CONNECTED TO LOCAL CORE

Traffic, in focus.

Requests00 req/s

Active exchanges0Full body lifetime

Payload transferred0 B↓ 0 B↑ 0 B

Errors05xx / body / cancelled

Cache hit ratio--

Process memory--

WebSocket tunnels0H1 Upgrade 0 · H2 RFC 8441 0 · H3 RFC 9220 0
Established: 0

HTTP/2 requests0Active H2 connections: 0

HTTP/3 requests0

TLS handshake errors0

HTTP protocol mix0.0/sH1 0.0/sH2 0.0/sH3 0.0/s

WebSocket protocol mix0H1 0H2 0H3 0

LIVE TRAFFIC

Requests per second

LIVE

Total 0.0/s HTTP/1.1 0.0/s HTTP/2 0.0/s HTTP/3 0.0/s Transformed 0.0/s

SYSTEM LOAD

- CPU

System RAM-

System swap-

CONNECTION ACTIVITY

0 Open connections

LIVE

Open connections 0Active exchanges 0

RAM cache

HIT / MISS / BYPASS: -
Objects / hot memory: -
Hot / transient cache RAM: -
Fill / cold queue / cold I/O: -
COLD storage / budget: -
Evicted / expired: -

HIT / MISS / BYPASS activity-

HOT RAM usage / limit-

Transient RAM usage / limit-

COLD storage usage / limit-

Process

Platform: -
CPU (100% = 1 core): -
File descriptors / limit: -
OS threads: -
Virtual memory / limit: -
Process start: -
Uptime: -
RSS total: -
HOT cache RAM / limit: -
Cache transient RAM / limit: -
Transform reserved RAM / budget: -
Active transforms / limit: -
Non-cache process RSS: -
Anonymous RSS: -
File-backed / shared RSS: -
Data address space / swap: -
cgroup RAM / limit: -

Process CPU history-

Process RSS history-

Network and responses

OS scope

RX / TX per second: -
Mean exchange duration: -
gzip / br / zstd / deflate: -

RX / TX history-

Traffic by interface-

Response time history-

Backends

Live state: leases cover the entire exchange; traffic is an EWMA of payload bytes.

Vhost	Backend	Status	Active	Requests	Errors	Latency	Traffic/s	Last failure	Last recovery

No backend diagnostics yet.

Reusable access profiles can be attached to multiple vhosts. Per-vhost ACL and country rules remain active and are enforced together with the profile.

REUSABLE POLICY

ACL profiles

Profile configuration

Profile ID Display name Enable IP ACL Default action Country access

IP rules

Paste / import rules

IP rules — one “allow|deny CIDR” per line

Whitespace and invisible Unicode separators are normalized during import.

Countries

Profile and vhost rules are restrictive: a request must pass both policies.

Certificate ID ACME contact email DNS names CA environment

Live cache activityHIT / MISS / BYPASS per second for the selected scope -

Samples

HIT 0.0/s MISS 0.0/s BYPASS 0.0/s

Hot objects--

Hot memory--

Transient cache RAM--

Cold objects--

Cold disk-

Hit ratio--

BYPASS--

Body bytes served from RAM-Domain counters since config revision

Tier moves--

Evicted / expired--

Domains and effectiveness

Show

Limits, fills and evictions are shared. Domain counters reset on configuration publication; purging objects does not reset counters.

Vhost	Domain	Hot	Cold	Hot memory	Cold disk	HIT / MISS / BYPASS	Hit ratio	Decision counters

No cache decisions yet. Send traffic to a configured host.

Stored objects

Most recently used first. Targets, cache keys and Cache-Tag values are visible to authenticated administrators; bodies and request headers are not exposed.

Vhost	Domain	Target	Cache key / tags	Tier	Body	Memory / disk	Overhead	HIT	Age	Remaining TTL	Actions

No fresh objects in this scope. Inspect the decision counters above.

Live transformation activityApplied / cache HIT / skipped / errors per second for the selected scope -

Samples

Applied 0.0/s Cache HIT 0.0/s Skipped 0.0/s Errors 0.0/s

Transformed responses--

Transformed cache HITs-Served without running the transformer again

Bytes saved before compression--

Average reduction-For responses that changed representation

Skipped / fail-open--

Body/transport errors--

Transform RAM reservation--

Active transform slots--

Transformations by type

Type	Applied

Skip / fail-open reasons

No skipped transformations in this scope.

Vhost effectiveness

Counters are in-memory runtime diagnostics. A transformed cache HIT does not execute the transformer again.

Vhost	Applied	Cache HITs	Skipped	Errors	Saved	Reduction	Avg time

No transform activity yet.

Security

Accounts and ACLs are global; SSL and response policies also have per-vhost controls.

ThemeInterface density

HTTP connections

Connection lifecycle and transport limits for HTTP/2 and HTTP/3.

HTTP/2 connections

RESTART

HTTP/2 enablement is controlled per listener. Tune idle, maximum lifetime and graceful GOAWAY drain limits here.

Static response transformation

LIVE APPLY

Enable transformation engine globally

Transformation happens after upstream decoding and before cache storage and client compression. Each vhost must opt in separately.

Resource preset

Presets tune the temporary memory ceiling, maximum transformable response size and global concurrent transformation limit. Content types and extension allow-lists are left unchanged.

Temporary transform memory budget (MiB)

Maximum transformable response (KiB)

Maximum concurrent transformations

JavaScript minification CSS minification HTML minification SVG optimization JSON compaction

Allowed file extensions, one per line

Cache-Control: no-transform is always respected. Transformed representations receive a new ETag and are cached before gzip, Brotli or zstd encoding.

JSON / ASYNC / BOUNDED

Structured access logging

LIVE APPLY

Live log viewing stays in memory. External sinks run on a bounded background queue and never block proxy request I/O.

JSON file

Enabled Separate file per vhost File path Per-vhost directory

When enabled, each vhost writes to its own JSONL file. Unmatched traffic uses _unmatched.jsonl.

Logstash

Enabled TCP address

Loki

Enabled Push URL Bearer token environment variable Labels (JSON object)

Error file

Enabled Error log path Format

Only ERROR events are written. Rotation is handled by system logrotate.

Configurable JSON format

Map output names to source fields. Leave mapping empty for the complete standard entry.

Format preset

Visual field builder

Advanced JSON mapping

Field mapping (JSON object) Static fields (JSON object)

Administration panel

RESTART

HTTPS allows the administration listener to bind beyond loopback. Listener and certificate changes take effect after restart.

Listen address Enable HTTPS for administration Certificate Allowed DNS hostnames Administrator session lifetime (days)

Browser sessions use an absolute 7–30 day lifetime.

Runtime information

API

Reported by the running RustProxy process and available only from the authenticated administrator status API.

Platform-

Statistics source-

Data directory-

Database-

Certificate API

SCOPED TOKENS

Separate Key ID + Bearer Token credentials can only deploy or reload externally managed certificates. They cannot read configuration or use other administration APIs.

Key ID Comment Bearer token (optional custom value)

Each cleartext token is shown only after generation/rotation. RustProxy stores only its hash.

Copy this token now

External automation sends the Key ID header and Bearer token to the certificate deploy/reload endpoints over HTTPS (or loopback HTTP).

Security

Access stays deliberate.

Sessions, credentials and host access policies in one place.

CURRENT SESSION

Lost access? Run rust-proxy admin reset-password locally. Existing sessions will be revoked.

Change passwordRequires the current password and signs out all sessions.

ACCESS CONTROL

Host access policies

Keep the policy list visible; open the editor only when adding or changing a rule set.

Add / replace host policyHostname scope, default action and CIDR rules.

Hostnames and aliases, comma-separated Default decision Rules: allow/deny followed by CIDR, one per line

Deny wins. Route allow never overrides host deny. The socket client IP is used.

CACHE

Active BAN rules

ID	Selector	Value	Host	Vhost	Expires	Actions

No active BAN rules.

WEBSOCKET / CONNECT

Active WebSocket / tunnels

Close reason

ID	Client	Host	Upstream	Protocol	Duration	RX	TX	Actions

No active tunnels.

SQLITE / LAST 100 / RETAINED 10,000

Administration audit

Recent administration changes are loaded only when this window is opened.

Time	Actor	Action	Detail

No audit entries.

Live access logs

ACTIVITY

Access log

Columns

Time	Request	Host	Source IP	Vhost	Backend	Status	Duration	Cache	Outcome	Transport	WebSocket	Upstream error

No traffic yet. Open the proxy to make your first request.

Live view starts with the latest 256 completed exchanges. Increase buffer to keep accumulating live entries up to 4096 until the log window is closed.

Visual field builder

CONFIGURABLE JSON

Select source fields and optionally rename their JSON keys. Changes are written to the advanced JSON mapping when applied.

Fields

Enabled	Source field	Output JSON key

Your traffic.Your control.

Sign in

Traffic, in focus.

Requests per second

- CPU

0 Open connections

RAM cache

Process

Network and responses

Backends

Virtual hosts

Docker vhosts

Redirect hosts

404 hosts

Streams

ACL profiles

Profile configuration

Domains and effectiveness

Stored objects

Transformations by type

Skip / fail-open reasons

Vhost effectiveness

Public listeners

HTTP connections

HTTP/2 connections

HTTP/3 / QUIC

Docker agents

Client response

Diagnostic headers

Streaming compression

Cache

Memory sizing

Request collapsing

Stale-if-error policy

Proactive refresh

COLD policy preset

Static asset cache boost

Static response transformation

Resource preset

Global custom headers

Response to client

Request to backend

Client identity / forwarding

Default responses