Set Up Your First Deployment

Every Proxyble deployment has two required settings:

• The listener is the public port where clients connect.
• The backend is the protected application or service that receives allowed traffic.

Configure both before starting the runtime stack. For a low-risk first deployment, put a non-production application behind Proxyble and verify normal requests before changing public DNS or client traffic.

Choose a listener mode

Choose the mode based on what Proxyble needs to inspect:

• TCP is for raw TCP services and HTTPS pass-through. Proxyble can use IP and connection information, but it cannot inspect HTTP paths or headers.
• HTTP is for unencrypted HTTP traffic.
• HTTPS terminates TLS in HAProxy. Use this only when Proxyble should hold the certificate and inspect HTTP requests before forwarding them to the backend.

For a local HTTP API that currently listens on port 8080, configure Proxyble to accept traffic on port 80 without starting services yet:

sudo proxyble --config-listener --mode http --port 80 --timeout 60s --no-start

For HTTPS pass-through, use TCP mode on port 443 instead. For TLS termination, use HTTPS mode and provide a PEM bundle containing the certificate and private key. Do not configure a loopback backend on the same port as the public listener.

Configure the backend

Point Proxyble at the service that should receive allowed traffic:

sudo proxyble --config-backend \
  --primary-host 127.0.0.1 \
  --primary-port 8080 \
  --no-secondary \
  --no-start

For an application on another host, replace 127.0.0.1 with its IP address or DNS name. A second backend is optional; when configured, HAProxy balances traffic across the two backends.

Start and verify

Start the services after the listener and backend are complete:

sudo proxyble --yes --config-start
sudo proxyble --config-status

The runtime stack starts nftables, HAProxy, and the Proxyble rule-agent triggers. RioDB is included only when analytics is enabled. Confirm that a normal request reaches your backend, then check the backend logs and Proxyble status before moving traffic to the new listener.

Review the configuration

The canonical configuration file is /etc/proxyble/config.ini. To view the settings managed by Proxyble:

sudo proxyble --config-view

Next step

If you want behavioral detection and automated short-lived rules, continue to Deploy Your First Automated Policy. Otherwise, review Manual Rules and Automated Policies before adding a rule.