Add HTTPS proxy configuration utility for canonical IPX capture #203

New issue

Open

opened 2026-09-17 00:19:59 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-17 00:19:59 +00:00

Owner

Operator direction

Direct operator instruction, 2026-09-16: expose the proxy ingest logger like a normal HTTPS proxy and provide utility scripts to configure clients similarly to an intercepting proxy tool.

Scope

Build on the existing canonical mitmproxy/IPX capture path. Do not add a second history/spool/schema authority.

Add a small stdlib-only utility under tools/ipx/ that emits client configuration for a running capture proxy:

shell environment exports (HTTP_PROXY, HTTPS_PROXY, ALL_PROXY);
TLS trust hints (SSL_CERT_FILE, REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE, NODE_EXTRA_CA_CERTS) when a CA file is supplied;
JSON output for tooling/actor integration;
curl invocation prefix for one-off verification;
deterministic proxy URL construction with IPv4/hostname/IPv6 support;
no global trust-store mutation by default;
no secret capture or remote ingest authority in the utility itself.

The existing operation/capture-session/spool identity remains owned by the supervised capture actor/addon. This helper only configures clients to route traffic to that listener.

Acceptance

stdlib unit tests cover shell quoting, IPv6 URL formatting, optional CA variables, JSON output, curl output and invalid ports;
CI executes those tests;
existing tools/ipx/mitmproxy-addon.py remains the canonical lossless exchange writer;
future StarIntel ingest consumes normalized :http-exchange output downstream rather than bypassing the IPX spool.

Related #133, #135, #136, #137, #139.

## Operator direction Direct operator instruction, 2026-09-16: expose the proxy ingest logger like a normal HTTPS proxy and provide utility scripts to configure clients similarly to an intercepting proxy tool. ## Scope Build on the existing canonical mitmproxy/IPX capture path. Do **not** add a second history/spool/schema authority. Add a small stdlib-only utility under `tools/ipx/` that emits client configuration for a running capture proxy: - shell environment exports (`HTTP_PROXY`, `HTTPS_PROXY`, `ALL_PROXY`); - TLS trust hints (`SSL_CERT_FILE`, `REQUESTS_CA_BUNDLE`, `CURL_CA_BUNDLE`, `NODE_EXTRA_CA_CERTS`) when a CA file is supplied; - JSON output for tooling/actor integration; - curl invocation prefix for one-off verification; - deterministic proxy URL construction with IPv4/hostname/IPv6 support; - no global trust-store mutation by default; - no secret capture or remote ingest authority in the utility itself. The existing operation/capture-session/spool identity remains owned by the supervised capture actor/addon. This helper only configures clients to route traffic to that listener. ## Acceptance - stdlib unit tests cover shell quoting, IPv6 URL formatting, optional CA variables, JSON output, curl output and invalid ports; - CI executes those tests; - existing `tools/ipx/mitmproxy-addon.py` remains the canonical lossless exchange writer; - future StarIntel ingest consumes normalized `:http-exchange` output downstream rather than bypassing the IPX spool. Related #133, #135, #136, #137, #139.