BareProxy Ships Its First Nine Plugins, From Maintenance Pages and CORS to Geo Rules and Rate Limits
BareProxy 0.11.0 is out, and with it the ninth plugin. On 8 October BareProxy had a plugin host and no plugins. Now it has nine, each a small WebAssembly file attached to the releases page, installed by one line in the config and removed by deleting it.
They were built in the order the roadmap set: easiest first, so each one could ship as soon as it was ready. The first took an afternoon. The last of the nine took a day and changed BareProxy itself along the way. That’s the point of building the small ones first: each plugin found something the plugin host needed, and the host got it before the bigger plugins come.
The Nine
| # | Plugin | Out in | What it does |
|---|---|---|---|
| 1 | Maintenance and failover pages | 0.4.0 | A page of your own when the app is down, and a maintenance switch with an allow list |
| 2 | CORS | 0.4.0 | Cross-origin rules for APIs, preflights answered at the proxy, one list of origins |
| 3 | Header and rewrite rules | 0.5.0 | Security headers on every response, header changes, redirects and rewrites, no regular expressions |
| 4 | Redirects from a file | 0.6.0 | Thousands of old URLs moved from one plain file, reloaded when it changes, every line counted |
| 5 | Geo rules | 0.7.0 | The visitor’s country from a local database, passed on in a header, allow and block lists |
| 6 | Request signing | 0.8.0 | Requests signed for the app behind, and links that expire |
| 7 | A/B and canary splits | 0.9.0 | A share of visitors sent to a new version, kept there by a cookie, routed by the core |
| 8 | Rate limiting and basic WAF | 0.10.0 | Limits per address or site, and simple rules against junk requests |
| 9 | Link previews | 0.11.0 | Open Graph cards for Slack, WhatsApp, LinkedIn and others, on pages that lack them |
All nine are written in Rust, and each has a manual in its folder of the code repository. Each one is tested twice: on its own, and inside a running BareProxy with real requests.
What the Plugins Taught the Core
Four changes to BareProxy itself came out of these plugins. None of them would have been obvious from the design alone.
A plugin’s answer passes the plugins before it. With CORS listed before the maintenance plugin, the maintenance page went out without CORS headers, and a page on another site couldn’t read the 503. Now a page one plugin sends goes back through the plugins before it, the way an app’s response does. It’s how Envoy, the proxy whose plugin interface BareProxy uses, has always worked.
check catches a plugin’s mistakes. A typo in a plugin’s settings, or a broken line in the redirect list, or a damaged country database, used to show only when the config went live. Now check and plan start each plugin once and name the file and the line before anything changes.
Counters shared by all copies of a plugin. BareProxy runs several copies of a plugin to share the load. A rate limit counted in each copy separately would let a client through several times over, so BareProxy now keeps counters for a plugin, shared by all its copies, with old counts swept away.
A plugin can let a page pass. A plugin that rewrites pages used to have every page held back for it. Link previews only needs a page when a preview fetcher asks, so a plugin can now say, request by request, that it doesn’t need the page, and everyone else’s pages go out at full speed.
Seeing What They Do
Every plugin reports into BareProxy’s own records, so why on any request says which plugins ran and what each did: “variant canary: assigned by share (5 of 100)”, “limit login (line 2): 6 requests in the last 60s from 203.0.113.9, over 5”, “turned away: CN is on the block list for /”. A plugin that turns a real visitor away shows up in the records the same day.
Next
The quick ones are done. Next come the plugins that take a day or more each, starting with AI crawler control, then bot challenges, Markdown serving, cookie consent, status pages, OpenTelemetry export and analytics. The longest jobs, from the auth gate to RenderCache, come last. Twelve plugins are still to come, and each page will be updated as its plugin is built.
The whole program is on the plugins page.