The image wraps SmartProxy with a small Node.js admin API so orchestrators such as Onebox can update routes without embedding the Node/Rust SmartProxy runtime into their own process.

Issue Reporting and Security

For reporting bugs, issues, or security vulnerabilities, please visit community.foss.global/. This is the central community hub for all issue reporting. Developers who sign and comply with our contribution agreement and go through identification can also get a code.foss.global/ account to submit Pull Requests directly.

Build

pnpm install
pnpm build

tsdocker builds linux/amd64 and linux/arm64 according to .smartconfig.json.

Release

pnpm release:docker

The image is pushed as code.foss.global/host.today/ht-docker-smartproxy.

Runtime

docker run --rm \
  -p 80:80 \
  -p 443:443 \
  -v ./config.json:/etc/smartproxy/config.json:ro \
  code.foss.global/host.today/ht-docker-smartproxy:latest

Expose the admin API only with an explicit bearer token:

docker run --rm \
  -p 80:80 \
  -p 443:443 \
  -p 3000:3000 \
  -e SMARTPROXY_ADMIN_HOST=0.0.0.0 \
  -e SMARTPROXY_ADMIN_TOKEN=replace-with-a-secret \
  -v ./config.json:/etc/smartproxy/config.json:ro \
  code.foss.global/host.today/ht-docker-smartproxy:latest

Environment variables:

SMARTPROXY_CONFIG: config path, default /etc/smartproxy/config.json.
SMARTPROXY_ADMIN_HOST: admin bind host, default 127.0.0.1.
SMARTPROXY_ADMIN_PORT: admin bind port, default 3000.
SMARTPROXY_ADMIN_TOKEN: optional bearer token for admin endpoints on loopback binds; required when SMARTPROXY_ADMIN_HOST is not loopback. When set, it protects all admin endpoints except unauthenticated health probes (GET /health and GET /ready).

Admin API

GET /health: health status.
GET /ready: readiness status.
GET /routes: current raw routes.
PUT /routes or POST /routes: replace routes with either an array or { "routes": [...] }.
POST /reload: reload config from SMARTPROXY_CONFIG and restart SmartProxy.
POST /security-policy: update global security policy.
GET /statistics: SmartProxy runtime statistics.
GET /listening-ports: currently listening proxy ports.

Config

The config is regular ISmartProxyOptions JSON with one daemon extension: httpToHttpsRedirect.

{
  "httpToHttpsRedirect": {
    "enabled": true,
    "httpPort": 80,
    "httpsPort": 443,
    "statusCode": 301
  },
  "routes": [
    {
      "name": "app-example-com",
      "match": {
        "ports": 443,
        "domains": "app.example.com",
        "protocol": "http"
      },
      "action": {
        "type": "forward",
        "targets": [{ "host": "app", "port": 3000 }],
        "tls": {
          "mode": "terminate",
          "certificate": {
            "key": "-----BEGIN PRIVATE KEY-----\\n...",
            "cert": "-----BEGIN CERTIFICATE-----\\n..."
          }
        }
      }
    }
  ]
}

License and Legal Information

This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the repository LICENSE file.

Please note: The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.

Trademarks

This project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH or third parties, and are not included within the scope of the MIT license granted herein.

Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines or the guidelines of the respective third-party owners, and any usage must be approved in writing. Third-party trademarks used herein are the property of their respective owners and used only in a descriptive manner, e.g. for an implementation of an API or similar.

readme.md

ht-docker-smartproxy