feat: add unix socket

[nmartorell]

Description

This PR extends the Unix socket listener support added on this branch by making the socket path and socket access mode configurable via environment variables and config.

Changes included:

• Added PROXY_UNIX_SOCKET_PATH as the env var to enable the main API listener on a Unix socket instead of PROXY_PORT.
• Added UnixSocketAccessMode config support, plus PROXY_UNIX_SOCKET_ACCESS_MODE as the env override.
• Supported access modes are:
  • USER -> 0600
  • GROUP -> 0660
  • ALL -> 0666
• Kept the default behavior aligned with the previous implementation by defaulting Unix socket access mode to USER.
• Added validation for invalid access mode values when Unix socket mode is enabled.
• Updated the Unix socket listener to apply the configured access mode instead of hardcoding 0600.
• Updated tests covering config validation, env loading, and access-mode-to-chmod mapping.
• Updated the README with documentation for PROXY_UNIX_SOCKET_PATH and how it interacts with socket access mode.

Linked Issue

Closes #460

Type of Change

• Bug fix
• New feature
• Refactor / code quality
• Documentation update
• CI / build change

Testing Done

Tested proxy via Unix socket and TCP exposition (to ensure no regressions).

Suggested manual test plan for reviewer:

• Ensure TCP exposition still works (and is the default mode)
• Enable Unix sockets exposition and test proxy
• Test different socket permissions modes

Checklist

• make test-go and make test pass locally
• make lint reports no new errors
• New PII detection changes are covered by unit tests in tests/
• Go proxy changes include test coverage in src/ or model/
• Documentation updated if behavior or configuration changed
• No sensitive data or credentials included

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[github-actions]

Warning

This PR touches 3+ distinct areas of the codebase.

Consider splitting into smaller, focused PRs — each covering a single semantic type.
This makes reviews easier and keeps the git history clean.

Categories found:

docs:

• README.md

code:

• src/backend/config/config.development.json
• src/backend/config/config.go
• src/backend/main.go
• src/backend/server/server.go

test:

• src/backend/config/config_test.go
• src/backend/main_test.go

[nmartorell]

@hanneshapke @Davidnet I'd be open to nuking the PROXY_UNIX_SOCKET_ACCESS_MODE env var, and making it so that the unix chmod is just configurable from the config file.

Tbh I added this initially because I thought I'd need it for DSS, but then noticed that I do not need it. I could even see the argument for not even allowing the perm mode to be configurable (i.e. just default to 600), and then make it the responsibility of the caller to chmod the unix socket file (if required).

[hanneshapke]

Looking great - @nmartorell you need to sign the CLA :)

[Davidnet]

Should we mkdir -p socketPath ? like in the case that people run in /run/

[Davidnet]

I propose that we expand this to check both in this case a test:

PROXY_UNIX_SOCKET_PATH=/tmp/kiji.sock PROXY_PORT=some-invalid ./build/kiji-proxy

this will silently pass.

We could do a safe check in both:

// one of these must work)
if c.UnixSocketPath != "" {
    // Unix socket mode
    if err := validateSocketAccessMode(c.UnixSocketAccessMode); err != nil {
        errs = append(errs, err.Error())
    }
} else {
    // TCP mode (default)
    if err := validatePort(c.ProxyPort, "ProxyPort"); err != nil {
        errs = append(errs, err.Error())
    }
}

// validate transparent proxy port
if err := validatePort(c.Proxy.ProxyPort, "Proxy.ProxyPort"); err != nil {
    errs = append(errs, err.Error())
}

This way, both fields are validated regardless of mode.

[Davidnet]

I am also keen to remove ALL, is there any scenario where this socket might be need it to run that open for everyone? (I suspect that this might be like paranoid thing), in the case that does, maybe a umask, but yeah I would like to understand a bit more in the case for the ALL case

[hanneshapke]

I agree. Nuke it. On Jun 3, 2026, at 5:27 PM, David Cardozo ***@***.***> wrote:Davidnet left a comment (dataiku/kiji-proxy#505) I am also keen to remove ALL, is there any scenario where this socket might be need it to run that open for everyone? (I suspect that this might be like paranoid thing), in the case that does, maybe a umask, but yeah I would like to understand a bit more in the case for the ALL one —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you were mentioned.Message ID: ***@***.***>