Kyle Isom
c7024dcdf0
Layer 4 TLS SNI proxy with global firewall (IP/CIDR/GeoIP blocking), per-listener route tables, bidirectional TCP relay with half-close propagation, and a gRPC admin API (routes, firewall, status) with TLS/mTLS support. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
38 lines
754 B
Plaintext
38 lines
754 B
Plaintext
# mc-proxy configuration
|
|
|
|
# Listeners. Each entry binds a TCP listener on the specified address.
|
|
[[listeners]]
|
|
addr = ":443"
|
|
|
|
[[listeners]]
|
|
addr = ":8443"
|
|
|
|
[[listeners]]
|
|
addr = ":9443"
|
|
|
|
# Routes. SNI hostname → backend address.
|
|
[[routes]]
|
|
hostname = "metacrypt.metacircular.net"
|
|
backend = "127.0.0.1:18443"
|
|
|
|
[[routes]]
|
|
hostname = "mcias.metacircular.net"
|
|
backend = "127.0.0.1:28443"
|
|
|
|
# Firewall. Global blocklist, evaluated before routing. Default allow.
|
|
[firewall]
|
|
geoip_db = "/srv/mc-proxy/GeoLite2-Country.mmdb"
|
|
blocked_ips = []
|
|
blocked_cidrs = []
|
|
blocked_countries = ["KP", "CN", "IN", "IL"]
|
|
|
|
# Proxy behavior.
|
|
[proxy]
|
|
connect_timeout = "5s"
|
|
idle_timeout = "300s"
|
|
shutdown_timeout = "30s"
|
|
|
|
# Logging.
|
|
[log]
|
|
level = "info"
|