<%- include('top') %>

Proxy List

Search Hosts:

	SSL Expire	Host Name	target	Updated	Actions
	{{{ wildcard_text }}} {{#wildcard_expires}} {{wildcard_expires_text}} {{/wildcard_expires}}	{{{ forcessl_text }}}{{ host }} {{#domain.provider}} {{displayName}} - {{name}} {{/domain.provider}} {{#wildcard_parent}} {{wildcard_parent}} {{/wildcard_parent}}	{{{ targetssl_text }}}{{ ip }}:{{ targetPort }}	{{ updated_on_text }}

Add host

Incoming host name The public hostname clients request. Use *.example.com for one subdomain level, **.example.com for any depth, or ** as a catch-all.

Incoming SSL

Force HTTPS (recommended)

Allow both HTTP and HTTPS

Redirect plain HTTP requests to HTTPS.

Target IP or host name Where matching requests are proxied. Hostname or IP only — no protocol, port, or path.

Target TCP port

Target SSL

Proxy to HTTP (recommended)

Proxy to HTTPS

SSL validation type

HTTP-01

DNS-01 Wildcard

Parent Wildcard from

Options light up based on the host name: wildcard certs need a DNS provider for the domain; child hosts reuse a parent wildcard.

Wildcard matching

Match only subdomains defined here (recommended)

Match any subdomain and proxy to this host

Rate limiting

Off (recommended)

Limit requests per client IP

Requests / sec

Burst

Token bucket per client IP; bursts above the rate are queued, then rejected with 429.

Response caching

Off (recommended)

Cache cacheable responses

Cache upstream responses that declare themselves cacheable.

HSTS

Off

Send Strict-Transport-Security

Tells browsers to only use HTTPS for this host. Enable once HTTPS is confirmed working.

Upstream request headers Added to each request sent to the target. One Name: value per line.

Response headers Added to each response returned to the client.

IP access

Allow IPs / CIDRs If non-empty, only these sources may connect (default-deny).

Deny IPs / CIDRs These sources are always blocked (deny wins over allow).

Basic auth and SSO are OR'd — if either is enabled, a request is allowed when it passes either one. Leave both off for a public host.

Basic authentication

Off

Require username / password

Realm

Users Current: none. Passwords are stored hashed and never shown here. Leave blank to keep the current users; entering any lines replaces the whole list.

Single sign-on (SSO)

Off

Require login via the configured OIDC provider

Gates the site behind the same identity provider the admin app uses. Empty allow-lists below mean any authenticated user is allowed.

Allowed users

Allowed groups

<%- include('bottom') %>