SocketX Server
SocketX Server is a WebSocket proxy written in Go. It terminates the SocketX/MTE-protected WebSocket connection from a SocketX client, decodes client payloads inside the proxy, and forwards plaintext WebSocket frames to the configured upstream WebSocket service. Responses from the upstream service are encoded with MTE before they are sent back to the client.
If the configured upstream URL uses wss://, the proxy-to-upstream leg is protected by TLS. If it uses ws://, that leg is plaintext.
Features
- SocketX/MTE client protection: Wraps WebSocket payloads in the SocketX protocol and uses the Eclypses MTE library for encode/decode operations between client and proxy.
- Dynamic upstream routing: Maps the incoming request
Hostheader to a configured upstream WebSocket URL. - Host and origin allow-listing: Validates each connection against
DOMAIN_MAPbefore upgrading to WebSocket. - Post-quantum handshake: Establishes an MTE encoder/decoder pair with a Kyber key exchange before proxying application data.
- Text and binary frame support: Preserves WebSocket text and binary message semantics through SocketX message type mapping.
- Connection audit logging: Emits structured logs for MTE operations and connection close summaries.
- Graceful shutdown: Handles
SIGINTandSIGTERMfor clean connection teardown.
Get Started
Configuration
Environment variables and the DOMAIN_MAP format.
Deploy on AWS
ECS, EKS, and Marketplace images.
Deploy on Azure AKS
AKS cluster extension and Helm chart.
Deploy on Oracle Cloud
OKE, Container Instances, and compute VMs.
Deploy On-Premise
Docker, Docker Compose, and Kubernetes.
Observability
Structured logs, audit events, and Grafana dashboards.
Health Check
SocketX exposes a simple HTTP endpoint:
curl http://localhost:8080/api/socketx-echo?msg=test
Expected response:
{
"message": "test",
"timestamp": "<RFC3339 timestamp>"
}
Without msg, the endpoint returns "message": "true".
Support
For assistance, contact Eclypses Support:
Monday-Friday, 8:00 AM-5:00 PM MST, excluding holidays.