What it does
rust-proxy is an L7 reverse proxy daemon: point a domain at it, and it handles HTTP/WebSocket forwarding, SNI-based TLS termination, and automatic Let's Encrypt certificate issuance and renewal — no separate certbot cron job, no manually-edited Nginx config. It also does raw TCP/UDP port forwarding for anything that isn't HTTP, and manages its own host firewall (nftables) so only the ports you've actually configured are ever open.
Built as a genuinely open alternative to Nginx Proxy Manager, not just a personal tool we happened to publish — runs on anything from a single dedicated IP to a full subnet block, with a small embedded web admin UI and a full REST API (session or API-token auth) behind it, so it's scriptable from day one.
What's actually running
- Native ACME client.Its own RFC 8555 implementation, not a wrapper around certbot — dns-01 validation through a pluggable DNS provider (Cloudflare, DigitalOcean, Hetzner, DuckDNS, GoDaddy, Namecheap, or AWS Route53 today), managed from the admin UI with no config-file editing required.
- Dynamic firewall.A default-DROP nftables ruleset regenerated automatically as hosts and port rules change — nothing is reachable that hasn't been explicitly configured.
- Wildcard-domain aware.A single leading wildcard label (
*.example.com) covers every subdomain under one route and certificate — useful for things like a self-hosted GitLab's Pages feature. - Admin API, not just a UI.Every host, port rule, and firewall change the web UI can make, a bearer API token can make too — for scripting, CI, or wiring into something else entirely.
Under the hood
Pure Rust — Axum for the admin API, tokio-rustls for TLS, sqlite for persistence, and hand-written RFC 8555 JWS framing rather than an existing ACME crate. MIT licensed.
Installing on Debian/Ubuntu
Every release publishes to our self-hosted, GPG-signed apt repo: sudo apt install rust-proxy after adding repo.jpps.us's stable channel. First launch serves a setup wizard from the admin UI — no config-file editing required to get running. Full instructions are in the README.