Common questions about ProxyStack, configuration, SSL, Docker, and more.
ProxyStack is a Windows-first DevSecOps and Security Center for modern web apps: Apache/Nginx reverse proxy, Docker, PostgreSQL, SSL certificates, OWASP compliance, WAF, Zero Trust mTLS, Process Reputation with two sandbox detonation tiers (low-integrity process + VM isolation), geo-blocking, VPN mesh (Headscale/ProxyStackVPN + NetBird), a real plugin runtime with a hosted marketplace, REST API v2.0 (20 endpoints), and multi-server cluster management into a single portable ZIP. It provides a modern dark-themed GUI with 22 sidebar views for managing all aspects of your web infrastructure. No installation required — extract and run. A cross-platform CLI with the same core feature set is also available for Linux, macOS, and Windows Server Core, including cross-platform Cluster VPN mesh join as of v14.17.0.
The GUI runs on Windows 10 and Windows 11 (native Windows Forms, requires .NET 8 Runtime, included in the portable ZIP). A separate, cross-platform CLI with full feature parity runs on Linux, macOS, and Windows Server Core.
ProxyStack is available in two editions: Full (~138 MB, includes PostgreSQL) and Lite (~98 MB, without PostgreSQL). Contact IAMVC Holdings, LLC for licensing information.
No. ProxyStack is fully portable. Extract the ZIP to any folder and run ProxyStackGUI.exe. All configuration, certificates, logs, and data are stored within the ProxyStack folder. You can move it to a USB drive or another machine.
Full Edition includes everything: Apache, PostgreSQL, win-acme, OpenSSL, SentinelAI agent, templates, and documentation. Lite Edition is the same but without the bundled PostgreSQL binaries (you can still auto-download PostgreSQL from the GUI if needed).
Click "Check for Updates" on the Dashboard. If a new version is available, click "Download & Install". The updater automatically preserves your configuration, certificates, logs, backups, and other user data while updating binaries and system files.
ProxyStack generates Apache virtual host configurations from your proxystack.json settings. Each site can be a reverse proxy (forwarding to a backend like Node.js, Python, etc.), a static file server, or a hybrid of both. Apache handles TLS termination, WebSocket proxying, and HTTP/HTTPS routing.
Yes. Add multiple sites in the Sites tab, each with its own domain and proxy target. ProxyStack generates separate virtual hosts for each domain. You can also define per-path proxy routes within a single site (e.g., /api goes to one backend, /ws goes to another).
Yes. Enable the WebSocket option on any site or proxy route. ProxyStack configures Apache's mod_proxy_wstunnel with proper upgrade headers for WebSocket connections.
Yes. Set both a documentRoot and proxyRoutes on a site. Static files are served from the document root, while specific paths are proxied to backends. Enable spaFallback for single-page applications that need index.html served for all non-file routes.
Common causes: (1) Port 80 or 443 is already in use by another application — check with netstat -ano | findstr :80. (2) Configuration error — click "Validate" in the GUI. (3) Missing or invalid SSL certificate paths. Check the Dashboard console and logs/error.log for details.
Go to the Certs tab, click "Let's Encrypt", enter your domain and email. ProxyStack uses the bundled win-acme ACME client to request a certificate via HTTP-01 validation. Apache is automatically stopped during validation (to free port 80) and restarted after.
Yes. The Certs tab has a "Generate Self-Signed" option that uses the bundled OpenSSL to create a certificate and key pair. Self-signed certs are useful for local development but will show browser warnings.
ProxyStack automatically detects matching certificate files in the certs/ folder based on the domain name. If it finds files like yourdomain.com-crt.pem and yourdomain.com-key.pem, it fills in the paths automatically and saves them to your configuration.
Certificates are stored in the certs/ folder within your ProxyStack directory. Win-acme generates PEM files named {domain}-crt.pem, {domain}-key.pem, and {domain}-chain.pem.
Win-acme creates a scheduled task for automatic renewal. You can also manually renew from the Certs tab. ProxyStack monitors certificate expiry dates and shows warnings in the Dashboard when certificates are approaching expiration.
The Apps tab lets you define backend applications (Node.js, Python, Go, etc.) that ProxyStack manages. You specify the command, working directory, and port. ProxyStack can auto-start apps, auto-restart on crash, and manage sub-processes.
Sub-processes are additional commands that run alongside your main app. For example, you might run npx supabase start as a sub-process alongside npm run dev. Sub-processes start before the main command and stop together when the app is stopped. All commands auto-accept prompts.
Yes. Define as many apps as you need in the Apps tab. Each runs as a separate process with its own working directory and port. ProxyStack tracks all running processes and provides start/stop controls for each.
Yes — Secure Project Import. Drop a .zip/.7z archive onto the Dashboard or Apps view (or use Browse) and ProxyStack extracts it, detects the stack — Node.js, Bun, Python, Go, .NET, Java, Ruby, PHP, Rust, Deno, Docker Compose, or a raw Dockerfile — and for direct app stacks dry-runs it through the Process Reputation sandbox in two phases (install/build, then a stricter runtime smoke test) against a disposable copy before ever presenting the guessed command as trustworthy. Nothing is saved, started, or set to autostart without an explicit Save. Dockerfile and Docker Compose imports build/run through Docker's own isolation instead, and a detected frontend build (React/Vite/etc.) can deploy as a static Site instead of a long-running process. Every import's full evidence is logged to logs/deploy-imports.jsonl, whether or not you keep it.
No. Docker integration is optional. If Docker Desktop is installed and running, ProxyStack can manage containers, images, Compose projects, and networks through the Docker tab. Without Docker, all other features work normally.
Click "Start PostgreSQL" in the Docker tab. If PostgreSQL isn't installed, ProxyStack auto-downloads it (~300 MB) with a progress bar. PostgreSQL runs portably from the postgres/ folder — no system-wide installation needed. Data is stored in postgres/data/.
Yes. Go to the Advanced tab and open the Database Console. Enter your connection details (host, port, database, user) and execute SQL queries directly from the GUI. Results are displayed in a table format.
All configuration is stored in proxystack.json in the ProxyStack root folder. This file defines sites, apps, security settings, and SentinelAI configuration. You can edit it directly or use the GUI.
The auto-updater preserves: proxystack.json, proxystack.settings.json, certs/, logs/, backups/, profiles/, sites/, team.json, plugins.json, and postgres/data/. Only system binaries and templates are updated.
Click "Backup" on the Dashboard. ProxyStack creates a timestamped backup in the backups/ folder containing your configuration, settings, and team data. You can also manually copy proxystack.json.
Yes. Store profiles in the profiles/ folder (e.g., proxystack.development.json, proxystack.production.json). Switch between profiles from the Security tab's Environment dropdown.
ProxyStack includes: HSTS headers, X-Frame-Options, X-Content-Type-Options, XSS protection headers, IP whitelist/blacklist, REST API authentication, team-based access control (Admin, Developer, Operator, Viewer roles), DPAPI-encrypted secrets vault with 8 categories, OWASP Top 10 2025 compliance dashboard, Web Application Firewall with 14 built-in rules, security scanner (29 checks), compliance reporting for SOC2/GDPR/PCI-DSS/HIPAA (28 controls), Zero Trust mTLS with certificate auth policies and network segmentation, SentinelAI integration for endpoint security, and Security Center (Enterprise) - a unified view across WAF, SentinelAI, Cluster, Microsoft Defender, ClamAV, Headscale VPN, Process Reputation (real process monitoring, reputation lookup, and sandbox analysis for your managed apps), Local Network Exposure (unmanaged non-loopback listeners), and the AI Runtime Manager (misconfigured/unenforced local LLM deployments).
Yes. Enable it from the Security tab ("Enable REST API on port 9090"). 20 endpoints total, including: /api/status, /api/health, /api/config, /api/version, /api/sites, /api/apps, /api/apache/start, /api/apache/stop, /api/apache/restart, /api/monitoring/system, /api/monitoring/services, /api/plugins, /api/plugins/marketplace, /api/docker/status, /api/cluster/info, /api/cluster/nodes, /api/cluster/promote, /api/cluster/mesh/invite, /api/cluster/mesh/join, and /api/config/sync. See the REST API Reference for full details. API key authentication is required for all mutating (POST) endpoints.
ProxyStack includes a SentinelAI tab that connects to your SentinelAI dashboard for real-time security monitoring. You can view agents, threats, and security status directly from the ProxyStack GUI. The SentinelAI Windows agent can also be launched from ProxyStack.
ProxyStack can send alerts via Slack webhooks and email (SMTP) when services go down or health checks fail. Configure alert channels in the Security tab. Alerts have a 5-minute cooldown to prevent spam from flapping services.
Yes, two ways. Microsoft Defender integration (real, via Get-MpComputerStatus/Start-MpScan/etc.) reports Windows' own real-time protection status and lets you run scans, view threat history, and manage exclusions from the Security Center. Separately, the Full edition bundles a real ClamAV 1.5.3 scanner (downloaded from clamav.net and PGP-signature-verified against Cisco Talos before it ever shipped) for on-demand/scheduled deep scans with real quarantine, restore, and exclusions - ClamAV isn't real-time (it has no supported Windows on-access driver), so Defender still covers that. The Lite edition doesn't bundle ClamAV but can download and install it on demand from within the app, the same pattern used for PostgreSQL. A fresh ClamAV install shows "ActionNeeded - run an update" until its signature database downloads - this happens automatically about 30 seconds after each launch and every 24 hours after that, or you can trigger it immediately with the "Update Signatures Now" button in the ClamAV actions dialog (v14.13.1+).
Yes, two ways. Headscale is a self-hosted, Tailscale-compatible mesh VPN coordinator - opt-in (off by default - enable "VPN Mesh" in Settings), since starting it opens a new persistent network-facing service. Headscale publishes no official Windows binary, so the Full edition bundles one compiled from source (Linux uses the official release binary instead); the Lite edition can download and install it on demand. As of v14.15.0, the client every node runs is ProxyStackVPN - our own build (self-compiled from Tailscale's open-source daemon) with the Windows service and network adapter renamed to "ProxyStackVPN" instead of "Tailscale". Once enabled, the Cluster view can join a node to the mesh automatically when you add it - cross-platform as of v14.17.0 (Windows, and Linux/macOS via the CLI's proxystack serve) - this installs the client on that node if it isn't already present, the most invasive single action Cluster performs, so only use it against nodes you already trust with cluster access. Separately, NetBird is available as a second, independently-toggleable backend ("Enable NetBird VPN Mesh" in Settings) - this one is client-only: you run your own NetBird management server (self-hosted or NetBird Cloud) and give ProxyStack its URL and an API token, the same relationship ProxyStack already has with Docker. We don't bundle NetBird's server since its Management/Signal components are AGPL-3.0 licensed.
Process Reputation (part of Security Center, Enterprise tier) monitors processes launched by your ProxyStack-managed apps, hashes and scores them, checks their reputation (local allowlist/blocklist plus VirusTotal), and can run a flagged process through an isolated sandbox for behavioral analysis - all in real time, locally, no cloud upload unless you explicitly approve one. To try it: start an app from the Apps view, open Security Center → the Process Reputation card, select the process in the list, and click "Detonate in Sandbox...". It is not a general "check any file" scanner - it only monitors processes ProxyStack itself launched.
No - it runs the sample on the same machine in a restricted temp directory with a best-effort network block for about 15 seconds, watching for child processes, file writes, registry changes, and network connections. This is real containment of a specific kind, not full OS/VM-level isolation. Windows Sandbox and Hyper-V specifically require Windows Pro/Enterprise/Education and aren't available on Home edition (the underlying virtualization technology is present on Home - it powers WSL2 - but Microsoft's own VM tooling isn't). Never point the sandbox at a file you already strongly suspect is genuinely malicious.
No, not by default - ProxyStack runs fine unelevated for normal use. A few specific security actions do require it, because Windows itself enforces the restriction: Microsoft Defender's quarantine listing, Process Reputation's real-time block-and-prevent-relaunch watcher, and its network isolation (firewall rule) action. Without elevation, each of these reports a clear message explaining that Administrator is required, instead of silently failing or falsely claiming success. Right-click ProxyStackGUI.exe and choose "Run as administrator" if you need these specific actions at full strength.
Yes, as of v14.19.0. The AI Runtime Manager scans your real hardware, recommends models from a curated 11-model catalog that will actually run well on it, detects or installs llama.cpp/Ollama, downloads a hash-verified model, and starts a real local OpenAI-compatible endpoint you manage like any other deployment - Start/Stop/Restart, health checks, logs, and a per-deployment API key. It's in the GUI's "AI Runtime" view and the CLI's proxystack ai ... commands, on both Windows and Linux.
No, not yet - the model catalog is a small, hand-curated list of 11 models with real, verified SHA256 hashes, licenses, and hardware requirements, deliberately not open Hugging Face browsing. Downloading an arbitrary, unvetted model file is a real trust question that's intentionally out of scope for this version.
No, not unless you explicitly enable it. Every deployment binds to localhost only by default, with a required API key. An explicit, off-by-default "Allow remote access" option (GUI checkbox or CLI --allow-remote flag) binds to all network interfaces instead, for when you deliberately want another device to reach it - and Security Center separately watches for this, flagging both the configuration and, more strongly, whether a deployment is actually reachable on the network right now.
It sends a real test request to the running server with no Authorization header and checks whether it's rejected. Just confirming a key exists in the Secrets Vault wouldn't be enough - a real bug in an earlier build had the key generated, stored, and shown in the UI, but never actually enforced by the server itself because of a mismatched environment variable name. This check is designed specifically to catch that class of bug again if it ever recurs.
The Compliance sidebar view runs 10 automated checks against the OWASP Top 10 2025 standard. It evaluates your live configuration for broken access control, cryptographic failures, injection vulnerabilities, insecure design, security misconfiguration, vulnerable components, authentication failures, data integrity, logging failures, and SSRF. Each category shows Pass/Fail with a color-coded card, and an overall security score (0–100) is calculated. Export results as CSV or TXT.
The WAF sidebar view lets you define and manage 14 built-in rules (plus your own custom regex rules) covering SQL injection, XSS, path traversal, command injection, SSRF, file inclusion, XXE, header/log injection, disallowed HTTP methods, and more. Rules set to Block are compiled into real inline firewall rules and actually reject matching requests with a 403 before they reach your site - not just logged after the fact - on both Nginx and Apache. A rule only falls back to detection-only if its specific pattern can't be safely compiled into that engine's config (for example a custom regex Nginx would misread as a variable reference, or one that mixes whitespace with a literal quote in a way Apache's RewriteCond can't escape), which the WAF view's "Enforcement" column always shows honestly per rule. You can also export the ruleset as a ModSecurity .conf file for a server that has the ModSecurity module installed separately.
Quick Scan runs 11 essential checks: TLS configuration, security headers, directory permissions, secrets exposure, and more. Full Scan adds 7 more checks covering network ports, container security, database security, and advanced configuration. Each finding is classified by severity (Critical, High, Medium, Low) and includes remediation guidance. Results are saved to logs/security-scan.json.
Currently, scans are triggered manually from the GUI. You can use the REST API endpoint or a Windows Scheduled Task to automate scans if needed.
The Secrets Vault uses Windows DPAPI (Data Protection API) with the CurrentUser scope. Secrets are encrypted with your Windows user credentials and can only be decrypted by the same user on the same machine. No master password is needed. The vault supports 8 categories (General, Database, API Key, OAuth, SSL/TLS, Cloud, Service, Internal), auto-hides revealed values after 5 seconds, and auto-clears the clipboard after 30 seconds.
Yes. Click "Export .env" to generate a standard .env file with all your secrets in KEY=value format. You can also use the "Rotate" button to generate a new 32-character cryptographically random value for any secret.
The Reports sidebar view supports 4 frameworks: SOC2 Type II (9 controls), GDPR (6 articles), PCI-DSS v4.0 (8 requirements), and HIPAA (5 safeguards). Select "All Frameworks" to run all 28 checks at once. Each check evaluates your real configuration and provides evidence text. Export reports as CSV or formatted TXT for auditors.
The reports provide evidence-based results showing what was checked, the pass/fail status, and the evidence found. While they serve as a strong starting point for compliance documentation, a formal audit may require additional evidence and attestation from a qualified auditor.
The Zero Trust sidebar view implements mutual TLS (mTLS), where both the server and client present certificates to authenticate each other. This goes beyond standard TLS where only the server is authenticated. ProxyStack can generate a CA certificate (RSA 4096-bit, 10yr) and server certificates (RSA 2048-bit, 2yr) with automatic Subject Alternative Names from your configured domains.
You can define rules that match specific certificate attributes: Common Name (CN), Organizational Unit (OU), Issuer, SHA256 Fingerprint, or Subject Alternative Name (SAN). Only clients whose certificates match at least one policy are granted access. This allows fine-grained access control based on certificate identity.
Network segmentation zones define IP-based access control rules. Each zone specifies a name, CIDR range (e.g., 192.168.1.0/24), allowed ports, and traffic direction (inbound, outbound, or both). These are exported as Apache <Location> blocks with Require ip directives.
The Trust Score (0–100) is a dynamic metric that reflects how well your Zero Trust configuration is set up. Points are awarded for: mTLS enabled (+30), CA cert configured (+15), server cert configured (+15), client verification set to "require" (+15), auth policies defined (+15), and segmentation zones defined (+10).
ProxyStack has a Plugin Marketplace in the Advanced tab. Plugins extend functionality with features like authentication middleware, caching layers, rate limiting, and more. Install, configure, and manage plugins from the GUI.
Yes. The Advanced tab includes API versioning (/v1, /v2), path prefix routing, per-version rate limiting, request/response header rewriting, and URL rewriting rules.
The Observability tab shows request rate and error rate parsed from your live Nginx access logs, plus a recent request log. Latency percentiles (P50/P95/P99) are shown when available, but honestly report "n/a" rather than a fabricated number when the access log has no per-request timing data to compute them from. See the Proof Status page for the full picture.
Yes. The Team tab supports multiple users with role-based access control: Admin (full access), Developer (manage sites/apps), Operator (start/stop services), and Viewer (read-only). All actions are logged in an audit trail.