roxy
[!WARNING]
roxy is in early development. Expect frequent breaking changes to config,
rules and interfaces.
roxy is a strict, programmable HTTP firewall: an egress proxy for untrusted
workloads, or a gateway in front of the APIs your clients call.
- Strict. roxy parses every request into one canonical form and
forwards exactly that, so smuggling and header injection never reach the
upstream. As a proxy it terminates TLS with its own CA.
- Rules. A YAML policy in a small, typed rule language. Deny always wins,
anything no rule allows is denied, and rules can keep checking bodies as
they stream. Metrics give rate limits and byte budgets, and secret
injection means clients only hold placeholders.
- Addons. WASM components or external services that every exchange
streams through. They can rewrite, withhold, answer or block, and the
rules judge whatever they pass on.
- Audit. A JSONL flow log with the rule or addon behind every decision.
It never drops a record: backpressure holds traffic until the log catches
up.
Documentation
roxy-proxy.github.io/roxy-proxy:
the quickstart, guides
for sandbox containment
and an HTTP gateway,
the design and
the reference.
The site's source is in docs/.
License
Licensed under either of Apache License, Version 2.0 or
MIT license at your option.
