fabio

Sniffing the SNI from the underlying TCP connection is the proper way to do this. a couple examples I know of(only know go ones of the top of my head): https://github.com/fabiolb/fabio/blob/master/proxy/tcp/tls_c... https://github.com/FiloSottile/mostly-harmless/blob/main/tal... > I don't like doing that but the only other way is to "roll my own crypto" which I understand is a bad thing. You would not be rolling your own cryptographic primitive, or combining existing ones in strange and speculative ways. This is what most people, most of the time mean when they admonish against rolling your own crypto. All you'd have to do is parse the ClientHello to retrieve the SNI. you're in a memory safe language, so parsing bugs result in a crash, not a buffer overflow. I'd say you're on pretty firm ground.

You should check fabio ( https://github.com/fabiolb/fabio ), it is really awesome ). I 100% agree with you, I've been using Consul for four years now to run 100s of services in 1000s of VMs across datacenters distributed globally and not once I saw the need for anything else... Maybe I just don't have the scale to find service mesh or kubernetes interesting. Nomad however is something I am willing to give a go for stateless workflows that I would usually provision a VM running a single docker container for.

Nomad [0] does some of this already: * config file for resources. * It does log capture/delivery mostly. * it does chroot exec. * it handles network ports, file paths, etc * handles batch workloads. It can't handle the load balancer piece directly, but if you use the consul tie-in, you can make it work, since it does service discovery, and then something like fabio [1] /traefik can handle load-balancing. [0] https://www.nomadproject.io/ [1] https://github.com/fabiolb/fabio [2] https://docs.traefik.io/

We used NGINX with Consul (template) and Vault quite extensively until I recently found out about eBay's Fabio ( https://github.com/eBay/fabio ). Fabio is really great as an NGINX reverse proxy alternative in an environment with Consul or etcd. I highly recommend it.

Thanks for some great tools guys, and a shout out to Fabio another great tool built on top of Consul https://github.com/eBay/fabio

I believe fabio is https://github.com/eBay/fabio Couldn't find "bud"

you might want to take a look at fabio: https://github.com/eBay/fabio

https://github.com/eBay/fabio might also be an option for you. Disclosure: I'm the author.

I'm curious whether https://github.com/eBay/fabio would meet your needs. It picks up the routing table from consul changes and service registrations and reloads it without restart. All the services have to do is to register their routes in consul. It is meant as a replacement for consul-template+HAproxy. Disclosure: I'm the author