107 lines
6.5 KiB
Markdown
107 lines
6.5 KiB
Markdown
# Feature list
|
|
|
|
RustProxy is a single service that combines a reverse proxy, a static/PHP web server, certificate management, an HTTP cache and traffic monitoring, all managed from a browser panel or an API. Optional features are disabled by default; enable only what you need.
|
|
|
|
|
|
|
|
## Reverse proxy
|
|
|
|
| Feature | Details |
|
|
|---|---|
|
|
| Vhosts | Exact and wildcard hostnames, aliases, several listeners per Vhost, per-Vhost HTTP/2 and HTTP/3 switches |
|
|
| Backends | HTTP and HTTPS origins, HTTP/1.1, automatic ALPN (H2/H1), strict HTTP/2 and H2C, optional upstream certificate verification with custom CA and server name |
|
|
| Load balancing | Least connections (default), round robin, least traffic, adaptive and IP hash; member weights, backup and draining members, sticky cookie or IP affinity |
|
|
| Health checks | Active TCP or HTTP probes with thresholds, optional separate probe port, expected response text and live health status per member |
|
|
| Connection reuse | Bounded keep-alive pools with idle and age limits, pool recycling and protocol telemetry |
|
|
| Custom locations | Prefix, exact and regex paths, path rewriting, per-location backends, Web Services, local responses, redirects and internal error fallbacks |
|
|
| WebSockets | HTTP/1.1 Upgrade, RFC 8441 (HTTP/2) and RFC 9220 (HTTP/3) Extended CONNECT |
|
|
| Forwarding headers | `X-Forwarded-*`, `Forwarded`, `X-Real-IP`, trusted proxy ranges, Cloudflare client IP and country |
|
|
| Redirects and pages | Redirect hosts, canonical host and HTTPS redirects, 404 hosts, custom error pages and direct-IP pages |
|
|
| TCP/UDP Streams | Layer-4 forwarding with backend pools, health checks, session limits and idle timeouts |
|
|
|
|
## Frontends and TLS
|
|
|
|
- HTTP/1.1, HTTPS with HTTP/2, optional HTTP/3 (QUIC) with `Alt-Svc` management and configurable UDP buffers.
|
|
- Named listeners with per-listener protocols; Vhosts bind to listener IDs.
|
|
- TLS 1.2/1.3 policy with cipher-suite allowlist and per-Vhost overrides.
|
|
- Optional hybrid post-quantum key exchange (X25519MLKEM768).
|
|
- SNI certificate selection, hot certificate reload without restart.
|
|
|
|
## Web Server
|
|
|
|
- Static sites and downloads served from reusable **Web Services** shared by several Vhosts.
|
|
- Index files, optional directory listing, MIME mapping and attachment extensions.
|
|
- `try_files`, regex rewrites and a safe subset of Apache `.htaccess` rules.
|
|
- Conditional requests (`ETag`, `Last-Modified`), byte ranges, precompressed `.br`/`.gz` sidecars and optional Linux `sendfile`.
|
|
- Symlink policy, attack-probe blocking and header hardening presets.
|
|
- PHP through external PHP-FPM with shared profiles, per-application pools and resource limits.
|
|
- Presets for single-page apps, WordPress and Roundcube.
|
|
|
|
|
|
|
|
## Certificates
|
|
|
|
- Self-signed certificates, PEM import and externally managed certificate paths (for example Certbot).
|
|
- Managed ACME with HTTP-01 and DNS-01 (Cloudflare, OVH, RFC 2136), automatic renewal and job history.
|
|
- Certificate inventory with expiry, coverage check and bulk assignment to Vhosts.
|
|
- Restricted certificate API keys for deploy/reload from external systems such as OPNsense.
|
|
- Prometheus metrics for the expiry date and remaining days of every installed certificate, ready for alerting.
|
|
|
|
|
|
|
|
## Access and security
|
|
|
|
- IP/CIDR and DNS/DDNS allow/deny rules, reusable ACL profiles (up to eight per Vhost).
|
|
- Country allow/deny lists with automatic GeoIP database updates.
|
|
- Request rate limiting per Vhost and globally, with burst and `Retry-After`.
|
|
- HTTP method policy, request Content-Type denylist and User-Agent blocking.
|
|
- Security headers: HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, `nosniff`.
|
|
- HTTP Basic authentication with Argon2 hashes and brute-force limits.
|
|
- Forward Auth with Tinyauth, Authelia and authentik; OIDC (Authorization Code + PKCE) with Authelia, authentik, Pocket ID and compatible providers.
|
|
- Fail-closed authentication errors, identity header stripping and private/no-store responses for authenticated content.
|
|
- Protection against private/loopback/control-plane upstream destinations unless explicitly allowed.
|
|
|
|
## Cache and delivery
|
|
|
|
- Shared HTTP cache with a memory tier (HOT) and an optional disk tier (COLD).
|
|
- RFC 9111 freshness, validators and `Vary`; stale-while-revalidate, stale-if-error and request coalescing.
|
|
- Varnish-compatible policy option, forced caching rules and per-location cache switches.
|
|
- RFC 9211 `Cache-Status` and optional `X-Cache` diagnostics.
|
|
- Purge and ban from the panel, the API or HTTP PURGE/BAN from allowlisted addresses.
|
|
- Live compression with gzip, Brotli, Zstandard and deflate.
|
|
- Optional minification of JavaScript, CSS, HTML, SVG and JSON with memory budgets.
|
|
|
|
|
|
|
|
## Monitoring and logs
|
|
|
|
- Overview dashboard with requests per second, bandwidth, status codes, error share, cache hit ratio, protocol mix, system load, backend health, requests rejected by limits and nearest certificate expiry.
|
|
- Customizable dashboard layouts and saved presets.
|
|
- Per-Vhost, per-backend, per-Web-Service and per-Stream statistics.
|
|
- Live request log in the browser and in the terminal (`--livelogs`).
|
|
- Stored JSON access logs with search syntax, per-Vhost log files and an error log.
|
|
- Prometheus exporter with token/CIDR protection, JSON metrics and a compact summary endpoint.
|
|
- Grafana dashboard and Nagios checks included.
|
|
|
|
|
|
|
|
## Operations
|
|
|
|
- Configuration stored in SQLite or in a JSON file, with validation before activation and hot reload.
|
|
- Revision history with diff and one-click restore.
|
|
- Encrypted full backups and validated offline restore; encrypted Secret Store for credentials.
|
|
- Docker discovery through a separate agent: publish containers as Vhosts with one switch.
|
|
- Nginx Proxy Manager import with a dry-run plan.
|
|
- Managed install/update scripts with rollback, DEB/RPM packages, Docker image and an OPNsense plugin.
|
|
- Panel in English and Polish, light and dark themes, adjustable density and corner style.
|
|
|
|
## Administration and API
|
|
|
|
- Panel served on a separate, loopback-only listener by default; optional HTTPS for remote administration.
|
|
- Single administrator with Argon2 password, session revocation and CSRF/Origin protection.
|
|
- Complete REST API described by a bundled OpenAPI schema with Swagger UI at `/docs`.
|
|
- Scoped `ro`/`rw` API tokens bound to IP allowlists.
|
|
- Command-line tools for setup, configuration, certificates, backups and live logs.
|
|
|
|
See the [screenshots](SCREENSHOTS.md) for a visual tour and the [documentation index](README.md) for detailed guides.
|