RustProxy 0.34.3

RustProxy combines a reverse proxy, static/PHP web server, certificate management and traffic monitoring in one service with a browser administration panel. It supports several domains and backends without requiring a separate proxy configuration language.

Main capabilities

Area	Available features
Reverse proxy	HTTP/HTTPS origins, HTTP/1.1 and HTTP/2 upstream modes, health checks, load balancing, connection reuse, WebSockets, path-based routing, retries and error fallbacks
Frontends	HTTP, HTTPS, HTTP/2, optional HTTP/3 (QUIC), named listeners, domain and wildcard routing, redirects, TLS certificates
Web Server	Static content, downloads, directory/index policy, rewrite and `try_files`, selected `.htaccess` rules, optional PHP-FPM, application presets
Access	IP/CIDR and DNS/DDNS rules, country restrictions, reusable ACLs, rate limits, method rules, Basic Auth, Tinyauth, security headers
Delivery	Optional shared HOT/RAM and COLD/disk cache, cache invalidation, compression, response transformations, static-file optimizations
Integrations	Docker discovery via separate agents, TCP/UDP Streams, ACME certificate providers, Prometheus, Grafana/Nagios examples and administration API
Operations	Dashboard presets, traffic analytics, live/stored logs, configuration history, encrypted backups and certificate reloads

Features and default settings vary by component; configure only the capabilities you need. The documentation index covers each workflow, including prerequisites, security boundaries, troubleshooting and API access.

0.34.3

HTTP/3 now explicitly requests 4 MiB effective UDP receive and send buffers per QUIC listener (configurable as udp_receive_buffer_bytes and udp_send_buffer_bytes in Settings > HTTP/3). On Linux the kernel can cap them using net.core.rmem_max / net.core.wmem_max; RustProxy logs the effective values and a warning if the target is not met. Setting either value to 0 leaves the OS default. Changing UDP buffers requires service restart.
HTTP/3 Alt-Svc response headers follow saved policy immediately; turning off an already-bound H3 service emits Alt-Svc: clear. New QUIC handshakes pick up modified stream/idle limits without socket rebinding. Increasing the connection cap beyond the startup bound or changing the UDP endpoint still requires restart. QUIC bulk-transfer diagnostic snapshots are available at debug log level.
The Overview has an optional, hidden-by-default cumulative cache-outcome bar showing HIT, MISS, BYPASS and OTHER request counts and percentages since service start. Enable it in the dashboard layout editor when needed. This complements the existing cumulative HIT/MISS donut and separate recent cache trend chart. OTHER denotes HTTP requests without a cache decision. Percentages use all HTTP requests, unlike the HIT/MISS donut. The upper-right counter displays only the lifetime HTTP request count; its full meaning is available on hover or to assistive technology.

0.34.2

Added read-only pull-based JSON monitoring at /api/metrics/json (admin session or General API token) and at the enabled Prometheus exporter path with .json suffix (same exporter bearer/CIDR policy). Includes Overview-style metrics and all existing Prometheus sample families without SSE. Compact precomputed dashboard metrics are available at /api/metrics/summary, under summary in the full JSON, and at the exporter path with .summary.json suffix. This includes readiness counts, RPS, transfer/second and system/cache percentages.
Settings → Manual config displays the active configuration storage mode, its path and the SQLite history location for file-backed mode.
Documented optional systemd --config /etc/rustproxy/config.json deployment with file/directory ACLs, write access for atomic panel saves and reload instructions.
Public Web Server errors reuse embedded application-style HTML templates (or a matching fallback for statuses without a dedicated page). Proxy-generated non-template errors use standard HTTP status text; neither leaks internal RustProxy: diagnostics. Origin error bodies and custom error pages remain configurable.

0.34.1

An explicit --config /absolute/path/config.json (or RUST_PROXY_CONFIG) makes an existing JSON document the active configuration source. Panel saves and configuration-history restores write back to that file, with SQLite retaining revision/audit data. Out-of-band file changes require an explicit reload; concurrent edits are rejected.
rust-proxy reload / rust-proxy config reload and the example systemd ExecReload perform configuration and certificate refresh without terminating the service; listener changes can still require a restart.
Panel-managed, one-time-displayed administration API Bearer tokens with ro/rw permissions and mandatory source-IP/CIDR restrictions. Browser login remains available; certificate-only tokens are separate.
Bulk assignment of Vhosts to a certificate; a single Save and lock control for unlocked Overview layout.
Panel-managed Prometheus token issuance, rotation and revocation with one-time display. Existing environment-token configuration remains a compatibility fallback until a generated credential or revocation record replaces it.

Installation

Use the maintained packages where available:

Linux DEB/RPM: https://rustproxy.linuxiarz.pl/
OPNsense: https://rustproxy-opn.linuxiarz.pl/
Docker hosts (optional agent, Linux DEB/RPM): install rustproxy-docker-agent independently; see Docker discovery.

For Debian 13+ source installation, manual compilation, managed updates or Docker, see Installation and updates.

Typical managed Linux defaults: HTTP on :80, HTTPS on :443, local administration at http://127.0.0.1:9090, private data in /var/lib/rustproxy. The initial public certificate is self-signed. There is no default administrator password. Initialize administration locally and assign trusted certificates before public use.

First configuration

Install and start the service, then initialize the administrator using the local CLI.
Open the panel and review Settings → Listeners, administration access and certificates.
Create a Vhost with a domain name and a reachable HTTP backend or Web Service.
Confirm frontend TLS, backend health, access permissions and routing.
Enable additional cache, compression, Docker or monitoring functions as needed; inspect Overview, Logs and Cache for results.

Guides

Installation · Settings · Vhosts · Web Server · PHP-FPM
Certificates · Cache · Response delivery · Docker discovery · Monitoring
Security · API · Troubleshooting
Changelog · Roadmap

The authenticated /docs page includes the guides and a separate interactive OpenAPI/Swagger tab.

Status of this source archive

Version 0.34.3 is provided as a source release candidate. The archive includes the 0.34.2 tests plus HTTP/3 socket-buffer and live-settings regressions, and a browser chart calculation test. Native compilation, full Rust tests and target-VM throughput testing must pass before a production release can be declared. See Installation and Roadmap.

7.5 KiB Raw Blame History