PosternProxy turns Caddy into an approachable, production-ready reverse proxy platform for self-hosted infrastructure.
Use it to route traffic, automate TLS, and manage proxy hosts from one focused control plane. The controller, embedded UI, and multi-server agent are available under AGPLv3, with commercial licensing available for proprietary products, hosted services, managed infrastructure, and OEM deployments.
PosternProxy is built for operators who want the power of Caddy without hand-editing every route, certificate, redirect, stream host, and access rule.
Capabilities
- Proxy hosts with load balancing, health checks, rate limiting, custom headers, and per-path locations.
- Redirection hosts for HTTP 301, 302, 307, and 308 redirects.
- TCP and UDP stream proxying with TLS passthrough through Caddy L4.
- Automatic Let’s Encrypt certificates or uploaded custom PEM certificates.
- Access lists with IP allowlists, denylists, and HTTP Basic Auth per host.
- Port forwarding rules managed from the UI.
- Remote server management through a lightweight outbound WebSocket agent.
- Audit logging with actor, IP, and before/after snapshots.
- Configuration history with rollback for proxy hosts.
- Nginx import for migration from existing configurations.
Architecture
PosternProxy runs as a controller with an embedded UI, REST API, SQLite database, and Caddy Admin API integration. Caddy handles the routing and TLS work while PosternProxy provides the management layer.
For multi-server setups, remote servers run posternproxy-agent, which maintains an outbound WebSocket connection to the controller and applies Caddy configuration updates as they arrive.
Fit
PosternProxy is a strong fit for self-hosted infrastructure, small teams, MSPs, homelabs moving toward production practices, and organizations that want reverse proxy control without adopting a large platform.
Visit the project site at posternproxy.com or view the source on GitHub.