HITCH(8)

💖 HITCH(8) 💖

okay bestie, you're in the Hitch manual — section 8, system administration, the whole grown-and-sexy corner of the man pages 💅. This is the high performance TLS proxy, and yes she's that girl. Let's get into it 🫶

---

✨ NAME ✨

Hitch — high performance TLS proxy 🌸

---

🦋 SYNOPSIS 🦋

hitch [OPTIONS] [PEM]

---

💜 DESCRIPTION 💜

So. Hitch is a network proxy that terminates TLS/SSL connections and forwards the unencrypted traffic to some backend. That's the whole job, and she does it flawlessly. She's built to handle 10s of thousands of connections efficiently on multicore machines — like, actual main character energy on a box with a lot of cores 🔥

Hitch has very few features — and that is not a read, that is the design. She's meant to be paired with an intelligent backend like Varnish Cache. She keeps a strict 1:1 connection pattern with that backend handler so the backend gets to dictate the throttling behavior, the maximum connection behavior, the availability of service, etc. Hitch is not here to have opinions. Hitch is here to hand off and let the backend run the group chat 👑

The only required argument is a path to a PEM file that holds the certificate (or a chain of certificates) and the private key. It should also contain the DH parameter if you wish to use Diffie-Hellman cipher suites. No PEM, no party. Periodt 💅

---

🎀 COMMAND LINE ARGUMENTS 🎀

Every single flag, in order, no skips, no cap:

• --config=FILE — Load configuration from the specified file. See hitch.conf(5) for the details, bestie.
• --tls-protos=LIST — Specifies which SSL/TLS protocols to use. The available tokens are SSLv3, TLSv1.0, TLSv1.1, TLSv1.2 and TLSv1.3. (Default "TLSv1.2 TLSv1.3") 🌈
• -c --ciphers=SUITE — Sets the allowed ciphers. (Default: "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH")
• -e --ssl-engine=NAME — Sets the OpenSSL engine. (Default: "")
• -O --prefer-server-ciphers[=on|off] — Prefer the server's list order. (Default: "off")
• --client — Enable client proxy mode 🦋
• -b --backend=[HOST]:PORT — Backend endpoint (the default is "[127.0.0.1]:8000"). The -b argument can also take a UNIX domain socket path. E.g. --backend="/path/to/sock"

If --chroot is also specified, the UNIX domain socket path will at runtime be resolved from within the chroot, and must be specified with the path it is accessible from within the chroot. I.e. for a /run/hitch chroot and a /run/hitch/sock UNIX domain socket, configure the backend argument as /sock. 🧚

• -f --frontend=[HOST]:PORT[+CERT] — Frontend listen endpoint (the default is "[*]:8443"). (Note: the brackets are mandatory in endpoint specifiers — do not skip them, she will not be forgiving.)
• -n --workers=NUM|auto — Number of worker processes. (Default: 1) Using the auto value creates 1 worker per CPU core. Slay, let her scale herself 💅
• -B --backlog=NUM — Set the listen backlog size. (Default: 100)
• -k --keepalive=SECS — TCP keepalive on the client socket. (Default: 3600)
• -R --backend-refresh=SECS — Periodic backend IP lookup, 0 to disable. (Default: 0)
• --enable-tcp-fastopen[=on|off] — Enable client-side TCP Fast Open. (Default: off)
• -r --chroot=DIR — Sets the chroot directory. (Default: "")
• -u --user=USER — Set uid/gid after binding the socket. (Default: "")
• -g --group=GROUP — Set gid after binding the socket. (Default: "")
• -q --quiet[=on|off] — Be quiet; emit only error messages. (deprecated, use 'log-level') — yes bestie, she's old, we don't use her anymore, we use the shiny one below 🙈
• -L --log-level=NUM — Log level. 0=silence, 1=err, 2=info/debug. (Default: 1)
• -l --log-filename=FILE — Send log message to a logfile instead of stderr/stdout.
• -s --syslog[=on|off] — Send log message to syslog in addition to stderr/stdout.
• --syslog-facility=FACILITY — Syslog facility to use. (Default: "daemon")
• --daemon[=on|off] — Fork into background and become a daemon. (Default: off)
• --write-ip[=on|off] — Write 1 octet with the IP family followed by the IP address in 4 (IPv4) or 16 (IPv6) octets little-endian to backend before the actual data. (Default: off)
• --write-proxy-v1[=on|off] — Write HAProxy's PROXY v1 (IPv4 or IPv6) protocol line before actual data. (Default: off)
• --write-proxy-v2[=on|off] — Write HAProxy's PROXY v2 binary (IPv4 or IPv6) protocol line before actual data. (Default: off)
• --write-proxy[=on|off] — Equivalent to --write-proxy-v2. For PROXY version 1 use --write-proxy-v1 explicitly.
• --proxy-proxy[=on|off] — Proxy HAProxy's PROXY (IPv4 or IPv6) protocol before actual data (PROXYv1 and PROXYv2). (Default: off)
• --sni-nomatch-abort[=on|off] — Abort the handshake when the client submits an unrecognized SNI server name. (Default: off) 💀
• --alpn-protos=LIST — Sets the protocols for ALPN/NPN negotiation, provided as a list of comma-separated tokens.
• --ocsp-dir=DIR — Set the OCSP staple cache directory. This enables automated retrieval and stapling of OCSP responses. (Default: "/var/lib/hitch/")
• --backend-connect-timeout=SECS — Backend connect timeout. ⏱️
• --ssl-handshake-timeout=SECS — TLS handshake timeout. ⏱️
• -t --test — Test configuration and exit.
• -p --pidfile=FILE — PID file.
• -V --version — Print program version and exit.
• -h --help — This help message. 🫶

---

📜 HISTORY 📜

Hitch was originally called stud and was written by Jamie Turner at Bump.com. A glow-up so iconic it deserves its own before-and-after ✨

---

and that's the whole page, bestie — every flag, every default, every chroot footgun, all of it, no cap. this was HITCH(8), the high performance TLS proxy page from the manual's section 8. go forth and terminate some TLS responsibly, queen 👑💖🌸