proxy-shield

Source code on GitHub.

README

Proxy Shield 🛡️

A High-Performance, Asynchronous AI Compliance Proxy.

Proxy Shield allows you to inspect network traffic for compliance violations (e.g., sensitive data leaks) using an AI/Embedding model without slowing down the user.

It uses a "Traffic Mirroring" architecture: traffic is instantly forwarded to a configured destination (zero latency), while a copy is sent asynchronously to an AI analyzer. If a violation is detected, the AI updates a shared Redis state to ban the offender's IP address temporarily.

🚀 Architecture

[ Client ] ---> [ OpenResty (Nginx) ] --------------------> [ Configured Target ] | +---> (Mirror Copy) ---> [ AI Service ] | <--- (Ban Command) -----------+ (via Redis)

• The Check: Nginx checks Redis. If IP is banned, return 403 Forbidden.
• The Forward: If clean, Nginx forwards the packet to the configured target instantly.
• The Mirror: Nginx sends a background copy to the Python AI Service.
• The Verdict: Python analyzes the text. If "secret" is found:
* Strike System: 3 strikes in 30 seconds = BAN. * Ban: The IP is added to Redis with a TTL (Time To Live).

🎯 Target Configuration

The proxy is configured at startup with a specific destination. All traffic will be forwarded to this target regardless of the original request's destination.

Set the TARGET_HOST environment variable in your .env file:

``bash

Example: Forward all traffic to an internal API server

TARGET_HOST=api.internal.example.com:443

Example: Forward to a local development server

TARGET_HOST=localhost:3000 `

🛠️ Tech Stack

* Proxy: OpenResty (Nginx + LuaJIT) * State/Cache: Redis (Alpine) * AI Service: Python (FastAPI + Uvicorn) * Orchestration: Docker Compose

⚡ Quick Start

Prerequisites

* Docker & Docker Compose

Configuration

• Copy .env.example to .env:
`bash cp .env.example .env `
• Edit .env and set your target host:
`bash TARGET_HOST=your-target-server:port `

Run the Stack

``bash docker-compose up --build