Posts on BareProxy.com

Introducing BareProxy, the Reverse Proxy That Explains Itself

Thu, 01 Oct 2026 00:00:00 +0000

Most applications use a small part of nginx. They terminate TLS, route by host and path, spread requests over backends that are up, change config without dropping traffic, and sometimes need to know what happened to one request. BareProxy is a reverse proxy for that part, with a core small enough to read in an afternoon.

The whole config for a site with an API, a web front end and a www redirect is 21 lines. A newcomer can read it in five minutes, and nothing in it depends on a precedence order: rules are tried from the top, and the first match wins.

How BareProxy Plan Shows What a Config Change Will Do Before It Goes Live

Wed, 30 Sep 2026 00:00:00 +0000

The riskiest moment in a proxy’s day is a config change. Cloudflare’s two outages at the end of 2025 both started with one that reached every server within seconds. BareProxy checks every config in full before it can go live, and plan goes one step further: it says which requests will be handled differently.

That works because BareProxy has no regular expressions and no scripting. Every matcher is an exact value, a prefix or a set, so the requests a site can receive fall into a finite number of classes, and every request in a class is handled the same way. plan works out what happens to each class under the old config and the new one, and prints the classes that change.

One Record per Request: How BareProxy Tracing Works

Tue, 29 Sep 2026 00:00:00 +0000

Every request BareProxy handles gets a random ID, sent to the backend and back to the client in a BareProxy-Id header, and shown on every error page BareProxy writes. When someone reports a problem, they can quote it.

Every request also leaves exactly one record: one JSON line with the rule that matched, the config version that handled it, every backend tried or passed over and why, and the timings. Records go to the trace log and stay in memory for quick lookups.

BareProxy Modules: Nine Add-Ons Around a Bare Core

Mon, 28 Sep 2026 00:00:00 +0000

BareProxy Core does six things: proxying, TLS, routing, backend health, config changes and request tracing. Everything else is a module, compiled in only when you want it. A Bare build carries the core alone. A Full build carries every module.

There are nine: Static, Compress, Cache, Limit, Auth, Split, Guard, Export and Fleet. Each plugs in at a fixed point in the request, before routing, as a rule’s action, around the backend call, on the response, on the record or on config changes.

Why BareProxy Routes on the Same Path It Forwards

Sun, 27 Sep 2026 00:00:00 +0000

Many proxy bypasses share one cause: the proxy reads a path one way and the application reads it another. A rule that blocks /admin/ does nothing if the request arrives as /api/%2e%2e/admin and the application decodes it after the proxy has let it through.

BareProxy normalizes every path once. It decodes escapes of plain characters, resolves . and .. segments, and merges runs of slashes. Then it routes on that form and sends the backend exactly the same form. Encoded slashes and backslashes are refused unless a site opts in.