Using Iroh to create a peer to peer reverse proxy (web server reachable by public key)

51 points SuspiciousSegfault 8 comments

iroh is an amazing project. I could talk for a long time
about what you could do with it, like use it as an axum-shim to run servers from anywhere,
connectable from anywhere, with low buy-in.

I've been wanting to use iroh for something for quite a while.
First I wrote a bad syncthing clone, but coming back to: "Build things that you want to use yourself."
I instead made a simple reverse proxy p2proxy,
which is a take on the above idea but less intrusive, requiring less adoption for it to work.

Simply, iroh uses UDP hole punching that lets you establish a quic-connection without messing with your router
or knowing/having a static IP, you only need a cryptographic key-pair.
On my raspberry pi I have a web server running on port 8080,
I can use p2proxyd, a reverse proxy that you can connect to using iroh by public key,
that will proxy all traffic for the quic-connection to the webserver over TCP at 8080, and back.

Since I can't make an iroh-browser that can natively connect directly by public key I resorted to a hack where on the client side I created a cli that starts a TCP socket on localhost
and pushes traffic from that TCP socket onto its end of the quic-connection.
Voilà! I can surf into my raspberry Pi's webserver on localhost from anywhere, with encrypted traffic,
without having a domain, cert, or messing with my router.
I created an Android app using flutter_rust_bridge that does the same as the cli
and an iced desktop application (because I wanted to do something with iced).

TLDR:
I created an iroh proxy daemon which can proxy quic-connections made through iroh through some TCP-server, and a client "launcher" which can make quic-connections and proxy those onto a local TCP-socket, allowing you to "surf to" a server by public key.

Feedback is appreciated, if you want to try it out on my server, try connecting to my raspberry pi's public key:
f97b4c8a80c2aa84380f44e69f193b41360c0bb6ff81861f9ed154f186e9f137 using any of the clients (or your own). Hack it for an Easter egg. If it's down, somebody hacked it too hard.