#dominoforever | Product Ideas Portal

 

Welcome to the #dominoforever Product Ideas Forum! The place where you can submit product ideas and enhancement request. We encourage you to participate by voting on, commenting on, and creating new ideas. All new ideas will be evaluated by HCL Product Management & Engineering teams, and the next steps will be communicated. While not all submitted ideas will be executed upon, community feedback will play a key role in influencing which ideas are and when they will be implemented.

For more information and upcoming events around #dominoforever, please visit our Destination Domino Page

implementing proxy-protocol for smtp (imap. pop)

implementing proxy-protocol for smtp (imap, pop) connections with domino servers will allow  ( i hope ) preserve client ip address information for haproxy - domino enviroments https://www.haproxy.com/blog/haproxy/proxy-protocol/
  • Guest
  • Apr 26 2019
  • Needs review
  • Attach files
  • Guest commented
    10 May 11:17am

    Yes this makes a lot of sense.

    There are many customers using appliances in front of Domino.

    And also as mentioned before K8s and other cloud native platforms need it today.


    IMHO we need both XCLIENT support and proxy protocol support.


    [ Daniel Nashed / https://blog.nashcom.de ]


  • Guest commented
    10 May 11:13am

    As soon as domino server tasks (smtp / imap / pop) are placed behind a protocol proxy (eg an nginx front-end server or other antispam architecture) we lose the possibility to receive the real original IP address.


    For this sceneario the HAProxy "proxy protocol" (also implemented by nginx) comes to the rescue for TCP based protocols.


    If domino server taks (ideally even the NRCP listened) would support proxy protocol it could be possible to have a DMZ responder (using haproxy or nginx) that acts as first point of contact and communicates with domino in a more secure lan segment.


    Having a proxy in the middle means the domino task can only see the proxy as the source IP. Having proxy protocol supported would allow to get the real source IP and behave accordingly.


    This is even more important as we begin to run domino inside k8s / containerized systems whe the K8S cluster network is in general nat-ted and proxies (like haproxy and nginx) manage the tranposrt.