dns proxy

Dockers/dns-proxy/Dockerfile

@@ -0,0 +1,13 @@
+FROM caddy:2-alpine
+
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+ENV LISTEN_PORT=8080 \
+    TARGET_URL="" \
+    PROXY_INSECURE_TLS=0 \
+    PRESERVE_HOST=0
+
+EXPOSE 8080
+
+ENTRYPOINT ["/entrypoint.sh"]

Dockers/dns-proxy/docker-compose.example.yml

@@ -0,0 +1,15 @@
+services:
+  dns-proxy:
+    build: .
+    ports:
+      - "8080:8080"
+    environment:
+      TARGET_URL: "https://internal.example.com"
+      # PROXY_INSECURE_TLS: "1"   # if upstream uses a self-signed cert
+      # PRESERVE_HOST: "1"       # keep the client's Host header instead of the upstream host
+    dns:
+      - 10.0.0.53   # custom DNS required to resolve TARGET_URL
+    # Extra hosts are also an option instead of / alongside custom DNS:
+    # extra_hosts:
+    #   - "internal.example.com:10.0.0.10"
+    restart: unless-stopped

Dockers/dns-proxy/entrypoint.sh

@@ -0,0 +1,59 @@
+#!/bin/sh
+set -eu
+
+TARGET_URL="${TARGET_URL:-}"
+LISTEN_PORT="${LISTEN_PORT:-8080}"
+PROXY_INSECURE_TLS="${PROXY_INSECURE_TLS:-0}"
+PRESERVE_HOST="${PRESERVE_HOST:-0}"
+
+if [ -z "$TARGET_URL" ]; then
+  echo "TARGET_URL is required (e.g. https://internal.example.com)" >&2
+  exit 1
+fi
+
+case "$TARGET_URL" in
+  http://*|https://*) ;;
+  *)
+    echo "TARGET_URL must start with http:// or https://" >&2
+    exit 1
+    ;;
+esac
+
+# Strip trailing slash so paths concatenate cleanly
+TARGET_URL="${TARGET_URL%/}"
+
+CADDYFILE="/etc/caddy/Caddyfile"
+mkdir -p /etc/caddy
+
+EXTRA_DIRECTIVES=""
+
+if [ "$PRESERVE_HOST" = "1" ]; then
+  EXTRA_DIRECTIVES="${EXTRA_DIRECTIVES}
+		header_up Host {http.request.host}"
+fi
+
+if [ "$PROXY_INSECURE_TLS" = "1" ]; then
+  EXTRA_DIRECTIVES="${EXTRA_DIRECTIVES}
+		transport http {
+			tls_insecure_skip_verify
+		}"
+fi
+
+cat > "$CADDYFILE" <<EOF
+{
+	admin off
+	auto_https off
+}
+
+:${LISTEN_PORT} {
+	reverse_proxy ${TARGET_URL} {${EXTRA_DIRECTIVES}
+	}
+}
+EOF
+
+echo "Proxying :${LISTEN_PORT} -> ${TARGET_URL}"
+if [ "$PROXY_INSECURE_TLS" = "1" ]; then
+  echo "TLS verification disabled for upstream"
+fi
+
+exec caddy run --config "$CADDYFILE" --adapter caddyfile