One controlled door for all your outbound traffic.
A minimal, header-driven HTTP forwarding proxy written in Rust. Put the destination in an X-Target-Url header; Aegis authenticates, allowlists, terminates TLS and streams the response back, all from a single binary.
curl https://proxy.devforge.org:8080/ \
-H 'X-Target-Url: https://api.example.com/v1/items' \
-H 'Authorization: Bearer sk-...'curl -fsSL https://raw.githubusercontent.com/devforge-io/aegis/master/install.sh | sudo sh
sudo aegis init
sudo aegis allow-host api.example.com
sudo aegis token create client-a # -> Bearer OO5q... (shown once)
sudo systemctl enable --now aegisEverything you need, batteries included.
Applications that call external APIs need a controlled, observable egress point, to centralize outbound traffic, enforce which upstreams are reachable, authenticate who may use the door, terminate and rotate TLS, and get consistent request logging. Aegis does exactly that and nothing more: no route configuration, no service mesh, no heavyweight gateway. Each request carries its target in one header; the proxy forwards the method, headers and body, and streams the response back verbatim.
Header-driven forwarding
The target URL travels in the X-Target-Url request header. Aegis forwards the method, headers and body, and streams the upstream response straight back.
Token authentication
Optional Bearer auth on the proxy hop. Only SHA-256 hashes are persisted; the plaintext token is shown once and compared in constant time.
Host allowlist
Restrict which upstream hosts the proxy will fetch, with exact case-insensitive matching. Prevents open-proxy abuse by default.
TLS hot-reload
Watches cert and key files and swaps certificates live on change, no restart, no signal. Certbot, acme.sh and Kubernetes mounted secrets just work.
Structured, redacted logs
One tracing line per request and response, with sensitive headers (Authorization, Cookie, Proxy-Authorization) automatically redacted.
Ops-ready CLI
init, show, get/set, allow-host/deny-host and a full token subcommand suite. Runs in the foreground for systemd, Docker and Kubernetes.