GoProxify

One binary. Three roles. Zero compromise.

Data plane, control plane and discovery in one Go binary — deploy the role you need, where you need it.

Data Plane · core mode

High-performance reverse proxy

HTTP/1–3 QUIC, L4 TCP/UDP. Adaptive LB from Agent metrics, inter-Core gateway, failover. In-memory TLS, WS control hub, encrypted local cache.

Control Plane · admin mode

UI, REST API & MCP server

Web UI (EN/FR/ES/DE), REST & MCP with scoped PAT. Domain delegation, error-page library, Access catalog & invites, multi-schedule backups, CLI (token/backup/alert/import).

Discovery · agent mode

Docker, Podman & Kubernetes

Read-only docker.sock (or Podman). goproxify.* labels, K8s watch. Live container metrics over WS for adaptive LB. Routes applied on the Core in real time.

High availability

Resilient by design

Each Core boots from an AES-256-GCM cache — autonomous without Admin. Raft Admin HA. Domain passthrough/terminate between Cores. Backend failover + quarantine.

Security

Defense in depth

OWASP CRS-4 WAF, rate limiting, Geo-IP, threat feeds. SSO / OIDC / SAML / LDAP / GitHub. Admin MFA. Security grade, Fail2Ban & CrowdSec. Scoped PAT for API & MCP.

Observability

Prism, metrics & audit

JSON access logs, Prometheus, OpenTelemetry. Prism analytics (Admin + per-Core) with Logs correlation. Audit with session or PAT actor. Live traffic views.

Access · SSH & shell portal

Operator access to VMs & containers

Web terminal + standard ssh with UUID sessions. Admin catalog & invites, per-user vault (SSH login + key/password), optional 2FA, HTML templates with SPA fallback.

Distributed architecture

Three independent, complementary components. The Core is the source of truth — Admin is reconstructible; the Core never sleeps.

goproxify — architecture

Get started in 5 minutes

A ready-to-run Admin + Core + Agent stack. Pick your method.

Official images on GHCR (SemVer + :preview). Pin tags from versions.json.

# 1. Fetch quickstart + env template
$ curl -LO https://github.com/Vincamok/goproxify/raw/public/main/docker-compose.quickstart.yml
$ curl -LO https://github.com/Vincamok/goproxify/raw/public/main/.env.example
$ cp .env.example .env
 
# 2. Fill the 4 required secrets in .env (openssl rand -hex 32)
 
# 3. Start Admin + Core + Agent
$ docker compose -f docker-compose.quickstart.yml up -d
 
# Admin UI → http://localhost:9443

.env (excerpt)

# Images (defaults = GHCR public)
# GOPROXIFY_REGISTRY=ghcr.io/vincamok/goproxify
# GOPROXIFY_ADMIN_TAG=0.2.24
# GOPROXIFY_CORE_TAG=0.3.13
# GOPROXIFY_AGENT_TAG=0.3.9

# Required
GPX_JWT_SECRET=
GPX_PAIRING_SECRET=
GPX_FIRST_ADMIN_EMAIL=admin@example.com
GPX_FIRST_ADMIN_PASSWORD=

ADMIN_PORT=9443

Deploy via Stacks → Add stack → Repository.

1 Repository URL : https://github.com/Vincamok/goproxify 2 Compose path : docker-compose.quickstart.yml · Reference : public/main 3

Environment — set at least : GPX_JWT_SECRET GPX_PAIRING_SECRET GPX_FIRST_ADMIN_EMAIL GPX_FIRST_ADMIN_PASSWORD

4 Deploy → Admin on port 9443

Core and Agent pair automatically via shared GPX_PAIRING_SECRET.

# Build from source (Go 1.25+)
$ git clone -b public/main https://github.com/Vincamok/goproxify.git && cd goproxify
$ go build -o goproxify ./cmd/goproxify
 
# Admin (control plane)
$ GPX_SECURITY_JWT_SECRET=$(openssl rand -hex 32) ./goproxify admin
 
# Core (data plane)
$ GPX_CONTROL_PLANE_ADMIN_ENDPOINT=http://localhost:9443 \
  GPX_CORE_TOKEN=gpx_... \
  ./goproxify core
 
# Agent (optional)
$ GPX_CONTROL_PLANE_CORE_ENDPOINT=http://localhost:8000 \
  ./goproxify agent

10 alert channels

Each alert rule can notify multiple teams on multiple channels at once. Alertmanager-inspired model.

Email

SMTP configurable

Webhook

Slack, Discord, Teams…

ntfy.sh

Push mobile, self-hosted

Gotify

Push mobile, self-hosted

Jira

Création d'issue auto

Linear

Issue tracking moderne

GitHub Issues

Ouverture d'issue

GitLab Issues

Ouverture d'issue

Zammad

Ticketing open-source

GLPI

ITSM, API REST

Tech stack

Deliberate choices. No heavy framework, no hidden runtime — just Go and proven libraries.

Component	Role	Used in
Go 1.25	Single static binary, zero runtime to install, native cross-compilation	Admin · Core · Agent
HTTP/3 QUIC	UDP transport via `quic-go`. Automatic Alt-Svc, 0-RTT, lower latency on degraded networks	Core
SQLite (CGO-free)	Persistance without C deps. Cross-platform binary. Optional Raft cluster (3 nodes) for Admin HA	Admin
WebSocket control plane	Persistent Admin↔Core and Agent↔Core tunnels. `full_sync`, live metrics for adaptive LB, inter-Core gateway	Admin · Core · Agent
Cache AES-256-GCM	Encrypted routes & certs on disk. Core starts autonomously even if Admin is unreachable	Core
Prometheus	`/metrics` endpoint on every component — drop-in Grafana integration	Admin · Core · Agent
OpenTelemetry	Distributed request tracing. Configurable OTLP exporters (Jaeger, Tempo…)	Core · Admin
Docker Engine API	Read-only via `docker.sock`. Real-time container events (start/stop/update)	Agent
JWT + PAT	UI session (JWT). User API tokens `gpx_pat_*` with scopes for REST & MCP. Separate Core/Agent pairing tokens	Admin
MCP	Model Context Protocol (JSON-RPC + SSE). Proxies, nodes, logs, audit tools… PAT required — Claude Desktop / Cursor ready	Admin
ACME DNS-01	Automatic wildcard certs via OVH, Cloudflare, Gandi, Route53, Hetzner	Admin → Core

Documentation

Guides, API contract, MCP server and version tracking — all in the repo.

REST