Configuration Reference

Server Configuration

[server]
bind_address = "0.0.0.0"              # IP address to bind
udp_port = 443                         # Primary UDP port for QUIC
additional_ports = [4433, 4434]        # Additional ports
max_connections = 10000                # Max concurrent connections
max_streams_per_connection = 1000      # Max streams per connection
keepalive_interval_secs = 15           # Keep-alive interval
max_idle_timeout_secs = 120            # Idle timeout
enable_ipv6 = true                     # Enable IPv6 dual-stack
worker_threads = 0                     # Worker threads (0 = auto)

Minimal Configuration

# /etc/pqcrypta/proxy-config.toml

[server]
bind_address = "0.0.0.0"
udp_port = 443
additional_ports = [4433, 4434]

[tls]
cert_path = "/etc/letsencrypt/live/example.com/fullchain.pem"
key_path = "/etc/letsencrypt/live/example.com/privkey.pem"
# ca_cert_path = "/path/to/ca.pem"     # CA cert for mTLS
# require_client_cert = true           # Require client certs
alpn_protocols = ["h3", "h2", "http/1.1"]
min_version = "1.3"                    # TLS 1.3 only
ocsp_stapling = true
cert_reload_interval_secs = 3600       # Hot-reload certs
enable_0rtt = false                    # Disabled by default (security)

[http_redirect]
enabled = true
port = 80

# Backend: Apache on port 8080
[backends.apache]
name = "apache"
type = "http1"
address = "127.0.0.1:8080"
tls_mode = "terminate"

# Backend: Rust API on port 3003
[backends.api]
name = "api"
type = "http1"
address = "127.0.0.1:3003"
tls_mode = "terminate"

# Route: api.example.com -> API backend
[[routes]]
name = "api-route"
host = "api.example.com"
path_prefix = "/"
backend = "api"
forward_client_identity = true
priority = 100

# Route: example.com -> Apache backend
[[routes]]
name = "main-site"
host = "example.com"
path_prefix = "/"
backend = "apache"
forward_client_identity = true
priority = 100

Security Configuration

[security]
max_request_size = 10485760            # Max request size (10MB)
max_header_size = 65536                # Max header size (64KB)
connection_timeout_secs = 30           # Connection timeout
dos_protection = true                  # Enable DoS protection
blocked_ips = []                       # Manually blocked IPs
allowed_ips = []                       # IP allowlist (empty = all)
max_connections_per_ip = 100           # Max connections per IP

# GeoIP blocking
geoip_db_path = "/var/lib/pqcrypta/geoip/GeoLite2-City.mmdb"
blocked_countries = ["CN", "RU", "KP"] # ISO country codes

# Auto-blocking behavior
auto_block_threshold = 10              # Patterns before auto-block
auto_block_duration_secs = 300         # Block duration

# Error rate monitoring
error_4xx_threshold = 100              # 4xx errors before check
min_requests_for_error_check = 200     # Min requests for check
error_rate_threshold = 0.7             # Error rate threshold (70%)
error_window_secs = 60                 # Error tracking window

# Zero-trust mode — startup aborts if any constraint is violated:
# all backends must use TLS, trusted_internal_cidrs must be empty,
# require_client_cert must be true, admin.hmac_secret must be set
zero_trust_mode = false                # Enable zero-trust startup validation

[security.rate_limit]
requests_per_second = 100
burst_size = 200
auto_block_threshold = 1000
block_duration_secs = 3600
max_connections_per_ip = 100

Advanced Rate Limiting

Multi-dimensional rate limiting inspired by Cloudflare, Envoy, and HAProxy. Solves the corporate NAT problem where many users share one gateway IP. Runs on all listener paths — HTTP/1.1, HTTP/2 (TCP), and HTTP/3 (QUIC). An optional Redis backend distributes per-key counters across all proxy instances using atomic Lua scripts, so quotas are shared cluster-wide rather than per-node.

Request arrives (HTTP/1.1, HTTP/2 via TCP  OR  HTTP/3 via QUIC)
  │
  ├─ [QUIC/HTTP3 only] Simple per-IP SecurityState governor + auto-block
  │
  ├─ Advanced rate limiter (ALL paths: TCP HTTP/1.1 + HTTP/2 + QUIC HTTP/3)
  │     │
  │     ├─ Global token-bucket (IN-MEMORY — per-node DDoS protection)
  │     ├─ Resolve key (IP / API key / JA3 / JWT / composite)
  │     ├─ Redis available?
  │     │    YES → Lua token-bucket  (per-second, distributed, atomic EVAL)
  │     │          Lua fixed-window  (per-minute, distributed, INCR+EXPIRE)
  │     │          Lua fixed-window  (per-hour,   distributed, INCR+EXPIRE)
  │     │          ── any command timeout → local DashMap fallback ──
  │     │    NO  → local DashMap bucket (in-process, original behaviour)
  │     └─ Adaptive anomaly detection (always local, per-node)

[advanced_rate_limiting]
enabled = true

# Key resolution strategy
# Options: source_ip, xff_trusted, ja3_fingerprint, jwt_subject, composite
key_strategy = "composite"

# X-Forwarded-For trust configuration
xff_trust_depth = 1
trusted_proxies = ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]

# IPv6 subnet grouping (prevents per-host evasion)
ipv6_prefix_length = 64

# Global rate limits
[advanced_rate_limiting.global_limits]
requests_per_second = 10000
burst_size = 2000

# Per-IP limits
[advanced_rate_limiting.global_limits.per_ip]
requests_per_second = 100
burst_size = 200
requests_per_minute = 1000
requests_per_hour = 10000

# Per-JA3 fingerprint limits (NAT-friendly client identification)
[advanced_rate_limiting.global_limits.per_fingerprint]
requests_per_second = 100
burst_size = 50
requests_per_minute = 3000
requests_per_hour = 50000

# Per-API-key limits
[advanced_rate_limiting.global_limits.per_api_key]
requests_per_second = 500
burst_size = 250
requests_per_minute = 15000
requests_per_hour = 250000

# Per-composite-key limits (IP + JA3 + path)
[advanced_rate_limiting.global_limits.per_composite]
requests_per_second = 200
burst_size = 100
requests_per_minute = 6000
requests_per_hour = 100000

# Adaptive baseline learning (ML-inspired anomaly detection)
[advanced_rate_limiting.adaptive]
enabled = false
baseline_window_secs = 3600
sensitivity = 0.7
std_dev_multiplier = 3.0
min_samples = 1000

# Distributed rate limiting via Redis (optional — omit section to use in-process only)
[advanced_rate_limiting.redis]
url                   = "redis://127.0.0.1:6379"
key_prefix            = "pqcp"          # Namespace prefix for all Redis keys
connect_timeout_ms    = 2000
command_timeout_ms    = 50              # Per-command; on timeout → silent local fallback
distribute_per_second = true            # Include per-second token bucket in Redis

# Route-specific overrides
[[advanced_rate_limiting.route_overrides]]
route_name = "api-route"
per_ip_rps = 200
per_ip_burst = 400

[[advanced_rate_limiting.route_overrides]]
route_name = "login-route"
per_ip_rps = 10
per_ip_burst = 20

Load Balancer Configuration

[load_balancer]
enabled = true
default_algorithm = "least_connections"

[load_balancer.session_affinity]
cookie_name = "PQCPROXY_BACKEND"
cookie_ttl_secs = 3600
cookie_secure = true
cookie_httponly = true
cookie_samesite = "lax"

[load_balancer.queue]
enabled = true
max_size = 1000
timeout_ms = 5000

[load_balancer.slow_start]
enabled = true
duration_secs = 30
initial_weight_percent = 10

[load_balancer.connection_draining]
enabled = true
timeout_secs = 30

# Backend pool with multiple servers
[backend_pools.api]
name = "api"
algorithm = "least_connections"
health_aware = true
affinity = "cookie"
health_check_path = "/health"
health_check_interval_secs = 10

# Primary server
[[backend_pools.api.servers]]
address = "127.0.0.1:3003"
weight = 100
priority = 1
max_connections = 100
timeout_ms = 30000
tls_mode = "terminate"

# Secondary server
[[backend_pools.api.servers]]
address = "127.0.0.1:3004"
weight = 100
priority = 1
max_connections = 100

# Failover server
[[backend_pools.api.servers]]
address = "10.0.0.5:3003"
weight = 50
priority = 2
max_connections = 50

Canary / Percentage Traffic Splitting

Route a configurable percentage of new traffic to a canary server. The [backend_pools.NAME.canary] section must appear before the first [[NAME.servers]] entry. Mark the canary server with canary = true and set canary_weight_percent.

# Pool-level canary settings (place before [[servers]] entries)
[backend_pools.api-pool.canary]
enabled                = true
sticky                 = true               # keep each client on the same canary
sticky_cookie_name     = "PQCPROXY_CANARY"  # cookie set on first assignment
sticky_cookie_ttl_secs = 3600              # lifetime in seconds
sticky_header          = "X-Canary-Group"  # optional: pre-assign via request header
auto_rollback          = true              # suspend on high error rate
rollback_error_rate    = 0.05             # suspend at 5 % errors
rollback_window_secs   = 60              # sliding window length (seconds)
rollback_min_requests  = 10             # minimum requests before rollback triggers

# Canary server — receives 5 % of new traffic
[[backend_pools.api-pool.servers]]
address               = "127.0.0.1:3005"
canary                = true
canary_weight_percent = 5
weight = 100
priority = 1
max_connections = 100
timeout_ms = 30000
tls_mode = "terminate"

# Stable servers — receive the remaining 95 %
[[backend_pools.api-pool.servers]]
address = "127.0.0.1:3003"
weight = 100
priority = 1
max_connections = 100
timeout_ms = 30000
tls_mode = "terminate"

Admin API endpoints for live canary control (all require Bearer token auth):

Traffic Shadowing / Mirroring

Add a [routes.shadow] block to any route to mirror traffic to a secondary backend. The client only sees the primary response; the shadow response is logged and discarded. All parameters are configurable — nothing is hardcoded.

[[routes]]
name    = "api-route"
host    = "api.example.com"
backend = "api-stable"

[routes.shadow]
backend             = "api-canary"      # Must be a key in [backends.*]
percent             = 10                # 0-100 % of requests to mirror (default 100)
timeout_ms          = 5000              # Abandon shadow after this many ms (default 5000)
shadow_header       = "X-Shadow-Request"  # Header injected on shadow requests
shadow_header_value = "1"               # Value for that header (default "1")
log_responses       = true              # Log shadow status + latency at INFO (default true)

Shadow requests carry the configurable marker header so the shadow backend can identify mirror traffic. Shadow errors and timeouts are logged as warnings and never affect the client. Body buffering is performed only on routes with shadow configured — no overhead on standard routes.

Connection Pool & Circuit Breaker

# HTTP Connection Pool
[connection_pool]
idle_timeout_secs = 90                 # Idle connection timeout
max_idle_per_host = 10                 # Max idle connections per host
max_connections_per_host = 100         # Max total connections per host
acquire_timeout_ms = 5000              # Connection acquire timeout

# Circuit Breaker (backend protection)
[circuit_breaker]
enabled = true
half_open_delay_secs = 30              # Open to Half-Open delay
half_open_max_requests = 3             # Max test requests in Half-Open
failure_threshold = 5                  # Failures to trigger Open state
success_threshold = 2                  # Successes to close breaker
stale_counter_cleanup_secs = 300       # Counter cleanup interval

TLS Configuration Modes

TLS Terminate (Default)

[backends.apache]
name = "apache"
type = "http1"
address = "127.0.0.1:8080"
tls_mode = "terminate"  # Decrypt at proxy, plain HTTP to backend

TLS Re-encrypt

[backends.internal-api]
name = "internal-api"
type = "http1"
address = "internal.example.com:443"
tls_mode = "reencrypt"
tls_cert = "/path/to/ca.pem"           # Optional: custom CA
tls_client_cert = "/path/to/client.pem" # Optional: mTLS client cert
tls_client_key = "/path/to/client.key"  # Optional: mTLS client key
tls_skip_verify = false                 # DANGEROUS if true
tls_sni = "internal.example.com"        # Optional: custom SNI

TLS Passthrough (SNI Routing)

[[passthrough_routes]]
name = "external-service"
sni = "external.example.com"    # Supports wildcards: *.example.com
backend = "10.0.0.5:443"
proxy_protocol = false
timeout_ms = 30000

Route Configuration

[[routes]]
name = "api-route"
host = "api.example.com"               # Host pattern (supports wildcards)
path_prefix = "/api"                   # Path prefix matching
# path_exact = "/health"               # Exact path matching
# path_regex = "^/v[0-9]+/.*"          # Regex matching
backend = "api"                        # Backend name or pool
webtransport = false                   # Enable WebTransport
forward_client_identity = true         # Forward client IP
client_identity_header = "X-Client-IP" # Custom header name
priority = 100                         # Route priority (higher = first)
# redirect = "https://example.com"     # Redirect URL
# redirect_permanent = true            # 301 vs 302
allow_http11 = false                   # Allow HTTP/1.1 upgrade
skip_bot_blocking = false              # Skip bot blocking
timeout_override_ms = 60000            # Route-specific timeout

# Add/remove headers
[routes.add_headers]
X-Forwarded-Proto = "https"
X-Request-ID = "${request_id}"

[routes.remove_headers]
X-Internal-Token = ""

# CORS configuration
[routes.cors]
allow_origin = "https://example.com"   # Or "*" for any
allow_methods = ["GET", "POST", "PUT", "DELETE", "OPTIONS"]
allow_headers = ["Content-Type", "Authorization", "X-Request-ID"]
expose_headers = ["X-Request-ID"]
allow_credentials = true
max_age = 86400                        # Preflight cache (seconds)

# Override global headers per-route
[routes.headers_override]
x_frame_options = "SAMEORIGIN"

ACME Certificate Automation

[acme]
enabled = true
domains = ["example.com", "api.example.com"]
email = "admin@example.com"
directory_url = "https://acme-v02.api.letsencrypt.org/directory"
challenge_type = "http-01"             # http-01 or dns-01
certs_path = "/etc/pqcrypta/certs"
renewal_days = 30                      # Renew 30 days before expiry
check_interval_hours = 12              # Check interval
http_port = 80                         # HTTP-01 challenge port

Admin API Configuration

[admin]
enabled = true
bind_address = "127.0.0.1"             # Bind to localhost only
port = 8082
require_mtls = false                   # Require mTLS for admin
auth_token = "your-secret-token"       # Bearer token auth
allowed_ips = ["127.0.0.1", "::1"]     # IP allowlist

OCSP Stapling

[ocsp]
enabled = true
cache_duration_secs = 3600
refresh_before_expiry_secs = 300
timeout_secs = 10
max_retries = 3
retry_delay_ms = 1000

JA3/JA4 Fingerprinting

[fingerprinting]
enabled = true
ja3_enabled = true
ja4_enabled = true

# Classification for rate limiting
[fingerprinting.classification]
browsers = ["Chrome", "Firefox", "Safari", "Edge"]
bots = ["Googlebot", "Bingbot", "curl", "wget"]
malware = ["known-c2-fingerprint"]

# Actions per category
[fingerprinting.actions]
browsers = "allow"
bots = "rate_limit"
malware = "block"
unknown = "rate_limit"

Logging Configuration

[logging]
level = "info"           # trace, debug, info, warn, error
format = "json"          # json or text (for SIEM integration)
output = "stdout"        # stdout, stderr, or file path
access_log = true
access_log_path = "/var/log/pqcrypta/access.log"
security_log_path = "/var/log/pqcrypta/security.log"

# What to include in access logs (W3C Extended format)
[logging.access]
include_headers = false   # Request headers (privacy consideration)
include_body = false      # Request body (size/privacy)
include_timing = true     # Request/response timing
include_ja3 = true        # JA3 fingerprint
include_ja4 = true        # JA4 fingerprint
include_backend = true    # Backend server selected
include_geo = true        # Country/city from GeoIP
include_error_details = true  # Error information

# Access log fields (W3C format)
# - timestamp, client_ip, method, path, status, size
# - timing (request_time_ms, backend_time_ms)
# - user_agent, referrer, protocol
# - ja3, ja4, backend, country, city

# Security-specific logging
[logging.security]
log_blocked_requests = true    # Log all blocked requests
log_rate_limited = true        # Log rate limit hits
log_fingerprints = true        # Log JA3/JA4 fingerprints
log_geoip = true               # Log geographic data
log_circuit_breaker = true     # Log breaker state changes

Access Log Example (JSON format)

{
  "timestamp": "2026-01-30T12:34:56.789Z",
  "client_ip": "203.0.113.42",
  "method": "GET",
  "path": "/api/v1/users",
  "status": 200,
  "size": 1542,
  "request_time_ms": 23,
  "backend_time_ms": 18,
  "user_agent": "Mozilla/5.0 ...",
  "protocol": "HTTP/3",
  "ja3": "771,4865-4866-4867...",
  "ja4": "t13d1516h2_002...",
  "backend": "api-server-1",
  "country": "US",
  "city": "San Francisco"
}

OpenTelemetry Configuration

[otel]
# Enable distributed tracing export (disabled by default)
enabled = false

# Service name reported to the collector
service_name = "pqcrypta-proxy"

# OTLP HTTP endpoint (Jaeger, Tempo, OpenTelemetry Collector, etc.)
otlp_endpoint = "http://localhost:4318"

# Sampling: 1.0 = always sample, 0.0 = never, 0.1 = 10 % of root spans
# Uses ParentBased(TraceIdRatioBased) — child spans follow parent decision
sample_ratio = 1.0

# Optional resource attributes added to every span
# [otel.resource_attributes]
# deployment.environment = "production"
# host.name = "proxy-1"

Performance Tuning

[performance]
max_concurrent_connections = 10000
max_streams_per_connection = 1000
keep_alive_interval_secs = 15
max_idle_timeout_secs = 120

# Buffer sizes
receive_buffer_size = 1048576
send_buffer_size = 1048576

# HTTP/3 specific
[performance.http3]
max_field_section_size = 65536
qpack_max_table_capacity = 4096
enable_0rtt = false           # Disabled by default for security

Linux Kernel Tuning (Recommended)

# /etc/sysctl.conf

# UDP Buffer sizes for QUIC performance
net.core.rmem_max = 26214400            # 25MB receive buffer
net.core.wmem_max = 26214400            # 25MB send buffer
net.core.rmem_default = 1048576         # 1MB default receive
net.core.wmem_default = 1048576         # 1MB default send

# UDP memory allocation
net.ipv4.udp_mem = 65536 131072 262144

# Network backlog for high connection rates
net.core.netdev_max_backlog = 65536
net.core.somaxconn = 65536

# TCP tuning (for HTTP/1.1 and HTTP/2)
net.ipv4.tcp_max_syn_backlog = 65536
net.ipv4.tcp_fastopen = 3
net.ipv4.tcp_rmem = 4096 87380 26214400
net.ipv4.tcp_wmem = 4096 65536 26214400

# File descriptor limits
fs.file-max = 1048576

# Apply changes
sudo sysctl -p

File Descriptor Limits

# /etc/security/limits.conf
pqcrypta soft nofile 65535
pqcrypta hard nofile 65535
pqcrypta soft nproc 4096
pqcrypta hard nproc 4096

Build Optimizations

# Build with native CPU optimizations
RUSTFLAGS="-C target-cpu=native" cargo build --release

# Build with maximum optimization (slower compile)
RUSTFLAGS="-C target-cpu=native -C opt-level=3" cargo build --release

# Profile-guided optimization (PGO)
# 1. Build instrumented binary
RUSTFLAGS="-Cprofile-generate=/tmp/pgo-data" cargo build --release

# 2. Run with typical workload
./target/release/pqcrypta-proxy --config config.toml &
# ... run benchmark traffic ...

# 3. Merge profile data
llvm-profdata merge -o /tmp/pgo-data/merged.profdata /tmp/pgo-data

# 4. Build optimized binary
RUSTFLAGS="-Cprofile-use=/tmp/pgo-data/merged.profdata" cargo build --release

Headers Configuration

[headers]
# HSTS (2-year preload)
hsts = "max-age=63072000; includeSubDomains; preload"

# Security headers
x_frame_options = "DENY"
x_content_type_options = "nosniff"
referrer_policy = "strict-origin-when-cross-origin"
permissions_policy = "camera=(), microphone=(), geolocation=(), interest-cohort=()"

# Cross-origin isolation
cross_origin_opener_policy = "same-origin"
cross_origin_embedder_policy = "require-corp"
cross_origin_resource_policy = "same-origin"

# Additional security
x_permitted_cross_domain_policies = "none"
x_download_options = "noopen"
x_dns_prefetch_control = "off"

# PQC branding (advertise capabilities)
x_quantum_resistant = "ML-KEM-1024, ML-DSA-87, X25519MLKEM768"
x_security_level = "Post-Quantum Ready"

# ============================================
# HTTP/3 Performance & Monitoring Headers
# ============================================

# Server-Timing header (RFC 6797) - Performance metrics
# Shows proxy processing time in browser DevTools Network tab
server_timing_enabled = true

# Accept-CH header - Client Hints for adaptive content delivery
# Enables browsers to send device/network info for responsive content
accept_ch = "DPR, Viewport-Width, Width, ECT, RTT, Downlink, Sec-CH-UA-Platform, Sec-CH-UA-Mobile"

# NEL (Network Error Logging) - Client-side error reporting
# JSON policy defining how browsers should report network errors
nel = '{"report_to":"default","max_age":86400,"include_subdomains":true}'

# Report-To header - Defines reporting endpoint for NEL
# JSON configuration for the Reporting API endpoint
report_to = '{"group":"default","max_age":86400,"endpoints":[{"url":"https://api.pqcrypta.com/reports"}]}'

# Priority header (RFC 9218) - HTTP/3 response prioritization
# u=0-7 (urgency, 0=highest), i (incremental delivery flag)
priority = "u=3"

CLI Arguments

pqcrypta-proxy [OPTIONS]

Options:
  -c, --config <PATH>       Configuration file [default: /etc/pqcrypta/config.toml]
      --udp-port <PORT>     Override UDP port for QUIC
      --admin-port <PORT>   Override admin API port
      --log-level <LEVEL>   Log level [default: info]
      --json-logs           Enable JSON log format
      --no-pqc              Disable PQC hybrid key exchange
      --watch-config        Watch config file for changes [default: true]
      --validate            Validate configuration only
  -h, --help                Print help
  -V, --version             Print version

Environment variables: PQCRYPTA_CONFIG, PQCRYPTA_UDP_PORT, PQCRYPTA_ADMIN_PORT, PQCRYPTA_LOG_LEVEL, PQCRYPTA_JSON_LOGS

Deployment Examples

Linux - Systemd Service

[Unit]
Description=PQCrypta Proxy - QUIC/HTTP3/WebTransport Proxy with PQC TLS
Documentation=https://github.com/PQCrypta/pqcrypta-proxy
After=network-online.target
Wants=network-online.target

[Service]
Type=notify
User=pqcrypta
Group=pqcrypta

# Configuration
Environment=PQCRYPTA_CONFIG=/etc/pqcrypta/config.toml
Environment=PQCRYPTA_LOG_LEVEL=info
Environment=PQCRYPTA_JSON_LOGS=true

ExecStart=/usr/local/bin/pqcrypta-proxy --config ${PQCRYPTA_CONFIG}
ExecReload=/bin/kill -HUP $MAINPID

# Graceful shutdown
TimeoutStopSec=30
KillSignal=SIGTERM
KillMode=mixed

# Restart policy
Restart=on-failure
RestartSec=5

# Security hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
MemoryDenyWriteExecute=true

# Read-only paths
ReadOnlyPaths=/etc/letsencrypt
ReadOnlyPaths=/etc/pqcrypta
ReadWritePaths=/var/log/pqcrypta-proxy

# Network capability
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

# Resource limits
LimitNOFILE=65535
LimitNPROC=4096

StandardOutput=journal
StandardError=journal
SyslogIdentifier=pqcrypta-proxy

[Install]
WantedBy=multi-user.target

# Installation
sudo cp pqcrypta-proxy.service /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable pqcrypta-proxy
sudo systemctl start pqcrypta-proxy
journalctl -u pqcrypta-proxy -f

macOS - launchd Service

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.pqcrypta.proxy</string>

    <key>ProgramArguments</key>
    <array>
        <string>/usr/local/bin/pqcrypta-proxy</string>
        <string>--config</string>
        <string>/usr/local/etc/pqcrypta/config.toml</string>
    </array>

    <key>EnvironmentVariables</key>
    <dict>
        <key>PQCRYPTA_LOG_LEVEL</key>
        <string>info</string>
        <key>PQCRYPTA_JSON_LOGS</key>
        <string>true</string>
    </dict>

    <key>WorkingDirectory</key>
    <string>/usr/local/var/pqcrypta-proxy</string>

    <key>RunAtLoad</key>
    <true/>

    <key>KeepAlive</key>
    <dict>
        <key>SuccessfulExit</key>
        <false/>
        <key>NetworkState</key>
        <true/>
    </dict>

    <key>ThrottleInterval</key>
    <integer>5</integer>

    <key>StandardOutPath</key>
    <string>/usr/local/var/log/pqcrypta-proxy/stdout.log</string>
    <key>StandardErrorPath</key>
    <string>/usr/local/var/log/pqcrypta-proxy/stderr.log</string>

    <key>SoftResourceLimits</key>
    <dict>
        <key>NumberOfFiles</key>
        <integer>65535</integer>
    </dict>
</dict>
</plist>

# Installation
cp com.pqcrypta.proxy.plist ~/Library/LaunchAgents/
launchctl load ~/Library/LaunchAgents/com.pqcrypta.proxy.plist
launchctl start com.pqcrypta.proxy

Windows - NSSM Service

# Run as Administrator
# Install NSSM from https://nssm.cc/

# Create service
nssm install pqcrypta-proxy "C:\Program Files\pqcrypta-proxy\pqcrypta-proxy.exe"
nssm set pqcrypta-proxy AppParameters "--config C:\ProgramData\pqcrypta\config.toml"
nssm set pqcrypta-proxy AppDirectory "C:\Program Files\pqcrypta-proxy"

# Environment variables
nssm set pqcrypta-proxy AppEnvironmentExtra "PQCRYPTA_LOG_LEVEL=info" "PQCRYPTA_JSON_LOGS=true"

# Logging with rotation
nssm set pqcrypta-proxy AppStdout "C:\ProgramData\pqcrypta\logs\stdout.log"
nssm set pqcrypta-proxy AppStderr "C:\ProgramData\pqcrypta\logs\stderr.log"
nssm set pqcrypta-proxy AppRotateFiles 1
nssm set pqcrypta-proxy AppRotateOnline 1
nssm set pqcrypta-proxy AppRotateBytes 10485760

# Restart policy
nssm set pqcrypta-proxy AppExit Default Restart
nssm set pqcrypta-proxy AppRestartDelay 5000

# Auto-start
nssm set pqcrypta-proxy Start SERVICE_AUTO_START
nssm set pqcrypta-proxy Description "PQCrypta Proxy - QUIC/HTTP3 with PQC TLS"

# Start service
nssm start pqcrypta-proxy

Windows - Native sc.exe (Alternative)

# Create service
sc.exe create pqcrypta-proxy binPath= "\"C:\Program Files\pqcrypta-proxy\pqcrypta-proxy.exe\" --config \"C:\ProgramData\pqcrypta\config.toml\"" DisplayName= "PQCrypta Proxy" start= auto

# Set description
sc.exe description pqcrypta-proxy "PQCrypta Proxy - QUIC/HTTP3/WebTransport with PQC TLS"

# Configure recovery (restart on failure)
sc.exe failure pqcrypta-proxy reset= 86400 actions= restart/5000/restart/10000/restart/30000

# Start service
sc.exe start pqcrypta-proxy

Docker

# Build image
docker build -t pqcrypta-proxy .

# Run container
docker run -d --name pqcrypta-proxy \
  -p 80:80 \
  -p 443:443/tcp \
  -p 443:443/udp \
  -p 8082:8082 \
  -v /etc/letsencrypt:/etc/letsencrypt:ro \
  -v ./config:/etc/pqcrypta:ro \
  -v ./logs:/var/log/pqcrypta \
  --ulimit nofile=65535:65535 \
  pqcrypta-proxy

Docker Compose

version: '3.8'
services:
  pqcrypta-proxy:
    image: pqcrypta/proxy:latest
    container_name: pqcrypta-proxy
    ports:
      - "80:80"
      - "443:443/tcp"
      - "443:443/udp"
      - "8082:8082"
    volumes:
      - ./config:/etc/pqcrypta:ro
      - /etc/letsencrypt:/etc/letsencrypt:ro
      - ./logs:/var/log/pqcrypta
      - ./data/geoip:/var/lib/pqcrypta/geoip:ro
    environment:
      - PQCRYPTA_LOG_LEVEL=info
      - PQCRYPTA_JSON_LOGS=true
    restart: unless-stopped
    ulimits:
      nofile:
        soft: 65536
        hard: 65536
    sysctls:
      - net.core.rmem_max=26214400
      - net.core.wmem_max=26214400
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8082/health"]
      interval: 30s
      timeout: 10s
      retries: 3