px-go

Go port of px: a local HTTP proxy that authenticates to upstream NTLM/Negotiate/Kerberos proxies, supports CONNECT tunneling, PAC files, allow/noproxy rules, client auth, /PxQuit, and health checks.

• HTTP proxy with direct and upstream-proxy forwarding
• CONNECT tunneling for HTTPS
• Upstream auth: BASIC, DIGEST, NTLM, NEGOTIATE
• Client auth: BASIC, DIGEST, NTLM, NEGOTIATE (SSPI on Windows)
• PAC execution, INI + .env + PX_* env + CLI config
• Allow-list and noproxy matching (IPs, CIDRs, wildcards, domains)
• Single static binary (~15 MB), Docker images via Goreleaser

go run ./cmd/px --server=upstream.proxy:8080 --port=3128 --auth=NONE
curl --proxy http://127.0.0.1:3128 http://example.com

Upstream requires NTLM/Negotiate/passwords? See Authentication.

Config precedence: defaults → px.ini → .env / PX_* → CLI flags. See px.ini.

--config=path/to/px.ini   --server=proxy:8080   --pac=http://wpad/proxy.pac
--listen=127.0.0.1       --port=3128           --gateway / --hostonly
--username=DOMAIN\\user  --auth=NTLM|NEGOTiate|...
--client-auth=BASIC      --noproxy=localhost,10.0.0.0/8
--log=4                  --log-file=/var/log/px-go/px-go.log
--health-check           --test=http://httpbin.org/get

Environment variables use PX_* (e.g. PX_SERVER, PX_PASSWORD, PX_LOG_FILE, PX_CLIENT_AUTH).

make tidy fmt test build          # or: go build ./cmd/px
go test ./...
go test -v ./internal/proxy/ -run TestIntegration

Windows builds: px-go.exe / pxw-go.exe (releases) or px.exe / pxw.exe (local) — see Windows deployment.

docker build -f docker/Dockerfile -t px-go .
docker run --rm -p 3128:3128 px-go \
  --server=corp-proxy:8080 --auth=NONE --gateway --foreground --log=4 \
  --allow='10.0.0.0/8,172.16.0.0/12,192.168.0.0/16' \
  --noproxy='localhost,127.0.0.1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16'

Image: ghcr.io/blackdark/px-go:latest. See Docker & Kubernetes and network defaults.

Contributor notes: AGENTS.md.

• /health returns 200 OK; /PxQuit shuts down gracefully (local callers).
• PAC files reload on proxyreload interval.
• Windows SSPI is build-tagged without CGO.