feat(proxy): preserve original Host header by default #1

Merged

james.oates merged 5 commits from feat/preserve-host-header into main

2026-06-12 16:07:01 +00:00

james.oates commented

2026-06-12 16:03:46 +00:00

Owner

Summary

Changes proxy_http to forward the original client Host header to the backend by default, instead of letting reqwest substitute the backend hostname
Adds a rewrite_host boolean per-service escape hatch (default false) for any backend that needs the old behaviour
Adds migration 006_service_rewrite_host.sql

Motivation

AWS Signature V4 includes Host in the signed headers. When a client signs a request with Host: s3.oates.ws and the proxy forwards it with Host: minio:9000, MinIO rejects it with SignatureDoesNotMatch. The same issue affects cookie domain matching and redirect URL generation.

The existing WebSocket path (proxy_websocket) already preserves the original Host — this brings HTTP into line with the same behaviour, and with nginx's recommended proxy_set_header Host $host practice.

Usage

Default (no change needed for most services):

[[services]]
name = "minio-api"
target_host = "minio"
target_port = 9000
routing_hosts = ["s3.oates.ws"]
routing_paths = ["/*"]

Opt out (rewrite to backend hostname):

[[services]]
name = "some-service"
rewrite_host = true
...

## Summary - Changes `proxy_http` to forward the original client `Host` header to the backend by default, instead of letting reqwest substitute the backend hostname - Adds a `rewrite_host` boolean per-service escape hatch (default `false`) for any backend that needs the old behaviour - Adds migration `006_service_rewrite_host.sql` ## Motivation AWS Signature V4 includes `Host` in the signed headers. When a client signs a request with `Host: s3.oates.ws` and the proxy forwards it with `Host: minio:9000`, MinIO rejects it with `SignatureDoesNotMatch`. The same issue affects cookie domain matching and redirect URL generation. The existing WebSocket path (`proxy_websocket`) already preserves the original Host — this brings HTTP into line with the same behaviour, and with nginx's recommended `proxy_set_header Host $host` practice. ## Usage Default (no change needed for most services): ```toml [[services]] name = "minio-api" target_host = "minio" target_port = 9000 routing_hosts = ["s3.oates.ws"] routing_paths = ["/*"] ``` Opt out (rewrite to backend hostname): ```toml [[services]] name = "some-service" rewrite_host = true ... ```

james.oates added 5 commits

2026-06-12 16:03:46 +00:00

feat(proxy): add rewrite_host migration f7b53a56d1

feat(proxy): add rewrite_host field to Service model 271c7df484

feat(proxy): add rewrite_host to ServiceConfig 24d78e189c

feat(proxy): preserve original Host header by default, add rewrite_host escape hatch 8c39f31e3b

feat(proxy): pass rewrite_host through service seeding

Build and Publish Docker Image (develop) / build-and-push (push) Failing after 5m2s

Details

a66a0961fc

james.oates merged commit a66a0961fc into main

2026-06-12 16:07:01 +00:00