Feature list

RustProxy is a single service that combines a reverse proxy, a static/PHP web server, certificate management, an HTTP cache and traffic monitoring, all managed from a browser panel or an API. Optional features are disabled by default; enable only what you need.

Reverse proxy

Feature	Details
Vhosts	Exact and wildcard hostnames, aliases, several listeners per Vhost, per-Vhost HTTP/2 and HTTP/3 switches
Backends	HTTP and HTTPS origins, HTTP/1.1, automatic ALPN (H2/H1), strict HTTP/2 and H2C, optional upstream certificate verification with custom CA and server name
Load balancing	Least connections (default), round robin, least traffic, adaptive and IP hash; member weights, backup and draining members, sticky cookie or IP affinity
Health checks	Active TCP or HTTP probes with thresholds, optional separate probe port, expected response text and live health status per member
Connection reuse	Bounded keep-alive pools with idle and age limits, pool recycling and protocol telemetry
Custom locations	Prefix, exact and regex paths, path rewriting, per-location backends, Web Services, local responses, redirects and internal error fallbacks
WebSockets	HTTP/1.1 Upgrade, RFC 8441 (HTTP/2) and RFC 9220 (HTTP/3) Extended CONNECT
Forwarding headers	`X-Forwarded-*`, `Forwarded`, `X-Real-IP`, trusted proxy ranges, Cloudflare client IP and country
Redirects and pages	Redirect hosts, canonical host and HTTPS redirects, 404 hosts, custom error pages and direct-IP pages
TCP/UDP Streams	Layer-4 forwarding with backend pools, health checks, session limits and idle timeouts

Frontends and TLS

HTTP/1.1, HTTPS with HTTP/2, optional HTTP/3 (QUIC) with Alt-Svc management and configurable UDP buffers.
Named listeners with per-listener protocols; Vhosts bind to listener IDs.
TLS 1.2/1.3 policy with cipher-suite allowlist and per-Vhost overrides.
Optional hybrid post-quantum key exchange (X25519MLKEM768).
SNI certificate selection, hot certificate reload without restart.

Web Server

Static sites and downloads served from reusable Web Services shared by several Vhosts.
Index files, optional directory listing, MIME mapping and attachment extensions.
try_files, regex rewrites and a safe subset of Apache .htaccess rules.
Conditional requests (ETag, Last-Modified), byte ranges, precompressed .br/.gz sidecars and optional Linux sendfile.
Symlink policy, attack-probe blocking and header hardening presets.
PHP through external PHP-FPM with shared profiles, per-application pools and resource limits.
Presets for single-page apps, WordPress and Roundcube.

Certificates

Self-signed certificates, PEM import and externally managed certificate paths (for example Certbot).
Managed ACME with HTTP-01 and DNS-01 (Cloudflare, OVH, RFC 2136), automatic renewal and job history.
Certificate inventory with expiry, coverage check and bulk assignment to Vhosts.
Restricted certificate API keys for deploy/reload from external systems such as OPNsense.
Prometheus metrics for the expiry date and remaining days of every installed certificate, ready for alerting.

Access and security

IP/CIDR and DNS/DDNS allow/deny rules, reusable ACL profiles (up to eight per Vhost).
Country allow/deny lists with automatic GeoIP database updates.
Request rate limiting per Vhost and globally, with burst and Retry-After.
HTTP method policy, request Content-Type denylist and User-Agent blocking.
Security headers: HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, nosniff.
HTTP Basic authentication with Argon2 hashes and brute-force limits.
Forward Auth with Tinyauth, Authelia and authentik; OIDC (Authorization Code + PKCE) with Authelia, authentik, Pocket ID and compatible providers.
Fail-closed authentication errors, identity header stripping and private/no-store responses for authenticated content.
Protection against private/loopback/control-plane upstream destinations unless explicitly allowed.

Cache and delivery

Shared HTTP cache with a memory tier (HOT) and an optional disk tier (COLD).
RFC 9111 freshness, validators and Vary; stale-while-revalidate, stale-if-error and request coalescing.
Varnish-compatible policy option, forced caching rules and per-location cache switches.
RFC 9211 Cache-Status and optional X-Cache diagnostics.
Purge and ban from the panel, the API or HTTP PURGE/BAN from allowlisted addresses.
Live compression with gzip, Brotli, Zstandard and deflate.
Optional minification of JavaScript, CSS, HTML, SVG and JSON with memory budgets.

Monitoring and logs

Overview dashboard with requests per second, bandwidth, status codes, error share, cache hit ratio, protocol mix, system load, backend health, requests rejected by limits and nearest certificate expiry.
Customizable dashboard layouts (drag-and-drop with a live drop placeholder, keyboard moves, per-block width, explicit gap filling) and saved presets.
Per-Vhost, per-backend, per-Web-Service and per-Stream statistics.
Live request log in the browser and in the terminal (--livelogs).
Stored JSON access logs with search syntax, per-Vhost log files and an error log.
Prometheus exporter with token/CIDR protection, JSON metrics and a compact summary endpoint.
Lightweight revision-aware polling views for Cache, Traffic and Transform keep the administration panel responsive without repeatedly transferring static configuration.
Grafana dashboard and Nagios checks included.

Operations

Configuration stored in SQLite or in a JSON file, with validation before activation and hot reload.
Revision history with diff and one-click restore.
Encrypted full backups and validated offline restore; encrypted Secret Store for credentials.
Docker discovery through a separate agent: publish containers as Vhosts with one switch.
Nginx Proxy Manager import with a dry-run plan.
Managed install/update scripts with rollback, DEB/RPM packages, Docker image and an OPNsense plugin.
Panel in English and Polish, light and dark themes, adjustable density and corner style.

Administration and API

Panel served on a separate, loopback-only listener by default; optional HTTPS for remote administration.
Single administrator with Argon2 password, session revocation and CSRF/Origin protection.
Complete REST API described by a bundled OpenAPI schema with Swagger UI at /docs.
Scoped ro/rw API tokens bound to IP allowlists.
Command-line tools for setup, configuration, certificates, backups and live logs.

See the screenshots for a visual tour and the documentation index for detailed guides.

6.8 KiB Raw Blame History