$ show ironsh/iron-proxy
Iron Proxy is a programmable egress proxy designed for securing and monitoring outbound traffic from untrusted workloads. It functions as a Man-in-the-Middle (MITM) proxy with built-in DNS interception, capable of inspecting and transforming HTTP/HTTPS, TCP tunnels, and PostgreSQL traffic. The system features a pluggable transform pipeline for access control, secret injection, authentication (AWS/GCP/OAuth), LLM-based policy enforcement, and Model Context Protocol (MCP) filtering. Architecture includes modular components for proxy handling, DNS server, transform pipeline, configuration management, and optional control plane synchronization. Deployment options range from standalone mode to managed mode via control plane, with support for Docker, Helm, and nftables enforcement. Key capabilities include structured JSON audit logging, OpenTelemetry integration, TLS MITM with dynamic certificate generation, and secret resolution from multiple backends (environment, AWS, 1Password).
The LLM identified 5 files worth highlighting for reuse:
Implements a thread-safe holder pattern for atomic configuration swapping used across transforms, MCP policies, and gateways. Enables hot-reloading of pipeline configurations without blocking in-flight requests through read-write mutex locking. Demonstrates advanced concurrent programming skills with minimal blocking and safe publication.
Provides a pluggable secret source abstraction with implementations for environment variables, files, AWS Secrets Manager/SSM, 1Password, and control plane. Features TTL-based caching with lazy initialization, failure handling, and context-aware resolution. The interface-based design allows easy extension to new secret backends while maintaining consistent caching behavior.
Implements flexible host and path matching logic supporting exact domains, wildcards (*.example.com), CIDR blocks, and rule-based matching with method/path constraints. Used by the allowlist transform but decoupled for independent reuse. Demonstrates skill in efficient rule compilation and matching algorithms with clear separation of concerns.
Implements an LRU cache for dynamically generated MITM TLS certificates with automatic eviction of least recently used entries. Combines certificate generation with caching to avoid expensive regenerations for repeated domains. Shows careful resource management and performance optimization for security-sensitive operations.
Implements a circuit breaker pattern with half-open probing and semaphore-based concurrency limiting for LLM-based judge transforms. Prevents cascading failures during LLM service outages while limiting concurrent requests to avoid resource exhaustion. Demonstrates production-grade resilience engineering for external API dependencies.