Summary
Rearchitect Cortex to cleanly separate the concrete proxy data-planes from a shared "proxy shim" layer. The shim owns the cross-cutting concerns so each proxy (Go proxy, Envoy, Praxies) becomes a thin data-plane implementation rather than a duplicate of the same plumbing.
The shim layer should handle
- TLS termination
- mTLS
- Session correlation
- Protocol bridging
- Support for both transparent and forward proxy modes
Motivation
Cross-cutting concerns (TLS/mTLS, session correlation, protocol bridging, transparent-vs-forward proxy handling) are currently entangled with the individual proxy implementations. Extracting them into a shim layer:
- makes adding a new proxy (e.g. Praxies) a matter of implementing a thin data-plane against the shim;
- gives one place for TLS/mTLS and session-correlation behavior across all proxies;
- unifies transparent + forward proxy support.
Related
Design to be expanded.
Summary
Rearchitect Cortex to cleanly separate the concrete proxy data-planes from a shared "proxy shim" layer. The shim owns the cross-cutting concerns so each proxy (Go proxy, Envoy, Praxies) becomes a thin data-plane implementation rather than a duplicate of the same plumbing.
The shim layer should handle
Motivation
Cross-cutting concerns (TLS/mTLS, session correlation, protocol bridging, transparent-vs-forward proxy handling) are currently entangled with the individual proxy implementations. Extracting them into a shim layer:
Related