Loading current release

Reverse proxy management.Reimagined.

Proxy hosts, HTTPS, HTTP/3 over QUIC and access rules. One interface on your server, powered by Caddy.

View on GitHub Get started

Open Source
Self Hosted
Caddy + HTTP/3

RentnerProxy / Features

Your server.Your rules.

Connect, protect and manage your apps.

Connect.
Assign a domain. Reach your app.
- Proxy hosts & redirects
- HTTP/2, HTTP/3 & WebSockets
- Automatic HTTPS
- Cloudflare & wildcards
- Cloudflare DDNS
Automatic HTTPS
Protect.
You decide who gets in.
- CrowdSec
- Basic Auth & IP rules
- SSO / Forward Auth
- Users & roles
- MFA & passkeys
Sign-in, IP rules and CrowdSec
Manage.
Organize hosts. Stay informed. Upgrade with confidence.
- Host tags, groups & filters
- Email & webhook notifications
- Update notifications & guided upgrades
- Backup & restore (CLI)
- Docker discovery & labels
Full backups through the CLI

All features

Proxy & routing

Proxy hosts & redirects: Connect domains to your services or redirect them with 301, 302, 307 and 308.
HTTP/2, HTTP/3 & WebSockets: HTTP and HTTPS upstreams, WebSockets and HTTP/3 over QUIC for your visitors.

Compression & caching

Zstd & Gzip compression: Configure response compression for your proxy hosts with Zstd and Gzip.
Caching for public assets: Set browser-cache rules and optionally enable a bounded response cache for public assets.

HTTPS & certificates

Automatic HTTPS: Issue certificates through ACME and renew them automatically.
Cloudflare & wildcards: Use HTTP-01 or Cloudflare DNS-01, including wildcard certificates through DNS-01.
Custom certificates: Import existing certificates and private keys and assign them to your hosts.
Trusted CAs: Verify HTTPS connections to your services using system or custom certificate authorities.

Access protection

CrowdSec: Optional IP protection with managed or external CrowdSec and a dedicated security dashboard.
Basic Auth & IP rules: Protect services with password authentication and IPv4 or IPv6 allow and deny rules.
SSO / Forward Auth: Place your external sign-in service in front of an application through Forward Auth.

Users & sign-in

Users & roles: Control management access with users, roles and specific permissions.
MFA & passkeys: Secure management sign-in with an authenticator app or passkeys.

Host management

Host tags, groups & filters: Organize your hosts with tags and groups and filter the list to find what you need.
Bulk host actions: Select and manage multiple hosts together. Permissions are checked for each action.
Duplicate hosts: Copy proxy and redirect hosts into a draft for new domains.

Operations & visibility

Live status & access logs: Follow runtime status and search access logs for your proxy hosts.
Audit logs: See who made changes in the management interface.
Email & webhook notifications: Connect notification channels, subscribe to events and track delivery status.
Update notifications & guided upgrades: Detect new releases, receive update notifications and follow the supported upgrade path.

Backup & migration

Import & export: Export and import supported host configurations through the interface.
NPM & Zoraxy import: Transfer supported configurations and review the preview and conflicts before importing.
Backup & restore (CLI): Back up and restore the database, certificates and appliance configuration through the CLI.

Automation

Cloudflare DDNS: Automatically update Cloudflare A and AAAA records when your public IP changes, with scheduling and retries on failure.
Docker discovery & labels: Opt into Docker discovery and manage labeled containers as proxy hosts.

Everyday tools

Global search: Find hosts, certificates and settings with Ctrl+K, Cmd+K or mobile search.
Dark / light mode & accent colors: Use the management interface with a light or dark theme and a personal accent color.
Eight languages: English, German, Spanish, French, Italian, Portuguese, Dutch and Polish.
Custom default site: For unmatched HTTP hosts: 404, welcome page, redirect, custom HTML or close the connection.

Inside the product

This is what control looks like.

Desktop screenshots of hosts, DNS management, certificates, security insights and notifications in dark and light mode. Choose a view and click to enlarge.

Proxy hosts in dark mode with tags, groups, example domains and bulk selection. — Proxy hosts · Dark

Certificate management in dark mode with ACME operations, imported certificates and expiry status. — TLS certificates · Dark

DDNS management in dark mode with Cloudflare A and AAAA records, proxy status and paused automatic updates. — Cloudflare DDNS · Dark

Security dashboard in dark mode with labeled synthetic metrics, charts and IP bans. — Security dashboard · Dark

Notification settings in dark mode with an email channel, event subscriptions and delivery status. — Notifications · Dark

From the registry

RentnerProxy in numbers.

Total Docker Pulls: —
Docker Pulls · last 30 days: —
GitHub stars: —

Docker Pulls per day

Source: GitHub Container Registry ↗

Architecture

You manage. Caddy routes.

Select a component to discover its role.

One Docker applianceYour infrastructure

Visitors reach your services through their public domain. Requests go directly to Caddy, which forwards them to the matching service.
The React interface runs on TanStack Start and Bun. It connects PostgreSQL and Valkey to the management app and talks to the Rust controller.
The Rust controller applies your configuration, manages Caddy and handles certificate operations. It also manages the optional CrowdSec integration.
PostgreSQL keeps users, hosts, policies and application configuration in durable storage, including across restarts.
Valkey handles rate limits, authentication challenges and live notifications between processes. Durable configuration stays in PostgreSQL.
Caddy terminates TLS and forwards HTTP/1.1, HTTP/2 and HTTP/3 traffic directly to your services. When CrowdSec is enabled, the bouncer enforces IP blocks in Caddy before forwarding. The management interface sits outside this traffic path.
Your apps and services receive traffic forwarded by Caddy. They run on your own infrastructure.
When enabled, the bundled CrowdSec engine analyzes Caddy access logs. The bouncer in Caddy uses its decisions to block malicious IPs before they reach your services. You can also connect an external CrowdSec Local API.

Your traffic takes the direct route.

HTTP/1.1 · HTTP/2 · HTTP/3

ControlState & eventsHTTP trafficAccess logs & IP blocks

Visitors / Internet

Visitors reach your services through their public domain. Requests go directly to Caddy, which forwards them to the matching service.

Explore component

// rentnerproxy.install

Install RentnerProxy.

Start the current RentnerProxy release with Docker Compose or docker run on your own server. Follow the guide from configuration to your first launch.

Get started