{"id":20777559,"url":"https://github.com/semgrep/semgrep-network-broker","last_synced_at":"2026-01-12T00:03:56.026Z","repository":{"id":163674239,"uuid":"576040921","full_name":"semgrep/semgrep-network-broker","owner":"semgrep","description":"Facilitates network access between Semgrep and on-prem resources","archived":false,"fork":false,"pushed_at":"2025-12-19T20:59:55.000Z","size":341,"stargazers_count":8,"open_issues_count":10,"forks_count":4,"subscribers_count":18,"default_branch":"develop","last_synced_at":"2025-12-22T09:17:09.426Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/semgrep.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2022-12-08T21:52:20.000Z","updated_at":"2025-12-19T20:58:10.000Z","dependencies_parsed_at":"2026-01-06T13:13:51.172Z","dependency_job_id":null,"html_url":"https://github.com/semgrep/semgrep-network-broker","commit_stats":null,"previous_names":["semgrep/semgrep-network-broker","returntocorp/semgrep-network-broker"],"tags_count":41,"template":false,"template_full_name":null,"purl":"pkg:github/semgrep/semgrep-network-broker","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/semgrep%2Fsemgrep-network-broker","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/semgrep%2Fsemgrep-network-broker/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/semgrep%2Fsemgrep-network-broker/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/semgrep%2Fsemgrep-network-broker/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/semgrep","download_url":"https://codeload.github.com/semgrep/semgrep-network-broker/tar.gz/refs/heads/develop","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/semgrep%2Fsemgrep-network-broker/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28328765,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-11T22:11:01.104Z","status":"ssl_error","status_checked_at":"2026-01-11T22:10:58.990Z","response_time":60,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-17T13:16:02.121Z","updated_at":"2026-01-12T00:03:56.009Z","avatar_url":"https://github.com/semgrep.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# semgrep-network-broker\n\n**NOTE:** These docs are in-progress. Feel free to direct any questions / feedback / improvements to your private channel on the Semgrep slack!\n\nThe Semgrep Network Broker facilitates secure access between Semgrep and a private network.\n\nThe broker accomplishes this by establishing a Wireguard VPN tunnel with the Semgrep backend, and then proxying inbound (Semgrep --\u003e customer) HTTP requests through this tunnel. This approach allows Semgrep to interact with on-prem resources without having to expose them to the public internet.\n\nExamples of inbound traffic include:\n\n- Pull Request comments\n- JIRA integrations\n- Webhooks\n\n## Setup\n\n### Build\n\nNOTE: The Semgrep Network broker uses [Buf](https://buf.build/) for protobuf compilation. If you are building the broker from scratch outside of Docker, make sure you have the Buf CLI installed: https://buf.build/docs/installation\n\n- Run `make build` to build the `semgrep-network-broker` binary locally\n- Run `make docker` to build a docker image\n- Docker images are also published to [ghcr.io/semgrep/semgrep-network-broker](https://github.com/semgrep/semgrep-network-broker/pkgs/container/semgrep-network-broker)\n\n### Keypairs\n\nThe broker requires a Wireguard keypair in order to establish a secure connection.\n\n- `semgrep-network-broker genkey` generates a random private key in base64 and prints it to stdout\n- `semgrep-network-broker pubkey` reads a base64 private key from stdin and prints the corresponding base64 public key to stdout\n\n#### Example\n\n```bash\n\u003e semgrep-network-broker genkey\nsome_private_key\n\n\u003e echo \"some_private_key\" | semgrep-network-broker pubkey\nsome_public_key\n```\n\nYour public key is safe to share. _Do not_ share your private key with anyone (including Semgrep).\n\n### Configuration\n\nSemgrep will help you create a configuration file tailored to your Semgrep deployment.\n\n**Do not** alter the `wireguard` section.\n\n**Do not** share the value of `inbound.wireguard.privateKey`. This is your organization's private key. Reach out to Semgrep on Slack if you need to rotate your Wireguard keys.\n\nExample:\n\n```yaml\ninbound:\n  wireguard:\n    localAddress: ...\n    privateKey: ...\n    peers:\n      - endpoint: ...\n  allowlist: [...]\n```\n\n### HttpClient\n\nThe `httpClient` configuration section modifies the HTTP client used for proxying requests.\n\nExample:\n\n```yaml\ninbound:\n  httpClient:\n    additionalCACerts: # Optional. Certificates here will be appended to the Root CA trust of the container. Necessary when the SCM(s) the broker interacts with have self-signed certificates.\n      - /path/to/custom/cert.pem\n    tlsMinVersion: \"1.2\" # Optional. Valid values: \"1.2\", \"1.3\". Defaults to \"1.3\" if unset.\n```\n\nAn alternative to stipulating `additionalCACerts:` is setting the `$SSL_CERT_DIR` environment variable at time of container creation.\n\nExample:\n\n```bash\n$ docker run \\\n  ...\n  -v /path/containing/your/certs:/certs \\ # mount a path from the host machine as a container volume\n  -e SSL_CERT_DIR=/certs \\ # set the $SSL_CERT_DIR environment variable to the mounted volume\n  ...\n  -it semgrep-network-broker:latest -c /emt/config.yaml\n```\n\nRefer to the [network broker docs on semgrep.dev](https://semgrep.dev/docs/semgrep-ci/network-broker) for more detail on docker setup.\n\n### GitHub\n\nThe `github` configuration section simplifies granting Semgrep access to leave PR comments.\n\nExample:\n\n```yaml\ninbound:\n  github:\n    baseUrl: https://github.example.com/api/v3\n    allowCodeAccess: false # default is false, set to true to allow Semgrep to read file contents\n```\n\nAdding a `github` field to the config implicitly adds these endpoints to the allowlist:\n\n\u003c!-- BeginAutogeneratedAllowList:Github --\u003e\n- GET `https://github.example.com/api/v3/app`\n- GET `https://github.example.com/api/v3/app/hook/config`\n- GET `https://github.example.com/api/v3/installation/repositories`\n- GET `https://github.example.com/api/v3/organizations`\n- GET `https://github.example.com/api/v3/orgs/:org`\n- GET `https://github.example.com/api/v3/orgs/:org/hooks`\n- GET `https://github.example.com/api/v3/orgs/:org/installation`\n- GET `https://github.example.com/api/v3/orgs/:org/members`\n- GET `https://github.example.com/api/v3/orgs/:org/repos`\n- GET `https://github.example.com/api/v3/orgs/:org/teams`\n- GET `https://github.example.com/api/v3/orgs/:org/teams/:team_slug/members`\n- GET `https://github.example.com/api/v3/repos/:org/:repo/actions/secrets/public-key`\n- GET `https://github.example.com/api/v3/repos/:owner/:repo`\n- GET `https://github.example.com/api/v3/repos/:owner/:repo/branches`\n- GET `https://github.example.com/api/v3/repos/:owner/:repo/collaborators/:username/permission`\n- GET `https://github.example.com/api/v3/repos/:owner/:repo/compare/:basehead`\n- GET `https://github.example.com/api/v3/repos/:owner/:repo/contents/.github/workflows/semgrep.yml`\n- GET `https://github.example.com/api/v3/repos/:owner/:repo/installation`\n- GET `https://github.example.com/api/v3/repos/:owner/:repo/pulls`\n- GET `https://github.example.com/api/v3/repos/:owner/:repo/pulls/comments/:comment_id/reactions`\n- GET `https://github.example.com/api/v3/user`\n- GET `https://github.example.com/api/v3/user/repos`\n- GET `https://github.example.com/api/v3/users/:user/installation`\n- GET `https://github.example.com/api/v3/users/:user/installation/repositories`\n- GET `https://github.example.com/api/v3/users/:username`\n- POST `https://github.example.com/api/v3/app-manifests/:code/conversions`\n- POST `https://github.example.com/api/v3/app/installations/:id/access_tokens`\n- POST `https://github.example.com/api/v3/orgs/:org/hooks`\n- POST `https://github.example.com/api/v3/repos/:owner/:repo/check-runs`\n- POST `https://github.example.com/api/v3/repos/:owner/:repo/issues/:number/comments`\n- POST `https://github.example.com/api/v3/repos/:owner/:repo/pulls/:number/comments`\n- POST `https://github.example.com/api/v3/repos/:owner/:repo/pulls/:number/comments/:comment_id/replies`\n- POST `https://github.example.com/api/v3/repos/:owner/:repo/statuses/:commit`\n- PUT `https://github.example.com/api/v3/repos/:org/:repo/actions/secrets/SEMGREP_APP_TOKEN`\n- PUT `https://github.example.com/api/v3/repos/:owner/:repo/contents/.github/workflows/semgrep.yml`\n- PATCH `https://github.example.com/api/v3/orgs/:org/hooks/:hook_id`\n- PATCH `https://github.example.com/api/v3/repos/:owner/:repo/check-runs/:check_run_id`\n- PATCH `https://github.example.com/api/v3/repos/:owner/:repo/pulls/:number/comments/:comment_id`\n- PATCH `https://github.example.com/api/v3/repos/:owner/:repo/pulls/comments/:comment_id`\n- DELETE `https://github.example.com/api/v3/orgs/:org/hooks/:hook_id`\n\u003c!-- EndAutogeneratedAllowList:Github --\u003e\n\nAnd if `allowCodeAccess` is set, these endpoints are also added to the allowlist:\n\n\u003c!-- BeginAutogeneratedAllowList:Github.AllowCodeAccess --\u003e\n- GET `https://github.example.com/:owner/:repo/info/refs`\n- GET `https://github.example.com/api/v3/repos/:owner/:repo/commits`\n- GET `https://github.example.com/api/v3/repos/:owner/:repo/contents`\n- GET `https://github.example.com/api/v3/repos/:owner/:repo/contents/*`\n- POST `https://github.example.com/:owner/:repo/git-upload-pack`\n\u003c!-- EndAutogeneratedAllowList:Github.AllowCodeAccess --\u003e\n\n### GitLab\n\nSimilarly, the `gitlab` configuration section grants Semgrep access to leave MR comments.\n\nExample:\n\n```yaml\ninbound:\n  gitlab:\n    baseUrl: https://gitlab.example.com/api/v4\n    allowCodeAccess: false # default is false, set to true to allow Semgrep to read file contents\n```\n\nAdding a `gitlab` field to the config implicitly adds these endpoints to the allowlist:\n\n\u003c!-- BeginAutogeneratedAllowList:Gitlab --\u003e\n- GET `https://gitlab.example.com/api/v4/:entity_type/:namespace/projects`\n- GET `https://gitlab.example.com/api/v4/groups/:namespace/hooks`\n- GET `https://gitlab.example.com/api/v4/groups/:namespace/members/all`\n- GET `https://gitlab.example.com/api/v4/groups/:namespace/members/all/:user`\n- GET `https://gitlab.example.com/api/v4/namespaces/:namespace`\n- GET `https://gitlab.example.com/api/v4/personal_access_tokens/self`\n- GET `https://gitlab.example.com/api/v4/projects/:project`\n- GET `https://gitlab.example.com/api/v4/projects/:project/members/all/:user`\n- GET `https://gitlab.example.com/api/v4/projects/:project/merge_requests`\n- GET `https://gitlab.example.com/api/v4/projects/:project/merge_requests/:number/discussions`\n- GET `https://gitlab.example.com/api/v4/projects/:project/merge_requests/:number/discussions/:discussion/notes/:note/award_emoji`\n- GET `https://gitlab.example.com/api/v4/projects/:project/merge_requests/:number/versions`\n- GET `https://gitlab.example.com/api/v4/projects/:project/repository/branches`\n- POST `https://gitlab.example.com/api/v4/groups/:namespace/hooks`\n- POST `https://gitlab.example.com/api/v4/projects/:project/hooks`\n- POST `https://gitlab.example.com/api/v4/projects/:project/merge_requests/:number/discussions`\n- POST `https://gitlab.example.com/api/v4/projects/:project/merge_requests/:number/discussions/:discussion/notes`\n- PUT `https://gitlab.example.com/api/v4/groups/:namespace/hooks`\n- PUT `https://gitlab.example.com/api/v4/projects/:project/merge_requests/:number/discussions/:discussion`\n- PUT `https://gitlab.example.com/api/v4/projects/:project/merge_requests/:number/discussions/:discussion/notes/:note`\n- DELETE `https://gitlab.example.com/api/v4/groups/:namespace/hooks/:hook`\n- DELETE `https://gitlab.example.com/api/v4/projects/:project/hooks/:hook`\n\u003c!-- EndAutogeneratedAllowList:Gitlab --\u003e\n\nAnd if `allowCodeAccess` is set, these endpoints are also added to the allowlist:\n\n\u003c!-- BeginAutogeneratedAllowList:Gitlab.AllowCodeAccess --\u003e\n- GET `https://gitlab.example.com/:namespace/:project/info/refs`\n- GET `https://gitlab.example.com/api/v4/projects/:project/repository/commits`\n- GET `https://gitlab.example.com/api/v4/projects/:project/repository/compare`\n- GET `https://gitlab.example.com/api/v4/projects/:project/repository/files/*`\n- GET `https://gitlab.example.com/api/v4/projects/:project/repository/merge_base`\n- POST `https://gitlab.example.com/:namespace/:project/git-upload-pack`\n- POST `https://gitlab.example.com/api/v4/projects/:project/statuses/:commit`\n\u003c!-- EndAutogeneratedAllowList:Gitlab.AllowCodeAccess --\u003e\n\n### Bitbucket\n\nSimilarly, the `bitbucket` configuration section grants Semgrep access to leave MR comments.\n\n```yaml\ninbound:\n  bitbucket:\n    baseUrl: https://bitbucket.example.com/rest/api/latest\n    allowCodeAccess: false # default is false, set to true to allow Semgrep to read file contents\n```\n\nAdding a `bitbucket` field to the config implicitly adds these endpoints to the allowlist:\n\n\u003c!-- BeginAutogeneratedAllowList:Bitbucket --\u003e\n- GET `https://bitbucket.example.com/rest/api/latest/application-properties`\n- GET `https://bitbucket.example.com/rest/api/latest/projects/:project`\n- GET `https://bitbucket.example.com/rest/api/latest/projects/:project/repos`\n- GET `https://bitbucket.example.com/rest/api/latest/projects/:project/repos/:repo`\n- GET `https://bitbucket.example.com/rest/api/latest/projects/:project/repos/:repo/default-branch`\n- GET `https://bitbucket.example.com/rest/api/latest/projects/:project/repos/:repo/pull-requests`\n- GET `https://bitbucket.example.com/rest/api/latest/projects/:project/repos/:repo/pull-requests/:number/comments/:comment`\n- GET `https://bitbucket.example.com/rest/api/latest/projects/:project/repos/:repo/webhooks`\n- GET `https://bitbucket.example.com/rest/api/latest/projects/:project/webhooks`\n- POST `https://bitbucket.example.com/rest/api/latest/projects/:project/repos/:repo/pull-requests/:number/blocker-comments`\n- POST `https://bitbucket.example.com/rest/api/latest/projects/:project/repos/:repo/pull-requests/:number/comments`\n- POST `https://bitbucket.example.com/rest/api/latest/projects/:project/repos/:repo/webhooks`\n- POST `https://bitbucket.example.com/rest/api/latest/projects/:project/webhooks`\n- PUT `https://bitbucket.example.com/rest/api/latest/projects/:project/repos/:repo/pull-requests/:number/comments/:comment`\n- PUT `https://bitbucket.example.com/rest/api/latest/projects/:project/repos/:repo/webhooks/:webhook`\n- PUT `https://bitbucket.example.com/rest/api/latest/projects/:project/webhooks/:webhook`\n- DELETE `https://bitbucket.example.com/rest/api/latest/projects/:project/repos/:repo/webhooks/:webhook`\n- DELETE `https://bitbucket.example.com/rest/api/latest/projects/:project/webhooks/:webhook`\n\u003c!-- EndAutogeneratedAllowList:Bitbucket --\u003e\n\nAnd if `allowCodeAccess` is set, these endpoints are also added to the allowlist:\n\n\u003c!-- BeginAutogeneratedAllowList:Bitbucket.AllowCodeAccess --\u003e\n- GET `https://bitbucket.example.com/rest/api/latest/projects/:project/repos/:repo/browse/*`\n- GET `https://bitbucket.example.com/rest/api/latest/projects/:project/repos/:repo/commits`\n- GET `https://bitbucket.example.com/scm/:project/:repo/info/refs`\n- POST `https://bitbucket.example.com/rest/api/latest/projects/:project/repos/:repo/commit/:commit/builds`\n- POST `https://bitbucket.example.com/scm/:project/:repo/git-upload-pack`\n\u003c!-- EndAutogeneratedAllowList:Bitbucket.AllowCodeAccess --\u003e\n\n### Azure DevOps\n\nSimilarly, the `azuredevops` configuration section grants Semgrep access to azure devops.\n\n```yaml\ninbound:\n  azuredevops:\n    baseUrl: https://example@dev.azure.com/\n    allowCodeAccess: false # default is false, set to true to allow Semgrep to read file contents\n```\n\nAdding a `azuredevops` field to the config implicitly adds these endpoints to the allowlist\n\n\u003c!-- BeginAutogeneratedAllowList:AzureDevOps --\u003e\n- GET `https://dev.azure.com/:namespace/:project/_apis/git/repositories`\n- GET `https://dev.azure.com/:namespace/:project/_apis/git/repositories/:repo`\n- GET `https://dev.azure.com/:namespace/:project/_apis/git/repositories/:repo/pullRequests`\n- GET `https://dev.azure.com/:namespace/:project/_apis/git/repositories/:repo/pullRequests/:number/iterations`\n- GET `https://dev.azure.com/:namespace/:project/_apis/git/repositories/:repo/pullRequests/:number/iterations/:iterationId/changes`\n- GET `https://dev.azure.com/:namespace/:project/_apis/hooks/subscriptions`\n- GET `https://dev.azure.com/:namespace/_apis/connectionData`\n- GET `https://dev.azure.com/:namespace/_apis/projects/:project`\n- GET `https://vsaex.dev.azure.com/:namespace/_apis/groupentitlements`\n- POST `https://dev.azure.com/:namespace/:project/_apis/git/repositories/:repo/pullRequests/:number/threads`\n- POST `https://dev.azure.com/:namespace/:project/_apis/git/repositories/:repo/pullRequests/:number/threads/:threadId/comments`\n- POST `https://dev.azure.com/:namespace/:project/_apis/hooks/subscriptions`\n- PUT `https://dev.azure.com/:namespace/:project/_apis/hooks/subscriptions`\n- PATCH `https://dev.azure.com/:namespace/:project/_apis/git/repositories/:repo/pullRequests/:number/threads`\n- PATCH `https://dev.azure.com/:namespace/:project/_apis/git/repositories/:repo/pullRequests/:number/threads/:threadId/comments/:commentId`\n\u003c!-- EndAutogeneratedAllowList:AzureDevOps --\u003e\n\nAnd if `allowCodeAccess` is set, these endpoints are also added to the allowlist:\n\n\u003c!-- BeginAutogeneratedAllowList:AzureDevOps.AllowCodeAccess --\u003e\n- GET `https://dev.azure.com/:namespace/:project/_apis/git/pullrequests/:number`\n- GET `https://dev.azure.com/:namespace/:project/_apis/git/repositories/:repo/items`\n- GET `https://dev.azure.com/:namespace/:project/_git/:repo/info/refs`\n- POST `https://dev.azure.com/:namespace/:project/_apis/git/repositories/:repo/commits/:commit/statuses`\n- POST `https://dev.azure.com/:namespace/:project/_git/:repo/git-upload-pack`\n\u003c!-- EndAutogeneratedAllowList:AzureDevOps.AllowCodeAccess --\u003e\n\n### Allowlist\n\nThe `allowlist` configuration section provides finer-grained control over what HTTP requests are allowed to be forwarded out of the broker. By default, the allowlist will automatically be populated and does not need explicit configuration.\n\nAllowlist Behaviour:\n- When multiple version of an allowlist item exist, the first matching allowlist item is used.\n- No allowlist match means the request will not be proxied.\n\nExamples:\n\n```yaml\ninbound:\n  allowlist:\n    # allow GET requests from http://example.com/foo (exact URL match)\n    - url: http://example.com/foo\n      methods: [GET]\n    # allow GET or POST requests from any path on http://example.com\n    - url: http://example.com/*\n      methods: [GET, POST]\n    # allow GET requests from a URL that looks like a GitHub Enterprise review comments URL, and add a bearer token to the request\n    - url: http://example.com/api/v3/repos/:owner/:repo/pulls/:number/comments\n      methods: [GET]\n      setRequestHeaders:\n        Authorization: \"Bearer ...snip...\"\n```\n\n### Real-world example\n\nHere's an example of allowing PR comments for a GitHub Enterprise instance hosted on https://git.example.com. Replace `\u003cGH TOKEN\u003e` with a GitHub PAT.\n\n```yaml\nallowlist:\n  - url: https://git.example.com/api/v3/repos/:owner/:repo\n    methods: [GET]\n    setRequestHeaders:\n      Authorization: \"Bearer \u003cGH TOKEN\u003e\"\n  - url: https://git.example.com/api/v3/repos/:owner/:repo/pulls\n    methods: [GET]\n    setRequestHeaders:\n      Authorization: \"Bearer \u003cGH TOKEN\u003e\"\n  - url: https://git.example.com/api/v3/repos/:owner/:repo/pulls/:number/comments\n    methods: [POST]\n    setRequestHeaders:\n      Authorization: \"Bearer \u003cGH TOKEN\u003e\"\n  - url: https://git.example.com/api/v3/repos/:owner/:repo/issues/:number/comments\n    methods: [POST]\n    setRequestHeaders:\n      Authorization: \"Bearer \u003cGH TOKEN\u003e\"\n```\n\n### Logging\n\nThe `logging` configuration section allows you to set additional logging options for requests that are proxied through the broker.\n\n```yaml\ninbound:\n  logging:\n    logRequestBody: false # If true, the contents of any proxied HTTP request matching the allowlist will be logged in the request_body field in the proxy.request event\n    logResponseBody: false # If true, the contents of any proxied HTTP response will be logged in the response_body field in the proxy.response event\n```\n\nHere's an example log output of `curl -X POST -H \"Content-Type: application/json\" \"https://httpbin.org/anything\" -d '{\"foo\": \"bar\"}'` being proxied through the network broker:\n\n```\nINFO[0006] request.start                                 client_ip=\"::1\" id=1 method=POST path=\"/proxy/https://httpbin.org/anything\" query= user_agent=curl/8.2.1\nINFO[0006] proxy.request                                 allowlist_match=\"https://httpbin.org/*\" client_ip=\"::1\" destinationUrl=\"https://httpbin.org/anything\" id=1 method=POST path=\"/proxy/https://httpbin.org/anything\" query= request_body=\"{\\\"foo\\\": \\\"bar\\\"}\" user_agent=curl/8.2.1\nINFO[0006] proxy.response                                allowlist_match=\"https://httpbin.org/*\" client_ip=\"::1\" destinationUrl=\"https://httpbin.org/anything\" id=1 method=POST path=\"/proxy/https://httpbin.org/anything\" query= response_body=\"{\\n  \\\"args\\\": {}, \\n  \\\"data\\\": \\\"{\\\\\\\"foo\\\\\\\": \\\\\\\"bar\\\\\\\"}\\\", \\n  \\\"files\\\": {}, \\n  \\\"form\\\": {}, \\n  \\\"headers\\\": {\\n    \\\"Accept\\\": \\\"*/*\\\", \\n    \\\"Accept-Encoding\\\": \\\"gzip\\\", \\n    \\\"Content-Length\\\": \\\"14\\\", \\n    \\\"Content-Type\\\": \\\"application/json\\\", \\n    \\\"Host\\\": \\\"httpbin.org\\\", \\n    \\\"User-Agent\\\": \\\"curl/8.2.1\\\", \\n    \\\"X-Amzn-Trace-Id\\\": \\\"Root=1-650469a8-0032596526902b563d7e5ebc\\\"\\n  }, \\n  \\\"json\\\": {\\n    \\\"foo\\\": \\\"bar\\\"\\n  }, \\n  \\\"method\\\": \\\"POST\\\", \\n  \\\"origin\\\": \\\"::1, ...snip..., ...snip...\\\", \\n  \\\"url\\\": \\\"https://httpbin.org/anything\\\"\\n}\\n\" user_agent=curl/8.2.1\nINFO[0006] request.response                              body_size=511 client_ip=\"::1\" id=1 latency=341.905708ms method=POST path=\"/proxy/https://httpbin.org/anything\" query= status_code=200 user_agent=curl/8.2.1\n```\n\n`logRequestBody` and `logResponseBody` can also be set on a per-allowlist basis:\n\n```yaml\ninbound:\n  allowlist:\n    - url: https://httpbin.org/*\n      methods: [GET, POST, DELETE]\n      logRequestBody: true\n      logResponseBody: true\n```\n\n## Usage\n\nThe broker can be run in Kubernetes, as a bare Docker container, or simply as a standalone binary on a machine. If more than one instance of the broker is run at a time to manage availability, you may see some noise in the logs as the broker is not yet architected with this specific configuration in mind. However, it should still perform correctly without duplicating requests.\n\nConfig file(s) are passed to the app with `-c`:\n\n```bash\nsemgrep-network-broker -c config.yaml\n```\n\nMultiple config files can be overlaid on top of each other by passing multiple `-c` args (ex. `semgrep-network-broker -c config1.yaml -c config2.yaml -c config3.yaml`). Note that while maps will be merged together, arrays will be _replaced_.\n\nRequirements:\n\n- internet access to `wireguard.semgrep.dev` on UDP port 51820\n\n## Other Commands\n\n### dump\n\n`semgrep-network-broker dump` dumps the current config. This is useful to see what the result of multiple configurations overlays would result in\n\n### genkey\n\n`semgrep-network-broker genkey` generates a base64 private key to stdout\n\n### pubkey\n\n`semgrep-network-broker pubkey` generates a base64 public key for a given private key (via stdin)\n\n### relay\n\n`semgrep-network-broker relay` launches an HTTP server that relays request that match a certain rule.\n\n```yaml\noutbound:\n  listenPort: 8080\n  relay:\n    test:\n      destinationUrl: https://httpbin.org/anything\n      jsonPath: \"$.foo\"\n      equals:\n        - bar\n```\n\nwould result in requests addressed to http://localhost:8080/relay/test being relayed to https://httpbin.org/anything as long as the result of the jsonpath query `$.foo` executed on the request body results in the string `bar`.\n\nCheck out an example [here](./examples/github-pr-comment-relay.yaml) for how to use the relay for GitHub PR comments.\n\nYou can also define additional relay mappings via the `additionalConfigs` field:\n\n```yaml\noutbound:\n  listenPort: 8080\n  relay:\n    test:\n      destinationUrl: https://httpbin.org/anything\n      jsonPath: \"$.foo\"\n      equals:\n        - bar\n      additionalConfigs:\n        - destinationUrl: https://example.com/fallback\n```\n\nThe example above would relay traffic to https://httpbin.org/anything if the request body contains `{\"foo\": \"bar\"}`, otherwise, it'd relay traffic to `htttps://example.com/fallback`.\n\nFor other questions or feedback, join us on the [Semgrep Community Slack](https://go.semgrep.dev/slack).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsemgrep%2Fsemgrep-network-broker","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsemgrep%2Fsemgrep-network-broker","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsemgrep%2Fsemgrep-network-broker/lists"}