# Feature list

RustProxy is a single service that combines a reverse proxy, a static/PHP web server, certificate management, an HTTP cache and traffic monitoring, all managed from a browser panel or an API. Optional features are disabled by default; enable only what you need.

![Overview dashboard](images/overview.png)

## Reverse proxy

| Feature | Details |
|---|---|
| Vhosts | Exact and wildcard hostnames, aliases, several listeners per Vhost, per-Vhost HTTP/2 and HTTP/3 switches |
| Backends | HTTP and HTTPS origins, HTTP/1.1, automatic ALPN (H2/H1), strict HTTP/2 and H2C, optional upstream certificate verification with custom CA and server name |
| Load balancing | Least connections (default), round robin, least traffic, adaptive and IP hash; member weights, backup and draining members, sticky cookie or IP affinity |
| Health checks | Active TCP or HTTP probes with thresholds, optional separate probe port, expected response text and live health status per member |
| Connection reuse | Bounded keep-alive pools with idle and age limits, pool recycling and protocol telemetry |
| Custom locations | Prefix, exact and regex paths, path rewriting, per-location backends, Web Services, local responses, redirects and internal error fallbacks |
| WebSockets | HTTP/1.1 Upgrade, RFC 8441 (HTTP/2) and RFC 9220 (HTTP/3) Extended CONNECT |
| Forwarding headers | `X-Forwarded-*`, `Forwarded`, `X-Real-IP`, trusted proxy ranges, Cloudflare client IP and country |
| Redirects and pages | Redirect hosts, canonical host and HTTPS redirects, 404 hosts, custom error pages and direct-IP pages |
| TCP/UDP Streams | Layer-4 forwarding with backend pools, health checks, session limits and idle timeouts |

## Frontends and TLS

- HTTP/1.1, HTTPS with HTTP/2, optional HTTP/3 (QUIC) with `Alt-Svc` management and configurable UDP buffers.
- Named listeners with per-listener protocols; Vhosts bind to listener IDs.
- TLS 1.2/1.3 policy with cipher-suite allowlist and per-Vhost overrides.
- Optional hybrid post-quantum key exchange (X25519MLKEM768).
- SNI certificate selection, hot certificate reload without restart.

## Web Server

- Static sites and downloads served from reusable **Web Services** shared by several Vhosts.
- Index files, optional directory listing, MIME mapping and attachment extensions.
- `try_files`, regex rewrites and a safe subset of Apache `.htaccess` rules.
- Conditional requests (`ETag`, `Last-Modified`), byte ranges, precompressed `.br`/`.gz` sidecars and optional Linux `sendfile`.
- Symlink policy, attack-probe blocking and header hardening presets.
- PHP through external PHP-FPM with shared profiles, per-application pools and resource limits.
- Presets for single-page apps, WordPress and Roundcube.

![Web Server editor](images/web-server.png)

## Certificates

- Self-signed certificates, PEM import and externally managed certificate paths (for example Certbot).
- Managed ACME with HTTP-01 and DNS-01 (Cloudflare, OVH, RFC 2136), automatic renewal and job history.
- Certificate inventory with expiry, coverage check and bulk assignment to Vhosts.
- Restricted certificate API keys for deploy/reload from external systems such as OPNsense.
- Prometheus metrics for the expiry date and remaining days of every installed certificate, ready for alerting.

![Certificates](images/certificates.png)

## Access and security

- IP/CIDR and DNS/DDNS allow/deny rules, reusable ACL profiles (up to eight per Vhost).
- Country allow/deny lists with automatic GeoIP database updates.
- Request rate limiting per Vhost and globally, with burst and `Retry-After`.
- HTTP method policy, request Content-Type denylist and User-Agent blocking.
- Security headers: HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, `nosniff`.
- HTTP Basic authentication with Argon2 hashes and brute-force limits.
- Forward Auth with Tinyauth, Authelia and authentik; OIDC (Authorization Code + PKCE) with Authelia, authentik, Pocket ID and compatible providers.
- Fail-closed authentication errors, identity header stripping and private/no-store responses for authenticated content.
- Protection against private/loopback/control-plane upstream destinations unless explicitly allowed.

## Cache and delivery

- Shared HTTP cache with a memory tier (HOT) and an optional disk tier (COLD).
- RFC 9111 freshness, validators and `Vary`; stale-while-revalidate, stale-if-error and request coalescing.
- Varnish-compatible policy option, forced caching rules and per-location cache switches.
- RFC 9211 `Cache-Status` and optional `X-Cache` diagnostics.
- Purge and ban from the panel, the API or HTTP PURGE/BAN from allowlisted addresses.
- Live compression with gzip, Brotli, Zstandard and deflate.
- Optional minification of JavaScript, CSS, HTML, SVG and JSON with memory budgets.

![Cache](images/cache.png)

## Monitoring and logs

- Overview dashboard with requests per second, bandwidth, status codes, error share, cache hit ratio, protocol mix, system load, backend health, requests rejected by limits and nearest certificate expiry.
- Customizable dashboard layouts and saved presets.
- Per-Vhost, per-backend, per-Web-Service and per-Stream statistics.
- Live request log in the browser and in the terminal (`--livelogs`).
- Stored JSON access logs with search syntax, per-Vhost log files and an error log.
- Prometheus exporter with token/CIDR protection, JSON metrics and a compact summary endpoint.
- Grafana dashboard and Nagios checks included.

![Live logs](images/logs.png)

## Operations

- Configuration stored in SQLite or in a JSON file, with validation before activation and hot reload.
- Revision history with diff and one-click restore.
- Encrypted full backups and validated offline restore; encrypted Secret Store for credentials.
- Docker discovery through a separate agent: publish containers as Vhosts with one switch.
- Nginx Proxy Manager import with a dry-run plan.
- Managed install/update scripts with rollback, DEB/RPM packages, Docker image and an OPNsense plugin.
- Panel in English and Polish, light and dark themes, adjustable density and corner style.

## Administration and API

- Panel served on a separate, loopback-only listener by default; optional HTTPS for remote administration.
- Single administrator with Argon2 password, session revocation and CSRF/Origin protection.
- Complete REST API described by a bundled OpenAPI schema with Swagger UI at `/docs`.
- Scoped `ro`/`rw` API tokens bound to IP allowlists.
- Command-line tools for setup, configuration, certificates, backups and live logs.

See the [screenshots](SCREENSHOTS.md) for a visual tour and the [documentation index](README.md) for detailed guides.