Is there a proper way to host SMP and XFTP servers behind a reverse proxy ?

[2Belette]

The small embedded web server for SMP is the easy piece as there is an option to use http: 8000 and so any reverse proxy can send the traffic to that.

My question is more on SMP and XFTP protocols, any of you had a chance to make it work with a HAProxy with TCP Proxy using SNI ?

My issue is that ideally it would be better to use 443 (if I only use 5223 I see this warning when launching the server: > WARNING: the clients will use port 443 by default soon.) but how can it use 443 if other domains are ?

As SMP is based on TLS1.3 is is possible to use the SSL routing based on SNI on HA Proxy ? This mode is only reading the SNI and don't touch on SSL (no offloading) and keep the TLS managed by the backends (here SMP and XFTP).

Any of you using something like this ? Or is there another alternative to host SMP/XFTP with other domains on 443 on the same IP address ? (which is a pretty common setup)

Thanks

[X-Ryl669]

You can set up a reverse proxy with nginx like this:

     server {
         listen 443 reuseport;
         proxy_pass  https://yourIP:5533;
# proxy_set_header   Host public_http_host;
         proxy_ssl_verify       off;
         proxy_ssl_protocols TLSv1.2 TLSv1.3;
         ssl_preread on;
     }

If I understand the protocol correctly, it seems that XFTP doesn't care about the HTTPS encryption at all. So it'll encrypt its communication with a self generated certificate (that can be self signed, you don't care since it's only between this server and nginx).
In the example, you tell nginx to ignore the SSL certificate issue.
You'll need to set the host header if XFTP needs an host (which I don't think it does).

It would be better if the server had an option to disable HTTPS directly (so the TLS part is done by the reverse proxy as usual, which can handle SNI that XFTP doesn't do)

EDIT: I haven't run XFTP yet, I'm just gathering documentation for now.

[2Belette]

Thanks for your response, if you check my message my all point is to have reverse proxy (HA or nginx) which is already serving multiple subdomain using SNI to dynamically routing the traffic to the right backend, which is very typical usecase nothing fancy.

But for that to work, as you mentioned we need to have SNI to be used and I am not sure SMP or XFTP has that.

In HAProxy I was also thiking to do stream but using 443 like my other subdomains I would also need to have SNI to be used for routing the traffic to the right backend (SimpleX container)

[X-Ryl669]

I don't know for HAProxy, I'm not using it. But for nginx, this is what I use. You'll have your 443 port directed to nginx, have nginx handle the smp.yourdomain.tld and xftp.yourdomain.tld (as well as yourotherservice.yourdomain.tld). It's nginx that's doing the SNI work.

Then for xftp, you'll proxy pass the request to the HTTPS port of xftp (this isn't usual: usually you have a HTTP port here for the proxy), but telling nginx to ignore any SSL issue with xftp, so you can use a 100 year long self signed certificate for it (so you don't need to bother with certbot for an internal LAN IP address).
It seems smp also speaks HTTP, so for it you'll just use the common proxy over HTTP.

So in the end, when a user connects to xftp.yourdomain.tld, he'll see:

[ User ] => [ Internet ] =(HTTPS:443:yournginxSSLcert)=>[yourdomain.tld server]=>[nginx (with SNI)]=(HTTPS:443:yourxftpmachine.ip)=>[xftp]