🔐 技術調査 - OneCLI

type InjectionConfig = {
  headerName: string;   // 必須: 注入先の HTTP ヘッダー名
  valueFormat: string;  // 省略時は "{value}" がデフォルト
};

git clone https://github.com/onecli/onecli.git
cd onecli
docker compose -f docker/docker-compose.yml up

docker run --pull always \
  -p 10254:10254 \
  -p 10255:10255 \
  -v onecli-data:/app/data \
  ghcr.io/onecli/onecli

git clone https://github.com/onecli/onecli.git
cd onecli
mise install          # Node.js、pnpm などを自動インストール
pnpm install
cp .env.example .env
pnpm db:generate      # Prisma クライアント生成
pnpm db:up            # PostgreSQL を Docker で起動
pnpm db:migrate       # マイグレーション実行
pnpm dev              # Web + Gateway を同時起動

node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"

curl -x http://localhost:10255 \
  -H "Proxy-Authorization: aoc_YOUR_TOKEN" \
  -H "x-api-key: FAKE_KEY" \
  https://api.anthropic.com/v1/messages \
  -d '{"model": "claude-3-5-sonnet-latest", ...}'

# CA 証明書のダウンロード（初回のみ）
curl http://localhost:10254/api/gateway/ca -o /tmp/onecli-gateway-ca.pem

# 環境変数の設定
export HTTPS_PROXY=http://x:aoc_YOUR_TOKEN@localhost:10255
export HTTP_PROXY=http://x:aoc_YOUR_TOKEN@localhost:10255
export NODE_EXTRA_CA_CERTS=/tmp/onecli-gateway-ca.pem

import os
import openai
import httpx

os.environ["REQUESTS_CA_BUNDLE"] = "/tmp/onecli-gateway-ca.pem"

client = openai.OpenAI(
    api_key="FAKE_KEY",
    http_client=httpx.Client(
        proxies={"https://": "http://x:aoc_YOUR_TOKEN@localhost:10255"},
    ),
)

import os
from langchain_anthropic import ChatAnthropic

os.environ["HTTPS_PROXY"] = "http://x:aoc_YOUR_TOKEN@localhost:10255"
os.environ["REQUESTS_CA_BUNDLE"] = "/tmp/onecli-gateway-ca.pem"
os.environ["ANTHROPIC_API_KEY"] = "sk-ant-placeholder"

llm = ChatAnthropic(model="claude-3-5-sonnet-20241022")
response = llm.invoke("Hello!")

# docker-compose.yml の n8n サービスに追加
services:
  n8n:
    image: docker.n8n.io/n8nio/n8n
    environment:
      - HTTPS_PROXY=http://x:aoc_YOUR_TOKEN@onecli:10255
      - NODE_EXTRA_CA_CERTS=/tmp/onecli-gateway-ca.pem
      - NODE_USE_ENV_PROXY=1
      - ANTHROPIC_API_KEY=sk-ant-placeholder
    volumes:
      - /tmp/onecli-gateway-ca.pem:/tmp/onecli-gateway-ca.pem:ro

# Dify の docker-compose.override.yml
services:
  api:
    environment:
      - HTTPS_PROXY=http://x:aoc_YOUR_TOKEN@onecli:10255
      - REQUESTS_CA_BUNDLE=/tmp/onecli-gateway-ca.pem
      - ANTHROPIC_API_KEY=sk-ant-placeholder
    volumes:
      - /tmp/onecli-gateway-ca.pem:/tmp/onecli-gateway-ca.pem:ro

import { OneCLI } from "@onecli-sh/sdk";

const onecli = new OneCLI({
  url: "http://localhost:10254",
  apiKey: "oc_your_api_key",
});

// Docker 引数にプロキシ設定を自動注入
const args = ["run", "-i", "--rm", "n8nio/n8n"];
await onecli.applyContainerConfig(args);

docker run -d \
  -p 10254:10254 \
  -p 10255:10255 \
  -v onecli-data:/app/data \
  ghcr.io/onecli/onecli

# ログの確認
docker logs onecli --follow

# 主要なログイベント
# CONNECT リクエスト
# INFO onecli_gateway::gateway: CONNECT peer=172.17.0.2:54321 host=api.anthropic.com:443 mode=mitm rule_count=1

# MITM フォワードリクエスト
# INFO onecli_gateway::gateway: MITM method=POST url=https://api.anthropic.com:443/v1/messages status=200 injections_applied=1

# トンネル終了
# INFO onecli_gateway::gateway: tunnel closed host=api.github.com:443 client_to_server=1024 server_to_client=2048

docker run ... -e RUST_LOG=debug ghcr.io/onecli/onecli

# エージェントはダミーキーを設定する
OPENAI_API_KEY=FAKE_KEY
# プロキシが本物のキーに置換して転送する

docker run -d \
  -e PORT=8080 \
  -e PROXY_PORT=8081 \
  -p 8080:8080 \
  -p 8081:8081 \
  -v onecli-data:/app/data \
  ghcr.io/onecli/onecli

curl http://localhost:10255/healthz

docker logs <container_id>

# ダミーキーでプロキシ経由リクエストを送信し、本物のキーが注入されるか確認する
curl -x http://localhost:10255 \
  -H "Proxy-Authorization: Bearer aoc_YOUR_TOKEN" \
  https://api.target-service.com/endpoint