLSFP and TCP SYN fingerprints on the public nginx listeners, alongside request and negotiated TLS metadata. Serve HTTPS using the existing certificate mounts and keep the development override HTTP-only. Anubis continues to filter public requests before forwarding accepted traffic to the internal listener.

Build nginx 1.30.6 with the independently implemented, BSD-2-Clause nginx-connfp module, pinned to commit 7d83cab08d1521df8a453c8b4fd0df9700a0f652. Verify both source archives with SHA-256. The module uses OpenSSL's message callback and Linux saved-SYN socket options, so nginx core patches are unnecessary. The image includes the module's LICENSE and NOTICE with attribution to ntop's TLSFP specification.

Public JSON logs contain:

• tlsfp: ntop TLSFP draft 0.1, with ephemeral-extension filtering and a supported-groups hash.
• tlsfp_registry: ephemeral extension registry version 1.
• tcp_syn: the module's versioned syn1: format, containing IP version, TTL/hop limit, IPv4 DF, TCP window, MSS, window scale and TCP option order.

The module preserves tcp_save_syn and the two legacy variable names $http_ssl_ja4 and $http_ssl_ja4t as aliases. Their values use TLSFP and syn1:; existing JA4/JA4T matching rules and parsers need migration. Log consumers must use tlsfp and tcp_syn in place of the earlier tls_ja4 and tcp_ja4t keys.

Client-supplied fingerprint headers cannot supply these values. The internal port 8080 retains its original log format and disables SYN capture. Capture must occur at the original connection edge; a terminating proxy supplies its own handshake. SYN capture requires Linux support and may be unavailable with SYN cookies. Fingerprints are telemetry, not authentication.

Validation passed on a Linux Docker host:

docker build -t dashboard-proxy:connfp ./proxy
python3 proxy/test-fingerprints.py dashboard-proxy:connfp

The smoke test exercises real Anubis forwarding, static/API routing, HTTP/1.1 and HTTP/2, TLS 1.2/1.3, keepalive, forged headers, JSON escaping and certificate-free development startup. Module CI also passed static/dynamic builds, IPv4/IPv6 SYN capture, fragmented ClientHellos, HelloRetryRequest, TLS resumption, reload behavior and more than six million parser fuzz inputs under sanitizers.

[alanpeixinho]

FoxIO License 1.1 is non-commercial only and says hosted services don't count as non-commercial. Should we check if we are safe to use it?

[nuclearcat]

Good point, i will implement alternative

[nuclearcat]

@alanpeixinho Following up on the licensing concern and my earlier promise to implement an alternative: 1c1211b5 replaces the FoxIO dependency with nginx-connfp, an independently written BSD-2-Clause module.

It implements ntop's published TLSFP draft and its own versioned TCP SYN fingerprint. No FoxIO module source or patches are shipped, and no nDPI implementation code was copied. The module's NOTICE credits ntop's CC BY 4.0 specification; source provenance and the contribution policy are documented.

The build pins the module commit and checks the source archive's SHA-256. OpenSSL's message callback and Linux saved-SYN socket options provide capture without nginx core patches.

The two legacy variable names and tcp_save_syn remain accepted, but values now use TLSFP and syn1:. Public log fields are tlsfp, tcp_syn and tlsfp_registry; existing JA4/JA4T parsers or matching rules need migration.

The rebuilt dashboard image passed the real Anubis smoke test, including TLS 1.2/1.3, HTTP/2, keepalive, forged headers, JSON escaping and the HTTP-only development override. Module CI also passed both build modes, connection tests and sanitizer fuzzing.

[nuclearcat]

Closing this PR because the current deployment terminates public TLS in the host nginx, which then forwards plain HTTP to the dashboard containers. TLS and TCP SYN fingerprinting will be deployed on the host nginx until staging is properly separated.