Implement a reverse proxy

3 files changed, 241 insertions, 137 deletions

diff --git a/po/POTFILES.in b/po/POTFILES.in
index 48b1c7d..0115b93 100644
--- a/po/POTFILES.in
+++ b/po/POTFILES.in
@@ -10,4 +10,5 @@ src/scm/webid-oidc/errors.scm
 src/scm/webid-oidc/identity-provider.scm
 src/scm/webid-oidc/authorization-page-unsafe.scm
 src/scm/webid-oidc/resource-server.scm
+src/scm/webid-oidc/reverse-proxy.scm
 src/scm/webid-oidc/hello-world.scm
diff --git a/po/fr.po b/po/fr.po
index 2c4a6fd..222f4cf 100644
--- a/po/fr.po
+++ b/po/fr.po
@@ -2,7 +2,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: webid-oidc 0.0.0\n"
 "Report-Msgid-Bugs-To: vivien@planete-kraus.eu\n"
-"POT-Creation-Date: 2021-06-05 16:19+0200\n"
+"POT-Creation-Date: 2021-06-05 16:20+0200\n"
 "PO-Revision-Date: 2021-06-05 11:07+0200\n"
 "Last-Translator: Vivien Kraus <vivien@planete-kraus.eu>\n"
 "Language-Team: French <vivien@planete-kraus.eu>\n"
@@ -707,6 +707,7 @@ msgid "Warning: generating a new key pair."
 msgstr "Attention : génération d'une nouvelle paire de clé."
 
 #: src/scm/webid-oidc/identity-provider.scm:148
+#: src/scm/webid-oidc/reverse-proxy.scm:124
 #: src/scm/webid-oidc/hello-world.scm:31
 msgid "command-line|version"
 msgstr "version"
@@ -750,10 +751,12 @@ msgid "comand-line|port"
 msgstr "port"
 
 #: src/scm/webid-oidc/identity-provider.scm:168
+#: src/scm/webid-oidc/reverse-proxy.scm:136
 msgid "comand-line|log-file"
 msgstr "fichier-journal"
 
 #: src/scm/webid-oidc/identity-provider.scm:170
+#: src/scm/webid-oidc/reverse-proxy.scm:138
 msgid "comand-line|error-file"
 msgstr "fichier-erreur"
 
@@ -904,6 +907,7 @@ msgstr ""
 "Si vous trouvez une erreur dans le programme, envoyez-en un rapport à ~a.\n"
 
 #: src/scm/webid-oidc/identity-provider.scm:267
+#: src/scm/webid-oidc/reverse-proxy.scm:210
 #: src/scm/webid-oidc/hello-world.scm:61
 #, scheme-format
 msgid "~a version ~a\n"
@@ -938,6 +942,7 @@ msgid "You need to set the token endpoint URI.\n"
 msgstr "Vous devez définir l'URI du terminal de jeton.\n"
 
 #: src/scm/webid-oidc/identity-provider.scm:327
+#: src/scm/webid-oidc/reverse-proxy.scm:238
 #: src/scm/webid-oidc/hello-world.scm:72
 msgid "The port should be a number between 0 and 65535.\n"
 msgstr "Le port doit être un nombre entre 0 et 65535.\n"
@@ -1099,6 +1104,148 @@ msgstr ""
 msgid "~a: authentication failure: ~a\n"
 msgstr "~a : échec d’authentificationn : ~a\n"
 
+#: src/scm/webid-oidc/reverse-proxy.scm:126
+msgid "command-line|help"
+msgstr "aide"
+
+#: src/scm/webid-oidc/reverse-proxy.scm:128
+msgid "command-line|port"
+msgstr "port"
+
+#: src/scm/webid-oidc/reverse-proxy.scm:130
+msgid "command-line|inbound-uri"
+msgstr "uri-entrant"
+
+#: src/scm/webid-oidc/reverse-proxy.scm:132
+msgid "command-line|outbound-uri"
+msgstr "uri-sortant"
+
+#: src/scm/webid-oidc/reverse-proxy.scm:134
+msgid "command-line|header"
+msgstr "en-tête"
+
+#: src/scm/webid-oidc/reverse-proxy.scm:152
+#, scheme-format
+msgid ""
+"Usage: ~a [OPTIONS]...\n"
+"\n"
+"Run a reverse proxy, taking requests with webid-oidc authentication\n"
+"and passing them to the outbound URI with an additional header\n"
+"containing the webid of the agent.\n"
+"\n"
+"Options:\n"
+"  -h, --~a:\n"
+"      display this help message and exit.\n"
+"  -v, --~a:\n"
+"      display the version information (~a) and exit.\n"
+"  -p PORT, --~a=8080:\n"
+"      set the port to bind.\n"
+"  -i URI, --~a=URI: \n"
+"      set the public URI of the reverse proxy.\n"
+"  -o URI, --~a=URI:\n"
+"      pass the requests to the server running at URI.\n"
+"  -H HEADER, --~a=HEADER:\n"
+"      pass request with optional HEADER set to the webid, XXX-Agent by "
+"default.\n"
+"  -l FILE.log, --~a=FILE.log:\n"
+"      dump the standard output to that file.\n"
+"  -e FILE.err, --~a=FILE.err:\n"
+"      dump the standard error to that file.\n"
+"\n"
+"Environment variables:\n"
+"\n"
+"  LANG: set the locale of the sysadmin-facing interface. It is\n"
+"currently ~a.\n"
+"\n"
+"Example:\n"
+"\n"
+"Suppose that you operate data.provider.com. Since everything is behind\n"
+"a big global reverse proxy, the authenticated proxy listens on\n"
+"http://localhost:8080. You have the data server running at\n"
+"https://private.data.provider.com, set up so that only you can query\n"
+"it.  The private server needs the XXX-Agent header to contain the\n"
+"authenticated webid of the user, if the user is authenticated.  That’s\n"
+"why you don’t want anyone to query it. You would run:\n"
+"\n"
+"    export LANG=C\n"
+"    webid-oidc-reverse-proxy \\\n"
+"      --port 8080 \\\n"
+"      --inbound-uri https://data.provider.com \\\n"
+"      --outbound-uri https://private.data.provider.com \\\n"
+"      --header XXX-Agent \\\n"
+"      --log-file /var/log/proxy.log \\\n"
+"      --error-file /var/log/proxy.err\n"
+"\n"
+"If you find a bug, send a report to ~a.\n"
+msgstr ""
+"Utilisation : ~a [OPTIONS]...\n"
+"\n"
+"Exécute un proxy inversé, prenant des requêtes avec authentification\n"
+"webid-oidc et les passant à un URI sortant avec un en-tête\n"
+"additionel contenant le webid de l’agent.\n"
+"\n"
+"Options :\n"
+"  -h, --~a :\n"
+"      affiche ce message d’aide et quitte.\n"
+"  -v, --~a :\n"
+"      affiche le numéro de version (~a) et quitte.\n"
+"  -p PORT, --~a=PORT :\n"
+"      définit le port à lier.\n"
+"  -i URI, --~a=URI :\n"
+"      définit le nom public du proxy inversé.\n"
+"  -o URI, --~a=URI :\n"
+"      passe les requêtes au serveur exécuté à URI.\n"
+"  -h ENTÊTE, --~a=ENTÊTE :\n"
+"      passe les requêtes avec un ENTÊTE optionnel défini par la valeur\n"
+"      du webid, XXX-Agent par défaut.\n"
+"  -l FICHIER.log, --~a=FICHIER.log :\n"
+"      déverser la sortie standard vers ce fichier.\n"
+"  -e FICHIER.err, --~a=FICHIER.err :\n"
+"      déverser la sortie d’erreur vers ce fichier.\n"
+"\n"
+"Variables d’environnement :\n"
+"\n"
+"  LANG : définit la locale de l’interface de l’administrateur système\n"
+"Elle vaut actuellement ~a.\n"
+"\n"
+"Exemple :\n"
+"\n"
+"Supposons que vous opérez donnees.fournisseur.com. Puisque tout est\n"
+"derrière un grand proxy inversé global, le proxy d’authentification\n"
+"écoute sur http://localhost:8080. Vous avez le serveur de données sur\n"
+"https://prive.donnees.fournisseur.com, configuré de sorte à ce que\n"
+"vous seul puissiez le requêter. Le serveur privé nécessite que la\n"
+"valeur de l’en-tête XXX-Agent contienne le webid de l’utilisateur\n"
+"authentifié, si c’est le cas. C’est pourquoi vous ne voulez pas que\n"
+"n’importe qui puisse le requêter. Vous exécuteriez :\n"
+"\n"
+"    export LANG=fr_FR.UTF-8\n"
+"    webid-oidc-reverse-proxy \\\n"
+"      --port 8080 \\\n"
+"      --uri-entrant https://donnees.fournisseur.com \\\n"
+"      --uri-sortant https://prive.donnees.fournisseur.com \\\n"
+"      --en-tête XXX-Agent \\\n"
+"      --fichier-journal /var/log/proxy.log \\\n"
+"      --fichier-erreur /var/log/proxy.err\n"
+"\n"
+"Si vous trouvez une erreur dans le programme, envoyez-en un rapport à\n"
+"~a.\n"
+
+#: src/scm/webid-oidc/reverse-proxy.scm:243
+msgid ""
+"The public name of the server must be present (with scheme) as --inbound-"
+"uri.\n"
+msgstr ""
+"Le nom public du serveur doit être présent (avec protocole) avec\n"
+"--uri-entrant.\n"
+
+#: src/scm/webid-oidc/reverse-proxy.scm:248
+msgid ""
+"The address of the proxy must be present (with scheme) as --outbound-uri.\n"
+msgstr ""
+"L’adresse du serveur doit être présent (avec protocole) avec\n"
+"--uri-sortant.\n"
+
 #: src/scm/webid-oidc/hello-world.scm:44
 #, scheme-format
 msgid ""
@@ -1209,141 +1356,6 @@ msgstr ""
 #~ msgid "there is an external error"
 #~ msgstr "il y a une erreur externe"
 
-#~ msgid "command-line|help"
-#~ msgstr "aide"
-
-#~ msgid "command-line|port"
-#~ msgstr "port"
-
-#~ msgid "command-line|inbound-uri"
-#~ msgstr "uri-entrant"
-
-#~ msgid "command-line|outbound-uri"
-#~ msgstr "uri-sortant"
-
-#~ msgid "command-line|header"
-#~ msgstr "en-tête"
-
-#, scheme-format
-#~ msgid ""
-#~ "Usage: ~a [OPTIONS]...\n"
-#~ "\n"
-#~ "Run a reverse proxy, taking requests with webid-oidc authentication\n"
-#~ "and passing them to the outbound URI with an additional header\n"
-#~ "containing the webid of the agent.\n"
-#~ "\n"
-#~ "Options:\n"
-#~ "  -h, --~a:\n"
-#~ "      display this help message and exit.\n"
-#~ "  -v, --~a:\n"
-#~ "      display the version information (~a) and exit.\n"
-#~ "  -p PORT, --~a=8080:\n"
-#~ "      set the port to bind.\n"
-#~ "  -i URI, --~a=URI: \n"
-#~ "      set the public URI of the reverse proxy.\n"
-#~ "  -o URI, --~a=URI:\n"
-#~ "      pass the requests to the server running at URI.\n"
-#~ "  -H HEADER, --~a=HEADER:\n"
-#~ "      pass request with optional HEADER set to the webid, XXX-Agent by "
-#~ "default.\n"
-#~ "  -l FILE.log, --~a=FILE.log:\n"
-#~ "      dump the standard output to that file.\n"
-#~ "  -e FILE.err, --~a=FILE.err:\n"
-#~ "      dump the standard error to that file.\n"
-#~ "\n"
-#~ "Environment variables:\n"
-#~ "\n"
-#~ "  LANG: set the locale of the sysadmin-facing interface. It is\n"
-#~ "currently ~a.\n"
-#~ "\n"
-#~ "Example:\n"
-#~ "\n"
-#~ "Suppose that you operate data.provider.com. Since everything is behind\n"
-#~ "a big global reverse proxy, the authenticated proxy listens on\n"
-#~ "http://localhost:8080. You have the data server running at\n"
-#~ "https://private.data.provider.com, set up so that only you can query\n"
-#~ "it.  The private server needs the XXX-Agent header to contain the\n"
-#~ "authenticated webid of the user, if the user is authenticated.  That’s\n"
-#~ "why you don’t want anyone to query it. You would run:\n"
-#~ "\n"
-#~ "    export LANG=C\n"
-#~ "    webid-oidc-reverse-proxy \\\n"
-#~ "      --port 8080 \\\n"
-#~ "      --inbound-uri https://data.provider.com \\\n"
-#~ "      --outbound-uri https://private.data.provider.com \\\n"
-#~ "      --header XXX-Agent \\\n"
-#~ "      --log-file /var/log/proxy.log \\\n"
-#~ "      --error-file /var/log/proxy.err\n"
-#~ "\n"
-#~ "If you find a bug, send a report to ~a.\n"
-#~ msgstr ""
-#~ "Utilisation : ~a [OPTIONS]...\n"
-#~ "\n"
-#~ "Exécute un proxy inversé, prenant des requêtes avec authentification\n"
-#~ "webid-oidc et les passant à un URI sortant avec un en-tête\n"
-#~ "additionel contenant le webid de l’agent.\n"
-#~ "\n"
-#~ "Options :\n"
-#~ "  -h, --~a :\n"
-#~ "      affiche ce message d’aide et quitte.\n"
-#~ "  -v, --~a :\n"
-#~ "      affiche le numéro de version (~a) et quitte.\n"
-#~ "  -p PORT, --~a=PORT :\n"
-#~ "      définit le port à lier.\n"
-#~ "  -i URI, --~a=URI :\n"
-#~ "      définit le nom public du proxy inversé.\n"
-#~ "  -o URI, --~a=URI :\n"
-#~ "      passe les requêtes au serveur exécuté à URI.\n"
-#~ "  -h ENTÊTE, --~a=ENTÊTE :\n"
-#~ "      passe les requêtes avec un ENTÊTE optionnel défini par la valeur\n"
-#~ "      du webid, XXX-Agent par défaut.\n"
-#~ "  -l FICHIER.log, --~a=FICHIER.log :\n"
-#~ "      déverser la sortie standard vers ce fichier.\n"
-#~ "  -e FICHIER.err, --~a=FICHIER.err :\n"
-#~ "      déverser la sortie d’erreur vers ce fichier.\n"
-#~ "\n"
-#~ "Variables d’environnement :\n"
-#~ "\n"
-#~ "  LANG : définit la locale de l’interface de l’administrateur système\n"
-#~ "Elle vaut actuellement ~a.\n"
-#~ "\n"
-#~ "Exemple :\n"
-#~ "\n"
-#~ "Supposons que vous opérez donnees.fournisseur.com. Puisque tout est\n"
-#~ "derrière un grand proxy inversé global, le proxy d’authentification\n"
-#~ "écoute sur http://localhost:8080. Vous avez le serveur de données sur\n"
-#~ "https://prive.donnees.fournisseur.com, configuré de sorte à ce que\n"
-#~ "vous seul puissiez le requêter. Le serveur privé nécessite que la\n"
-#~ "valeur de l’en-tête XXX-Agent contienne le webid de l’utilisateur\n"
-#~ "authentifié, si c’est le cas. C’est pourquoi vous ne voulez pas que\n"
-#~ "n’importe qui puisse le requêter. Vous exécuteriez :\n"
-#~ "\n"
-#~ "    export LANG=fr_FR.UTF-8\n"
-#~ "    webid-oidc-reverse-proxy \\\n"
-#~ "      --port 8080 \\\n"
-#~ "      --uri-entrant https://donnees.fournisseur.com \\\n"
-#~ "      --uri-sortant https://prive.donnees.fournisseur.com \\\n"
-#~ "      --en-tête XXX-Agent \\\n"
-#~ "      --fichier-journal /var/log/proxy.log \\\n"
-#~ "      --fichier-erreur /var/log/proxy.err\n"
-#~ "\n"
-#~ "Si vous trouvez une erreur dans le programme, envoyez-en un rapport à\n"
-#~ "~a.\n"
-
-#~ msgid ""
-#~ "The public name of the server must be present (with scheme) as --inbound-"
-#~ "uri.\n"
-#~ msgstr ""
-#~ "Le nom public du serveur doit être présent (avec protocole) avec\n"
-#~ "--uri-entrant.\n"
-
-#~ msgid ""
-#~ "The address of the proxy must be present (with scheme) as --outbound-"
-#~ "uri.\n"
-#~ msgstr ""
-#~ "L’adresse du serveur doit être présent (avec protocole) avec\n"
-#~ "--uri-sortant.\n"
-
 #~ msgid "comand-line|client-id"
 #~ msgstr "id-client"
 
diff --git a/po/webid-oidc.pot b/po/webid-oidc.pot
index d652b54..f3e5c51 100644
--- a/po/webid-oidc.pot
+++ b/po/webid-oidc.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: webid-oidc SNAPSHOT\n"
 "Report-Msgid-Bugs-To: vivien@planete-kraus.eu\n"
-"POT-Creation-Date: 2021-06-05 16:19+0200\n"
+"POT-Creation-Date: 2021-06-05 16:20+0200\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -690,6 +690,7 @@ msgid "Warning: generating a new key pair."
 msgstr ""
 
 #: src/scm/webid-oidc/identity-provider.scm:148
+#: src/scm/webid-oidc/reverse-proxy.scm:124
 #: src/scm/webid-oidc/hello-world.scm:31
 msgid "command-line|version"
 msgstr ""
@@ -733,10 +734,12 @@ msgid "comand-line|port"
 msgstr ""
 
 #: src/scm/webid-oidc/identity-provider.scm:168
+#: src/scm/webid-oidc/reverse-proxy.scm:136
 msgid "comand-line|log-file"
 msgstr ""
 
 #: src/scm/webid-oidc/identity-provider.scm:170
+#: src/scm/webid-oidc/reverse-proxy.scm:138
 msgid "comand-line|error-file"
 msgstr ""
 
@@ -814,6 +817,7 @@ msgid ""
 msgstr ""
 
 #: src/scm/webid-oidc/identity-provider.scm:267
+#: src/scm/webid-oidc/reverse-proxy.scm:210
 #: src/scm/webid-oidc/hello-world.scm:61
 #, scheme-format
 msgid "~a version ~a\n"
@@ -848,6 +852,7 @@ msgid "You need to set the token endpoint URI.\n"
 msgstr ""
 
 #: src/scm/webid-oidc/identity-provider.scm:327
+#: src/scm/webid-oidc/reverse-proxy.scm:238
 #: src/scm/webid-oidc/hello-world.scm:72
 msgid "The port should be a number between 0 and 65535.\n"
 msgstr ""
@@ -1001,6 +1006,92 @@ msgstr ""
 msgid "~a: authentication failure: ~a\n"
 msgstr ""
 
+#: src/scm/webid-oidc/reverse-proxy.scm:126
+msgid "command-line|help"
+msgstr ""
+
+#: src/scm/webid-oidc/reverse-proxy.scm:128
+msgid "command-line|port"
+msgstr ""
+
+#: src/scm/webid-oidc/reverse-proxy.scm:130
+msgid "command-line|inbound-uri"
+msgstr ""
+
+#: src/scm/webid-oidc/reverse-proxy.scm:132
+msgid "command-line|outbound-uri"
+msgstr ""
+
+#: src/scm/webid-oidc/reverse-proxy.scm:134
+msgid "command-line|header"
+msgstr ""
+
+#: src/scm/webid-oidc/reverse-proxy.scm:152
+#, scheme-format
+msgid ""
+"Usage: ~a [OPTIONS]...\n"
+"\n"
+"Run a reverse proxy, taking requests with webid-oidc authentication\n"
+"and passing them to the outbound URI with an additional header\n"
+"containing the webid of the agent.\n"
+"\n"
+"Options:\n"
+"  -h, --~a:\n"
+"      display this help message and exit.\n"
+"  -v, --~a:\n"
+"      display the version information (~a) and exit.\n"
+"  -p PORT, --~a=8080:\n"
+"      set the port to bind.\n"
+"  -i URI, --~a=URI: \n"
+"      set the public URI of the reverse proxy.\n"
+"  -o URI, --~a=URI:\n"
+"      pass the requests to the server running at URI.\n"
+"  -H HEADER, --~a=HEADER:\n"
+"      pass request with optional HEADER set to the webid, XXX-Agent by "
+"default.\n"
+"  -l FILE.log, --~a=FILE.log:\n"
+"      dump the standard output to that file.\n"
+"  -e FILE.err, --~a=FILE.err:\n"
+"      dump the standard error to that file.\n"
+"\n"
+"Environment variables:\n"
+"\n"
+"  LANG: set the locale of the sysadmin-facing interface. It is\n"
+"currently ~a.\n"
+"\n"
+"Example:\n"
+"\n"
+"Suppose that you operate data.provider.com. Since everything is behind\n"
+"a big global reverse proxy, the authenticated proxy listens on\n"
+"http://localhost:8080. You have the data server running at\n"
+"https://private.data.provider.com, set up so that only you can query\n"
+"it.  The private server needs the XXX-Agent header to contain the\n"
+"authenticated webid of the user, if the user is authenticated.  That’s\n"
+"why you don’t want anyone to query it. You would run:\n"
+"\n"
+"    export LANG=C\n"
+"    webid-oidc-reverse-proxy \\\n"
+"      --port 8080 \\\n"
+"      --inbound-uri https://data.provider.com \\\n"
+"      --outbound-uri https://private.data.provider.com \\\n"
+"      --header XXX-Agent \\\n"
+"      --log-file /var/log/proxy.log \\\n"
+"      --error-file /var/log/proxy.err\n"
+"\n"
+"If you find a bug, send a report to ~a.\n"
+msgstr ""
+
+#: src/scm/webid-oidc/reverse-proxy.scm:243
+msgid ""
+"The public name of the server must be present (with scheme) as --inbound-"
+"uri.\n"
+msgstr ""
+
+#: src/scm/webid-oidc/reverse-proxy.scm:248
+msgid ""
+"The address of the proxy must be present (with scheme) as --outbound-uri.\n"
+msgstr ""
+
 #: src/scm/webid-oidc/hello-world.scm:44
 #, scheme-format
 msgid ""