v0.35.1: performance, AGPL licensing and documentation overhaul
- Web Server reads static files inline; proxy middleware chain flattened - About window with license summary and project links; AGPL-3.0-or-later - Rewritten documentation: feature list, screenshots, performance guide - Fix false spikes in per-Vhost request-rate charts
This commit is contained in:
gru committed
1 parent
d3b492874b
commit
eba9f89283
135 files changed
+1425
-1064
No files matched your search
@@ -0,0 +1,105 @@
|
||||
# Feature list
|
||||
|
||||
RustProxy is a single service that combines a reverse proxy, a static/PHP web server, certificate management, an HTTP cache and traffic monitoring, all managed from a browser panel or an API. Optional features are disabled by default; enable only what you need.
|
||||
|
||||
|
||||
|
||||
## Reverse proxy
|
||||
|
||||
| Feature | Details |
|
||||
|---|---|
|
||||
| Vhosts | Exact and wildcard hostnames, aliases, several listeners per Vhost, per-Vhost HTTP/2 and HTTP/3 switches |
|
||||
| Backends | HTTP and HTTPS origins, HTTP/1.1, automatic ALPN (H2/H1), strict HTTP/2 and H2C, optional upstream certificate verification with custom CA and server name |
|
||||
| Load balancing | Least connections (default), round robin, least traffic, adaptive and IP hash; member weights, backup and draining members, sticky cookie or IP affinity |
|
||||
| Health checks | Active TCP or HTTP probes with thresholds and live health status per member |
|
||||
| Connection reuse | Bounded keep-alive pools with idle and age limits, pool recycling and protocol telemetry |
|
||||
| Custom locations | Prefix, exact and regex paths, path rewriting, per-location backends, Web Services, local responses, redirects and internal error fallbacks |
|
||||
| WebSockets | HTTP/1.1 Upgrade, RFC 8441 (HTTP/2) and RFC 9220 (HTTP/3) Extended CONNECT |
|
||||
| Forwarding headers | `X-Forwarded-*`, `Forwarded`, `X-Real-IP`, trusted proxy ranges, Cloudflare client IP and country |
|
||||
| Redirects and pages | Redirect hosts, canonical host and HTTPS redirects, 404 hosts, custom error pages and direct-IP pages |
|
||||
| TCP/UDP Streams | Layer-4 forwarding with backend pools, health checks, session limits and idle timeouts |
|
||||
|
||||
## Frontends and TLS
|
||||
|
||||
- HTTP/1.1, HTTPS with HTTP/2, optional HTTP/3 (QUIC) with `Alt-Svc` management and configurable UDP buffers.
|
||||
- Named listeners with per-listener protocols; Vhosts bind to listener IDs.
|
||||
- TLS 1.2/1.3 policy with cipher-suite allowlist and per-Vhost overrides.
|
||||
- Optional hybrid post-quantum key exchange (X25519MLKEM768).
|
||||
- SNI certificate selection, hot certificate reload without restart.
|
||||
|
||||
## Web Server
|
||||
|
||||
- Static sites and downloads served from reusable **Web Services** shared by several Vhosts.
|
||||
- Index files, optional directory listing, MIME mapping and attachment extensions.
|
||||
- `try_files`, regex rewrites and a safe subset of Apache `.htaccess` rules.
|
||||
- Conditional requests (`ETag`, `Last-Modified`), byte ranges, precompressed `.br`/`.gz` sidecars and optional Linux `sendfile`.
|
||||
- Symlink policy, attack-probe blocking and header hardening presets.
|
||||
- PHP through external PHP-FPM with shared profiles, per-application pools and resource limits.
|
||||
- Presets for single-page apps, WordPress and Roundcube.
|
||||
|
||||
|
||||
|
||||
## Certificates
|
||||
|
||||
- Self-signed certificates, PEM import and externally managed certificate paths (for example Certbot).
|
||||
- Managed ACME with HTTP-01 and DNS-01 (Cloudflare, OVH, RFC 2136), automatic renewal and job history.
|
||||
- Certificate inventory with expiry, coverage check and bulk assignment to Vhosts.
|
||||
- Restricted certificate API keys for deploy/reload from external systems such as OPNsense.
|
||||
|
||||
|
||||
|
||||
## Access and security
|
||||
|
||||
- IP/CIDR and DNS/DDNS allow/deny rules, reusable ACL profiles (up to eight per Vhost).
|
||||
- Country allow/deny lists with automatic GeoIP database updates.
|
||||
- Request rate limiting per Vhost and globally, with burst and `Retry-After`.
|
||||
- HTTP method policy, request Content-Type denylist and User-Agent blocking.
|
||||
- Security headers: HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, `nosniff`.
|
||||
- HTTP Basic authentication with Argon2 hashes and brute-force limits.
|
||||
- Forward Auth with Tinyauth, Authelia and authentik; OIDC (Authorization Code + PKCE) with Authelia, authentik, Pocket ID and compatible providers.
|
||||
- Fail-closed authentication errors, identity header stripping and private/no-store responses for authenticated content.
|
||||
- Protection against private/loopback/control-plane upstream destinations unless explicitly allowed.
|
||||
|
||||
## Cache and delivery
|
||||
|
||||
- Shared HTTP cache with a memory tier (HOT) and an optional disk tier (COLD).
|
||||
- RFC 9111 freshness, validators and `Vary`; stale-while-revalidate, stale-if-error and request coalescing.
|
||||
- Varnish-compatible policy option, forced caching rules and per-location cache switches.
|
||||
- RFC 9211 `Cache-Status` and optional `X-Cache` diagnostics.
|
||||
- Purge and ban from the panel, the API or HTTP PURGE/BAN from allowlisted addresses.
|
||||
- Live compression with gzip, Brotli, Zstandard and deflate.
|
||||
- Optional minification of JavaScript, CSS, HTML, SVG and JSON with memory budgets.
|
||||
|
||||
|
||||
|
||||
## Monitoring and logs
|
||||
|
||||
- Overview dashboard with requests per second, bandwidth, status codes, cache hit ratio, protocol mix, system load and backend health.
|
||||
- Customizable dashboard layouts and saved presets.
|
||||
- Per-Vhost, per-backend, per-Web-Service and per-Stream statistics.
|
||||
- Live request log in the browser and in the terminal (`--livelogs`).
|
||||
- Stored JSON access logs with search syntax, per-Vhost log files and an error log.
|
||||
- Prometheus exporter with token/CIDR protection, JSON metrics and a compact summary endpoint.
|
||||
- Grafana dashboard and Nagios checks included.
|
||||
|
||||
|
||||
|
||||
## Operations
|
||||
|
||||
- Configuration stored in SQLite or in a JSON file, with validation before activation and hot reload.
|
||||
- Revision history with diff and one-click restore.
|
||||
- Encrypted full backups and validated offline restore; encrypted Secret Store for credentials.
|
||||
- Docker discovery through a separate agent: publish containers as Vhosts with one switch.
|
||||
- Nginx Proxy Manager import with a dry-run plan.
|
||||
- Managed install/update scripts with rollback, DEB/RPM packages, Docker image and an OPNsense plugin.
|
||||
- Panel in English and Polish, light and dark themes, adjustable density and corner style.
|
||||
|
||||
## Administration and API
|
||||
|
||||
- Panel served on a separate, loopback-only listener by default; optional HTTPS for remote administration.
|
||||
- Single administrator with Argon2 password, session revocation and CSRF/Origin protection.
|
||||
- Complete REST API described by a bundled OpenAPI schema with Swagger UI at `/docs`.
|
||||
- Scoped `ro`/`rw` API tokens bound to IP allowlists.
|
||||
- Command-line tools for setup, configuration, certificates, backups and live logs.
|
||||
|
||||
See the [screenshots](SCREENSHOTS.md) for a visual tour and the [documentation index](README.md) for detailed guides.
|
||||
Reference in new issue
Block a user