example.json5

{
  // Admin API — optional management endpoint for external integration.
  // Disabled by default. Uncomment to enable.
  // admin: {
  //   listen: "127.0.0.1:9090",  // TCP address, or "unix:///var/run/prox.sock"
  //   token: "your-secret-token", // Optional Bearer token for authentication
  // },

  // Logging configuration.
  // Level can be overridden by LOG_LEVEL environment variable.
  logging: {
    level: "info",
    access_log: "/var/log/prox/access.log",
    error_log: "/var/log/prox/error.log",
  },

  // Global plugins registry.
  plugins: {
    auth: { path: "./plugins/auth" },
    resolver: { path: "./plugins/resolver" },

    // Autostart plugins are spawned at startup without route bindings.
    // Useful for background routines, health monitors, metrics, etc.
    routines: { path: "./plugins/routines", autostart: true },
  },

  // A web app with domain-based routing, API backend, and static frontend.
  services: {
    web: {
      listen: ":8080",
      // Service-level plugins apply to all routes in this service.
      plugins: ["auth"],
      routes: [
        // Health check — inline action, no need for a separate entry.
        {
          match: { path: "/health", methods: ["GET"] },
          action: {
            type: "static",
            status: 200,
            headers: { "Content-Type": "application/json" },
            body_ref: { json: { status: "ok" } },
          },
        },

        // API — proxy to backend with timeout.
        {
          match: { path: "/api/*" },
          // Per-route access log — requests to /api/* go to a separate file.
          access_log: "/var/log/prox/api-access.log",
          action: {
            type: "proxy",
            upstream: "localhost:3000",
            timeout: "10s",
          },
        },

        // Everything else — serve static files.
        {
          match: { path: "/*" },
          action: "frontend",
        },
      ],
    },

    // Mixed L4/L7 gateway — single listener, mixed pass-through and HTTP routes.
    // Routes are evaluated in order. "pass" routes relay raw TCP (no TLS termination).
    // Other routes go through TLS termination → HTTP routing as usual.
    gateway: {
      listen: ":443",
      tls: true,
      tls_cert: "/etc/prox/certs/",

      // Per-service tuning — override default server and proxy transport timeouts.
      // Durations accept strings ("5m", "30s") or numbers (seconds).
      config: {
        read_timeout: "5m", // time to read the full request (default: 10s)
        write_timeout: "5m", // time to write the full response (default: 30s)
        idle_timeout: "2m", // keep-alive idle timeout (default: 120s)
        response_header_timeout: "5m", // wait for upstream response headers (default: 30s)
        flush_interval: -1, // flush immediately — required for streaming (SSE, long-lived HTTP)
        max_connections: 10000, // limit concurrent connections (default: unlimited)
      },

      routes: [
        // L4: TCP pass-through — relay raw TLS to backend (no termination).
        {
          match: { domain: "*.cdn.example.com" },
          action: {
            type: "pass",
            upstream: "10.0.0.5:3504",
          },
        },

        // L7: normal HTTPS route — TLS terminated, then HTTP handling.
        {
          match: { domain: "*.example.com" },
          action: {
            type: "static",
            status: 200,
            headers: { "Content-Type": "text/plain" },
            body_ref: { text: "Hello from {domain}!" },
          },
        },

        // Load-balanced proxy with shared bandwidth limit.
        // All connections on this route share a 100 Mbps download budget.
        {
          match: { domain: "*.**", path: "/ws" },
          balancer: {
            type: "roundrobin",
            targets: ["10.0.1.1:3505", "10.0.1.2:3505", "10.0.1.3:3505"],
          },
          speed: { download_mbps: 100, shared: true },
          action: {
            type: "proxy",
            upstream: "{target}",
          },
        },

        // Plugin-managed targets with per-connection speed limit.
        // "resolver" plugin is declared on the action, not each route.
        // Each connection gets its own 50 Mbps download / 10 Mbps upload cap.
        {
          match: { domain: "*.**", path: "/ws" },
          balancer: { type: "leastconn" },
          speed: { download_mbps: 50, upload_mbps: 10 },
          set: { port: "8080" },
          action: "dynamic_proxy",
        },
        {
          match: { domain: "*.**", path: "/grpc" },
          balancer: { type: "leastconn" },
          set: { port: "8081" },
          action: "dynamic_proxy",
        },

        // Catch-all with custom Host header.
        {
          match: { domain: "*.**" },
          action: {
            type: "proxy",
            upstream: "https://backend.internal",
            headers: { Host: "public.example.com" },
          },
        },

        // Drop all unmatched requests.
        { action: { type: "drop" } },
      ],
    },
  },

  actions: {
    api: {
      type: "proxy",
      upstream: "localhost:3000",
      timeout: "10s",
    },
    frontend: {
      type: "serve",
      root: "./public",
    },
    // Shared dynamic proxy with fallback.
    // Action-level plugins apply to all routes using this action.
    dynamic_proxy: {
      type: "proxy",
      upstream: "{target}:{port}",
      plugins: ["resolver"],
      fallback: "default_backend",
    },
    default_backend: {
      type: "proxy",
      upstream: "https://fallback.internal",
    },
  },
}