Listen

The [listen] section controls where the proxy accepts client connections. Static: changing it requires a process restart. Each bind address is combined with each present port.

HTTP and HTTPS can listen at the same time (port and port_tls), or you can set only one of them.

Fields

• port: plain HTTP port. Omit it to skip HTTP sockets.
• port_tls: HTTPS port. Omit it to skip TLS sockets. At least one of port or port_tls is required, and they must differ. Each socket is stamped by the field that created it (port is plaintext, port_tls is TLS).
• https_redirection: process-wide HTTP→HTTPS policy. Default true when both ports are set, otherwise false. The key may be written only when both ports are set. With true, a matched plaintext request receives 301 (request host, path, and query; port_tls is omitted from Location when it is 443). With false, HTTP is proxied. A host that matches no domain receives 421, not a redirect. A reload that changes this value is ignored until restart.
• ipv6: also bind IPv6 :: when address_v6 is omitted (default false). IPv4 0.0.0.0 is bound unless address_v4 lists specific addresses.
• address_v4 / address_v6: bind addresses. Each address is combined with each present port. An empty list is rejected. Do not mix the wildcard (0.0.0.0 or ::) with other addresses. IPv6 accepts bare (::1) and bracketed ([::1]) forms.
• tcp_backlog: listen queue depth (default 4096).
• proxy_protocol: optional PROXY protocol v1/v2 support when huginn sits behind a trusted L4 load balancer (see below).

Example

YAML

listen:
  port: 80
  port_tls: 443
  https_redirection: true
  ipv6: true
  address_v4:
    - "0.0.0.0"
  address_v6:
    - "::"
  # tcp_backlog: 4096
  # proxy_protocol:
  #   mode: off # off | optional | require
  #   header_timeout_ms: 100

TOML

[listen]
port = 80
port_tls = 443
https_redirection = true
ipv6 = true
address_v4 = ["0.0.0.0"]
address_v6 = ["::"]
# tcp_backlog = 4096

# [listen.proxy_protocol]
# mode = "off" # off | optional | require
# header_timeout_ms = 100

PROXY protocol

When an L4 load balancer prepends a PROXY protocol header (HAProxy, nginx stream, AWS NLB, Envoy, …), huginn can recover the real client (src_ip, src_port). That address is used for X-Forwarded-For / X-Forwarded-Port, rate limiting, IP filtering, eBPF SYN lookup, and logs.

mode	Behavior
off (default)	Never read a PROXY header; peer is always the TCP socket peer.
optional	If a trusted peer sends a header, use it; otherwise treat as a direct client.
require	A trusted peer must send a valid header, else the connection is dropped.

A header is honored only from peers in security.trusted_proxies. With an empty list, optional behaves like off, and require drops every connection (fail-closed).

header_timeout_ms (default 100) bounds how long a trusted peer may sit waiting for the header. Both v1 (text) and v2 (binary) are auto-detected.

See Configuration overview for the full config layout.