Choose a Listener Mode

The listener is the public port where Proxyble receives client traffic. Its mode determines which traffic signals and enforcement actions are available.

TCP: connection-level protection

Use TCP mode for raw TCP services or HTTPS pass-through. Proxyble can use client IP and connection information, but it cannot inspect HTTP methods, paths, or headers because another service decrypts TLS later.

sudo proxyble --config-listener \
  --mode tcp \
  --port 443 \
  --timeout 60s \
  --no-start

TCP mode supports connection-oriented controls such as DROP, REJECT, connection-rate limits, and concurrent-connection limits. HTTP endpoint rules and HTTP-visible policies are unavailable.

HTTP: request-level protection

Use HTTP mode when clients send unencrypted HTTP to Proxyble. It lets HAProxy inspect request paths and apply HTTP-aware controls before forwarding traffic to the backend.

sudo proxyble --config-listener \
  --mode http \
  --port 80 \
  --timeout 60s \
  --no-start

Choose this mode when TLS is terminated before Proxyble or when the protected service intentionally uses plain HTTP on a trusted network.

HTTPS: TLS termination and HTTP visibility

Use HTTPS mode when Proxyble should terminate TLS itself. Provide a PEM bundle containing the certificate and private key so HAProxy can decrypt requests and expose HTTP paths and headers to Proxyble.

sudo proxyble --config-listener \
  --mode https \
  --port 443 \
  --timeout 60s \
  --certificate /etc/proxyble/api.pem \
  --no-start

HTTPS mode enables HTTP-visible policies and controls such as endpoint rate limits. It also means the Proxyble host becomes responsible for the certificate material.

Change modes carefully

Changing an existing listener from HTTP/HTTPS to TCP can make active HTTP-specific rules incompatible. Proxyble will ask whether to reset or keep active rules; review the impact before confirming either choice.

After setting the listener, configure backend routing, then start the runtime stack.