FFPROXY.CONF(5)

🎀 NAME 🎀

ffproxy.conf(5) — the filtering HTTP/HTTPS proxy server configuration file. yes bestie, the config file got its own whole manual page, it's giving main character energy 💅

---

✨ DESCRIPTION ✨

okay so ffproxy is a filtering HTTP/HTTPS proxy server. it's genuinely so capable, like, it can filter by host, URL, and header. custom header entries can be filtered and added. it can even drop its privileges and optionally chroot(2) to some directory. logging to syslog(3) is supported, as is using another auxiliary proxy server. an HTTP accelerator feature (acting as a front-end to an HTTP server) is included, no big deal 🫶

contacting IPv6 servers as well as binding to IPv6 is supported, and that allows transparent IPv6 over IPv4 browsing (and vice versa). literally so iconic 🌈

this manual describes how to use configuration files with the program and documents the options. that's the whole assignment 📋

---

🦋 USING CONFIGURATION FILES 🦋

🌸 Default ffproxy.conf 🌸

if the command line parameters -f or -F are not used, the proxy tries to open /etc/ffproxy/ffproxy.conf. if this file does not exist, the program continues execution. it's fine, she just moves on 💅

💖 User Configuration File 💖

use command line parameter -f to load a non-default configuration file. you will notice the warning at the program's startup, and no, it's not being shady — it's due to the program's implementation that allows one to reload all configuration files. to disable the warning, use -F instead. slay, warning gone ✨

🧚 Deactivating 🧚

to use command line options only, use -f "". periodt.

👑 Reloading Configuration 👑

to let the proxy reload its configuration files — that is, besides the configuration file specified, the contents of db/ and html/ — send the signal HUP to the program's master process. ffproxy pid can be found by default in file /var/run/ffproxy.pid, you can override /var/run directory with command line parameter -n or with pid_dir setting in config file. iykyk 🫡

options that can be successfully altered at runtime are:

• child_processes
• use_ipv6
• use_syslog
• log_all_requests
• forward_proxy
• forward_proxy_port
• forward_proxy_ipv6
• accel_host
• accel_port
• accel_user_host
• use_keep_alive
• unrestricted_connect
• timeout_connect
• backlog_size

set accel_port 0 or forward_proxy_port 0 to explicitly disable acceleration or auxiliary proxy. commenting out options is not sufficient, since configuration options may only overwritten. that's the rule, bestie, we don't make them 💀

changes to other options not mentioned above get silently ignored. yes, silently. the audacity 🙈

---

💅 CONFIGURATION OPTIONS 💅

here's the whole annotated sample, exactly as it lives, with me hyping you up between sections 🫶

🍓 the basics: comments, daemonize, child processes

#
# lines starting with '#' are comments
#

# run as daemon?
# (default: no)
#daemonize yes
#daemonize no

# number of child processes,
# that is, the maximum number of concurrent requests
# (default: 10)
#child_processes 10

so # starts a comment, daemonize decides if she runs as a daemon (default is no), and child_processes is literally just how many concurrent requests you can juggle at once (default is 10). multitasking queen 👑

🌈 binding + ports + the toggles

# ffproxy binds to any IPv4 address
# and any IPv6 address by default
#
# bind to IPv4?  (default: yes)
#bind_ipv4 no
#bind_ipv4 yes
# bind to IPv6?  (default: yes)
#bind_ipv6 no
#bind_ipv6 yes
#
# Hostname or IP to bind to
# (default is any IP)
#
#bind_ipv4_host 192.168.10.1
#bind_ipv4_host martyr.burden.eu.org
#bind_ipv6_host ::1
#bind_ipv6_host oz.burden.eu.org

# listen on port
# (default: 8080)
#port 1111
#port 8080

# use IPv6 when contacting servers?
# (default: yes)
#use_ipv6 no
#use_ipv6 yes

# use syslog?
# (default: yes)
#use_syslog no
#use_syslog yes

# log all requests?
# (default: no)
# to use, set also use_syslog to yes
#log_all_requests yes
#log_all_requests no

by default she binds to any IPv4 address and any IPv6 address (both yes by default), but you can pin her to a specific hostname or IP with bind_ipv4_host / bind_ipv6_host (default is any IP). the port defaults to 8080. use_ipv6 for contacting servers defaults to yes, use_syslog defaults to yes.

heads up bestie: log_all_requests defaults to no, and to use it you also have to set use_syslog to yes. they're a package deal 💖

🔥 dropping privileges + chroot + auxiliary proxy

# change UID and GID
#
# to use, both uid and gid must be set
# (disabled by default)
#uid proxy
#gid proxy
#uid 37
#gid 38

# change root to (only in connection with uid and gid change)
#   /etc/resolv.conf might need to be copied
#   to chroot_dir/etc/resolv.conf
# (disabled by default)
#chroot_dir /usr/share/ffproxy

# forward to proxy (auxiliary proxy)
# (set `forward_proxy_port 0' to explicitly disable feature
#  (i.e, when reloading configuration file via SIGHUP))
# (disabled by default)
#forward_proxy blackness.burden.eu.org
#forward_proxy 192.168.10.5
#forward_proxy ::1
#forward_proxy_port 8082
#forward_proxy_port 0

# try IPv6 for auxiliary proxy?
# use_ipv6 must be set to yes, too
# (default: yes)
#forward_proxy_ipv6 no
#forward_proxy_ipv6 yes

uid and gid change the UID and GID — and both must be set to use it (disabled by default). chroot_dir changes root, and it only works in connection with a uid and gid change (also disabled by default).

note the vibe: /etc/resolv.conf might need to be copied to chroot_dir/etc/resolv.conf. don't forget it, or she'll be lost 😭

forward_proxy points at an auxiliary proxy (disabled by default), and forward_proxy_port 0 explicitly disables the feature — which matters when you're reloading the configuration file via SIGHUP. forward_proxy_ipv6 defaults to yes, but use_ipv6 must be set to yes too. they hold hands 🤝

🦋 db/ and html/ paths

# path to db/ and html/ directories
# (default: /usr/share/ffproxy)
# (Note: if ffproxy runs chrooted,
#  give a path name relative to new root, or,
#  if db_files_path is the same as root, use db_files_path ./
#  You have to start ffproxy in the new root directory,
#  otherwise it won't find the database files.
#  Please keep in mind that ffproxy's config file has to
#  be within chroot directory, otherwise it will not find
#  its config file on reload)
#db_files_path ./
#db_files_path /usr/share/ffproxy

db_files_path points to the db/ and html/ directories (default /usr/share/ffproxy).

real talk, this one is important if you're chrooted: give a path name relative to the new root, or, if db_files_path is the same as root, use db_files_path ./. you have to start ffproxy in the new root directory, otherwise it won't find the database files. and please keep in mind that ffproxy's config file has to be within the chroot directory, otherwise it will not find its config file on reload. so many little rules but they all make sense, trust 💅

⭐ HTTP accelerator

# http accelerator
# (disabled by default)
#
# if you want to use ffproxy as http accelerator (that is, connecting
# to just one http server and being used as front-end to that, e.g.
# in DMZ) uncomments options below (port is optional, defaults to 80)
# (set `accel_port 0' to explicitly disable feature
#  (i.e, when reloading configuration file via SIGHUP))
#accel_host 10.254.1.2
#accel_host revelation.martyr.eu.org
#accel_port 80
#accel_port 0
#
# Omit Host: accel_host:accel_port in Header
# to provide own Host: header via db/filter.header.add?
# (default: yes)
#accel_user_host no
#accel_user_host yes

the accelerator is disabled by default. if you want ffproxy as an http accelerator — that is, connecting to just one http server and being used as front-end to that, e.g. in DMZ — uncomment the options below (port is optional, defaults to 80). and again, accel_port 0 explicitly disables the feature, i.e. when reloading the configuration file via SIGHUP.

accel_user_host defaults to yes, and it controls omitting Host: accel_host:accel_port in the header so you can provide your own Host: header via db/filter.header.add. cute, right? 🎀

🧚 keep alive, CONNECT, timeouts, backlog, pid dir

# keep alive on client to proxy connections
# (enabled by default)
#use_keep_alive no
#use_keep_alive yes

# allow CONNECT request to other than port 443 (HTTPS)
# (CONNECT enables HTTPS proxying)
# (disabled by default for security)
#unrestricted_connect yes
#unrestricted_connect no

# timeout for CONNECT requests in seconds
# (default: 5)
#timeout_connect 20
#timeout_connect 5

# backlog size for accept()
# (default: 4)
#backlog_size 16
#backlog_size 4

# directory to store file ffproxy.pid (with ffproxy pid inside)
# (default: /var/run)
#pid_dir /tmp
#pid_dir /var/run

use_keep_alive is for keep alive on client to proxy connections, and it's enabled by default.

unrestricted_connect allows a CONNECT request to other than port 443 (HTTPS) — and remember, CONNECT enables HTTPS proxying. it's disabled by default for security, and that's a big deal, so leave it alone unless you know exactly why you're flipping it 🔒

timeout_connect is the timeout for CONNECT requests in seconds, default 5. backlog_size is the backlog size for accept(), default 4. and pid_dir is the directory to store the file ffproxy.pid (with the ffproxy pid inside), default /var/run. 🫶

---

🌟 VERSION 🌟

this manual documents ffproxy 1.6 (2005-01-05). vintage but thriving ✨

---

📁 FILES 📁

• /etc/ffproxy/ffproxy.conf — default configuration file
• sample.config — sample configuration file

---

🔗 SEE ALSO 🔗

ffproxy(8), ffproxy.quick(7), regex(7), re_format(7), syslogd(8), chroot(2), kill(1)

go read them bestie, they're all part of the lore 📚

---

and that's the whole page!! this one came from ffproxy 1.6, dated Jan 5, 2005, and it lives under the name ffproxy.conf(5) 💖 configure responsibly, hydrate, and don't comment out options when you meant to zero them — periodt 🎀✨