s1d3sw1ped_bot
ac295ec330
Land develop compose/README port align (PR #11 / a6e0693) onto master.
Resolves README divergence vs master ADMIN_PASSWORD docs; keeps ADMIN_PORT=81 healthcheck align. Temporary head branch only — develop retained.
Co-authored-by: s1d3sw1ped_bot <s1d3sw1ped+giteabot@gmail.com>
Co-committed-by: s1d3sw1ped_bot <s1d3sw1ped+giteabot@gmail.com>
82 lines
5.1 KiB
Markdown
82 lines
5.1 KiB
Markdown
# Helix Proxy
|
|
|
|
A pure-Go reverse proxy with embedded web UI. Supports proxy hosts, TCP/UDP streams, redirections, dead hosts, certificates (Let's Encrypt + custom), access lists, audit, and more. Single static binary. Single built-in admin (no multi-user registration). Production requires `ADMIN_PASSWORD` on first boot (the well-known default `"password"` is rejected); development may leave it unset until you change it (bootstrap lock).
|
|
|
|
**Key features / differences from traditional setups**:
|
|
- **Entirely replaces nginx**: pure Go reverse proxy (http) + TCP/UDP stream proxy engine. No nginx binary, no config files on disk for routing, live updates.
|
|
- **Single binary**: the modern Svelte SPA UI is built and **embedded** (`//go:embed`) into the Go executable.
|
|
- **Storage**: default is a single `data/db.bolt` (cwd-relative, bbolt embedded).
|
|
- **No magic paths**: everything defaults to paths relative to the process CWD (`data/db.bolt`, `data/www/`, `data/certs/`, ...). All overridable with env vars (`DATA_DIR`, `WWW_DIR`, etc.).
|
|
- **www/html lives in data/** by default (single volume tree).
|
|
|
|
## Quick start (binary)
|
|
```bash
|
|
make # builds UI (placeholder) + Go binary with embed
|
|
ADMIN_PASSWORD='choose-a-real-password' ./helix-proxy
|
|
# Defaults (overridable via env):
|
|
# Admin UI + API: 127.0.0.1:8081 (ADMIN_HOST / ADMIN_PORT)
|
|
# Proxy HTTP: :8080 (PROXY_HTTP_PORT)
|
|
# Proxy HTTPS: :18443 (PROXY_HTTPS_PORT)
|
|
```
|
|
|
|
Visit http://127.0.0.1:8081
|
|
|
|
Data (db, certs, logs, www html) lives in `./data` relative to where you ran the binary.
|
|
|
|
## Docker (recommended)
|
|
```bash
|
|
docker compose up -d
|
|
# compose sets ADMIN_PORT=81 PROXY_HTTP_PORT=80 PROXY_HTTPS_PORT=443
|
|
# proxy :80/:443 published; admin binds 127.0.0.1:81 (not published by default)
|
|
# or
|
|
docker build -t helix-proxy:dev .
|
|
docker run --env ADMIN_PASSWORD='choose-a-real-password' \
|
|
-p 80:80 -p 443:443 \
|
|
-e ADMIN_PORT=81 -e PROXY_HTTP_PORT=80 -e PROXY_HTTPS_PORT=443 \
|
|
-v $PWD/data:/app/data --workdir /app helix-proxy:dev
|
|
```
|
|
|
|
Publishing admin (`-p 81:81`) also needs `-e ADMIN_HOST=0.0.0.0`. Do not publish :81 on untrusted networks.
|
|
Without those env overrides the binary still defaults to admin `127.0.0.1:8081` and proxy `:8080` / `:18443` inside the container.
|
|
|
|
PUID/PGID + DISABLE_IPV6 example (see docker-compose.yml for full):
|
|
```yaml
|
|
# user: "0:0" # root to allow chown+drop inside
|
|
environment:
|
|
- PUID=1000
|
|
- PGID=1000
|
|
- DISABLE_IPV6=1
|
|
# PUID_NO_DROP=1 # for low ports (80/443) + PUID: do chown as root but do not drop (stay root to bind low ports; default with PUID drops to non-root after chown, so use high ports or NET_BIND_SERVICE cap or run without PUID for low ports)
|
|
```
|
|
Binary auto-chowns data tree (if started root) then drops privs (unless PUID_NO_DROP); umask support via UMASK env. Files 0600, dirs 0755.
|
|
Note: privilege drop happens early (before listeners); low-port binds require either root (with PUID_NO_DROP), capabilities, high ports in config, or external setuid wrapper.
|
|
|
|
See docker-compose.yml for a full example (ADMIN_PORT=81 / proxy 80/443 via env; publishes 80/443; admin stays on loopback unless you set `ADMIN_HOST` / publish the admin port).
|
|
|
|
## Paths (all overridable)
|
|
- `data/db.bolt` (or `DATA_DIR`)
|
|
- `data/certs/`, `data/logs/`, `data/letsencrypt-acme-challenge/`
|
|
- `data/www/` (default site / custom html; `WWW_DIR` or `HTML_DIR`)
|
|
- `data/.jwt_secret` (auto-generated admin API signing key if `JWT_SECRET` is unset)
|
|
- etc.
|
|
|
|
## Status
|
|
Core features implemented and verified:
|
|
- cwd-relative + env-overridable paths/storage (single `data/db.bolt` primary via bbolt)
|
|
- pure-Go engine: proxy hosts (full: locations, advanced_config parser, ssl_forced, block_exploits, websocket, hsts, caching w/ HIT/MISS, access lists, custom certs, LE), streams (tcp/udp +ssl term), redirection hosts (full forward_http_code/preservePath/scheme + CRUD), dead hosts (per-dead custom content + CRUD)
|
|
- certificates: custom PEM (meta keys compat) + full Let's Encrypt issuance/renewal via lego (http-01). In PROXY_MODE=development *all* LE certs are self-signed test certs (domain-based sim tricks removed).
|
|
- single admin (`ADMIN_PASSWORD` required in production; default `"password"` refused; hashed + stored in DB; no registration or multi-user)
|
|
- audit (userId=1), settings (default_site + letsencrypt_email etc)
|
|
- live reload on all CRUD, dual https/http + SNI, embedded Svelte SPA (full tabs, pickers, edits)
|
|
- single binary (go build embeds UI after make ui-build), docker multi-stage + full PUID/PGID/umask
|
|
- no nginx, no .conf files, no external processes for proxying
|
|
|
|
LE note: for real certs use a public DNS domain pointing at your server (port 80/http reachable). By default (production), real LE http-01 is used. Set PROXY_MODE=development and *all* letsencrypt cert requests will produce self-signed test certs instead (for dev/testing). Real LE will be used otherwise (requires valid email, port 80 reachable etc).
|
|
|
|
## Development
|
|
- `make ui-build` (once real Svelte UI added to ui/)
|
|
- `make`
|
|
- `make docker`
|
|
|
|
Contributions / v2 features: open an issue or just ask to implement the next piece (advanced config, full certs with lego, streams, full Svelte UI, SQL backend, etc.).
|