Method fetchDedup

cmd/cache-proxy/proxy.go:358–386

fetchDedup tries peers then origin, deduplicating concurrent fetches. On success the body has been committed to local disk under cacheKey; the caller serves it by streaming from the file. Nothing here holds the body in memory.

(cacheKey string, r *http.Request, rangeHeader string)

	"upgrade":             true,
}

// cachePassthroughHeader is added only by duckgres's worker-local router.
// It selects the proxy's observable-but-uncached request path and is stripped
// before the origin request so it cannot affect S3 or a SigV4 request.
const cachePassthroughHeader = "X-Duckgres-Cache-Passthrough"

func isInternalPropagationHeader(header string) bool {
	return strings.EqualFold(header, "traceparent") || strings.EqualFold(header, "tracestate")
}

// HandleProxy handles forward HTTP proxy requests from DuckDB httpfs.
// Expects absolute-form URIs (scheme + host + path in the request-line).
func (p *CacheProxy) HandleProxy(w http.ResponseWriter, r *http.Request) {
	inflightRequests.Inc()
	defer inflightRequests.Dec()
	r = r.WithContext(otel.GetTextMapPropagator().Extract(r.Context(), propagation.HeaderCarrier(r.Header)))

	// HTTPS via CONNECT tunnel — we can't cache encrypted traffic, but we must
	// still tunnel it so DuckDB can reach external HTTPS sources (e.g.
	// read_parquet('https://datasets.clickhouse.com/...')) while
	// http_proxy is set globally.
	if r.Method == http.MethodConnect {
		p.handleConnect(w, r)
		return
	}

	if r.URL.Scheme == "" || r.URL.Host == "" {
		http.Error(w, "expected forward-proxy absolute-form URL", http.StatusBadRequest)
		return
	}

	// Non-GET (HEAD, etc.) is never cached — forward and return.