rust-socksd/config/config.yml.example

# rust-socksd Proxy Server Configuration
# This is the main configuration file for the proxy server

server:
  # IP address to bind to (0.0.0.0 for all interfaces, 127.0.0.1 for localhost only)
  bind_address: "127.0.0.1"

  # Port for SOCKS5 proxy
  socks5_port: 1080

  # Port for HTTP proxy
  http_port: 8080

  # Maximum number of concurrent connections
  max_connections: 1000

  # Connection timeout in seconds
  connection_timeout: 300

  # Buffer size for data transfer (in bytes)
  buffer_size: 65536

# Authentication settings
# Authentication settings
auth:
  # Enable authentication (true/false)
  enabled: false

  # Authentication Backend Configuration
  # ------------------------------------
  
  # Type: 'simple' (File-based), 'pam', 'ldap', 'database', 'none'
  type: simple
  
  # --- Simple Backend ---
  # Path to user configuration file
  user_config_file: "config/users.yml"

  # --- PAM Backend ---
  # Service name for PAM (e.g., 'login', 'sudo', 'socksd')
  # service: "socksd"

  # --- LDAP Backend ---
  # LDAP Connection URL
  # url: "ldap://localhost:389"
  # Base DN for user search
  # base_dn: "ou=users,dc=example,dc=com"
  # Bind DN (optional, for searching if anonymous bind is disabled)
  # bind_dn: "cn=admin,dc=example,dc=com"
  # Bind Password (optional)
  # bind_password: "password"
  # User Filter ({} is replaced by username)
  # user_filter: "(uid={})"

  # --- Database Backend (MySQL/PostgreSQL) ---
  # Database Type: 'mysql' or 'postgres'
  # db_type: "mysql"
  # Database URL
  # url: "mysql://user:pass@localhost/socksd"
  # Query to fetch password hash (must return single column)
  # query: "SELECT password_hash FROM users WHERE username = ?"
  # Hash Type: 'argon2', 'bcrypt', 'scrypt'
  # hash_type: "argon2"

# Logging configuration
logging:
  # Log level: trace, debug, info, warn, error
  level: "info"

  # Log file path (optional, set to null to disable file logging)
  file: "/var/log/rust-socksd/rust-socksd.log"

  # Enable console logging
  console: false

  # Enable systemd journald logging (Linux only)
  journald: false

# Security settings
security:
  # Allowed networks (CIDR notation or single IPs)
  allowed_networks:
    - "0.0.0.0/0"  # Allow all (change this for security)
    # - "10.0.0.0/8"
    # - "192.168.0.0/16"
    # - "172.16.0.0/12"

  # Blocked domains (exact matches)
  blocked_domains:
    - "malicious-site.com"
    - "blocked-domain.net"

  # Allowed egress networks (destination IPs or CIDRs)
  # If empty, all outbound destinations are allowed (except those blocked by blocked_egress_networks)
  allowed_egress_networks: []
  #   - "0.0.0.0/0"
  #   - "::/0"

  # Blocked egress networks (destination IPs or CIDRs)
  blocked_egress_networks: []
  #   - "127.0.0.1/8"
  #   - "192.168.0.0/16"

  # Maximum request size in bytes
  max_request_size: 1048576  # 1MB

  # Rate limiting (optional)
  rate_limit:
    requests_per_minute: 1000
    burst_size: 100

# Upstream Proxy Settings
# Route outgoing traffic through upstream HTTP or SOCKS5 proxies
upstream:
  # Enable upstream proxying (true/false)
  enabled: false

  # Upstream protocol: 'socks5' or 'http'
  protocol: socks5

  # Address of the upstream proxy server
  address: "127.0.0.1"

  # Port of the upstream proxy server
  port: 1080

  # Upstream proxy credentials (optional)
  # username: "proxy_user"
  # password: "proxy_password"

  # Networks to exclude from upstream proxying (CIDR blocks or IPs)
  exclude_networks:
    - "127.0.0.1/8"
    - "10.0.0.0/8"

  # Domains to exclude from upstream proxying (exact or subdomain suffix)
  exclude_domains:
    - "localhost"
    - "local.lan"

  # Respect standard environment variables: HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, NO_PROXY (true/false)
  # Environment variables will override configuration settings if present.
  prefer_env: true

# Admin API Settings
# Enable administrative port for metrics, health check, and dynamic config reload
admin:
  # Enable the admin API listener (true/false)
  enabled: false

  # IP address to bind the admin listener to
  bind_address: "127.0.0.1"

  # Port for the admin API
  port: 8081

  # Static pre-shared token for API authentication (optional)
  # token: "my-secure-static-bypass-token"

  # List of usernames allowed to log in and get dynamic tokens
  # admin_users:
  #   - "admin"

  # Dynamic token lifespan in seconds (default: 3600)
  # token_ttl: 3600