Tinyproxy - Hardened HTTP Forward Proxy for VPC Egress

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Why This Image Instead of a Self-Managed Forward Proxy

Egress control is a control every security review asks for and almost nobody wants to build. The usual outcome is either a NAT Gateway that lets every private instance reach anything on the internet, or a hand-rolled proxy that quietly ends up reachable by the whole world because one ACL line was wrong. Installing a forward proxy from packages gives you a daemon that, out of the box, will happily relay for anyone who can reach the port. This image removes that risk: it launches an outbound web proxy that is closed by default, requires credentials unique to that one instance, and proves both properties on demand with a single command.

## Who This Is For

Platform, security, and network teams running private subnets on AWS who need a single, auditable outbound hop for HTTP and HTTPS traffic. If you have instances that must fetch packages, call a partner API, or reach an update service - but should not have a general route to the internet - this is the piece that sits between them and the outside world.

## How It Works

Tinyproxy is a small, fast HTTP and HTTPS forward proxy daemon. Clients on your network send their requests to it, it makes the request on their behalf, and it returns the response. It is a single lightweight service with a plain text configuration file and a very small memory footprint, so it runs comfortably on modest instance sizes. Because every outbound request passes through one place, you get one log and one place to apply policy.

## Closed by Default - Three Independent Locks

First, a source address allow list. The shipped configuration permits loopback and the private RFC1918 and RFC4193 ranges only. Because at least one allow rule is present, the daemon denies every source that does not match, including the entire public internet, before it even looks at credentials.

Second, mandatory proxy authentication. On first boot the instance generates a proxy password unique to itself and injects it into the configuration. Every client must present that username and password; a request without valid credentials is refused. No password is baked into the image, so no two instances ever share one.

Third, security group posture. The recommended security group opens SSH only. You open the proxy port yourself, scoped to your own VPC or subnet CIDR, so the port is never exposed to the internet by an accidental default.

Tunnelled connections are additionally restricted to the standard TLS ports, and the proxy identification header is disabled.

## Prove It Yourself

The image ships a single command that demonstrates the whole posture on the running instance: an allowed client with correct credentials succeeds, the same client with no credentials is refused, the same client with wrong credentials is refused, and a client from a source outside the allow list is refused before authentication is even considered. The same proof runs automatically on first boot, so an instance that cannot demonstrate it never reports itself ready.

## Example Deployment Scenario

A platform team runs application instances in private subnets with no internet route. They launch this image into a small public subnet, open the proxy port to their VPC CIDR only, and set the standard proxy environment variables on their application instances. Package updates and partner API calls now leave through one instance with one log, and the private subnets keep their default deny egress posture.

## Application Architecture

• Tinyproxy running as a hardened systemd service under its own unprivileged account
• A single plain text configuration file, easy to review and keep in version control
• A first-boot service that mints this instance's proxy credential and verifies the posture
• A root-only credentials file holding the username, password, and proxy endpoint
• Linux hosts, fully patched at build time, with unattended security upgrades enabled

## Getting Started

1. Launch the image into a subnet that has outbound internet access.

2. Add an inbound rule for the proxy port scoped to your own VPC or subnet CIDR.

3. SSH in and read this instance's proxy credentials from the root-only credentials file.

4. Point a client at the proxy using the standard proxy environment variables.

5. Run the bundled proof command whenever you want to re-confirm the posture.

A 7-day free trial is enabled on this listing, so you can evaluate the whole image before any charges apply.

## Built and Verified by cloudimg

Every cloudimg image is built from the official distribution packages, fully patched, and verified working end to end before publication. Backed by 24/7 cloudimg support via email and live chat. cloudimg is not affiliated with or endorsed by the Tinyproxy project; Tinyproxy is free software licensed under the GNU General Public License version 2.