Proxyble Architecture

Proxyble combines local traffic handling, rule enforcement, and optional streaming analytics. It runs on infrastructure you control instead of operating as a hosted proxy service.

Core components

• Proxyble Core provides the terminal UI, configuration workflow, and manual rule management.
• HAProxy receives client traffic on the configured listener and forwards accepted requests to the configured backend.
• nftables provides Linux packet-filtering enforcement for actions such as drops, rejects, and connection limits.
• RioDB is optional in-memory stream analytics. When enabled, it evaluates live HAProxy traffic events with RioSQL policies.
• proxyble-rule-agent is the root-owned enforcement component. It validates rule decisions and applies them to HAProxy runtime maps or nftables.

Traffic and decision flow

Client
  -> HAProxy listener
  -> protected backend

When RioDB analytics is enabled:
HAProxy access logs
  -> RioDB policy evaluation
  -> local rule queue
  -> proxyble-rule-agent validation
  -> HAProxy runtime maps or nftables enforcement

HAProxy continues to forward allowed traffic to the configured backend. Automated policy decisions do not modify HAProxy or nftables directly; the rule agent is the only component that applies enforcement state.

Why the rule agent matters

RioDB is useful for analyzing changing traffic patterns, but it does not receive authority to edit proxy configuration or firewall rules. The rule agent treats incoming decisions as untrusted input, validates their syntax and target, maintains the desired rule state, and then applies the relevant action.

This separation keeps analytics, proxying, and privileged enforcement in distinct roles:

• Analytics can propose a rule.
• The rule agent decides whether it is valid and applies it.
• HAProxy and nftables enforce the resulting state.

What changes by listener mode

TCP mode handles connection-level controls and HTTPS pass-through. HTTP mode, and HTTPS mode with TLS termination, allow Proxyble to use HTTP-visible information such as request paths. Select the listener mode before deploying policies that depend on HTTP behavior.

Next step

Use Manual Rules and Automated Policies to decide whether to begin with explicit rules or automated traffic analysis.