roxy

[!WARNING] roxy is in early development. Expect frequent breaking changes to config, rules and interfaces.

roxy is a strict, programmable HTTP firewall: an egress proxy for untrusted workloads, or a gateway in front of the APIs your clients call.

• Strict. roxy parses every request into one canonical form and forwards exactly that, so smuggling and header injection never reach the upstream. As a proxy it terminates TLS with its own CA.
• Rules. A YAML policy in a small, typed rule language. Deny always wins, anything no rule allows is denied, and rules can keep checking bodies as they stream. Metrics give rate limits and byte budgets, and secret injection means clients only hold placeholders.
• Addons. WASM components or external services that every exchange streams through. They can rewrite, withhold, answer or block, and the rules judge whatever they pass on.
• Audit. A JSONL flow log with the rule or addon behind every decision. It never drops a record: backpressure holds traffic until the log catches up.

Documentation

roxy-proxy.github.io/roxy-proxy: the quickstart, guides for sandbox containment and an HTTP gateway, the design and the reference. The site's source is in docs/.

License

Licensed under either of Apache License, Version 2.0 or MIT license at your option.