example.toml

# PolyTLS example config (TOML).

[proxy]
# Frontend protocol: "explicit" (HTTP CONNECT) or "socks5".
mode = "explicit"
# mode = "socks5"

[proxy.listen]
address = "127.0.0.1:8080"
backlog = 1024

[proxy.mitm]
enabled = true

[proxy.upstream]
# Default upstream TLS profile name used when the client does not provide
# HTTP `X-PolyTLS-Upstream-Profile` or a SOCKS5 username profile.
default_profile = "chrome-143-macos-arm64"
# Optional: override the upstream target (currently unused).
# default_upstream = "example.com:443"
#
# Additional PEM trust bundle used for proxy→upstream TLS verification.
# ca_file = "./testdata/upstream-ca.pem"
#
# Lab-only: disable upstream certificate/hostname verification (like curl -k).
insecure_skip_verify = false

# Optional chained SOCKS5 proxy for PolyTLS outbound connections. When enabled,
# PolyTLS connects to this SOCKS5 proxy first, asks it to CONNECT to the original
# target host:port, then starts passthrough relay or upstream TLS over that tunnel.
# Config values can also be overridden through environment variables, for example:
# POLYTLS__PROXY__UPSTREAM__PROXY__ADDRESS=127.0.0.1:9050
#
# [proxy.upstream.proxy]
# protocol = "socks5"
# address = "127.0.0.1:9050"
# username = "optional-chain-user"
# password = "optional-chain-password"

[proxy.certificate]
ca_key_path = "./ca/private.key"
ca_cert_path = "./ca/certificate.pem"
cache_ttl = 3600

# Optional upstream TLS ClientHello profiles. In HTTP CONNECT mode, select one per
# request with `X-PolyTLS-Upstream-Profile: <profile-name>`. In SOCKS5 mode, put
# `<profile-name>` or `profile=<profile-name>` in the SOCKS5 username.
[profiles."chrome-143-macos-arm64"]
permute_extensions = true