Security model and deployment boundaries

RustProxy provides several security controls, but it is not a complete Web Application Firewall, PHP sandbox or network firewall. Safe deployment depends on frontend TLS, trusted origin connectivity, application updates, least-privilege operating-system access and release testing.

Administration and private state

Keep the separate admin listener on loopback unless explicitly configuring trusted administration HTTPS and restricted reachability. Use an SSH tunnel for simple remote management.
Create the first administrator locally. There are no default passwords. Protect CLI recovery operations, sessions, session revocation and API token creation.
Keep the SQLite database, Secret Store encryption material, certificate keys, .env, ACME profiles, external credentials and backups readable only by trusted operators. .env and service configuration may be trusted executable/input material.
Never expose stored logs, OpenAPI, detailed status, full config or backup files anonymously. Keep public Vhosts away from the administration listener except in a carefully reviewed explicit-risk topology.

Origin and request trust

Enforce IP/country/DDNS policies, rate limits, HTTP method rules and ordinary Vhost request Content-Type deny rules before connecting to backends. A Custom location cannot undo a Vhost-level denial. A Content-Type rule is based on the declared request header; a client can omit or mislabel it, so it does not substitute for application or PHP security patches.
Private and local backend addresses require deliberate exceptions. Routing to the local administration listener can expose secrets or create routing loops.
HTTPS to a backend is not proof of identity unless upstream certificate/hostname verification is enabled; current backend defaults do not enable verification automatically.
Honor forwarding identity headers only from correctly configured trusted peers. A client can forge arbitrary X-Forwarded-* and User-Agent headers.
Restrict Basic Auth to HTTPS and protect Tinyauth endpoints. Authentication traffic should never be stored in public shared cache.

Content and cache privacy

Shared cache must refuse private/no-store content and unsafe authenticated representations. Test behavior with cookies, Authorization, Set-Cookie, Vary and conditional requests.
HTTP BAN/PURGE is disabled by default and must use a narrow allowlist if enabled. Never grant untrusted clients cross-site invalidation rights.
Rewrites/transforms and custom headers can change semantics; verify that CSP, HSTS, CORS, validators and Cache-Control remain appropriate.

Web Server and PHP

Put credentials, source secrets and backups outside document roots. Directory listing and symlink relaxation are disabled by default; change only when deliberate.
Run PHP-FPM as a separate controlled service. Give unrelated PHP applications distinct FPM pools to prevent cross-application INI/worker leakage.
Treat .htaccess support as a restricted compatibility feature, not arbitrary Apache configuration. RustProxy hardening rules supplement but do not replace application security updates.

Integrations and transport

Docker agents have read-only inventory endpoints but their local Docker socket permission is highly privileged. Restrict the host account, port, Bearer token and pinned certificate.
Prometheus has its own endpoint/network credential policy and no admin browser session. Keep it private or behind a secure tunnel.
TCP/UDP Streams do not inherit HTTP ACL/auth/cache/TLS termination. Protect protocol endpoints separately.
HTTP/3 needs UDP and should be tested with firewall, NAT and TLS behavior on the actual deployment.
Managed ACME and external certificate reload integrations require least-privilege DNS/file/token access.

Release and operational validation

The provided 0.34.0 source includes changes without completed native compilation, all-protocol regression or production performance measurement. Do not treat source-code inspection as proof of security or performance. Before using it at an Internet edge, test on the target OS, run the automated suite, verify TLS/H2/H3/WebSocket handling, access and cache privacy, backup/restore, logging and failure recovery. Keep monitored off-host backups and a rollback plan.

4.3 KiB Raw Blame History