p2ns/proxy-server

P2NS P2P Proxy

Overview

P2NS P2P Proxy is a Node.js-based application designed to bridge peer-to-peer (P2P) domains to the public internet. It leverages a decentralized P2P network to resolve domain names to content hashes and proxies HTTP and WebSocket requests to the appropriate peer-hosted services using the Holesail protocol. The system integrates with Hyperswarm for peer discovery, Corestore for data storage, and Autopass for secure key management, providing a robust solution for accessing P2P-hosted content via standard web protocols.

Features

• P2P Domain Resolution: Resolves domain names to content hashes using a decentralized voting mechanism.
• HTTP and WebSocket Proxying: Proxies HTTP and WebSocket requests to P2P-hosted services.
• Holesail Integration: Utilizes the Holesail system to establish secure P2P connections.
• Hyperswarm Networking: Uses Hyperswarm for peer discovery and connection management.
• Corestore Storage: Manages persistent storage for P2P data.
• Autopass Authentication: Handles secure key exchange for joining the P2P network.
• Dynamic Port Allocation: Automatically assigns available ports for Holesail clients.
• TLS and HTTP Redirects: Supports TLS proxies and HTTP-to-HTTPS redirects (optional).
• Graceful Shutdown: Ensures clean resource cleanup on termination.

Prerequisites

• Node.js: Version 14 or higher.
• npm: For installing dependencies.
• Dependencies:
  • express: Web framework for handling HTTP requests.
  • http-proxy: For proxying HTTP and WebSocket requests.
  • holesail: P2P connection protocol.
  • corestore: Decentralized data storage.
  • hyperswarm: P2P networking and peer discovery.
  • autopass: Secure key management.
  • protomux: Multiplexing for P2P connections.
  • compact-encoding: Efficient data encoding.
• Environment Variables (optional):
  • PROXY_PORT: Port for the proxy server (default: 5577).
  • PROXY_HOST: Host to bind the proxy server to (default: 0.0.0.0).
  • DEBUG: Set to true for verbose logging (default: false).
  • TOPIC_SEED: Seed for generating the Hyperswarm topic (default: p2ns-dns).
  • STORAGE_DIR: Directory for Corestore data (default: ./my-proxy-storage).
  • HTTP_PORT: Port for HTTP redirect server (default: 80).
  • HOLESAIL_TIMEOUT: Timeout for non-persistent Holesail clients in minutes (default: 720 minutes = 12 hours).
  • FULL_PERSISTENCE: Set to true to keep Holesail clients persistent (default: false).
  • MAX_HOLESAIL_CLIENTS: Maximum number of concurrent Holesail clients (default: 100).
  • DISABLE_PROXY_SERVER: Set to true to disable TLS proxy and HTTP redirect servers (default: false).
  • CACHE_TTL: Cache TTL for domain resolution in seconds (default: 60 seconds).
  • AUTO_VOTE_DEBOUNCE: Debounce interval for auto-voting in seconds (default: 60 seconds).
  • RATE_LIMIT_WINDOW: Rate limit window in seconds (default: 60 seconds).
  • RATE_LIMIT_MAX_REQUESTS: Maximum requests per window (default: 100).
  • RATE_LIMIT_MAX_PER_DOMAIN: Maximum requests per domain per window (default: 20).
  • REQUEST_TIMEOUT: Request timeout in seconds (default: 30 seconds).

Installation

1. Install dependencies:

   npm install express http-proxy holesail corestore hyperswarm autopass protomux compact-encoding
   

2. Configure environment variables (optional): Create a .env file or set variables directly:

   export DEBUG=true
   export TOPIC_SEED=p2ns-dns
   export STORAGE_DIR=./storage
   export HTTP_PORT=80
   export HOLESAIL_TIMEOUT=300000
   

Usage

1. Start the proxy server:

   node p2ns_proxy_server.js
   

   The server will listen on port 5577 by default and log initialization details.

2. Access P2P domains:

   • Send HTTP requests to http://<server-ip>:5577/<domain> to access P2P-hosted content.
   • WebSocket connections are supported via ws://<server-ip>:5577/<domain>.

3. Shutdown:

   • Press Ctrl+C (SIGINT), or send SIGTERM or SIGQUIT to gracefully shut down the server.
   • The server will close all Holesail clients, TLS servers, HTTP servers, and peer connections.

How It Works

1. P2P Network Setup

• The application joins a Hyperswarm topic derived from a seed (TOPIC_SEED).
• It uses Corestore for persistent storage and Autopass for secure key exchange to join the P2NS network as a non-master node (joiner).
• Peers exchange invite messages to share access to the decentralized DNS store (dnsPass).
• The proxy server operates independently from the main P2NS system but connects to the same P2P network.

2. Domain Resolution

• Domains are resolved to content hashes using a voting mechanism stored in dnsPass.
• The system retrieves claims (claim:<domain>:<claimant>) and votes (vote:<domain>:<claimant>:<voter>) to determine the most-voted hash for a domain.
• Domain resolution is cached for performance (TTL configurable via CACHE_TTL).
• Auto-voting occurs at debounced intervals (configurable via AUTO_VOTE_DEBOUNCE) to maintain consensus.

3. Proxying Requests

• HTTP requests to /:domain/*subpath or /:domain are intercepted by the Express server.
• The domain is resolved to a hash (using cache if available), and a Holesail client is started to connect to the corresponding P2P service.
• The system checks if the domain uses SSL/TLS (stored in the domain's claim record).
• Requests are proxied to the Holesail client's local IP and port using the appropriate protocol:
  • https://127.0.0.1:<port> for SSL/TLS-enabled domains
  • http://127.0.0.1:<port> for standard domains
• WebSocket upgrades are handled similarly, using wss:// for SSL domains and ws:// for standard domains.
• Rate limiting is applied per request and per domain to prevent abuse.

4. Holesail Client Management

• Holesail clients are created dynamically for each domain and run on available local ports.
• Port allocation is automatic and checks for availability before binding.
• Optional TLS proxies and HTTP-to-HTTPS redirect servers are created unless disabled.
• Non-persistent clients are closed after a timeout (HOLESAIL_TIMEOUT).
• Maximum number of concurrent clients is limited (MAX_HOLESAIL_CLIENTS).
• If FULL_PERSISTENCE=true, clients remain active until manually closed or server shutdown.

5. Integration with Main P2NS System

The proxy server is a standalone component that:

• Connects to the same P2NS network as the main system
• Uses the same Hyperswarm topic and Corestore structure
• Resolves domains using the same consensus mechanism
• Can run independently or alongside the main P2NS instance
• Does not require the main P2NS system to be running

Use Cases:

• Expose P2P domains to the public internet via reverse proxy
• Provide access to P2P content without running the full P2NS system
• Scale horizontally by running multiple proxy instances
• Isolate proxy functionality from the main P2NS system

6. Cleanup

• On shutdown, the application closes all Holesail clients, TLS servers, HTTP servers, peer channels, and the Hyperswarm instance.
• Graceful shutdown ensures no resource leaks.

Configuration

Server Configuration

• Port: The proxy server listens on port 5577 by default. Change via PROXY_PORT environment variable.
• Host: The proxy server binds to 0.0.0.0 by default. Change via PROXY_HOST environment variable.

P2NS Network Configuration

• Topic Seed: Hyperswarm topic seed (default: p2ns-dns). Change via TOPIC_SEED.
• Storage Directory: Corestore data directory (default: ./my-proxy-storage). Change via STORAGE_DIR.

Holesail Configuration

• Client Timeout: Non-persistent Holesail clients timeout after 12 hours (720 minutes) by default. Change via HOLESAIL_TIMEOUT (in minutes).
• Full Persistence: Set FULL_PERSISTENCE=true to keep Holesail clients persistent (default: false).
• Max Clients: Maximum number of concurrent Holesail clients (default: 100). Change via MAX_HOLESAIL_CLIENTS.
• HTTP Redirect Port: Port for HTTP-to-HTTPS redirect server (default: 80). Change via HTTP_PORT.

Performance Configuration

• Cache TTL: Domain resolution cache TTL in seconds (default: 60). Change via CACHE_TTL.
• Auto-Vote Debounce: Debounce interval for auto-voting in seconds (default: 60). Change via AUTO_VOTE_DEBOUNCE.

Security Configuration

• Rate Limiting:
  • Window duration: 60 seconds (change via RATE_LIMIT_WINDOW)
  • Max requests per window: 100 (change via RATE_LIMIT_MAX_REQUESTS)
  • Max requests per domain per window: 20 (change via RATE_LIMIT_MAX_PER_DOMAIN)
• Request Timeout: Request timeout in seconds (default: 30). Change via REQUEST_TIMEOUT.

Logging

• Debug Mode: Enable verbose logging by setting DEBUG=true.

Feature Flags

• Disable Proxy Server: Set DISABLE_PROXY_SERVER=true to disable TLS proxies and HTTP redirect servers.

Example Configuration

Create a .env file or set environment variables:

# Server
PROXY_PORT=5577
PROXY_HOST=0.0.0.0

# P2NS Network
TOPIC_SEED=p2ns-dns
STORAGE_DIR=./my-proxy-storage

# Holesail
HOLESAIL_TIMEOUT=720
FULL_PERSISTENCE=false
MAX_HOLESAIL_CLIENTS=100
HTTP_PORT=80

# Performance
CACHE_TTL=60
AUTO_VOTE_DEBOUNCE=60

# Security
RATE_LIMIT_WINDOW=60
RATE_LIMIT_MAX_REQUESTS=100
RATE_LIMIT_MAX_PER_DOMAIN=20
REQUEST_TIMEOUT=30

# Logging
DEBUG=false

# Features
DISABLE_PROXY_SERVER=false

Reverse Proxy Configurations

To expose the P2NS P2P Proxy to the internet or integrate it with an existing web infrastructure, you can use a reverse proxy. Below are example configurations for popular reverse proxy solutions, including NGINX and NGINX Proxy Manager.

NGINX Reverse Proxy Configuration

NGINX can be used to forward HTTP and WebSocket requests to the P2NS P2P Proxy server running on port 5577. Below is an example NGINX configuration.

Steps:

1. Install NGINX on your server (e.g., sudo apt install nginx on Ubuntu).
2. Create or edit an NGINX configuration file (e.g., /etc/nginx/sites-available/p2ns-proxy).
3. Add the following configuration:

server {
    listen 80;
    server_name p2ns.example.com; # Replace with your domain or server IP

    location / {
        proxy_pass http://127.0.0.1:5577;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

4. Enable the configuration by creating a symbolic link:

   sudo ln -s /etc/nginx/sites-available/p2ns-proxy /etc/nginx/sites-enabled/
   

5. Test the NGINX configuration:

   sudo nginx -t
   

6. Reload NGINX to apply changes:

   sudo systemctl reload nginx
   

Notes:

• Replace p2ns.example.com with your actual domain or server IP.
• Ensure port 80 is open in your firewall.
• For HTTPS, obtain an SSL certificate (e.g., using Certbot) and update the configuration to listen on port 443 with SSL settings.

NGINX Proxy Manager Configuration

NGINX Proxy Manager provides a user-friendly web interface to manage reverse proxy configurations. It is ideal for users who prefer a GUI over manual configuration.

Steps:

1. Install NGINX Proxy Manager (e.g., via Docker):

   docker run -d --name nginx-proxy-manager \
     -p 80:80 -p 443:443 -p 81:81 \
     -v npm-data:/data \
     -v npm-letsencrypt:/etc/letsencrypt \
     --restart=unless-stopped \
     jc21/nginx-proxy-manager:latest
   

2. Access the NGINX Proxy Manager web interface at http://<server-ip>:81.
3. Log in with default credentials ([email protected], password: changeme) and update them.
4. Add a new Proxy Host:
   • Domain Names: Enter your domain (e.g., p2ns.example.com).
   • Scheme: Select http.
   • Forward Hostname/IP: Set to 127.0.0.1.
   • Forward Port: Set to 5577.
   • Websockets Support: Enable the WebSocket toggle for P2NS WebSocket proxying.
5. (Optional) Enable SSL:
   • Go to the SSL tab in the Proxy Host settings.
   • Request a new SSL certificate (e.g., via Let’s Encrypt).
   • Enable "Force SSL" and "HTTP/2 Support" if desired.
6. Save the configuration to apply changes.

Notes:

• Ensure Docker is installed and running.
• Open ports 80, 443, and 81 in your firewall.
• NGINX Proxy Manager automatically handles HTTP-to-HTTPS redirects when SSL is enabled.
• The WebSocket toggle is critical for supporting P2NS WebSocket connections.

Apache Reverse Proxy Configuration

Apache can also be used as a reverse proxy for the P2NS P2P Proxy.

Steps:

1. Install Apache (e.g., sudo apt install apache2 on Ubuntu).
2. Enable necessary modules:

   sudo a2enmod proxy proxy_http proxy_wstunnel
   

3. Create or edit a virtual host configuration (e.g., /etc/apache2/sites-available/p2ns-proxy.conf):

   <VirtualHost *:80>
       ServerName p2ns.example.com # Replace with your domain or server IP
   
       ProxyPreserveHost On
       ProxyPass / http://127.0.0.1:5577/
       ProxyPassReverse / http://127.0.0.1:5577/
   
       # WebSocket support
       RewriteEngine On
       RewriteCond %{HTTP:Upgrade} websocket [NC]
       RewriteCond %{HTTP:Connection} upgrade [NC]
       RewriteRule ^/?(.*) ws://127.0.0.1:5577/$1 [P,L]
   </VirtualHost>
   

4. Enable the site:

   sudo a2ensite p2ns-proxy
   

5. Test the configuration:

   sudo apachectl configtest
   

6. Reload Apache:

   sudo systemctl reload apache2
   

Notes:

• Replace p2ns.example.com with your domain or server IP.
• For HTTPS, configure an SSL certificate and update the virtual host to use port 443.
• Ensure the proxy_wstunnel module is enabled for WebSocket support.

Limitations

• Single IP: The proxy assumes 127.0.0.1 for Holesail clients. Multi-IP support will require modifications.
• Non-Master Node: The application operates as a joiner, not a master node, in the P2NS network.
• Port Conflicts: The system checks for port availability but may face issues on heavily loaded systems.
• Reverse Proxy: Ensure the reverse proxy is configured to handle WebSocket connections for full functionality.

Troubleshooting

• Port in Use: Ensure port 5577 (and 80 for HTTP redirects) is free.
• Dependency Errors: Verify all dependencies are installed and compatible with your Node.js version.
• P2P Connection Issues: Check the TOPIC_SEED and ensure peers are available in the Hyperswarm network.
• Reverse Proxy Issues:
  • Verify WebSocket support is enabled in the proxy configuration.
  • Check firewall rules for open ports (80, 443, etc.).
  • Ensure the proxy server can reach 127.0.0.1:5577.
• Logs: Enable DEBUG=true for detailed logs to diagnose issues.

Contributing

Contributions are welcome! Please submit pull requests or issues to the repository. Ensure code follows the existing style and includes tests where applicable.