Enhancing Network Ingress

[bowei]

Current request flow:

Request => 
  Router:80 => 
    Request handling  (routing + scheduling queue + resume on traffic)
    => Actor.

Current limitations:

• Only supports one port (port 80) and protocol (HTTP 1.1)
• No policy, most importantly authz.
• Routing by Host header
• Router could become a bandwidth bottleneck

CUJs

• Policy
  • Actor exposes services on multiple ports.
    External requests should be able to route traffic to those ports. All other ports are blocked.
  • Actor A can receive requests from [Actor B1, B2, …] based on ateapi Authz policy.
  • Actor A can receive requests from external identity, e.g. sending a request directly to the router from a desktop (curl -H 'Host: ' router-dns') based on ateapi Authz policy.

Enhancements for ease of use. These allow for users to more easily interact with the system:

• (Idea) We should also allow for easy access to an Actor via URL e.g. http://actors.router.ate.dev/<atespace>/<actor name>/<actual path> will route the request to the Actor stripping the <atespace>/<actor name> prefix.
• (Idea) Configurable vanity hostnames for Actors? Users can define a custom domain that the Router will understand and map to the appropriate Actor. For example, myactor.foo.com hostname goes to specific Actor defined by the user. We will need to solve the issue of giving permissions to create hostname mappings as these are substrate global entities.

Backlog for now

• (P2 for now, need actual use case) Actor exposes a port directly, skipping the router. For example, run a test web server that receives traffic from an external probe.

xref:

• Pluggable Substrate Ingress and Actor-Aware Routing