About this project

This reverse proxy enables webhook senders to reach specific paths of a Cloudflare Access protected service. It forwards requests only when the path matches a configured regex pattern and the HTTP method is allowed (GET, POST, PUT, PATCH, DELETE), injecting CF-Access-Client-Id and CF-Access-Client-Secret headers. Non-matching requests receive 404 without contacting the target. Service token credentials remain within the proxy, never exposed to the sender. Configuration uses multiple layers (TOML, environment variables, secrets directory) with strict validation: duplicate secrets from different layers cause boot failure. Supports runtime configuration reload for most settings by watching config/secrets directories. Logs every request for auditing and provides /health endpoint for liveness checks. Distributed as a minimal Docker container (scratch-based) for security.