netgoat: Self-Host a Reverse Proxy and Traffic Policy Agent

Overview

NetGoat is a self-hosted reverse proxy and traffic-policy agent written in Go. It routes requests to configured upstreams and applies controls such as authentication, caching, rate limiting, and request rules, helping homelab and infrastructure operators manage traffic without relying solely on a hosted proxy service.

It can run from local YAML routes or use snapshots from its optional control plane. When that plane is unavailable, the agent can continue with local routes and its last valid recovery snapshot. The project is active alpha software, so it is best suited to users prepared to configure and review an evolving system.

Key Features

• Domain, wildcard, regex, and path-prefix routing to upstream services.
• Load balancing, health checks, and safe-method retry and failover.
• WAF rules, rate limiting, request queueing, bandwidth controls, and honeypot handling.
• Local cookie or Basic authentication, with explicit bootstrap credentials.
• Shared response caching and per-route cache or bandwidth policies.
• TLS termination, with optional ACME certificate issuance and renewal.
• Optional Cloudflare Access verification and DNS or tunnel reconciliation.
• Metrics endpoints and recovery snapshots for operational visibility and resilience.

Use Cases

• Homelab operators can route local services through one configurable entry point, with authentication and traffic controls where needed.
• Small infrastructure teams can manage upstream routing, health checks, and failover on a self-hosted agent.
• Operators using Cloudflare can add optional Access or DNS integrations, or use NetGoat alongside Cloudflare for selected traffic policies.
• Developers can test proxy configuration locally before deploying, using YAML routes and reachable HTTP upstreams.

Getting Started

Requires Go 1.25 or newer and at least one reachable HTTP upstream. Clone the repository, configure routes in config.yml, then run:

go test ./...
go run .

See the README for route configuration, authentication setup, deployment guidance, and operational details.

Alternatives

• NPMplus: NPMplus manages Nginx proxy hosts through a web interface, while NetGoat is a Go-based proxy with built-in caching, rate limits, and security controls.

Considerations

• NetGoat is active alpha software, and its configuration and behavior may evolve.
• A fresh configuration has no routes, so requests return 404 until routes are added. A missing config.yml is fatal.
• Public plaintext HTTP is refused by default. Use TLS for public traffic, and take care when routing to loopback or private-network services.
• Fingerprinting and session-bound proof-of-work depend on NetGoat terminating TLS. They are unavailable with plaintext traffic, TLS pass-through, or another TLS terminator in front; HTTP/3 and QUIC are not covered by fingerprint v1.
• Optional AI classifiers require model files and Python dependencies. Cloudflare reconciliation requires an API token and defaults to dry-run.
• The AGPL-3.0 license should be reviewed for deployments that modify or offer the software as a network service.

Repository: netgoat-xyz/netgoat · Project site