Simple Proxy Manager

Simple HTTPS/HTTP reverse proxy manager for ioBroker.

Features

• HTTPS + HTTP in parallel – both servers always run
• Per-host protocol – backend with certificate = HTTPS, without = HTTP
• Certificate per virtual host – ACME (Let's Encrypt), self-signed or manual collections
• Configurable backends via the admin interface
• IP filtering for internal services (CIDR-based, IPv4 + IPv6, multiple networks)
• HTTP → HTTPS redirect with ACME challenge forwarding
• Automatic SSL certificate reload on ACME renewal
• Certificate expiry warning in the log
• HSTS (Strict-Transport-Security)
• WebSocket support (e.g. for ioBroker Admin)
• Dual-stack IPv4 + IPv6
• Change Origin option

Prerequisites

• Node.js >= 22
• ioBroker with js-controller >= 6.0.11
• ACME adapter for automatic SSL certificates (optional – also usable without certificates)
• The configured ports must be available (defaults: 80 for HTTP, 443 for HTTPS)

Configuration

Tab "General"

Tab "Backends"

Each backend defines a virtual host:

Example Configuration

In this example:

• website.example.com → HTTPS with Let's Encrypt certificate, HTTP redirects to HTTPS
• iobroker.example.com → HTTPS with ioBroker default certificate (default), local network only
• host.example.com → HTTP (no certificate), local network only

States

Certificate states are created dynamically for each used certificate collection (e.g. certificates.acme.daysLeft, certificates.default.expires).

ACME Adapter Configuration

The ACME adapter must run on a port other than 80, if the proxy runs on the default port 80. ACME challenges are automatically forwarded by the proxy to the configured ACME port.

1. Set the ACME adapter port to 8080 (or any desired port)
2. Set the same value as the ACME adapter port in the proxy manager
3. Enter all desired domains in the ACME adapter

Certificates

The adapter reads certificates from system.certificates and offers three types:

1. Individual Certificates by Naming Convention

These are certificates that the user can add manually through the ioBroker system settings. All key/certificate pairs stored in system.certificates → native.certificates can be used, provided they follow this naming convention:

The base name {name} is what appears in the dropdown and is stored in the config.

Example: If ioBroker has stored the keys myCertPrivate and myCertChained, myCert will appear in the dropdown.

The ioBroker Default Certificate

The self-signed certificate shipped with ioBroker is stored under the names defaultPrivate and defaultPublic in system.certificates. It follows the same convention as any other certificate:

• Base name: default
• Appears in the dropdown as default
• Ideal for internal services that do not require a publicly signed certificate

2. ACME Collections

Let's Encrypt certificates automatically generated by the ACME adapter. They are stored in system.certificates → native.collections under the name assigned to the collection in the ACME adapter configuration. ACME challenges on port 80 are automatically forwarded by the proxy to the configured ACME port.

Per-Host Protocol

The adapter decides per backend whether HTTPS or HTTP is used:

Both servers run in parallel. Each backend can have its own certificate source. SNI (Server Name Indication) automatically selects the correct certificate for the requested hostname during the TLS handshake.

Hosts with an unknown hostname are rejected at the TLS level – no fallback certificate is used.

Certificate loading details are available in the debug log.

Changelog

1.0.0 (2026-07-07)

• (copilot) Adapter requires node.js >= 22 now

0.1.10 (2026-04-29)

• Harden error handling: certificate loading, renewal, cleanup and adapter teardown are now individually guarded so a single failure no longer aborts the entire operation
• Fix: register server error/close handlers before calling listen() (correct Node.js pattern)
• Code quality: remove inconsistent typeof this.terminate guards, rename misleading certHashes to certPemCache, fix template literal formatting

0.1.9 (2026-04-06)

• Optimize logging behavior: request logs now use debug level, transient backend restart errors are logged as debug with details, and startup logs are less noisy ...
• Harden certificate handling: hosts with configured but unavailable certificates now fail closed for HTTPS/WSS instead of falling back silently
• Improve info.connection state handling: state is now true only when both HTTP and HTTPS listeners are active

0.1.8 (2026-03-26)

• Update GitHub Actions test matrix (Node.js 20, 22, 24)
• Address reviewer suggestions (use node: prefix, specific state roles, interval limiting)
• Fix linting errors

0.1.7 (2026-03-20)

• Docs: remove generic installation section per S6014

License

MIT License

Copyright (c) 2026 lubepi

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.