RustProxy/docs/FEATURES.md

Feature list

RustProxy is a single service that combines a reverse proxy, a static/PHP web server, certificate management, an HTTP cache and traffic monitoring, all managed from a browser panel or an API. Optional features are disabled by default; enable only what you need.

Reverse proxy

Feature	Details
Vhosts	Exact and wildcard hostnames, aliases, several listeners per Vhost, per-Vhost HTTP/2 and HTTP/3 switches
Backends	HTTP and HTTPS origins, HTTP/1.1, automatic ALPN (H2/H1), strict HTTP/2 and H2C, optional upstream certificate verification with custom CA and server name
Load balancing	Least connections (default), round robin, least traffic, adaptive and IP hash; member weights, backup and draining members, sticky cookie or IP affinity
Health checks	Active TCP or HTTP probes with thresholds and live health status per member
Connection reuse	Bounded keep-alive pools with idle and age limits, pool recycling and protocol telemetry
Custom locations	Prefix, exact and regex paths, path rewriting, per-location backends, Web Services, local responses, redirects and internal error fallbacks
WebSockets	HTTP/1.1 Upgrade, RFC 8441 (HTTP/2) and RFC 9220 (HTTP/3) Extended CONNECT
Forwarding headers	X-Forwarded-*, Forwarded, X-Real-IP, trusted proxy ranges, Cloudflare client IP and country
Redirects and pages	Redirect hosts, canonical host and HTTPS redirects, 404 hosts, custom error pages and direct-IP pages
TCP/UDP Streams	Layer-4 forwarding with backend pools, health checks, session limits and idle timeouts

Frontends and TLS

• HTTP/1.1, HTTPS with HTTP/2, optional HTTP/3 (QUIC) with Alt-Svc management and configurable UDP buffers.
• Named listeners with per-listener protocols; Vhosts bind to listener IDs.
• TLS 1.2/1.3 policy with cipher-suite allowlist and per-Vhost overrides.
• Optional hybrid post-quantum key exchange (X25519MLKEM768).
• SNI certificate selection, hot certificate reload without restart.

Web Server

• Static sites and downloads served from reusable Web Services shared by several Vhosts.
• Index files, optional directory listing, MIME mapping and attachment extensions.
• try_files, regex rewrites and a safe subset of Apache .htaccess rules.
• Conditional requests (ETag, Last-Modified), byte ranges, precompressed .br/.gz sidecars and optional Linux sendfile.
• Symlink policy, attack-probe blocking and header hardening presets.
• PHP through external PHP-FPM with shared profiles, per-application pools and resource limits.
• Presets for single-page apps, WordPress and Roundcube.

Certificates

• Self-signed certificates, PEM import and externally managed certificate paths (for example Certbot).
• Managed ACME with HTTP-01 and DNS-01 (Cloudflare, OVH, RFC 2136), automatic renewal and job history.
• Certificate inventory with expiry, coverage check and bulk assignment to Vhosts.
• Restricted certificate API keys for deploy/reload from external systems such as OPNsense.

Access and security

• IP/CIDR and DNS/DDNS allow/deny rules, reusable ACL profiles (up to eight per Vhost).
• Country allow/deny lists with automatic GeoIP database updates.
• Request rate limiting per Vhost and globally, with burst and Retry-After.
• HTTP method policy, request Content-Type denylist and User-Agent blocking.
• Security headers: HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, nosniff.
• HTTP Basic authentication with Argon2 hashes and brute-force limits.
• Forward Auth with Tinyauth, Authelia and authentik; OIDC (Authorization Code + PKCE) with Authelia, authentik, Pocket ID and compatible providers.
• Fail-closed authentication errors, identity header stripping and private/no-store responses for authenticated content.
• Protection against private/loopback/control-plane upstream destinations unless explicitly allowed.

Cache and delivery

• Shared HTTP cache with a memory tier (HOT) and an optional disk tier (COLD).
• RFC 9111 freshness, validators and Vary; stale-while-revalidate, stale-if-error and request coalescing.
• Varnish-compatible policy option, forced caching rules and per-location cache switches.
• RFC 9211 Cache-Status and optional X-Cache diagnostics.
• Purge and ban from the panel, the API or HTTP PURGE/BAN from allowlisted addresses.
• Live compression with gzip, Brotli, Zstandard and deflate.
• Optional minification of JavaScript, CSS, HTML, SVG and JSON with memory budgets.

Monitoring and logs

• Overview dashboard with requests per second, bandwidth, status codes, cache hit ratio, protocol mix, system load and backend health.
• Customizable dashboard layouts and saved presets.
• Per-Vhost, per-backend, per-Web-Service and per-Stream statistics.
• Live request log in the browser and in the terminal (--livelogs).
• Stored JSON access logs with search syntax, per-Vhost log files and an error log.
• Prometheus exporter with token/CIDR protection, JSON metrics and a compact summary endpoint.
• Grafana dashboard and Nagios checks included.

Operations

• Configuration stored in SQLite or in a JSON file, with validation before activation and hot reload.
• Revision history with diff and one-click restore.
• Encrypted full backups and validated offline restore; encrypted Secret Store for credentials.
• Docker discovery through a separate agent: publish containers as Vhosts with one switch.
• Nginx Proxy Manager import with a dry-run plan.
• Managed install/update scripts with rollback, DEB/RPM packages, Docker image and an OPNsense plugin.
• Panel in English and Polish, light and dark themes, adjustable density and corner style.

Administration and API

• Panel served on a separate, loopback-only listener by default; optional HTTPS for remote administration.
• Single administrator with Argon2 password, session revocation and CSRF/Origin protection.
• Complete REST API described by a bundled OpenAPI schema with Swagger UI at /docs.
• Scoped ro/rw API tokens bound to IP allowlists.
• Command-line tools for setup, configuration, certificates, backups and live logs.

See the screenshots for a visual tour and the documentation index for detailed guides.