344 lines
9 KiB
Markdown
344 lines
9 KiB
Markdown
# v6proxy Host - IPv6 Gateway
|
|
|
|
IPv6 gateway proxy hosted on Hetzner VPS, forwarding all IPv6 traffic to the main IPv4 proxy.
|
|
|
|
## Overview
|
|
|
|
- **Hostname**: v6proxy
|
|
- **IPv4 Address**: 178.104.18.93/32
|
|
- **IPv6 Address**: 2a01:4f8:1c19:96f8::1/64
|
|
- **Type**: Hetzner VPS (Full VM)
|
|
- **Services**: HAProxy (IPv6 to IPv4 forwarding)
|
|
- **Role**: IPv6 gateway for StuRa HTW Dresden infrastructure
|
|
|
|
## Architecture
|
|
|
|
The v6proxy serves as an IPv6 gateway because the main infrastructure at 141.56.51.0/24 is IPv4-only:
|
|
|
|
- All IPv6 DNS records (AAAA) point to this host (2a01:4f8:1c19:96f8::1)
|
|
- HAProxy forwards all IPv6 HTTP/HTTPS traffic to the main proxy at 141.56.51.1
|
|
- The main proxy then handles routing to backend services
|
|
- Simple pass-through configuration - no SNI inspection or routing logic
|
|
|
|
## Why This Host Exists
|
|
|
|
The HTW Dresden network (141.56.51.0/24) does not have native IPv6 connectivity. This Hetzner VPS provides:
|
|
|
|
1. **IPv6 connectivity**: Public IPv6 address for all services
|
|
2. **Transparent forwarding**: All traffic is forwarded to the IPv4 proxy
|
|
3. **No maintenance overhead**: Simple configuration, no routing logic
|
|
|
|
This allows all StuRa services to be accessible via IPv6 without requiring IPv6 support in the HTW network.
|
|
|
|
## Services
|
|
|
|
### HAProxy
|
|
|
|
HAProxy runs in simple TCP forwarding mode:
|
|
|
|
**HTTP (Port 80)**
|
|
- Binds to IPv6 `:::80`
|
|
- Forwards all traffic to `141.56.51.1:80`
|
|
- No HTTP inspection or routing
|
|
|
|
**HTTPS (Port 443)**
|
|
- Binds to IPv6 `:::443`
|
|
- Forwards all traffic to `141.56.51.1:443`
|
|
- No SNI inspection or TLS termination
|
|
|
|
**Key features:**
|
|
- Logging: All connections logged to systemd journal
|
|
- Stats page: Available at http://127.0.0.1:8404/stats (localhost only)
|
|
- Max connections: 50,000
|
|
- Buffer size: 32,762 bytes
|
|
- Timeouts: 5s connect, 30s client/server
|
|
|
|
### Configuration Philosophy
|
|
|
|
Unlike the main proxy at 141.56.51.1, this proxy is **intentionally simple**:
|
|
- No SNI inspection
|
|
- No HTTP host header routing
|
|
- No ACME challenge handling
|
|
- Just pure TCP forwarding
|
|
|
|
All routing logic happens at the main IPv4 proxy. This keeps the v6proxy configuration minimal and reduces maintenance burden.
|
|
|
|
## Deployment Type
|
|
|
|
The v6proxy is a **Hetzner VPS** (full VM):
|
|
- Hosted outside HTW network
|
|
- Uses Hetzner-specific disk layout (hetzner-disk.nix)
|
|
- Network interface: `eth0`
|
|
- Both IPv4 and IPv6 connectivity
|
|
|
|
## Network Configuration
|
|
|
|
### IPv4
|
|
- **Address**: 178.104.18.93/32
|
|
- **Gateway**: 172.31.1.1
|
|
- **Interface**: eth0
|
|
|
|
### IPv6
|
|
- **Address**: 2a01:4f8:1c19:96f8::1/64
|
|
- **Gateway**: fe80::1 (link-local)
|
|
- **Route**: Default route via fe80::1
|
|
- **Interface**: eth0
|
|
|
|
### DNS
|
|
- **Nameservers**: 9.9.9.9, 1.1.1.1 (Quad9 and Cloudflare)
|
|
- Uses public DNS servers (not HTW internal DNS)
|
|
|
|
### Firewall
|
|
- **Firewall**: nftables enabled
|
|
- **Open ports**: 22, 80, 443
|
|
|
|
## DNS Configuration
|
|
|
|
For IPv6 support, configure AAAA records pointing to this host:
|
|
|
|
```
|
|
proxy.htw.stura-dresden.de AAAA 2a01:4f8:1c19:96f8::1
|
|
*.htw.stura-dresden.de CNAME proxy.htw.stura-dresden.de
|
|
```
|
|
|
|
This provides IPv6 access to all services while IPv4 traffic continues to use the main proxy (141.56.51.1).
|
|
|
|
## Deployment
|
|
|
|
See the [main README](../../README.md) for deployment methods.
|
|
|
|
### Initial Installation
|
|
|
|
**Using nixos-anywhere (recommended):**
|
|
```bash
|
|
nix run github:nix-community/nixos-anywhere -- --flake .#v6proxy --target-host root@178.104.18.93
|
|
```
|
|
|
|
This handles disk partitioning via disko automatically.
|
|
|
|
### Updates
|
|
|
|
```bash
|
|
# From local machine
|
|
nixos-rebuild switch --flake .#v6proxy --target-host root@178.104.18.93
|
|
|
|
# Or use auto-generated script
|
|
nix run .#v6proxy-update
|
|
```
|
|
|
|
## Disko Configuration
|
|
|
|
The v6proxy uses the Hetzner-specific disk layout (hetzner-disk.nix):
|
|
- **Filesystem**: Btrfs or Ext4 (Hetzner default)
|
|
- Declarative disk management via disko
|
|
- Automatic partitioning on installation
|
|
|
|
## Traffic Flow
|
|
|
|
IPv6 request flow:
|
|
|
|
1. Client connects to `2a01:4f8:1c19:96f8::1` (v6proxy)
|
|
2. v6proxy forwards to `141.56.51.1:443` (main IPv4 proxy)
|
|
3. Main proxy performs SNI inspection and routes to backend
|
|
4. Backend responds through the chain
|
|
|
|
For the client, the IPv6 connectivity is transparent - they don't know the backend infrastructure is IPv4-only.
|
|
|
|
## HAProxy Configuration
|
|
|
|
The HAProxy configuration is minimal:
|
|
|
|
```haproxy
|
|
frontend http-in
|
|
bind :::80
|
|
use_backend http_80
|
|
|
|
frontend sni_router
|
|
bind :::443
|
|
mode tcp
|
|
use_backend http_443
|
|
|
|
backend http_80
|
|
mode http
|
|
server proxy 141.56.51.1:80
|
|
|
|
backend http_443
|
|
mode tcp
|
|
server proxy 141.56.51.1:443
|
|
```
|
|
|
|
This is intentionally simple - all routing intelligence is at 141.56.51.1.
|
|
|
|
## HAProxy Stats
|
|
|
|
Access HAProxy statistics page (localhost only):
|
|
|
|
```bash
|
|
# SSH into v6proxy
|
|
ssh root@178.104.18.93
|
|
|
|
# Access stats via curl
|
|
curl http://127.0.0.1:8404/stats
|
|
|
|
# Or forward port to your local machine
|
|
ssh -L 8404:127.0.0.1:8404 root@178.104.18.93
|
|
# Then browse to http://localhost:8404/stats
|
|
```
|
|
|
|
The stats page shows:
|
|
- Current connections to main proxy backend
|
|
- Traffic statistics
|
|
- Connection status
|
|
|
|
## Monitoring
|
|
|
|
### Check HAProxy Status
|
|
|
|
```bash
|
|
# HAProxy service status
|
|
systemctl status haproxy
|
|
|
|
# View HAProxy logs
|
|
journalctl -u haproxy -f
|
|
|
|
# Check configuration
|
|
haproxy -c -f /etc/haproxy/haproxy.cfg
|
|
```
|
|
|
|
### Test Connectivity
|
|
|
|
```bash
|
|
# Test IPv6 HTTP forwarding
|
|
curl -6 -v http://[2a01:4f8:1c19:96f8::1]/
|
|
|
|
# Test IPv6 HTTPS forwarding
|
|
curl -6 -vk https://[2a01:4f8:1c19:96f8::1]/
|
|
|
|
# Test backend connectivity (IPv4 to main proxy)
|
|
curl -v http://141.56.51.1/
|
|
curl -vk https://141.56.51.1/
|
|
|
|
# Check IPv6 routing
|
|
ip -6 route show
|
|
ping6 2a01:4f8:1c19:96f8::1
|
|
```
|
|
|
|
## Troubleshooting
|
|
|
|
### HAProxy not starting
|
|
|
|
```bash
|
|
# Check HAProxy status
|
|
systemctl status haproxy
|
|
|
|
# Check configuration syntax
|
|
haproxy -c -f /etc/haproxy/haproxy.cfg
|
|
|
|
# View HAProxy logs
|
|
journalctl -u haproxy -f
|
|
```
|
|
|
|
### IPv6 connectivity issues
|
|
|
|
```bash
|
|
# Verify IPv6 address is configured
|
|
ip -6 addr show eth0
|
|
|
|
# Check IPv6 routing
|
|
ip -6 route show
|
|
|
|
# Test IPv6 connectivity
|
|
ping6 2606:4700:4700::1111 # Cloudflare DNS
|
|
|
|
# Check IPv6 firewall rules
|
|
nft list ruleset | grep ip6
|
|
```
|
|
|
|
### Backend (main proxy) unreachable
|
|
|
|
```bash
|
|
# Test IPv4 connectivity to main proxy
|
|
ping 141.56.51.1
|
|
curl -v http://141.56.51.1/
|
|
curl -vk https://141.56.51.1/
|
|
|
|
# Check HAProxy backend status
|
|
curl http://127.0.0.1:8404/stats | grep proxy
|
|
|
|
# View connection errors
|
|
journalctl -u haproxy | grep -i error
|
|
```
|
|
|
|
### DNS not resolving
|
|
|
|
```bash
|
|
# Check nameserver configuration
|
|
cat /etc/resolv.conf
|
|
|
|
# Test DNS resolution
|
|
dig git.adm.htw.stura-dresden.de A
|
|
dig git.adm.htw.stura-dresden.de AAAA
|
|
|
|
# Test with specific nameserver
|
|
dig @9.9.9.9 git.adm.htw.stura-dresden.de
|
|
```
|
|
|
|
## Security Considerations
|
|
|
|
- **No TLS termination**: Traffic is passed through encrypted to main proxy
|
|
- **No deep packet inspection**: Simple TCP forwarding only
|
|
- **Minimal attack surface**: No routing logic or service-specific configuration
|
|
- **Public IPv6 address**: Exposed to the internet, firewall must be properly configured
|
|
|
|
## Performance Considerations
|
|
|
|
- **Additional hop**: IPv6 traffic goes through an extra proxy hop
|
|
- **Latency**: Hetzner → HTW network adds some latency
|
|
- **Bandwidth**: Hetzner provides high bandwidth, unlikely to be a bottleneck
|
|
- **Connection limits**: HAProxy configured for 50,000 concurrent connections
|
|
|
|
For most use cases, the additional latency is negligible (typically <10ms within Germany).
|
|
|
|
## Cost and Hosting
|
|
|
|
- **Provider**: Hetzner Cloud
|
|
- **Type**: VPS (Virtual Private Server)
|
|
- **Location**: Germany (likely Falkenstein or Helsinki datacenter)
|
|
- **Cost**: Minimal - basic VPS tier sufficient for forwarding traffic
|
|
|
|
## Future Improvements
|
|
|
|
Possible improvements (not currently needed):
|
|
|
|
1. **Native IPv6 at HTW**: If HTW network gains IPv6, this proxy can be decommissioned
|
|
2. **GeoDNS**: Use GeoDNS to route IPv4 and IPv6 separately
|
|
3. **Monitoring**: Add automated monitoring and alerting
|
|
4. **Failover**: Add a second IPv6 proxy for redundancy
|
|
|
|
## Files and Directories
|
|
|
|
- **HAProxy config**: `/etc/haproxy/haproxy.cfg` (generated by Nix)
|
|
- **Disk config**: `./hetzner-disk.nix` (disko configuration)
|
|
- **Hardware config**: `./hardware-configuration.nix` (Hetzner VPS hardware)
|
|
- **NixOS config**: `./default.nix` (v6proxy configuration)
|
|
|
|
## Relationship to Main Proxy
|
|
|
|
| Feature | v6proxy (IPv6 Gateway) | proxy (Main Proxy) |
|
|
|---------|------------------------|-------------------|
|
|
| IP Version | IPv4 + IPv6 | IPv4 only |
|
|
| Location | Hetzner Cloud | HTW network (141.56.51.0/24) |
|
|
| Function | Simple forwarding | SNI routing, service routing |
|
|
| Complexity | Minimal | Complex routing logic |
|
|
| HAProxy Mode | TCP forwarding | TCP + HTTP with SNI inspection |
|
|
| TLS Handling | Pass-through | Pass-through (SNI inspection) |
|
|
| ACME Handling | None | Forwards challenges to backends |
|
|
|
|
The v6proxy is intentionally minimal - all intelligence lives at the main proxy.
|
|
|
|
## See Also
|
|
|
|
- [Main README](../../README.md) - Deployment methods and architecture
|
|
- [Proxy README](../proxy/README.md) - Main IPv4 proxy configuration
|
|
- [HAProxy Documentation](http://www.haproxy.org/#docs)
|
|
- [Hetzner Cloud Docs](https://docs.hetzner.com/cloud/)
|