Initial implementation of mc-proxy

Layer 4 TLS SNI proxy with global firewall (IP/CIDR/GeoIP blocking),
per-listener route tables, bidirectional TCP relay with half-close
propagation, and a gRPC admin API (routes, firewall, status) with
TLS/mTLS support.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

deploy/mc-proxy.toml.example

@@ -0,0 +1,37 @@
+# mc-proxy configuration
+
+# Listeners. Each entry binds a TCP listener on the specified address.
+[[listeners]]
+addr = ":443"
+
+[[listeners]]
+addr = ":8443"
+
+[[listeners]]
+addr = ":9443"
+
+# Routes. SNI hostname → backend address.
+[[routes]]
+hostname = "metacrypt.metacircular.net"
+backend  = "127.0.0.1:18443"
+
+[[routes]]
+hostname = "mcias.metacircular.net"
+backend  = "127.0.0.1:28443"
+
+# Firewall. Global blocklist, evaluated before routing. Default allow.
+[firewall]
+geoip_db          = "/srv/mc-proxy/GeoLite2-Country.mmdb"
+blocked_ips       = []
+blocked_cidrs     = []
+blocked_countries = ["KP", "CN", "IN", "IL"]
+
+# Proxy behavior.
+[proxy]
+connect_timeout  = "5s"
+idle_timeout     = "300s"
+shutdown_timeout = "30s"
+
+# Logging.
+[log]
+level = "info"

deploy/scripts/install.sh

@@ -0,0 +1,42 @@
+#!/bin/sh
+set -eu
+
+SERVICE="mc-proxy"
+BINARY="/usr/local/bin/${SERVICE}"
+DATA_DIR="/srv/${SERVICE}"
+UNIT_DIR="/etc/systemd/system"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+REPO_DIR="$(cd "${SCRIPT_DIR}/../.." && pwd)"
+
+# Create system user and group (idempotent).
+if ! id -u "${SERVICE}" >/dev/null 2>&1; then
+    useradd --system --no-create-home --shell /usr/sbin/nologin "${SERVICE}"
+    echo "Created system user ${SERVICE}."
+fi
+
+# Install binary.
+install -m 0755 "${REPO_DIR}/${SERVICE}" "${BINARY}"
+echo "Installed ${BINARY}."
+
+# Create data directory structure.
+install -d -o "${SERVICE}" -g "${SERVICE}" -m 0700 "${DATA_DIR}"
+install -d -o "${SERVICE}" -g "${SERVICE}" -m 0700 "${DATA_DIR}/backups"
+echo "Created ${DATA_DIR}/."
+
+# Install example config if none exists.
+if [ ! -f "${DATA_DIR}/${SERVICE}.toml" ]; then
+    install -o "${SERVICE}" -g "${SERVICE}" -m 0600 \
+        "${REPO_DIR}/${SERVICE}.toml.example" \
+        "${DATA_DIR}/${SERVICE}.toml"
+    echo "Installed example config to ${DATA_DIR}/${SERVICE}.toml — edit before starting."
+fi
+
+# Install systemd units.
+install -m 0644 "${REPO_DIR}/deploy/systemd/${SERVICE}.service" "${UNIT_DIR}/"
+systemctl daemon-reload
+echo "Installed systemd unit ${SERVICE}.service."
+
+echo ""
+echo "Done. Next steps:"
+echo "  1. Edit ${DATA_DIR}/${SERVICE}.toml"
+echo "  2. systemctl enable --now ${SERVICE}"

deploy/systemd/mc-proxy.service

@@ -0,0 +1,32 @@
+[Unit]
+Description=mc-proxy TLS proxy and router
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=mc-proxy
+Group=mc-proxy
+ExecStart=/usr/local/bin/mc-proxy server --config /srv/mc-proxy/mc-proxy.toml
+Restart=on-failure
+RestartSec=5
+
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictNamespaces=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+RestrictRealtime=true
+ReadWritePaths=/srv/mc-proxy
+
+[Install]
+WantedBy=multi-user.target