A containerized secure proxy with advanced filtering capabilities, real-time monitoring, and a modern web UI.

• High-Performance Proxy Engine: Built on Squid with optimized caching capabilities
• Advanced Filtering:
  • IP Blacklisting with CIDR support
  • Domain Blacklisting with wildcard support
  • Content Type Filtering
  • Direct IP Access Control
  • Time-based Access Restrictions
• Comprehensive Security:
  • HTTPS Filtering with proper certificate management
  • Rate Limiting protection against brute force attacks
  • Security scoring and recommendations
  • Configurable content policies
• Modern Dashboard:
  • Real-time traffic monitoring
  • Resource usage statistics
  • Cache performance metrics
  • Security status visualization
• Detailed Analytics:
  • Full request logging and analysis
  • Traffic pattern visualization
  • Blocked request reporting
  • Exportable reports
• Enterprise Management:
  • Configuration backup and restore
  • Role-based access control
  • API for automation and integration
  • Health monitoring endpoints

The application consists of three main containerized components:

1. Proxy Service: Squid-based proxy with customized configurations for enhanced security
2. Backend API: RESTful API built with Flask providing management capabilities
3. Web UI: Modern Bootstrap 5 interface for administration and monitoring

  ┌─────────────┐      ┌─────────────┐      ┌─────────────┐
  │             │      │             │      │             │
  │  Web UI     │◄────►│  Backend    │◄────►│  Proxy      │
  │  (Flask)    │      │  API        │      │  (Squid)    │
  │             │      │  (Flask)    │      │             │
  └─────────────┘      └─────────────┘      └─────────────┘
         │                    │                    │
         │                    │                    │
         ▼                    ▼                    ▼
  ┌─────────────────────────────────────────────────────┐
  │                                                     │
  │                 Shared Volumes                      │
  │  (Configuration, Logs, Database, Certificates)      │
  │                                                     │
  └─────────────────────────────────────────────────────┘
  

• Docker (v20.10.0+)
• Docker Compose (v2.0.0+)
• Minimum System Requirements:
  • 1 CPU core
  • 1GB RAM
  • 5GB disk space
• Network Requirements:
  • Open ports for HTTP (8011) and Proxy (3128)

1. Clone the repository:

   git clone https://github.com/yourusername/secure-proxy.git
   cd secure-proxy

2. Start the application:

   docker-compose up -d

3. Access the web interface:

   http://localhost:8011
   

   Default credentials: username: admin, password: admin

4. Configure your client devices:

   • Set proxy server to your host's IP address, port 3128
   • For transparent proxying, see the Network Configuration section

For HTTPS filtering with your own certificate:

1. Place your certificate and key in the /config directory:

   • ssl_cert.pem: Your SSL certificate
   • ssl_key.pem: Your private key

2. Enable HTTPS filtering in the web interface:

   • Settings > Security > Enable HTTPS Filtering

3. Install the certificate on client devices to avoid warnings

To use Secure Proxy as a transparent proxy:

1. Configure iptables on your router/gateway:

   iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
   iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 3129

2. Enable transparent proxy mode in the web interface:

   • Settings > Advanced > Transparent Mode

Integrate with external threat intelligence:

1. Import blacklists via the API:

   curl -X POST http://localhost:8011/api/blacklists/import \
     -H "Content-Type: application/json" \
     -H "Authorization: Basic $(echo -n admin:admin | base64)" \
     -d '{"url": "https://example.com/blacklist.txt", "type": "ip"}'

2. Schedule automatic updates with the maintenance endpoint:

   curl -X POST http://localhost:8011/api/maintenance/update-blacklists \
     -H "Authorization: Basic $(echo -n admin:admin | base64)"

• Proxy Status: Real-time operational status
• Traffic Statistics: Request volume over time
• Resource Usage: Memory and CPU consumption
• Cache Performance: Hit ratio and response time
• Security Score: Overall security assessment

All proxy traffic is logged and can be analyzed in the web interface:

• Access Logs: All requests with filtering and search
• Security Events: Authentication attempts and blocked requests
• System Logs: Application and service events

Health status endpoints are available for monitoring:

curl -I http://localhost:8011/health

Create a full system backup:

1. Via Web UI:

   • Maintenance > Backup Configuration > Download Backup

2. Via API:

   curl -X GET http://localhost:8011/api/maintenance/backup-config \
     -H "Authorization: Basic $(echo -n admin:admin | base64)" \
     > secure-proxy-backup.json

Restore from a previous backup:

1. Via Web UI:

   • Maintenance > Restore Configuration > Upload Backup

2. Via API:

   curl -X POST http://localhost:8011/api/maintenance/restore-config \
     -H "Content-Type: application/json" \
     -H "Authorization: Basic $(echo -n admin:admin | base64)" \
     -d @secure-proxy-backup.json

curl -x http://localhost:3128 http://example.com

curl -x http://localhost:3128 https://example.com --insecure

To test if blacklisting works:

1. Add an IP or domain to the blacklist
2. Attempt to access a resource from that IP or domain
3. Verify the request is blocked (check logs)

1. Service Logs:

   docker-compose logs -f backend
   docker-compose logs -f ui
   docker-compose logs -f proxy

2. Database Check:

   docker-compose exec backend sqlite3 /data/secure_proxy.db .tables

3. Network Validation:

   docker-compose exec proxy ping -c 3 google.com

4. Cache Analysis:

   docker-compose exec proxy squidclient -h localhost mgr:info

Secure Proxy provides a comprehensive RESTful API for integration and automation:

curl -X POST http://localhost:8011/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": "admin"}'

Full API documentation is available at /api/docs when the service is running.

1. Change default credentials immediately after installation
2. Enable HTTPS for the admin interface in production
3. Restrict access to the admin interface to trusted IPs
4. Regular backups of configuration and database
5. Keep the system updated with security patches
6. Monitor logs for suspicious activity
7. Use strong certificates for HTTPS filtering

• Authentication Integration: LDAP/Active Directory support
• Advanced Analytics: ML-based traffic pattern analysis
• Threat Intelligence: Integration with external threat feeds
• Clustering: Multi-node deployment for high availability
• Content Inspection: DLP capabilities for data protection
• Mobile Support: Improved UI for mobile administration
• Notification System: Alerts via email, Slack, etc.

Contributions are welcome and appreciated!

1. Fork the repository
2. Create a feature branch: git checkout -b feature-name
3. Commit your changes: git commit -m 'Add some feature'
4. Push to the branch: git push origin feature-name
5. Open a Pull Request

This project is licensed under the MIT License - see the LICENSE file for details.

• Squid Proxy for the core proxy engine
• Flask for the web framework
• Bootstrap for the UI components
• Docker for containerization
• All our contributors who have helped shape this project

• Create an issue in the GitHub repository
• Contact the maintainers at: [[email protected]]
• Community forum: [https://community.example.com]