$ show fatedier/frp
frp is a high-performance reverse proxy application that exposes local services behind NAT or firewalls to the internet. It implements a client-server architecture where the frpc client connects to the frps server, registers proxies (TCP, UDP, HTTP, HTTPS, STCP, XTCP, TCPMUX), and tunnels traffic through encrypted, compressed connections. The system supports multiple transport protocols (TCP, KCP, QUIC, WebSocket, WSS), authentication (token, OIDC), health checks, load balancing, bandwidth limiting, and a plugin system for both client and server extensions. It also includes NAT hole punching for direct peer-to-peer connections and an SSH tunnel gateway that allows SSH clients to create tunnels without frpc. The codebase is well-structured with clear separation of concerns: configuration loading and validation in pkg/config/, wire protocol and message handling in pkg/msg/ and pkg/proto/, network utilities in pkg/util/net/, and proxy implementations in server/proxy/ and client/proxy/. The project includes comprehensive end-to-end tests, a Vue.js web dashboard for both server and client management, Prometheus metrics, and a store API for dynamic proxy configuration at runtime. The architecture is modular, using factory patterns for proxy types, visitor patterns for P2P connections, and an aggregator pattern for merging configuration sources. Despite its complexity, the codebase is actively maintained with regular releases, extensive documentation, and a large community. It demonstrates strong engineering practices including interface-based design, dependency injection for testability, and careful concurrency management. The main technical debt is the coexistence of legacy INI configuration and v1 wire protocol alongside newer formats, but these are well-isolated and migration paths are provided.
The LLM identified 4 files worth highlighting for reuse:
Implements a length-prefixed frame protocol with type/flag header, supporting AEAD crypto negotiation, transcript hashing, and message-level encryption. The design is clean and self-contained: it defines FrameHeader, Frame, and a ReadWriter interface that can wrap any io.ReadWriter. The crypto negotiation uses a client-server handshake with HKDF key derivation, making it reusable for any application requiring secure, framed communication over a stream transport.
Provides a modular NAT hole punching pipeline with Prepare, ExchangeInfo, and MakeHole stages. It includes NAT type classification (EasyNAT/HardNAT), port change behavior analysis, and an adaptive scoring system that learns successful strategies per client-visitor pair. The implementation is protocol-agnostic and can be extracted for any P2P networking project requiring UDP hole punching with fallback modes.
Implements a persistent, mutex-protected configuration store with atomic file writes and rollback on failure. Supports CRUD operations for proxies and visitors, with a merge strategy that combines static file config with dynamic store entries. The store uses JSON serialization, provides a watcher for reloads, and is designed to be embedded in any Go application needing runtime configuration persistence with consistency guarantees.
Provides a collection of connection wrappers including ContextConn (with context cancellation), StatsConn (traffic counting), WrapReadWriteCloserConn (converts io.ReadWriteCloser to net.Conn), and AEAD crypto read/writers with HKDF key derivation. These are self-contained utilities that can be reused in any Go network application to add encryption, statistics, or context-aware connection handling without modifying the underlying transport.