rpxy

rpxy is a lightweight Layer 7 (HTTP) reverse-proxy written in Rust. It is designed to route multiple hostnames to backend application servers while handling TLS termination.

Key features include:

• Protocol Support: HTTP/1.1, HTTP/2, and HTTP/3 (via quinn or s2n-quic).
• gRPC Support: Native support for gRPC traffic.
• TLS/SSL: TLS termination for multiple domains, Mutual TLS (mTLS) with client certificates, and automated certificate management via the TLS-ALPN-01 ACME protocol.
• Security: Post-quantum key exchange (X25519MLKEM768) and TLS connection sanitization to prevent domain fronting (ensuring SNI and HTTP HOST headers match).
• Load Balancing: Round-robin, random, and sticky sessions.
• Observability: Support for HAProxy PROXY Protocol (v1/v2) to recover client IPs behind L4 proxies.

The rpxy-trusted-proxies crate is a helper used by rpxy to resolve trusted_forwarded_proxies entries. It accepts user-facing entries like CIDRs or built-in alias names and expands them into a resolved Vec<IpNet> for the main configuration parser.

Key Behaviors:

• Built-in Aliases: Supports aliases like cloudflare, fastly, and cloudfront which are expanded into concrete CIDR sets.
• Deterministic Resolution: It uses static snapshots checked into the source code. It does not perform network fetches during configuration parsing or proxy startup, ensuring startup is deterministic and does not depend on external network reachability.
• Separation of Concerns: Alias resolution is kept separate from the main proxy runtime to prevent provider-specific metadata from leaking into request handling code.

Access logging behavior depends on whether you are logging to a file or to stdout:

Access Log Format: In file mode, access logs use a high-performance minimal formatter with the shape: {timestamp} {message} .

You can route requests to different backends based on the URL path using the [[apps.<app_name>.reverse_proxy]] array. rpxy uses longest-prefix-matching to select the correct rule.

• Path Matching: Use the path key to define the prefix to match.
• URL Rewriting: Use the replace_path key to rewrite the matched portion of the path before sending it to the upstream.
• Default Destination: A reverse_proxy entry without a path key acts as the default destination for that application. If no such entry exists, requests that don't match any defined paths are rejected.

[[apps.app1.reverse_proxy]]
path = '/path/another'
replace_path = '/path'
upstream = [{ location = 'another.backend.local' }]

Because the crate uses static snapshots for provider IP ranges, you must explicitly refresh these snapshots to include the latest provider data. This is done using a dedicated binary that fetches IP lists from official provider endpoints and updates the source file src/snapshots.rs.

Note: To run the updater, you must enable the update-snapshots feature, which pulls in additional dependencies (reqwest, chrono, serde, serde_json) not required by the standard runtime.

Command:

cargo run -p rpxy-trusted-proxies --features update-snapshots --bin update-snapshots -- [FLAGS]

rpxy requires private keys to be in PKCS8 format. If you are using certificates and private keys obtained directly from Let's Encrypt (which are typically PKCS1-formatted), you must convert them using openssl before use.

% openssl pkcs8 -topk8 -nocrypt \
    -in your_domain_from_le.key \
    -inform PEM \
    -out your_domain_pkcs8.key.pem \
    -outform PEM

To serve HTTPS, specify a listen_port_tls (e.g., 443) globally. For each application, provide the paths to your PEM-encoded certificate and private key in the tls table.

Requirements:

• The private key must be in PKCS8 format.
• On Unix-like systems, it is recommended to set private key file permissions to 0600. rpxy will emit a warn! log if permissions are too open.

listen_port = 80
listen_port_tls = 443

[apps."app_name"]
server_name = 'app1.example.com'
tls = { tls_cert_path = 'server.crt',  tls_cert_key_path = 'server.key' }
reverse_proxy = [{ upstream = [{ location = 'app1.local:8080' }] }]

You can use the third-party project Gamerboy59/rpxy-webui to manage rpxy through a web interface.

Warning: rpxy-webui is maintained independently. Recent rpxy releases may include breaking configuration changes (such as removed keys) that can cause rpxy-webui generated configurations to fail. Always verify compatibility before use.

To set up a basic HTTP reverse proxy, configure listen_port globally and define applications under the [apps.<app_name>] table. rpxy routes requests based on the server_name matching the HOST header or the URL's request line.

To host multiple domains on a single IP/port, create multiple [apps.<app_name>] entries. You can also define a default_app to handle requests that do not match any specific server_name. Note that default_app only works for HTTP; HTTPS requests for unknown server names are rejected.

listen_port = 80

[apps.app1]
server_name = 'app1.example.com'
reverse_proxy = [{ upstream = [{ location = 'app1.local:8080' }] }]