FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Comparing main...origin-setup · profullstack/moshpit-proxy · GitHub

/ moshpit-proxy Public
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: profullstack/moshpit-proxy
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: main
Choose a base ref
Could not load branches
Nothing to show
{{ refName }}
...
head repository: profullstack/moshpit-proxy
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: origin-setup
Choose a head ref
Could not load branches
Nothing to show
{{ refName }}
Checking mergeability… Don’t worry, you can still create the pull request.
  • 1 commit
  • 3 files changed
  • 2 contributors

Commits on Aug 1, 2026

  1. Add the origin side: nginx template and a setup script that proves it… 

    …self

The gateway config in this repo describes the box that routes without
decrypting. Nothing described the box that actually terminates the session,
which is where every live Moshpit name currently goes wrong.

Diagnosed on a real one. `chovy.hacker` is registered with an IPv6 target
pointing at a droplet, and direct-to-origin resolution works — no gateway
involved. But the droplet answers :443 for that name with a Let's Encrypt
certificate for `dev.profullstack.com`, because there is no server block for
`chovy.hacker` and it falls through to the default vhost. Its :80 block then
301s to https://, so a browser is redirected straight into the error. The
registry also has `pins: []`, so no client would accept the name even once
the certificate is right.

That is three separate mistakes and none of them is exotic. Hence a template
and a script rather than prose.

setup-origin.sh generates the key and self-signed certificate, writes the
server block, reloads, and then connects back to 127.0.0.1:443 with the name
as SNI to check what is actually presented. A clean `nginx -t` does not mean
the name reaches the intended block, and the default-vhost fallthrough is
precisely the bug this exists to prevent — so it is verified, not assumed.

Reuses an existing key when one is present, because the pin is over the key:
certificates can be regenerated freely without invalidating what is published.

The template pins TLS 1.3 and asks for X25519MLKEM768, which needs nginx built
against OpenSSL 3.5+. The script reads `nginx -V`, warns, and comments the line
out rather than handing someone a failed reload that takes their live site down
with it.

Verified the pin the script prints is byte-identical to what lib/spki.ts
computes — the value moshpit-proxy and TronBrowser actually check against.
Shell syntax checked, dry-run exercised. 35 tests pass, tsc clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
    ralyodio and claude committed Aug 1, 2026
    Configuration menu
    Copy the full SHA
    210dc4e View commit details
    Browse the repository at this point in the history
Loading
Back | FazBrowse Home | New Git URL