Octo-proxy or octo is simple TCP & TLS Proxy with mutual authentication and traffic mirroring/shadowing support.
- Accept TCP connection and forward/mirror it to TCP
- Accept TCP connection and forward/mirror it to TLS (w/ mTLS)
- Accept TLS (w/ mTLS) connection and forward/mirror it to TCP
- Accept TLS (w/ mTLS) connection and forward/mirror it to TLS (w/ mTLS)
- Reload configuration or certificate without dropping connection
- Expose metrics that can be consumed by prometheus
octo-proxy -listener 127.0.0.1:8080 -target 127.0.0.1:80
// config.yaml
servers:
- name: web-proxy
listener:
host: 127.0.0.1
port: 8080
target:
host: 127.0.0.1
port: 80octo -config config.yaml
// config.yaml
servers:
- name: web-proxy
listener:
host: 0.0.0.0
port: 8080
tlsConfig:
mode: mutual
caCert: /tmp/ca-cert.pem
cert: /tmp/cert.pem
key: /tmp/cert-key.pem
target:
host: 127.0.0.1
port: 80octo-proxy -config config.yaml
// config.yaml
servers:
- name: web-proxy
listener:
host: 0.0.0.0
port: 8080
tlsConfig:
mode: simple
cert: /tmp/cert.pem
key: /tmp/cert-key.pem
target:
host: 127.0.0.1
port: 80
mirror:
host: 172.16.0.1
port: 80octo-proxy -config config.yaml
See all configuration in CONFIGURATION.md
After changing configuration or certificates, send signal SIGUSR1 or SIGUSR2 to octo-proxy process. Configuration will be reloaded if the configuration is valid.
Octo-proxy use SO_REUSEPORT to binding the listener, so every reload triggered octo-proxy will create new listener and drop old listener after new listener created, by using this approach octo-proxy can minimize dropped connection when reload triggered.
Metrics running at http://127.0.0.1:9123/metrics