mirror of
https://github.com/dalbodeule/hop-gate.git
synced 2026-09-21 08:11:06 +09:00
dalbodeule
fe1018469d
- replace gRPC/DTLS tunnel paths with TLS + yamux transport - remove legacy protocol, protobuf, DTLS, and proxy implementations - simplify server and client entrypoints around yamux - update configuration, metrics, API, and architecture documentation - add bidirectional yamux session tests - verify with go test ./...
32 lines
1.2 KiB
Markdown
32 lines
1.2 KiB
Markdown
# HopGate Architecture
|
|
|
|
HopGate exposes public HTTP traffic and forwards it to a private HTTP service
|
|
through an outbound client connection.
|
|
|
|
```text
|
|
public HTTP/HTTPS :80/:443
|
|
|
|
|
v
|
|
HopGate server -- TLS/TCP :7443 -- yamux -- HopGate client -- localhost HTTP
|
|
```
|
|
|
|
The client opens one TLS connection to the server and authenticates with a
|
|
yamux control stream containing the registered domain and API key. Each HTTP
|
|
request uses one bidirectional yamux stream. The stream begins with a bounded
|
|
JSON metadata record and then carries the HTTP/1.1 wire representation.
|
|
|
|
The public Go HTTP server handles HTTP/1.1 and HTTP/2. HTTP/3 and WebSocket
|
|
upgrade support are planned ingress features; they can reuse the same yamux
|
|
stream abstraction.
|
|
|
|
## Packages
|
|
|
|
- `internal/tunnel`: TLS dialing, yamux sessions, stream metadata, and responses.
|
|
- `cmd/server`: public HTTP/HTTPS ingress and yamux tunnel listener.
|
|
- `cmd/client`: outbound yamux client and local HTTP forwarding.
|
|
- `internal/admin`: domain registration and API-key validation.
|
|
- `internal/acme`: certificate acquisition and renewal.
|
|
|
|
The tunnel is intentionally stream-oriented. It does not implement application
|
|
ACKs or retransmission; TCP and yamux provide ordered reliable delivery.
|