nx_http_proxy.nx
buildroot/runtime/nx_http_proxy.nx
about
nx_http_proxy.nx -- HTTP upstream forwarding (replaces nginx proxy_pass).
module: nishi-core.net.http_proxy
depends: nishi-core.perception.profile + nishi-core.io.syscalls
disk_kb: 6
capability: NET
wired_status: PARTIAL_WIRED
MISSING_CAPABILITIES:
- REQUEST_BUFFER_FORWARDING (read request body from client conn, send
to upstream; bounded by payload_size_limit_bytes from nx_deploy
manifest)
- RESPONSE_STREAM_BACK (streaming forward: upstream chunk -> client;
no full-buffering required for typical HTTP responses)
- WS_BIDI_PUMP (WebSocket frames bidirectional; upgrade detection +
transparent pump; required for /video room WS chat)
- HEADER_REWRITE (X-Forwarded-For / X-Real-IP / X-Forwarded-Proto /
Host preservation per nginx-compatible rules)
- UPSTREAM_KEEPALIVE_POOL (reuse upstream TCP connections for HTTP/1.1
keepalive; avoids per-request connect overhead)
- PAYLOAD_SIZE_ENFORCE (reject at proxy layer with 413 when request
body exceeds declared limit; replaces nginx client_max_body_size)
- PROXY_TIMEOUT (configurable connect / send / read timeouts per
nginx proxy_connect_timeout / proxy_send_timeout / proxy_read_timeout)
license_tier: PUBLIC_NISHI_SUBSTRATE
genealogy_id: feedback-no-temporary-third-party-scaffolding-when-substrate-arc-exists_2026 +
feedback-bits-up-exceed-never-match +
nx_http_server (FULLY_WIRED per status doc) +
nx_tls13_server (shipped per nx_tls13_loopback_test KAT) +
nx_socket (FULLY_WIRED) +
rfc_7230_http_1_1 (math + spec; not adoption)
SCAFFOLDING_REPLACED_BY: this primitive IS the Nishi-native replacement
for nginx's proxy_pass / proxy_http_version / proxy_set_header chain.
When wired + composed with nx_http_server, the nginx /video/ location
block becomes a single nx_http_proxy_route_register call. At that
point the /etc/nginx/sites-enabled/server.NishiServices.conf /video/
block can be REMOVED entirely.
dependencies 3 imports · 4 importers
imports: nx_syscalls.nxnx_connect.nxnx_perceptual_profile.nx
imported by: nx_backend_probe.nxnx_http_proxy_probe.nxnx_http_proxy_test.nxnx_sites_daemon.nx
structs
| 141 | struct NxProxyRoute |
consts
| 64 | const NX_MAGIC_8282: i64 = 8282 |
| 65 | const NX_MAGIC_65536: i64 = 65536 |
| 72 | const NX_PROXY_MODE_HTTP_1_1: i64 = 1 // request/response, keepalive ok |
| 73 | const NX_PROXY_MODE_HTTP_1_1_WS: i64 = 2 // WebSocket upgrade |
| 74 | const NX_PROXY_MODE_HTTP_2: i64 = 3 // multiplexed; queued |
| 75 | const NX_PROXY_MODE_HTTP_3_QUIC: i64 = 4 // QUIC; queued behind nx_quic arc |
| 76 | const NX_PROXY_MODE_RAW_TCP_TUNNEL: i64 = 5 // for CONNECT method |
| 77 | const NX_PROXY_MODE_SSE: i64 = 6 // text/event-stream long-poll |
| 91 | const NX_PROXY_OK: i64 = 0 |
| 92 | const NX_PROXY_FAIL_UPSTREAM_CONNECT: i64 = 1 |
| 93 | const NX_PROXY_FAIL_UPSTREAM_TIMEOUT: i64 = 2 |
| 94 | const NX_PROXY_FAIL_UPSTREAM_RESET: i64 = 3 |
| 95 | const NX_PROXY_FAIL_PAYLOAD_TOO_LARGE_413: i64 = 4 // enforced at proxy |
| 96 | const NX_PROXY_FAIL_BAD_GATEWAY_502: i64 = 5 // upstream malformed |
| 97 | const NX_PROXY_FAIL_GATEWAY_TIMEOUT_504: i64 = 6 |
| 98 | const NX_PROXY_FAIL_CLIENT_DISCONNECTED: i64 = 7 // not an error; |
| 100 | const NX_PROXY_FAIL_DEPENDENCY_MISSING: i64 = 8 // PARTIAL_WIRED |
| 120 | const NX_PROXY_HDR_PRESERVE_HOST: i64 = 1 // Host: header passed through |
| 121 | const NX_PROXY_HDR_REWRITE_HOST: i64 = 2 // Host: replaced with |
| 123 | const NX_PROXY_HDR_ADD_FORWARDED: i64 = 3 // RFC 7239 Forwarded header |
| 124 | const NX_PROXY_HDR_ADD_LEGACY_XFF: i64 = 4 // X-Forwarded-For + X-Real-IP |
| 126 | const NX_PROXY_HDR_HIDE_BACKEND: i64 = 5 // strip Server: / X-Powered-By: |
functions
| 79 | func nx_proxy_mode_name(m: i64) -> *u8 |
| 102 | func nx_proxy_verdict_name(v: i64) -> *u8 |
| 128 | func nx_proxy_hdr_policy_name(p: i64) -> *u8 |
| 162 | func nx_http_proxy_route_register(route_ptr: *NxProxyRoute) -> i64 |
| 170 | func nx_http_proxy_dispatch(client_fd: i64, |
| 183 | func nx_http_proxy_pump_ws(client_fd: i64, upstream_fd: i64, |
| 193 | func nx_http_proxy_count_routes() -> i64 |
| 199 | func nx_http_proxy_get_last_verdict() -> i64 |
| 210 | func nxp_sockaddr(addr: *u8, port: i64, a: i64, b: i64, c: i64, d: i64) -> i64 called by 1: nx_http_proxy_forward |
| 221 | func nxp_parse_ip(s: *u8, slen: i64, out4: *i64) -> i64 |
| 237 | func nx_http_proxy_rewrite(req: *u8, reqn: i64, prefix: *u8, prefixlen: i64, out: *u8) -> i64 |
| 263 | func nx_http_proxy_forward(host: *u8, hostlen: i64, port: i64, req: *u8, reqn: i64, out: *u8, out_cap: i64) -> i64 called by 2: probenx_http_proxy_relay calls 8: sys_mmapnxp_parse_ipsys_socketnxp_sockaddrnx_connect_boundedsys_close+2 |
| 286 | func nx_http_proxy_relay(host: *u8, hostlen: i64, port: i64, prefix: *u8, prefixlen: i64, req: *u8, reqn: i64, out: *u8, out_cap: i64) -> i64 |