gru/RustProxy
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v0.35.1: performance, AGPL licensing and documentation overhaul

Browse Source 
- Web Server reads static files inline; proxy middleware chain flattened
- About window with license summary and project links; AGPL-3.0-or-later
- Rewritten documentation: feature list, screenshots, performance guide
- Fix false spikes in per-Vhost request-rate charts
This commit is contained in:
gru committed 2026-11-05 18:29:56 +01:00
1 parent d3b492874b
commit eba9f89283
135 files changed
+1425 -1064
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/INSTALL.md
+29 -10
View File
@@ -11,7 +11,7 @@ Use maintained packages whenever possible. For custom installations, use the scr
| OPNsense plugin | https://rustproxy-opn.linuxiarz.pl/ |
| Debian 13+ source bootstrap | `install-debian13.sh` from the project repository |
| Manual Linux/systemd install | Compile the application; use `install.sh` and `update.sh` |
| OCI container | Included `Dockerfile`; see [Container](CONTAINER.md) |
| OCI container | Included `Dockerfile`; see [Docker / OCI container](#docker--oci-container) |
Package/plugin instructions and maintenance policies are maintained separately from the source archive. The optional Docker agent is packaged independently of RustProxy's main service for **Linux amd64/x86_64 only**, not FreeBSD pkg. On a Docker host, the agent can also be installed manually from `docker-agent/install.sh`; the installer and packages preserve existing tokens and TLS keys. See [Docker discovery](DOCKER_DISCOVERY.md) and [agent operations](../docker-agent/README.md).
@@ -31,7 +31,7 @@ The script installs dependencies, builds with `cargo build --release --locked` a
## Build from the source
The current `Cargo.toml` declares **Rust 1.99 minimum**, with a `stable` toolchain in `rust-toolchain.toml`. Use Cargo, a C compiler/linker, Bash and Python 3 (Python 3.11+ is advisable for project checks). Run as a normal build user:
The minimum Rust version is declared in `Cargo.toml` (`rust-version`); `rust-toolchain.toml` selects the `stable` channel. Use Cargo, a C compiler/linker, Bash and Python 3 (Python 3.11+ is advisable for project checks). Run as a normal build user:
```bash
bash dev.sh doctor
@@ -89,8 +89,7 @@ Then visit `http://127.0.0.1:9090` on your workstation. For a directly reachable
## Linux DEB/RPM: read-only access to external paths
New Linux packages (package-builder filesystem-access policy, revision 5) and
the maintained manual service template use `ProtectHome=read-only` rather than
Linux packages and the maintained manual service template use `ProtectHome=read-only` rather than
`ProtectHome=true`. This makes document roots under `/home`, `/var/www` and
`/srv` readable if the service account has **ordinary Unix group or ACL
permissions**. `ProtectSystem=strict` remains enabled: the service cannot
@@ -98,7 +97,7 @@ modify these files merely because a group or ACL permits it. No systemd
drop-in or extra `ReadOnlyPaths=` entry is needed to **read** site content or
an external certificate. This also applies when paths are stored in the panel.
In **0.34.10**, the panel generates Linux permission commands from the actual
The panel generates Linux permission commands from the actual
paths you enter: below the two external certificate/key fields, and directly
below a Web Server's document root. The commands target the standard
`rustproxy` account and resolve symlink targets when run. Review them and run
@@ -160,7 +159,7 @@ After granting certificate read access, return to the form and use
**Read names from certificate**. The editor reads the public certificate's
DNS SAN entries into the legacy SNI field; this does not read the private key
or save the certificate. Manual name edits are preserved by background reads.
See [Certificates](ACME_PROVIDERS.md#permission-commands-and-automatic-sni-names).
See [Certificates](CERTIFICATES.md#permission-commands-and-automatic-sni-names).
To diagnose unresolved errors, run `systemctl cat rustproxy` and
`systemctl show rustproxy -p ProtectHome -p ProtectSystem -p User -p Group`,
@@ -170,7 +169,7 @@ check parent permissions with `namei -l /path/to/file`, and examine
unit and is **not** automatically removed by an upgrade. On SELinux/AppArmor
hosts, additional mandatory access-control policy may be required; POSIX ACLs
cannot bypass it. See [Web Server](WEB_SERVER.md) and
[Certificates](ACME_PROVIDERS.md).
[Certificates](CERTIFICATES.md).
**Write access is intentionally different.** An app that needs to upload or
modify files under an arbitrary document root needs a separately planned
@@ -233,6 +232,28 @@ This is **optional**. Without `--config`, RustProxy keeps its active configurati
For the alternate environment-variable method, set `RUST_PROXY_CONFIG=/etc/rustproxy/config.json` in the service's protected EnvironmentFile. Do not set **both** unrelated config paths. See [Configuration](CONFIGURATION.md) and the [deployment example](../deploy/README.md).
## Docker / OCI container
The included `Dockerfile` compiles RustProxy in a Rust build image and runs it on Debian as the unprivileged `rustproxy` account (UID 10001). The image contains Python, Certbot and DNS plugins for certificate automation. The main container does **not** need the Docker socket.
```bash
docker build -t rustproxy:latest .
docker volume create rustproxy-data
docker run -d --name rustproxy \
-p 8080:8080 \
-v rustproxy-data:/var/lib/rustproxy \
rustproxy:latest
docker exec rustproxy rust-proxy admin setup-token
```
Inside the image the HTTP frontend binds `0.0.0.0:8080` and administration binds `127.0.0.1:9090`, so publishing port 9090 alone does not expose the panel. For remote administration, enable administration HTTPS with a certificate and an explicit non-loopback listener first, and restrict access with firewall rules.
- Mount `/var/lib/rustproxy` persistently: it holds SQLite, private keys, certificate profiles and the optional COLD cache.
- Publish the HTTP/HTTPS TCP ports you use, and the matching **UDP** port when HTTP/3 is enabled.
- The image runs without root; map low host ports with port forwarding or deliberate capabilities.
- To discover containers on other hosts, install the separate [Docker agent](DOCKER_DISCOVERY.md).
- Upgrade by building a new image, keeping the volume and taking an encrypted backup first.
## Managed update
Test the new build first. Then execute:
@@ -246,10 +267,8 @@ Managed updates preserve the saved configuration, create a private backup, switc
## ACME prerequisites
The managed certificate service can create a private Python/Certbot environment in the data directory; a usable system Certbot may be used as fallback. DNS-01 providers need credentials and appropriate permissions. HTTP-01 needs incoming public TCP `80`. On systems without an available Python/Certbot runtime, PEM import and external certificate references can still be used. See [Certificates](ACME_PROVIDERS.md).
The managed certificate service can create a private Python/Certbot environment in the data directory; a usable system Certbot may be used as fallback. DNS-01 providers need credentials and appropriate permissions. HTTP-01 needs incoming public TCP `80`. On systems without an available Python/Certbot runtime, PEM import and external certificate references can still be used. See [Certificates](CERTIFICATES.md).
## After installation
Verify `systemctl status rustproxy` and `journalctl -u rustproxy` (managed systemd), the panel login, frontend certificates, first Vhost, real backend response, access policies, optional QUIC, current logs and a full backup/restore test. For error diagnosis, consult [Troubleshooting](TROUBLESHOOTING.md).
**Release verification:** RustProxy 0.34.2 is a source package; complete a Rust 1.99+ build and target-platform HTTP/systemd/security acceptance tests before Internet-facing production use.