Airlock Proxy Service is an identity-aware proxy with a built-in web interface. Key capabilities:
- Authenticating users through SSO or local credentials for SSH and Windows desktop access via the web interface.
- Intercepting traffic over SSH, Kubernetes, HTTPS, and database protocols with client authentication verification.
- Recording commands, API calls, and requests and sending them to the audit log.
- Reverse tunnels for connecting servers and proxies behind firewalls.
- TLS routing — multiplexing all ports and protocols onto a single TLS port.
A minimal Airlock cluster consists of Auth Service and Proxy Service. In a home lab, both services can be run from a single airlock binary.
Web interface
In the web interface, Proxy Service uses WSS (secure WebSockets) to proxy the target resource — an SSH server or desktop.
When using the web interface, Proxy Service terminates TLS traffic and reformats data for the client connection.
Identity-Aware Proxy (IAP) mode
In IAP mode, users initiate SSO or local login to sign public keys on the client machine.
IAP mode is considered more secure than web interface access: private keys never leave the client, the connection to the resource is mutually authenticated, and the browser is used less — reducing the risk of CSRF attacks and cookie theft.
Tunnels
In this mode, resources behind a firewall establish reverse tunnels to the proxy. The proxy forwards client connections to target resources through these tunnels.
For example, a user connects to a Kubernetes cluster behind a firewall through two tunnels.
All described modes are enabled in Proxy Service by default. No special configuration is required unless you need to disable individual modes.
Multiple Proxy Service instances
An Airlock cluster can include multiple Proxy Service instances running in parallel. This is the standard approach for scaling and improving fault tolerance.
| Goal | How multiple proxies help |
|---|---|
| Availability | A single node failure does not block access: traffic switches to remaining instances |
| Load distribution | A load balancer distributes user sessions and connections across proxies |
| Latency | Proxies in different data centres or regions shorten the path to users and agents |
Users connect to a single address (for example, https://airlock.example.com) through a load balancer. When agents register, they open reverse tunnels to all Proxy Service instances in the cluster, so any proxy can route traffic to the required agent.
The load balancer must use round-robin (or equivalent without session affinity). Sticky sessions are not suitable for Proxy Service.
For more on connecting agents to multiple proxies: join token.