v0.1.0

v0.1.0

Let's call this the first stable development release. We'll try to keep decent release notes going forward.

TLSPROXY is primarily a TLS termination proxy that uses letsencrypt to provide TLS encryption for any number of TCP or HTTP servers, and any number of server names concurrently on the same port.

Its functionality is similar to an stunnel server, but without the need to configure and run certbot separately.

TLSPROXY can also be used as a Reverse Proxy for HTTP(S) services, and optionally control access to these services with user authentication and authorization.

Overview of features:

• Use Let's Encrypt automatically to get TLS certificates (http-01 & tls-alpn-01 challenges).
• Terminate TLS connections, and forward the data to any TCP server in plaintext.
• Terminate TLS connections, and forward the data to any TLS server. The data is encrypted in transit, but the proxy sees the plaintext.
• Terminate TCP connections, and forward the TLS connection to any TLS server (passthrough). The proxy doesn't see the plaintext.
• Terminate HTTPS connections, and forward the requests to HTTP or HTTPS servers (http/1 only, not recommended with c2fmzq-server).
• TLS client authentication & authorization (when the proxy terminates the TLS connections).
• Built-in Certificate Authority for managing client and backend server TLS certificates.
• User authentication with OpenID Connect, SAML, and/or passkeys (for HTTP and HTTPS connections). Optionally issue JSON Web Tokens (JWT) to authenticated users to use with the backend services and/or run a local OpenID Connect server for backend services.
• Access control by IP address.
• Routing based on Server Name Indication (SNI), with optional default route when SNI isn't used.
• Simple round-robin load balancing between servers.
• Support any ALPN protocol in TLS, TLSPASSTHROUGH, or TCP mode.
• Use the same TCP address (IPAddr:port) for any number of server names, e.g. foo.example.com and bar.example.com on the same xxx.xxx.xxx.xxx:443.

v0.0.36

v0.0.36

• Experimenting with release notes
• Ensure PKI endpoint is on CONSOLE or LOCAL backend. This is to avoid potential interference from javascript code running on backends.
• Misc clean-up

v0.0.35

What's Changed

• Keep original sub claim, use email for auth by @rthellend in #23
• Update actions and pin versions by @rthellend in #24

Full Changelog: v0.0.34...v0.0.35

v0.0.34

What's Changed

• Add support for github oauth2 by @rthellend in #21
• Bandwidth limits by @rthellend in #22

Full Changelog: v0.0.33...v0.0.34

v0.0.33

Full Changelog: v0.0.32...v0.0.33

v0.0.32

What's Changed

• Add built-in PKI by @rthellend in #20

Full Changelog: v0.0.31...v0.0.32

v0.0.31

What's Changed

• Add ed25519 token keys by @rthellend in #19

Full Changelog: v0.0.30...v0.0.31

v0.0.30

What's Changed

• Add authentication with passkeys by @rthellend in #18

Full Changelog: v0.0.29...v0.0.30

v0.0.29

What's Changed

• Add a local OIDC provider by @rthellend in #17

Full Changelog: v0.0.28...v0.0.29

v0.0.28

What's Changed

• Link binaries statically when possible by @rthellend in #16

Full Changelog: v0.0.27...v0.0.28