New: gRPC Transform API
iron-proxy now supports delegating request/response handling to external gRPC servers via a new grpc transform. Build custom policy engines, request loggers, or body rewriters as standalone services and plug them into the pipeline.
transforms:
- name: grpc
config:
name: "policy-engine"
target: "localhost:9500"
send_request_body: true
send_response_body: true
rules:
- host: "api.openai.com"
methods: ["POST"]
paths: ["/v1/*"]Features:
- One server per transform entry. Chain multiple gRPC backends by adding multiple entries. They run in pipeline order.
- Selective routing via rules. Same host/CIDR/methods/paths syntax as the allowlist. Requests that don't match skip the gRPC call entirely.
- Body control. send_request_body and send_response_body opt in to forwarding bodies over gRPC. Bodies are capped by the global max_request_body_bytes / max_response_body_bytes settings.
- TLS support. Plaintext by default; enable TLS with optional custom CA and mTLS client certs via tls.enabled, tls.ca_cert, tls.cert, tls.key.
The proto schema lives in proto/transform/v1/transform.proto. Generated Go code is in gen/transform/v1/. Codegen uses https://buf.build.
Other changes
- Global body buffer limits. New proxy.max_request_body_bytes (default 1 MiB) and proxy.max_response_body_bytes (default uncapped) control how much transforms can buffer. Bodies are buffered incrementally as transforms read them and automatically rewound between pipeline stages.
- Streaming response writes. Response bodies are no longer fully buffered into memory before writing to the client. The proxy streams directly from the buffer and then the upstream connection.