Skip to content

External HTTP and HTTPS access - #7

Open
markrwilliams wants to merge 2 commits into
fzakaria:mainfrom
markrwilliams:markrwilliams/http-https
Open

markrwilliams wants to merge 2 commits into
fzakaria:mainfrom
markrwilliams:markrwilliams/http-https

Conversation

@markrwilliams

Copy link
Copy Markdown

This PR allows commands running in a booted qemu VM to connect to external web sites through an HTTP/HTTPS proxy system, half of which runs alongside the VM in the browser, and the other half which runs on the host. Running half of the proxy system on the host gets around the browser's limitations on which sites the VM can connect to.

The VM connects to the half that runs in the web browser, called trynixnet. trynixnet is itself a SOCKS5 client of the half that runs on the host, called trynixsproxy, sending the SOCKS5 protocol over a WebSocket to trynixsproxy which then connects to the target website. trynixsproxy only accepts WebSocket clients whose origin is either trynix.dev or one passed on the command line (like http://localhost:8137).

A worked example:

  1. You've booted a VM with curl in it and run curl https://example.com;
  2. The VM has the https_proxy environment variable http://192.168.2.3:8080 (remember that such a proxy supports HTTPS through the CONNECT request method, so it's ok to host the proxy as a plaintext site); curl doesn't connect to example.com, but instead connects to 192.168.2.3:8080 and sends a request with CONNECT example.com:443
  3. trynix runs alongside the VM and hosts an HTTPS proxy on 192.168.2.3:8080; it sees the CONNECT example.com:443 and translates it to a SOCKS5 operation that means "resolve example.com" and another that says "connect to that IP on port 443"
  4. trynix initiates a WebSocket connection to 127.0.0.1:1080
  5. trynixsproxy accepts the connection because its Origin is localhost:8137 and pulls the SOCKS5 messages out and performs the operations (resolving example.com and connecting to it at 443)
  6. The request flows over the tunnel with responses going back, getting translated from HTTP, to SOCKS5, and then back to HTTP.

Run a Go/Wasm gVisor Ethernet endpoint at 192.168.2.3:8080, assign unique guest addresses without a default route, and tunnel HTTP and HTTPS CONNECT through the local SOCKS5 service. Package both programs with Nix and exercise the full path in Chromium and QEMU.
Include the NIC in the shared machine layout, assign guest addresses after resume, refresh wall time, and install the system CA bundle for HTTPS verification.

Restrict WebSocket origins to trynix.dev or an explicit local development origin and log proxy connections with slog. Extend Chromium coverage for snapshot resume, CA validation, and disabled networking.

The replacement snapshot has been generated and tested locally; release publication and pin updates remain deferred.
@markrwilliams
markrwilliams force-pushed the markrwilliams/http-https branch from 467f866 to d8fd0df Compare September 13, 2026 06:30

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant