With the team we are building a network management tool: switch upgrades, data collection/analytics, etc. With the write operations on production switches we've been requested to add an AAA flow so we have only 1 entry point for all microservices. For that reason we decided to add a proxy in the first place, so each request goes through the proxy, authenticates with External Authentication (the first A), then proceeds to the next step etc.

First we thought about squid/envoy, but these proxies were declined by our devops as planned for the future. For sure we found a workaround, but then I thought why there are almost no proxies with UI/ACLs/limits/quotas/speed limits etc.

So I decided to create my own solution that works out of the box with 1 simple command:

  docker run -d --name proxium -p 80:80 -p 8080:8080 -v proxium:/var/lib/proxium \
    -e SUPERUSER_CREATE=true -e SUPERUSER_EMAIL=admin@example.com \
    -e SUPERUSER_PASSWORD=change-me ikoldakov/proxium

Then open http://localhost, log in, create a proxy account and use it: curl -x http://username:password@localhost:8080 https://ifconfig.me curl -x socks5h://username:password@localhost:8080 https://ifconfig.me

Also, proxium supports https for the admin panel with self-signed certificates, let's encrypt certificates or your own uploaded ones. The proxy itself supports TLS too (self-signed, uploaded or imported from certbot).

External auth is not supported yet, but it's next in the roadmap: an HTTP hook in nginx auth_request style first, then JWTs from your identity provider. SSO over OIDC for the admin panel is planned as well.

I used AI for some parts of the code

Feedback is welcome!