Add support for HTTPS proxy URLs in Fluent Bit

[antoniomrfranco]

Hello everyone,

The current version of Fluent Bit restricts the proxy scheme to http, as it does not currently implement TLS for the proxy connection. I opened this PR to add support for the https scheme in proxy URLs.

When https is used in the proxy URL, Fluent Bit first establishes a TLS connection to the proxy endpoint. If the destination URL is also https, Fluent Bit can then send a CONNECT request through that TLS-terminated proxy connection and establish a second TLS session through the tunnel to reach the destination server.

For example:

Fluent Bit
  -> TLS connection to proxy endpoint
    -> CONNECT s3.us-east-1.amazonaws.com:443
      -> TLS connection through the tunnel
        -> https://s3.us-east-1.amazonaws.com

In other words, this allows a setup like:

Fluent Bit
  -> https://proxy.example.com
    -> CONNECT s3.us-east-1.amazonaws.com:443
      -> https://s3.us-east-1.amazonaws.com

I understand that using TLS for the client-to-proxy connection does not necessarily add a significant security benefit when the destination traffic is already encrypted. However, I have seen some enterprise environments requiring or standardizing on TLS-terminated proxy endpoints.

One example would be a highly available proxy deployment where a load balancer terminates TLS in front of multiple proxy instances:

Fluent Bit
  -> TLS connection to AWS NLB / load balancer
    -> proxy instance 1
    -> proxy instance 2
    -> proxy instance N
      -> CONNECT destination:443
        -> destination server

In this kind of setup, the proxy URL exposed to clients is still https://proxy.example.com, even if the traffic from the load balancer to the backend proxy instances uses plain HTTP internally. AWS Network Load Balancer supports TLS listeners/TLS termination, which makes this a realistic deployment pattern for high availability.

This is also consistent with what many HTTP clients and libraries already support today. For example, urllib3 documents support for both HTTP and HTTPS proxies, where the HTTPS proxy case means establishing a TLS connection to the proxy first.

I’d appreciate any feedback and would love to have this considered for a future release.

Thanks!