Getting started

Huginn Proxy is a reverse proxy built on Tokio, Hyper, and Rustls. It passively fingerprints clients (TLS JA4, HTTP/2 Akamai, optional TCP SYN via eBPF) and injects trusted x-tls-*, x-http2-*, and x-tcp-* headers for backends. Fingerprinting primitives come from Huginn Net. TCP SYN fingerprinting is implemented via an eBPF program (XDP or TC) using Aya.

Inspired by production-grade proxies like Pingora, and rust-rpxy.

Prerequisites

• Obtain a binary or image: use the latest releases on GitHub; see Artifacts for GHCR image names and Containers to run with Docker Compose.
• Linux (kernel ≥ 5.11) is required for TCP SYN / eBPF fingerprinting; TLS and HTTP/2 fingerprints work on other platforms when eBPF is disabled.

Scope and limitations

Huginn Proxy focuses on passive fingerprinting and a small set of hardening features, not feature parity with Nginx/Traefik. Current rough edges:

• No built-in ACME: certificates are files on disk (cert_path / key_path per domain). Another process issues and renews them (cert-manager, acme.sh, Vault, etc.). PEMs reload on config reload, not by watching cert files alone. See TLS.
• Load balancing: round-robin across backend addresses on a route. Optional active health_check. No least-connections or weights; many setups still leave replicas and failover to an orchestrator (see Routes).
• Rate limiting is per process only (not distributed across proxy replicas).
• HTTP/3 is not supported yet.

If you need an additional feature, open an issue on GitHub with requirements and constraints.