5 Copyright @copyright{} 2021-2024 @email{stargrave@@stargrave.org, Sergey Matveev}
11 @command{tofuproxy} is
12 @url{https://www.gnu.org/philosophy/free-sw.html, free software}
13 flexible HTTP/HTTPS proxy server, TLS terminator, X.509 TOFU manager,
14 @url{https://en.wikipedia.org/wiki/Web_ARChive, WARC} and
15 @url{https://en.wikipedia.org/wiki/Gemini_(protocol), geminispace}
16 browser, written on @url{https://go.dev/, Go} with following
22 Full TLS connection termination between Web-servers and
23 @command{tofuproxy} itself. TLS 1.3, session resumption, GOST
24 cryptography (if built with @url{http://www.gostls13.cypherpunks.ru/,
25 gostls13}) support. Connection between @command{tofuproxy} and browser
26 itself uses ephemeral on-the-fly generated certificates with proper
30 @url{https://http2.github.io/, HTTP/2} (if negotiated with ALPN) and
31 HTTP keep-alives are supported.
34 Default Go's @code{crypto/x509} checks are applied to all certificates.
35 If they pass, then certificate chain is saved on the disk (TOFU,
36 trust-on-first-use). Future connections are compared against it, warning
37 you about SPKI change (SPKI pinning) and waiting for your decision
38 either to accept new chain (possibly once per session), or reject it.
39 Even if native Go's checks are failed (for example domain still does not
40 use @code{SubjectAltName} extension), you can still make a decision to
41 forcefully trust the domain.
44 CAs can have restrictions on what domains they are allowed to be served.
47 Optional @url{https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities, DANE-EE} check.
50 TLS client certificates are supported too.
53 HTTP-based authorization requests are intercepted and user/password
54 input dialogue is shown. It automatically loads initial form values from
58 Permanent HTTP redirects are replaces with non-refreshing HTML page with
59 the link, to make you explicitly allow that step. Temporary redirects
60 are followed if it is neither @url{https://newsboat.org/, Newsboat}
61 nor @url{https://www.feeder.stargrave.org/, go.stargrave.org/feeder}
62 user-agent, not image paths.
65 JPEG XL, AVIF and WebP images are transparently transcoded to PNG,
66 giving it back to the browser, not requiring it to support modern
67 effective image formats.
70 Ability to load, index and browse WARC web archives, that are possibly
71 multi-segment/frame compressed with @command{gzip}/@command{zstd}.
74 Ability to browse geminispace, transparently converting gemfiles to
75 HTMLs with URL rewriting.
79 And additional personal preferences:
84 Various spying domains (advertisement, tracking counters) are denied.
87 @code{www.reddit.com} is redirected to @code{old.reddit.com} (because it
88 works without JavaScript and looks nicer).
91 @url{https://habr.com/ru/all/, Хабр}'s resolution reduced images are
92 redirected to their full size variants.
95 Web fonts downloads are forbidden.
102 @include install.texi
106 @include tlsauth.texi
107 @include restricted.texi
108 @include httpauth.texi