pomerium / pomerium / 24369764509
52%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 691
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 45.451% (-0.01%) from 45.463%
24369764509

push

github

web-flow 
feat: add unix socket support for target resources (#6259)

## Summary

Add support for unix:// and unix+https:// URL schemes to route to Unix
domain sockets as upstream destinations.

## Related issues

- #6246

## User Explanation

Pomerium currently only supports TCP/UDP host-based upstreams. Many
services (Docker, PostgreSQL, Redis, Nginx, etc.) expose Unix domain
sockets as an alternative to network ports.

Benefits:

1. Direct socket access - Route to Unix sockets like
unix:///var/run/docker.sock without needing a network port, reducing
attack surface and latency.
2. TLS support - The unix+https:// scheme enables TLS-encrypted
connections to Unix socket services that support HTTPS over Unix sockets
(e.g., nginx with proxy_protocol).
3. Protocol auto-detection - unix:// uses HTTP/1.1, while unix+https://
leverages existing ALPN-based protocol detection (HTTP/1.1 or HTTP/2).
4. Security - Unix sockets can use filesystem permissions for access
control instead of network-level restrictions.
5. Consistent with existing patterns - Follows the same scheme mixing
rules as TCP/UDP upstreams.

Example use case:
```
routes:
  - from: https://secure.internal.example.com
    to: unix+https:///run/nginx-tls.sock
```

## Checklist

- [x] reference any related issues
- [x] updated unit tests
- [ ] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [x] ready for review

25 of 40 new or added lines in 6 files covered. (62.5%)

33 existing lines in 13 files now uncovered.

35134 of 77301 relevant lines covered (45.45%)

114.08 hits per line

Uncovered Changes

Lines Coverage ∆ File
9
81.57
 -2.98% config/envoyconfig/envoyconfig.go
4
71.06
 -0.53% config/envoyconfig/clusters.go
2
82.61
 -0.13% config/policy.go

Coverage Regressions

Lines Coverage ∆ File
8
91.72
 -1.79% pkg/ssh/policy_index_inmemory.go
4
74.26
 -1.18% internal/databroker/config_source.go
4
90.91
 0.0% pkg/fanout/receive.go
3
90.69
 -1.47% config/config_source.go
2
71.06
 -0.53% config/envoyconfig/clusters.go
2
69.83
 -0.3% internal/databroker/server_backend.go
2
92.78
 -1.11% internal/fileutil/watcher.go
2
89.19
 -5.41% pkg/fanout/fanout.go
2
88.52
 0.0% pkg/storage/postgres/postgres.go
1
57.49
 -0.25% internal/controlplane/server.go
1
80.13
 -0.21% pkg/ssh/manager.go
1
78.36
 2.37% pkg/storage/postgres/backend.go
1
75.41
 0.0% pkg/storage/postgres/registry.go
Jobs
ID Job ID Ran Files Coverage
1 24369764509.1 691
45.45
 GitHub Action Run
Source Files on build 24369764509