GoProxify

How GoProxify works

From the control panel to the architecture assistant — here is what each piece does for you day to day.

Admin

Your control panel

A clear web interface to run the whole setup: publish sites, attach domain names, invite teammates, schedule backups, and follow alerts — in your language (EN, FR, ES, DE).

Create and edit which address opens which site
Manage domains and certificates from one place
Design your layout with the architecture assistant

Architecture assistant

Draw your setup, install or reconfigure it

Inside the Admin, place your machines on a canvas and drop what each one needs — control panel, gateways, Agent, Portainer. GoProxify turns that picture into ready-to-run install steps, and lets you reconfigure an existing deployment without editing compose files yourself.

Drag hosts and services onto a visual board — no blank config to invent
Get install commands per machine, already wired together
Reconfigure live nodes — GoProxify tells you what needs a restart or a redeploy

Gateway

The traffic gateways

Gateways are the public front door. They welcome visitors on your https://… addresses and send each one to the right site in your fleet — quietly, and at scale.

Expose several websites behind their own internet addresses
Share load when several copies of an app are running
Keep traffic flowing if you run more than one gateway

Agent + Portainer

Your container fleet, connected

The Agent watches your containers (via Portainer or Docker) and tells the gateways what is running. When you start, stop or move an app, public routes stay in sync.

Discover new containers, Kubernetes services and Consul, Nomad, etcd or Amazon ECS instances as they appear
Stay linked to Portainer to manage the whole fleet
Update routes automatically when apps change

Reliability

Keeps working when things break

Your sites should not go dark because one machine hiccups. Gateways remember their settings, a spare gateway can take over, and unhealthy apps are skipped.

Sites keep answering even if the Admin is briefly offline
A second gateway covers for the first — configurable health checks, circuit breaker, retry
Failing apps are bypassed so visitors still reach a healthy copy

Security

Protect what you publish

Putting sites on the internet invites bots and abuse. GoProxify includes a WAF, the Sentinel behavioural engine, CrowdSec integration, GeoIP filtering, and SSO — all configured from the Admin.

WAF — 13 OWASP CRS-4 rule sets, anomaly scoring, response body inspection, hot-reload
Sentinel — immediate ban on signal, anti-DDoS global RPS, behavioural per-IP window
Rate limit (per IP or per authenticated user), GeoIP, CrowdSec, CVE scanner, SSO
Automation flows — rules, schedules and playbooks with human approval, built in a visual editor
WASM plugins — Coraza (SecLang) and ready-made examples installed in one click, sandboxed on every request

Visibility

See what happens

Know who visits which site, spot errors quickly, and get notified where your team already works — without digging through server files.

Live views of traffic across your published sites
Clear access logs you can actually read
Alerts on several channels when something goes wrong

Access

Reach servers from the browser

When an operator needs a shell on a VM or container, they open a secure terminal in the browser. You invite people, set limits, and avoid sharing passwords in chat.

Secure web terminal to VMs and containers
Invite operators with the access they need — no more
Optional second factor instead of shared passwords

Privacy

Built for GDPR

Visitor IP addresses are personal data. Decide how they are kept and for how long, who may see them, and handle erasure requests — from the Admin, the CLI or the API.

IPs kept in full, anonymised, or pseudonymised (AES-256 encrypted, revealable)
Real IP revealed only by the accounts you authorise — superadmin, DPO, delegation — with a reason in the audit log
Configurable retention and right to erasure (Art. 17) by IP or by user
Self-hosted: you remain the data controller, logs stay on your servers

Two example setups

Many layouts are possible — here are two examples. A home lab needs one Admin, one Edge and one Agent. For production, add a second gateway and an Agent on every host. Read the diagram top to bottom: Internet, gateways, then your apps and hosts.

goproxify — home lab · 1 Admin · 1 Edge · 1 Agent

goproxify — enterprise · 1 Admin · 2 Edges · 4 hosts

You can build a layout like this in the Admin with the architecture assistant: place hosts on a board, then get install steps and a QR code per machine.

A look at the Admin

A few screens from a running instance — dashboard, topology editor, security and live logs.

Dashboard

Fleet health, request rate and recent activity at a glance.

Proxies

Every HTTP proxy and L4 stream in one view — status, backends, load balancing and live throughput.

GoProxify Admin — Prism traffic analysis

Prism analytics

Traffic analysis across gateways and proxies: requests, error rate, countries, anomalies and top clients.

Architecture assistant

Place hosts on a board and let GoProxify turn it into a working setup.

GoProxify Admin — Infrastructure, HA group with 2 gateways

Redundant gateways, live

Infrastructure view of an HA group — two gateways, one leader, quorum and sync tracked in real time.

Security

Fail2Ban, CrowdSec and WAF status, bans and posture score per gateway.

Automation

Rules, schedules, playbooks, alert channels and ready-made flow templates.

SSH portal

Access catalog of SSH and Docker destinations, reachable from a web terminal or a standard ssh client.

Live access logs

Every request across every proxy, filterable in real time.

Get started in 5 minutes

A ready-to-run Admin + Edge + Agent stack. Pick your method.

Generates hex-32 secrets, writes .env (chmod 600), checks Docker / ports, then starts Admin + Edge + Agent.

shell

# Download then run (inspect before execute)
$ curl -fsSL https://github.com/Vincamok/goproxify/raw/public/main/scripts/quickstart.sh -o quickstart.sh
$ bash quickstart.sh

Admin UI → http://localhost:9443. Variants (run alone, never paste with the block above): bash quickstart.sh --print-secrets · bash quickstart.sh --env-only

Official GHCR images with floating :preview tag (0.x). Optional SemVer pin via versions.json.

              shell
              
            
# 1. Generate docker-compose.yml + .env (no manual download needed)
$ curl -fsSL https://github.com/Vincamok/goproxify/raw/public/main/scripts/quickstart.sh -o quickstart.sh
$ bash quickstart.sh --env-only
 
# 2. Fill secrets in .env if needed (already generated by the script)
 
# 3. Start Admin + Edge + Agent
$ docker compose up -d
 
# Admin UI → http://localhost:9443

.env (excerpt)

# Click the key icon to generate secrets in your browser
GPX_JWT_SECRET=
GPX_PAIRING_SECRET=
GPX_FIRST_ADMIN_EMAIL=admin@example.com
GPX_FIRST_ADMIN_PASSWORD=

# Optional — defaults work out of the box; configure further in the Admin
# ADMIN_PORT=9443
# TZ=Europe/Paris
# GOPROXIFY_ADMIN_TAG=preview
# GOPROXIFY_EDGE_TAG=preview
# GOPROXIFY_AGENT_TAG=preview

Stacks → Add stack → Web editor. Pick a model, paste the compose, deploy. Admin on port 9443.

Paste the compose, then load stack.env (Advanced → Load variables from .env file) or set the same keys in Environment variables.

docker-compose.yml

# Portainer — model A: secrets via stack.env
networks:
  goproxify_net:
    name: goproxify_net

volumes:
  goproxify_admin_data:
  goproxify_edge_data:
  goproxify_agent_data:

services:
  goproxify-admin:
    image: ghcr.io/vincamok/goproxify/admin:preview
    container_name: goproxify-admin
    restart: unless-stopped
    command: ["admin"]
    environment:
      - TZ=${TZ:-Europe/Paris}
      - GPX_SECURITY_JWT_SECRET=${GPX_JWT_SECRET}
      - GPX_PAIRING_SECRET=${GPX_PAIRING_SECRET}
      - GPX_FIRST_ADMIN_EMAIL=${GPX_FIRST_ADMIN_EMAIL}
      - GPX_FIRST_ADMIN_PASSWORD=${GPX_FIRST_ADMIN_PASSWORD}
      - GPX_IDENTITY_EDGE_NODE_NAME=${EDGE_NODE_NAME:-goproxify-edge}
      - GPX_SERVER_API_PORT=9443
    ports:
      - "${ADMIN_PORT:-9443}:9443"
    volumes:
      - goproxify_admin_data:/etc/goproxify
    networks: [goproxify_net]

  goproxify-edge:
    image: ghcr.io/vincamok/goproxify/edge:preview
    container_name: goproxify-edge
    restart: unless-stopped
    command: ["edge"]
    environment:
      - TZ=${TZ:-Europe/Paris}
      - GPX_PAIRING_SECRET=${GPX_PAIRING_SECRET}
      - GPX_IDENTITY_EDGE_NODE_NAME=${EDGE_NODE_NAME:-goproxify-edge}
    ports:
      - "${EDGE_HTTP_PORT:-80}:80"
      - "${EDGE_HTTPS_PORT:-443}:443"
      - "${EDGE_HTTPS_PORT:-443}:443/udp"
    volumes:
      - goproxify_edge_data:/etc/goproxify
    networks: [goproxify_net]
    depends_on: [goproxify-admin]

  goproxify-agent:
    image: ghcr.io/vincamok/goproxify/agent:preview
    container_name: goproxify-agent
    restart: unless-stopped
    command: ["agent"]
    environment:
      - TZ=${TZ:-Europe/Paris}
      - GPX_PAIRING_SECRET=${GPX_PAIRING_SECRET}
      - GPX_CONTROL_PLANE_EDGE_ENDPOINT=http://goproxify-edge:8000
      - GPX_CONTROL_PLANE_ADMIN_ENDPOINT=http://goproxify-admin:9443
      - GPX_IDENTITY_AGENT_NODE_NAME=${AGENT_NODE_NAME:-goproxify-agent}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - goproxify_agent_data:/etc/goproxify
    networks: [goproxify_net]
    depends_on: [goproxify-edge]

stack.env

# Click the key icon to generate secrets in your browser
GPX_JWT_SECRET=
GPX_PAIRING_SECRET=
GPX_FIRST_ADMIN_EMAIL=admin@example.com
GPX_FIRST_ADMIN_PASSWORD=

# Optional — defaults work out of the box; configure further in the Admin
# ADMIN_PORT=9443
# TZ=Europe/Paris
# EDGE_NODE_NAME=goproxify-edge
# AGENT_NODE_NAME=goproxify-agent

Single paste: replace CHANGE_ME_* before Deploy. No stack.env / env file needed.

docker-compose.yml

# Portainer — model B: inline secrets (no stack.env)
# Click the key icon to fill CHANGE_ME_* in your browser
networks:
  goproxify_net:
    name: goproxify_net

volumes:
  goproxify_admin_data:
  goproxify_edge_data:
  goproxify_agent_data:

services:
  goproxify-admin:
    image: ghcr.io/vincamok/goproxify/admin:preview
    container_name: goproxify-admin
    restart: unless-stopped
    command: ["admin"]
    environment:
      - TZ=Europe/Paris
      - GPX_SECURITY_JWT_SECRET=CHANGE_ME_JWT_HEX32
      - GPX_PAIRING_SECRET=CHANGE_ME_PAIRING_HEX32
      - GPX_FIRST_ADMIN_EMAIL=admin@example.com
      - GPX_FIRST_ADMIN_PASSWORD=CHANGE_ME_PASSWORD_MIN12
      - GPX_IDENTITY_EDGE_NODE_NAME=goproxify-edge
      - GPX_SERVER_API_PORT=9443
    ports:
      - "9443:9443"
    volumes:
      - goproxify_admin_data:/etc/goproxify
    networks: [goproxify_net]

  goproxify-edge:
    image: ghcr.io/vincamok/goproxify/edge:preview
    container_name: goproxify-edge
    restart: unless-stopped
    command: ["edge"]
    environment:
      - TZ=Europe/Paris
      - GPX_PAIRING_SECRET=CHANGE_ME_PAIRING_HEX32
      - GPX_IDENTITY_EDGE_NODE_NAME=goproxify-edge
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    volumes:
      - goproxify_edge_data:/etc/goproxify
    networks: [goproxify_net]
    depends_on: [goproxify-admin]

  goproxify-agent:
    image: ghcr.io/vincamok/goproxify/agent:preview
    container_name: goproxify-agent
    restart: unless-stopped
    command: ["agent"]
    environment:
      - TZ=Europe/Paris
      - GPX_PAIRING_SECRET=CHANGE_ME_PAIRING_HEX32
      - GPX_CONTROL_PLANE_EDGE_ENDPOINT=http://goproxify-edge:8000
      - GPX_CONTROL_PLANE_ADMIN_ENDPOINT=http://goproxify-admin:9443
      - GPX_IDENTITY_AGENT_NODE_NAME=goproxify-agent
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - goproxify_agent_data:/etc/goproxify
    networks: [goproxify_net]
    depends_on: [goproxify-edge]

Edge and Agent pair via the same GPX_PAIRING_SECRET. Secrets are generated in your browser only — nothing is sent to any server.

Chart in the repo (helm/goproxify). Requires global.authToken. Generate secrets in your browser, then helm install.

values-secrets.yaml

# Click the key icon — secrets stay in your browser
fullnameOverride: goproxify

global:
  authToken: ""
  timezone: Europe/Paris

admin:
  image:
    tag: "preview"
  config:
    jwtSecret: ""
  ingress:
    enabled: true
    host: admin.example.com

edge:
  image:
    tag: "preview"

agent:
  image:
    tag: "preview"

              shell
              
            
# 1. Clone chart (public/main)
$ git clone -b public/main https://github.com/Vincamok/goproxify.git && cd goproxify
 
# 2. Save values-secrets.yaml (from the block above), then install
$ helm upgrade --install goproxify ./helm/goproxify \
  -n goproxify --create-namespace \
  -f values-secrets.yaml
 
# Admin Service → port-forward or Ingress host
$ kubectl -n goproxify port-forward svc/goproxify-admin 8080:8080

shell
                
                
              
# Build from source (Go 1.25+)
$ git clone -b public/main https://github.com/Vincamok/goproxify.git && cd goproxify
$ go build -o goproxify ./cmd/goproxify
 
# Click the key icon to fill secrets (browser-only)
# Admin (control plane)
$ GPX_SECURITY_JWT_SECRET=CHANGE_ME_JWT_HEX32 \
  GPX_PAIRING_SECRET=CHANGE_ME_PAIRING_HEX32 \
  ./goproxify admin
 
# Edge (data plane) — same pairing secret
$ GPX_PAIRING_SECRET=CHANGE_ME_PAIRING_HEX32 \
  ./goproxify edge
 
# Agent (optional)
$ GPX_PAIRING_SECRET=CHANGE_ME_PAIRING_HEX32 \
  GPX_CONTROL_PLANE_EDGE_ENDPOINT=http://localhost:8000 \
  GPX_CONTROL_PLANE_ADMIN_ENDPOINT=http://localhost:9443 \
  ./goproxify agent

One role per machine, same images. Use the same GPX_PAIRING_SECRET everywhere and open port 8000 between machines (firewall: only from your own hosts).

1. Admin + Gateway 1

On the first machine, follow the Home lab method (Script or Docker Compose): it starts the Admin and the first Edge.

2. Second Edge

On a second machine, run an Edge with its own node name, then register it in the Admin (Infrastructure → Edit architecture): it goes from declared to online.

docker-compose.yml — edge 2

services:
  goproxify-edge:
    image: ghcr.io/vincamok/goproxify/edge:preview
    container_name: goproxify-edge
    restart: unless-stopped
    command: ["edge"]
    environment:
      - GPX_PAIRING_SECRET=<same as the Admin>
      - GPX_IDENTITY_EDGE_NODE_NAME=edge-2
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
      - "8000:8000"
    volumes:
      - edge2_data:/etc/goproxify

volumes:
  edge2_data:

3. One Agent per host

On each internal host, run an Agent that points to an Edge. Give every Agent a unique node name, then approve it in the Admin (Agents menu).

docker-compose.yml — agent

services:
  goproxify-agent:
    image: ghcr.io/vincamok/goproxify/agent:preview
    container_name: goproxify-agent
    restart: unless-stopped
    command: ["agent"]
    environment:
      - GPX_PAIRING_SECRET=<same as the Admin>
      - GPX_CONTROL_PLANE_EDGE_ENDPOINT=http://<edge-ip>:8000
      - GPX_CONTROL_PLANE_ADMIN_ENDPOINT=http://<admin-ip>:9443
      - GPX_IDENTITY_AGENT_NODE_NAME=agent-host-1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - agent_data:/etc/goproxify

volumes:
  agent_data:

Tip: the architecture assistant in the Admin generates these steps, with a QR code, for each machine.

10 alert channels

Each alert rule can notify multiple teams on multiple channels at once. Alertmanager-inspired model.

Email

SMTP configurable

Webhook

Slack, Discord, Teams…

ntfy.sh

Push mobile, self-hosted

Gotify

Push mobile, self-hosted

Jira

Automatic issue creation

Linear

Modern issue tracking

GitHub Issues

Automatic issue opening

GitLab Issues

Automatic issue opening

Zammad

Open-source ticketing

GLPI

ITSM via REST API

Tech stack

Deliberate choices. No heavy framework, no hidden runtime — just Go and proven libraries.

Component	Role	Used in
Go 1.25	Single static binary, zero runtime to install, native cross-compilation	Admin · Edge · Agent
HTTP/3 QUIC	UDP transport via `quic-go`. Automatic Alt-Svc, 0-RTT, lower latency on degraded networks	Edge
SQLite (CGO-free)	Persistance without C deps. Cross-platform binary. Optional Raft cluster (3 nodes) for Admin HA	Admin
WebSocket control plane	Persistent Admin↔Edge and Agent↔Edge tunnels. `full_sync`, live metrics for adaptive LB, inter-Edge gateway	Admin · Edge · Agent
mTLS L4 tunnel	Edge↔Edge encrypted L4 channel — pool of peers, automatic failover, CONNECT-like protocol over TLS 1.3	Edge
Cache AES-256-GCM	Encrypted routes & certs on disk. Edge starts autonomously even if Admin is unreachable	Edge
Prometheus	`/metrics` endpoint on every component — drop-in Grafana integration	Admin · Edge · Agent
OpenTelemetry	Distributed request tracing. Configurable OTLP exporters (Jaeger, Tempo…)	Edge · Admin
Docker Engine API	Read-only via `docker.sock`. Real-time container events (start/stop/update)	Agent
Service directories	Kubernetes, Portainer, Consul, Nomad, etcd v3 and Amazon ECS — same options as Docker labels; an unreachable directory never removes a route	Agent
WebAssembly (wazero)	Sandboxed plugins on requests, bodies and TCP/UDP streams, without CGO. Signed packages, plugin repositories, Coraza (SecLang) bundled	Edge · Admin
JWT + PAT	UI session (JWT). User API tokens `gpx_pat_*` with scopes for REST & MCP. Separate Edge/Agent pairing tokens	Admin
MCP	Model Context Protocol (JSON-RPC + SSE). 30+ tools: proxies, certs, domains, snippets, alerts, auth providers, logs, audit… PAT required — Claude Desktop / Cursor ready	Admin
ACME DNS-01	Automatic wildcard certs via OVH, Cloudflare, Gandi, Route53, Hetzner and 28 more DNS providers (libdns)	Admin → Edge
Certificate Hub	ACME monitor (expiry dashboard + alerts), external cert import (PEM), deploy targets (webhook HMAC / ssh_exec), pull tokens in 7 formats (PEM / DER / PKCS#12 / JSON)	Admin
Internal CA	Self-signed internal root CA (ECDSA P-256), server/client certificate issuance for internal services — outside ACME	Admin

What is a reverse proxy for?

Several sites, several addresses

One front door for all of them

You stay in control

How GoProxify works

Your control panel

Draw your setup, install or reconfigure it

The traffic gateways

Your container fleet, connected

Keeps working when things break

Protect what you publish

See what happens

Reach servers from the browser

Built for GDPR

Two example setups

A look at the Admin

Dashboard

Proxies

Prism analytics

Architecture assistant

Redundant gateways, live

Security

Automation

SSH portal

Live access logs

Get started in 5 minutes

1. Admin + Gateway 1

2. Second Edge

3. One Agent per host

10 alert channels

Email

Webhook

ntfy.sh

Gotify

Jira

Linear

GitHub Issues

GitLab Issues

Zammad

GLPI

Tech stack

Documentation

API specifications

Tools & AI clients

Architecture

Domain delegation

Feature catalog

Frequently asked questions

Security engines

GDPR guide

CLI reference

Docker labels

Config schema

Metrics reference

Changelog

Public roadmap

Contributing

Docker volumes