Kyle Isom
b25e1b0e79
Rate limiting: per-source-IP connection rate limiter in the firewall layer with configurable limit and sliding window. Blocklisted IPs are rejected before rate limit evaluation to avoid wasting quota. Unix socket: the gRPC admin API can now listen on a Unix domain socket (no TLS required), secured by file permissions (0600), as a simpler alternative for local-only access. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
66 lines
1.8 KiB
Plaintext
66 lines
1.8 KiB
Plaintext
# mc-proxy configuration
|
|
#
|
|
# This file seeds the database on first run. After that, the database is
|
|
# the source of truth — listener, route, and firewall fields here are ignored.
|
|
|
|
# Database. Required.
|
|
[database]
|
|
path = "/srv/mc-proxy/mc-proxy.db"
|
|
|
|
# Listeners. Each listener binds a TCP port and has its own route table.
|
|
[[listeners]]
|
|
addr = ":443"
|
|
|
|
[[listeners.routes]]
|
|
hostname = "metacrypt.metacircular.net"
|
|
backend = "127.0.0.1:18443"
|
|
|
|
[[listeners.routes]]
|
|
hostname = "mcias.metacircular.net"
|
|
backend = "127.0.0.1:28443"
|
|
|
|
[[listeners]]
|
|
addr = ":8443"
|
|
|
|
[[listeners.routes]]
|
|
hostname = "metacrypt.metacircular.net"
|
|
backend = "127.0.0.1:18443"
|
|
|
|
[[listeners]]
|
|
addr = ":9443"
|
|
|
|
[[listeners.routes]]
|
|
hostname = "mcias.metacircular.net"
|
|
backend = "127.0.0.1:28443"
|
|
|
|
# gRPC admin API. Optional — omit or leave addr empty to disable.
|
|
# If enabled over TCP, tls_cert and tls_key are required. mTLS (client_ca)
|
|
# is strongly recommended for any non-loopback listen address.
|
|
[grpc]
|
|
addr = "127.0.0.1:9090"
|
|
tls_cert = "/srv/mc-proxy/certs/cert.pem"
|
|
tls_key = "/srv/mc-proxy/certs/key.pem"
|
|
client_ca = "/srv/mc-proxy/certs/ca.pem" # mTLS; omit to disable client auth
|
|
|
|
# Unix socket alternative (no TLS needed, secured by file permissions):
|
|
# addr = "/srv/mc-proxy/admin.sock"
|
|
|
|
# Firewall. Global blocklist, evaluated before routing. Default allow.
|
|
[firewall]
|
|
geoip_db = "/srv/mc-proxy/GeoLite2-Country.mmdb"
|
|
blocked_ips = []
|
|
blocked_cidrs = []
|
|
blocked_countries = ["KP", "CN", "IN", "IL"]
|
|
rate_limit = 100 # max connections per source IP per window (0 = disabled)
|
|
rate_window = "1m" # sliding window duration (required if rate_limit > 0)
|
|
|
|
# Proxy behavior.
|
|
[proxy]
|
|
connect_timeout = "5s"
|
|
idle_timeout = "300s"
|
|
shutdown_timeout = "30s"
|
|
|
|
# Logging.
|
|
[log]
|
|
level = "info"
|