iroh-axum, iroh-http-proxy and serving web pages from an Iroh endpoint

[dpc]

This might be a better spin on #3236 .

If you're building your app with Iroh support, it would make sense to just expose things like web interface (e.g. web interface) via Iroh as well, to get connectivity even behind firewalls etc.

I'm thinking:

Make a iroh-axum crate that basically implements https://docs.rs/axum/latest/axum/serve/trait.Listener.html for iroh's Endpoint. That would allow accepting Iroh connections/streams as http connections in Axum and handle them just like normal http traffic.

Make an iroh-http-prox, that converts http requests to https://<node-id>.proxy-domain/ into iroh requests to <node-id>. DNS can use wildcard records to map all sub-domains to go the the proxy instance.

Such a proxy would get access to the transmitted data, but anyone should be able to host/run their own quite easily if so they desire.

[flub]

Are you aware of https://github.com/n0-computer/iroh-experiments/tree/main/h3-iroh which allows you to run http3 over iroh? It comes with an example running an axum server.

The iroh-http-proxy would indeed be a cool interface to add. It should have a local mode where you can run it at https://<node-id>.iroh-proxy.localhost easily. Though I can see that needing a petname or some DNS integration rather quickly.

[flub]

The axum::serve::Listener trait is indeed another interesting integration point, I wasn't aware of that. Though doing the server on the hyper level means you can use more server-side frameworks.

[dpc]

Are you aware of https://github.com/n0-computer/iroh-experiments/tree/main/h3-iroh which allows you to run http3 over iroh?

No, I was not. I see that it does it the other way around - creates axum router without starting it in a server, then calls into it with requests. Cool, that works too and I can't think of any downsides OTOH.

It should have a local mode where you can run it at https://.iroh-proxy.localhost easily

I was thinking that it should be possible to just pass --single-node-id <node-id>, so that the <node-id> in the URL and DNS names altogether wouldn't be necessary. I imagine a lot of people would want to use it for a single endpoint anyway.

Alternatively, one can play tricks with sneaking endpoint selection inside cookies, magic paths, query parameters. So e.g. pointing a browser tab at http://localhost:2345 the proxy would read the http headers, notice that there is no "active endpoint" header, display a UI with some instructions and way to set it, which would set the cookie. On subsequent request, the cookie would be removed before forwarding.