Aegis
A minimal, header-driven HTTP forwarding proxy written in Rust.
Aegis (axum + reqwest) is a header-driven forward proxy: point any request at it with an X-Target-Url header and it forwards the method, headers, and body upstream and streams the response back. Two optional controls sit in front of every request - Bearer-token auth on the proxy hop and a host allowlist - plus TLS with hot-reloading certs and a small config / token CLI.
Header-Driven Forwarding
Every request carries the upstream in an X-Target-Url header; Aegis forwards the method, headers, and body to that URL and streams the response back verbatim. The proxy path is ignored.
Token Authentication
Optional Proxy-Authorization: Bearer on the proxy hop. Only SHA-256 hashes are persisted (0600 store), compared in constant time - auth stays off until the first token exists.
Host Allowlist
Restrict which upstreams the proxy will fetch. Exact, case-insensitive host matching; anything off the list gets a 403 - off by default, set via config or env.
TLS & Hot Reload
Runs HTTPS when a cert + key are set, HTTP otherwise. It watches the cert directories and reloads on change - debounced and atomic-rename-safe - with no restart or signal.
Streaming Passthrough
Response bodies stream straight through; 3xx redirects are passed back, not followed, so the client stays in control. Hop-by-hop headers are stripped on both legs.
Config & Token CLI
init / show / get / set / allow-host / token subcommands manage a TOML config and the token store with atomic writes - env vars override file values.
Daemon & systemd
Foreground by default (what systemd, launchd, and Docker want), with an optional --daemon double-fork, a PID file, and a ready-to-drop systemd unit.
Header Hygiene
Strips Host, X-Target-Url, and Proxy-Authorization before forwarding so upstreams never see them; Authorization, Cookie, and Set-Cookie are redacted from logs.
Structured Logging
tracing-subscriber with a line per request and upstream response; debug adds the exact forwarded headers. Scope the noise with RUST_LOG per-module filters.