dns proxy

Dockers/dns-proxy/entrypoint.sh

@@ -0,0 +1,59 @@
+#!/bin/sh
+set -eu
+
+TARGET_URL="${TARGET_URL:-}"
+LISTEN_PORT="${LISTEN_PORT:-8080}"
+PROXY_INSECURE_TLS="${PROXY_INSECURE_TLS:-0}"
+PRESERVE_HOST="${PRESERVE_HOST:-0}"
+
+if [ -z "$TARGET_URL" ]; then
+  echo "TARGET_URL is required (e.g. https://internal.example.com)" >&2
+  exit 1
+fi
+
+case "$TARGET_URL" in
+  http://*|https://*) ;;
+  *)
+    echo "TARGET_URL must start with http:// or https://" >&2
+    exit 1
+    ;;
+esac
+
+# Strip trailing slash so paths concatenate cleanly
+TARGET_URL="${TARGET_URL%/}"
+
+CADDYFILE="/etc/caddy/Caddyfile"
+mkdir -p /etc/caddy
+
+EXTRA_DIRECTIVES=""
+
+if [ "$PRESERVE_HOST" = "1" ]; then
+  EXTRA_DIRECTIVES="${EXTRA_DIRECTIVES}
+		header_up Host {http.request.host}"
+fi
+
+if [ "$PROXY_INSECURE_TLS" = "1" ]; then
+  EXTRA_DIRECTIVES="${EXTRA_DIRECTIVES}
+		transport http {
+			tls_insecure_skip_verify
+		}"
+fi
+
+cat > "$CADDYFILE" <<EOF
+{
+	admin off
+	auto_https off
+}
+
+:${LISTEN_PORT} {
+	reverse_proxy ${TARGET_URL} {${EXTRA_DIRECTIVES}
+	}
+}
+EOF
+
+echo "Proxying :${LISTEN_PORT} -> ${TARGET_URL}"
+if [ "$PROXY_INSECURE_TLS" = "1" ]; then
+  echo "TLS verification disabled for upstream"
+fi
+
+exec caddy run --config "$CADDYFILE" --adapter caddyfile