____ __
/ __ \_________ ____ __ ______ / /__ ____ _
/ /_/ / ___/ __ \/ __ \/ / / / / _ \/ / _ \/ __ `/
/ ____/ / / /_/ / /_/ / /_/ / / __/ / __/ /_/ /
\/ \/ \____/ .___/\__, /_/\___/_/\___/\__,_/
/_/ /____/
Sovereign L7 Reverse Proxy & Perimeter Defense Gate
In ancient classical Greece, the Propylaea (Προπύλαια) stood as the monumental fortified gateway to the Acropolis of Athens—a majestic boundary shielding the sacred citadel within while welcoming legitimate citizens. Propylea serves the exact same role for your modern web architecture: a sovereign, ultra-low-memory L7 reverse proxy, multi-domain SNI TLS multiplexer, and perimeter defense gateway written in 100% pure Rust.
Modern web infrastructure is plagued by two persistent problems:
- Memory Bloat & Resource Starvation: Conventional reverse proxies (Caddy, Traefik, Kong) carry heavy Go runtimes, garbage collection pauses, and multi-megabyte footprints that starve small VPS nodes and edge workstations.
- Passive Forwarding of Hostile Scanners: Traditional proxies blindly pass automated reconnaissance scans (/.env,/wp-login.php,/.git/config) directly upstream to your web applications, wasting CPU cycles and exposing application attack surfaces.
Propylea solves both:
-
$< 15\text{ MB}$ Constant RSS: Zero garbage collector, zero C runtime dependencies, and an autonomous memory vacuum that periodically returns unused heap pages directly to the Linux kernel vialibc::malloc_trim.
-
Nanosecond Perimeter Defense: Powered by the sovereign phylaxdefense pipeline, Propylea evaluates incoming request paths against an in-memory threat trie in$< 15\text{ ns}$ . Automated crawlers and vulnerability sprayers are served stealth404 Not Foundresponses before they ever reach your upstream services.
- Automated Threat Intelligence: Seamlessly and asynchronously dispatches forensic dossiers to AbuseIPDB and custom webhooks (Slack, Discord, SIEM) with built-in token-bucket rate limiting to stay safely within free-tier quotas.
Below is an authentic execution trace captured at the ingress boundary during a mass Internet scanning wave:
2026-09-24T04:12:01.002Z WARN [PROPYLEA-EDGE] Hostile reconnaissance scan trapped at ingress
├── Remote IP: 198.51.100.42 (Anonymous VPN / Proxy)
├── Target URI: GET /.env
├── Action: Intercepted in 11ns (stealth 404 returned, 0 bytes proxied upstream)
└── Threat Intelligence: Dispatched async incident report to AbuseIPDB (Confidence: 100%)
2026-09-24T04:12:01.450Z INFO [PROPYLEA-ROUTER] Legitimate client proxied upstream
├── Remote IP: 203.0.113.19
├── Target URI: GET /api/v1/status
├── Resolved Upstream: 127.0.0.1:8080 (app.example.com)
├── Duration: 142µs
└── Telemetry: Recorded in ring buffer (Query redacted: /api/v1/status?token=[REDACTED])
2026-09-24T04:15:00.000Z DEBUG [GOVERNOR] Executing autonomous resource hygiene pass
└── Memory Vacuum: malloc_trim(0) returned 4.2 MB unmapped pages to kernel (RSS: 11.4 MB)
git clone https://github.com/xuoxod/propylea.git
cd propylea
cargo build --releaseCreate propylea.toml:
[server]
http_bind = "0.0.0.0:80"
https_bind = "0.0.0.0:443"
[security]
enable_defense = true
server_banner = "Aegis-Apollo-Proxy-Service/4.12"
# abuseipdb_api_key = "YOUR_KEY"
[maintenance]
hygiene_interval_secs = 300
memory_vacuum = true
[[routes]]
domains = ["example.com", "www.example.com"]
upstream = "127.0.0.1:8080"
cert = "/etc/letsencrypt/live/example.com/fullchain.pem"
key = "/etc/letsencrypt/live/example.com/privkey.pem"
websocket = true# Validate configuration and certificate syntax without binding ports
./target/release/propylea check --config propylea.toml
# Start the reverse proxy
./target/release/propylea serve --config propylea.toml Internet Ingress Traffic
│
┌───────────────────────┴───────────────────────┐
▼ ▼
Port 80 (HTTP) Port 443 (HTTPS)
Instant 301 Redirect SNI TLS Multiplexer
(Preserves URI + Query) │
┌───────────┴───────────┐
▼ ▼
Hostile Scanner Legitimate Request
(/.env, /wp-login.php) │
│ ▼
│ Upstream Router O(1)
│ (Host / :authority)
▼ │
[Stealth 404] ▼
(Drop in < 15ns) Streaming Proxy / WebSocket
│ │
Async Threat Report ▼
(AbuseIPDB / Webhooks) Backend Upstream
(127.0.0.1:8080 / etc.)
- 📘 Installation & Systemd Guide: Setup as a hardened systemd daemon on Ubuntu, Debian, Rocky, or Arch.
- ⚙️ Configuration Reference: Complete guide to all TOML directives and tuning parameters.
- 🔒 Let's Encrypt Guide: Zero-downtime certificate acquisition, automated renewal hooks, and permissions.
- 🛡️ Active Perimeter Defense: Deep dive into microsecond honeypots, rate limiting, and SIEM webhooks.
Dual-licensed under either:
- MIT License (LICENSE-MIT)
- Apache License, Version 2.0 (LICENSE-APACHE)
at your option.