RustProxy 0.34.9

RustProxy combines a reverse proxy, static/PHP web server, certificate management and traffic monitoring in one service with a browser administration panel. It supports several domains and backends without requiring a separate proxy configuration language.

Main capabilities

Area	Available features
Reverse proxy	HTTP/HTTPS origins, HTTP/1.1 and HTTP/2 upstream modes, health checks, load balancing, connection reuse, WebSockets, path-based routing, retries and error fallbacks
Frontends	HTTP, HTTPS, HTTP/2, optional HTTP/3 (QUIC), named listeners, domain and wildcard routing, redirects, TLS certificates
Web Server	Static content, downloads, directory/index policy, rewrite and try_files, selected .htaccess rules, optional PHP-FPM, application presets
Access	IP/CIDR and DNS/DDNS rules, country restrictions, reusable ACLs, rate limits, method rules, Basic Auth, Tinyauth, security headers
Delivery	Optional shared HOT/RAM and COLD/disk cache, cache invalidation, compression, response transformations, static-file optimizations
Integrations	Docker discovery via separate agents, TCP/UDP Streams, ACME certificate providers, Prometheus, Grafana/Nagios examples and administration API
Operations	Dashboard presets, traffic analytics, live/stored logs, configuration history, encrypted backups and certificate reloads

Features and default settings vary by component; configure only the capabilities you need. The documentation index covers each workflow, including prerequisites, security boundaries, troubleshooting and API access.

0.34.9 — experimental PQC (source candidate)

• Settings → TLS policy: opt-in experimental TLS 1.3 hybrid post-quantum key exchange (X25519MLKEM768), using aws-lc-rs only for enabled frontend TLS policies. Classic key-exchange groups remain enabled for client compatibility. Off by default; cipher-suite choices remain separate. HTTP/3 and per-vhost TLS overrides follow the selected policy. Details and rollback: TLS PQC guide (also in the authenticated panel Reader).

0.34.8

• Docker vhosts: automatic hostname uses the container name, without image or port suffix; prior auto-generated names are updated while custom names and aliases are preserved. Docker Agent 1.0.1.

0.34.7

• Settings → Cache: Varnish-inspired cache policy (on by default) ignores hard-reload no-cache / max-age=0 / Pragma: no-cache for fresh HITs, without disabling only-if-cached, no-store, max-stale or min-fresh. Public origin no-cache responses can use an explicit fallback TTL; other responses retain revalidation, stale-if-error, Surrogate-Control vetoes and privacy protections. The behavior is explained by an i icon next to the setting. See Cache for examples and safety implications.

0.34.6

• Docker vhosts: Live logs beside Open app opens the existing HTTP access-log viewer, filtered to the selected generated Docker vhost and its aliases. These are RustProxy request logs, not container stdout/stderr. Open app honors HTTPS and nonstandard listener ports.
• Publish switch: a compact neutral on/off control in the existing panel theme, without a pill container or green fill. It saves immediately and rolls back on failure.
• Ordinary Vhosts → Security: optional request Content-Type denylist with exact MIME types and type/* wildcards. Matching requests receive 403 before PHP-FPM, Web Server, reverse proxy, custom locations or cache. Docker vhost configuration remains unchanged.

0.34.5

• Administration UX refinements: clearer grouping for Web Server delivery and PHP-FPM controls, Stream backend and health-check settings, and Redirect/404 host identity versus frontend certificate options.
• Stream backend probe settings are hidden while health checks are off, and disabled Web Server fields now have a consistent muted appearance. Both UI languages are supported.
• UX follow-up: Vhost transform/cache overrides now place checkboxes directly above their textareas; inline Vhost IP rules live with ACL profiles under Security. Web Server preset hardening controls and refresh interval grids have clearer alignment, and System information keeps the statistics source without the separate process block.
• More controls (including the authenticated documentation/Swagger page) follow the saved corner style. Configuration keys, API payloads and proxy behavior are unchanged.
• Published Docker vhosts now expose collapsed, Vhost-style traffic statistics and a single toolbar button to expand or collapse the statistics for all published Docker services.

0.34.4

• Docker vhosts: SHA-256 certificate fingerprints wrap correctly in mobile agent details.
• Ordinary and Docker vhosts support up to eight ACL profiles with deterministic explicit deny priority and merged explicit allows, while keeping standalone ACL layers restrictive. Existing singular ACL configuration remains supported.
• Certificate-to-domain mismatch can be explicitly accepted per ordinary or Docker vhost (with a warning/confirmation); normal validation stays enforced without this override, and TLS clients may still reject the certificate.
• Editor layout: SSL certificates and TLS settings are separate; Vhost traffic/security, WebSockets, balancing and location access options are grouped by purpose. Docker certificate overrides appear under the backend IP choice, and common controls respect the dashboard corner style.

0.34.3

• HTTP/3 now explicitly requests 4 MiB effective UDP receive and send buffers per QUIC listener (configurable as udp_receive_buffer_bytes and udp_send_buffer_bytes in Settings > HTTP/3). On Linux the kernel can cap them using net.core.rmem_max / net.core.wmem_max; RustProxy logs the effective values and a warning if the target is not met. Setting either value to 0 leaves the OS default. Changing UDP buffers requires service restart.
• HTTP/3 Alt-Svc response headers follow saved policy immediately; turning off an already-bound H3 service emits Alt-Svc: clear. New QUIC handshakes pick up modified stream/idle limits without socket rebinding. Increasing the connection cap beyond the startup bound or changing the UDP endpoint still requires restart. QUIC bulk-transfer diagnostic snapshots are available at debug log level.
• The Overview has an optional, hidden-by-default cumulative cache-outcome bar showing HIT, MISS, BYPASS and OTHER request counts and percentages since service start. Enable it in the dashboard layout editor when needed. This complements the existing cumulative HIT/MISS donut and separate recent cache trend chart. OTHER denotes HTTP requests without a cache decision. Percentages use all HTTP requests, unlike the HIT/MISS donut. The upper-right counter displays only the lifetime HTTP request count; its full meaning is available on hover or to assistive technology.

0.34.2

• Added read-only pull-based JSON monitoring at /api/metrics/json (admin session or General API token) and at the enabled Prometheus exporter path with .json suffix (same exporter bearer/CIDR policy). Includes Overview-style metrics and all existing Prometheus sample families without SSE. Compact precomputed dashboard metrics are available at /api/metrics/summary, under summary in the full JSON, and at the exporter path with .summary.json suffix. This includes readiness counts, RPS, transfer/second and system/cache percentages.
• Settings → Manual config displays the active configuration storage mode, its path and the SQLite history location for file-backed mode.
• Documented optional systemd --config /etc/rustproxy/config.json deployment with file/directory ACLs, write access for atomic panel saves and reload instructions.
• Public Web Server errors reuse embedded application-style HTML templates (or a matching fallback for statuses without a dedicated page). Proxy-generated non-template errors use standard HTTP status text; neither leaks internal RustProxy: diagnostics. Origin error bodies and custom error pages remain configurable.

0.34.1

• An explicit --config /absolute/path/config.json (or RUST_PROXY_CONFIG) makes an existing JSON document the active configuration source. Panel saves and configuration-history restores write back to that file, with SQLite retaining revision/audit data. Out-of-band file changes require an explicit reload; concurrent edits are rejected.
• rust-proxy reload / rust-proxy config reload and the example systemd ExecReload perform configuration and certificate refresh without terminating the service; listener changes can still require a restart.
• Panel-managed, one-time-displayed administration API Bearer tokens with ro/rw permissions and mandatory source-IP/CIDR restrictions. Browser login remains available; certificate-only tokens are separate.
• Bulk assignment of Vhosts to a certificate; a single Save and lock control for unlocked Overview layout.
• Panel-managed Prometheus token issuance, rotation and revocation with one-time display. Existing environment-token configuration remains a compatibility fallback until a generated credential or revocation record replaces it.

Installation

Use the maintained packages where available:

• Linux DEB/RPM: https://rustproxy.linuxiarz.pl/
• OPNsense: https://rustproxy-opn.linuxiarz.pl/
• Docker hosts (optional agent, Linux DEB/RPM): install rustproxy-docker-agent independently; see Docker discovery.

For Debian 13+ source installation, manual compilation, managed updates or Docker, see Installation and updates.

Typical managed Linux defaults: HTTP on :80, HTTPS on :443, local administration at http://127.0.0.1:9090, private data in /var/lib/rustproxy. The initial public certificate is self-signed. There is no default administrator password. Initialize administration locally and assign trusted certificates before public use.

Updated Linux service templates allow read-only access to static website roots under /home, /var/www and /srv using Unix groups or ACLs without per-directory systemd overrides. The service still runs unprivileged with ProtectSystem=strict; external certificate paths have stricter trust/owner checks. See Linux filesystem access.

First configuration

1. Install and start the service, then initialize the administrator using the local CLI.
2. Open the panel and review Settings → Listeners, administration access and certificates.
3. Create a Vhost with a domain name and a reachable HTTP backend or Web Service.
4. Confirm frontend TLS, backend health, access permissions and routing.
5. Enable additional cache, compression, Docker or monitoring functions as needed; inspect Overview, Logs and Cache for results.

Guides

• Installation · Settings · Vhosts · Web Server · PHP-FPM
• Certificates · Cache · Response delivery · Docker discovery · Monitoring
• Security · API · Troubleshooting
• Changelog · Roadmap

The authenticated /docs page includes the guides and a separate interactive OpenAPI/Swagger tab.

Status of this source archive

Version 0.34.9 is provided as a source-only experimental candidate. PQC dependencies were provisionally locked using published crate metadata, not checked by Cargo in the packaging environment. Run cargo metadata --locked, cargo check --locked --all-targets, cargo test --locked --all-targets and protocol compatibility checks on your target system before production deployment. See Installation and Roadmap.