Proximo

A simple, lightweight HTTP proxy to allow anyone to access cloud run endpoints behind authentication. This will proxy requests to the cloud run endpoint, and add the Authorization header to the request based on your credentials.

Usage

Login

You need to ensure that you are logged in to your Google account before using Proximo.

gcloud auth login

Start the proxy

Start with a single target

proximo -targets service=https://my-cloud-run-endpoint.run.app

This will start the proxy on port 8080, proxying requests to the given Cloud Run URL and adding the Authorization header with your Google credentials. You should be able to access the endpoint at http://localhost:8080.

Start with multiple targets

proximo -targets service1=https://service1.com,service2=https://service2.com

This will start the proxy on port 8080, proxying requests to the given Cloud Run URLs and adding the Authorization header with your Google credentials. You should be able to access the endpoints at http://localhost:8080.

Start with config file

proximo -file config.yaml

This will start the proxy on port 8080, proxying requests to the given Cloud Run URLs and adding the Authorization header with your Google credentials. You should be able to access the endpoints at http://localhost:8080. This will use a config file to specify target and url mappings.

{
  "targets": {
    "google": "https://google.com",
    "microsoft": "https://microsoft.com"
  }
}

Change the port of the proxy

proximo -targets service=https://my-cloud-run-endpoint.run.app -port 4040

Disable the JWT token

proximo -config config.json -auth=false

Multiple Backends

Proximo supports routing requests to multiple backends based on the Host header. You can specify multiple host-to-target mappings when starting the proxy using the -targets or -file flag.

proximo -targets="search=https://search.com,api=https://api.com"

This will create reverse proxies for `search.com` and `api.com`, respectively. You can then send requests to these backends using the appropriate `Host` header:

# For https://search.com
curl -H "Host: search" http://localhost:8080/path/to/resource

# For https://api.com
curl -H "Host: api" http://localhost:8080/api/v1/endpoint

Authentication and Authorization

Proximo automatically adds an `Authorization` header with a JWT token to the forwarded requests. The token is obtained from the default Google Cloud Platform credentials on your machine.

To ensure that the proxy can authenticate with your Google account, you need to be logged in:

gcloud auth login

The proxy will use the credentials from your currently authenticated Google account to generate the JWT token.

Building

It should be easy to build Proximo from source:

make

This will build the proximo binary and output it to the ./builds directory based on the arch you build it in.