Introduction¶
A self-hosted reverse proxy for homelabs, built on Kestrel and YARP. Deploy it once, then manage hosts, certificates and users from a web dashboard or a REST API, with every change reviewed first, versioned and reversible.
Pre-alpha
It works end to end, and v0.1, the first release, is coming. Until it is out, expect breaking changes, and do not put it in front of anything that matters yet.
Paduraksa: the gate into the inner sanctum, flanked by guardian figures meant to keep evil out.
What it does¶
- Proxying: HTTP/1.1, HTTP/2 and HTTP/3, a certificate per name (SNI), HTTPS redirects, WebSockets, HSTS. Real client addresses from behind Cloudflare, a trusted proxy or the PROXY protocol.
- Certificates: ACME issuance and renewal (HTTP-01, DNS-01 with Cloudflare or deSEC), uploaded and self-signed certificates, and a built-in local CA for LAN names.
- Safe changes: review every change as a diff before it goes live, collect changes in a draft, roll back any revision, and see who did what in a tamper-evident audit log.
- Access control and WAF: access lists with addresses, countries and basic-auth users, rule sets, rate limits, request limits, a proof-of-work browser check, a managed
robots.txt, and forward-auth to authentik, Authelia or oauth2-proxy. - Insight: access and error logs, a live tail, metrics (Prometheus too), traffic analytics, a request simulator and notifications.
- Automation: a REST API with an OpenAPI description, YAML import and export, a command line, and an MCP endpoint for AI assistants.
- Secrets stay encrypted in a vault: certificate keys, DNS credentials, TOTP secrets and access-list passwords.
Where to start¶
| If you want to | Read |
|---|---|
| Run it and put your first service behind it | Getting started |
| Understand hosts, routes, profiles and drafts | Hosts and routes |
| Get HTTPS for a public name or a LAN name | TLS and certificates |
| Lock a service down | Access control and WAF |
| Install it properly, back it up, upgrade it | Operating it |
| Script it | The REST API, The command line |
| Find out how it works, or what it defends against | Threat model, Design overview |
| Fix something that does not work | Troubleshooting |
The image¶
ghcr.io/hizkifw/paduraksa, for amd64 and arm64. The source, issues and releases are on GitHub. Paduraksa is licensed under Apache-2.0.