Route Monit's HTTPS Collector Traffic Through a Local SOCKS Relay

A local TCP relay can carry Monit's HTTPS reports through SOCKS without becoming the TLS endpoint. The routing must preserve the collector's name for HTTPS while giving the relay its real destination address.

Suppose the collector is collector.example at 203.0.113.40:443. For an existing socat-based arrangement, the relay has this shape:

socat TCP4-LISTEN:9900,bind=127.0.0.1,reuseaddr,fork \
  SOCKS4:socks.example:203.0.113.40:443,socksport=1080

Here 127.0.0.1:9900 accepts Monit's local connection. socks.example:1080 is the SOCKS4 server, which is asked to connect to the real collector address on port 443. Replace all documentation addresses with the deployment's values.

Resolve the collector name to that listener locally, and keep the name in monitrc:

127.0.0.1 collector.example

set mmonit https://monit:[email protected]:9900/collector

The first line is a hosts-file entry; the second is the Monit configuration. Use the real collector credentials with the required URL encoding. A hosts-file mapping also affects other applications using that name on the machine.

The HTTPS handshake still belongs to the collector, so retain its hostname and the intended certificate verification policy. Changing the URL to localhost changes the identity Monit asks to verify.

The relay deliberately uses the collector's real IP rather than looking up the name remapped to loopback. Update that IP when the collector address changes. Keep the listener available as part of the reporting path; fork gives accepted relay connections separate handling.