tinyproxy Egress Proxy For The Domains You List, And Nothing Else
tinyproxy from EPEL as a small egress proxy: only the domains you list, each matched anchored so a look-alike host is refused, HTTPS to port 443 only, a password per user, and no Via header naming the host. The live test runs dnf through it and is refused a look-alike, another domain and no credentials. Original role, live-tested on Rocky Linux 10.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-10-08 · podman 4.9.3 · ansible 2.21.4 · how we verify
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/ansible-tinyproxy?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Ansible role 1.0.0, live-tested on IaC Bazaar: [tinyproxy Egress Proxy For The Domains You List, And Nothing Else](https://www.iac-bazaar.com/catalog/ansible-tinyproxy?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```yaml
# tinyproxy Egress Proxy For The Domains You List, And Nothing Else: https://www.iac-bazaar.com/catalog/ansible-tinyproxy (download from your IaC Bazaar account)
```Preview:
Documentation
tinyproxy
tinyproxy from EPEL as a small egress proxy: only the destination domains
you list (each matched anchored, so a look-alike host is refused), HTTPS only to
the ports you list, a user and a password made for each client, no Via header
naming the host, and every file checked by starting tinyproxy with it before it
lands. Original role for EL 10, live-tested with podman on Rocky Linux 10.
No download, and no version to pin. EL 10 packages tinyproxy in EPEL, so the
role installs it by name and takes what the distribution ships: a security
update arrives through dnf, not through a new release of this role. What the
role owns is the configuration and the proof that the service works.
The distribution's unit, our configuration. The role installs tinyproxy
from EPEL, writes /etc/tinyproxy/tinyproxy.conf and the destination filter
/etc/tinyproxy/iacbazaar-filter (both root:tinyproxy 0640: the configuration
holds the passwords) and enables the package's tinyproxy.service. The listener
is 127.0.0.1:8888 by default; to serve other hosts set
tinyproxy_listen_address and add their network to tinyproxy_allow. The live
test reads the listening sockets and expects loopback only.
The package proxies anything for anyone it allows, and names itself. The
stock file listens on every address, sends any destination on, and adds Via: 1.1 tinyproxy (tinyproxy/1.11.2) to every response; a file without
ViaProxyName names the host itself there (measured). The role sends only the
domains in tinyproxy_allowed_domains, requires a user and password, allows
CONNECT to 443 only, and adds no Via header.
A filter that is not anchored lets a look-alike through. tinyproxy searches
the pattern anywhere in the host name: with dl\.rockylinux\.org in the filter,
dl.rockylinux.org.evil.test was passed on (measured). The role writes each
domain as ^(.+\.)?<domain>$ with FilterType ere - in tinyproxy's default
basic syntax the same pattern matches nothing, because (, + and ? are
literal there (measured) - so the domain and the names under it pass, and the
look-alike, xdl.rockylinux.org and everything else get 403.
dnf needs a baseurl. An allow-list of the distribution's own domains does
not carry dnf's mirror list, which sends it to mirrors on other domains (refused,
and makecache failed); with a baseurl on dl.rockylinux.org dnf works
through the proxy - the live test runs exactly that.
Basic auth in clear. Clients authenticate with HTTP Basic: 407 with no credentials, 401 with a wrong password. Between a client and the proxy the password is not encrypted, so keep the listener on loopback or on a network you trust.
A checker, because tinyproxy has none. tinyproxy accepts an Allow line it
cannot use without a word (999.1.1.1, or a name), and a bad regular expression
in the filter file stops the service at its next start (measured). The role
refuses any Allow, Deny or Listen value that is not an address or a
network, and starts each candidate - the configuration, and the filter under
the live configuration - on a spare port for two seconds before it lands.
License
Commercial - IaC Bazaar EULA. (c) IaC Bazaar.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Variables
- Test
Related modules
ansible-squid
The stock squid.conf allows localhost before it denies loopback destinations, so a local client can proxy into loopback services. This role puts every deny first and binds loopback. The live test fetches a page through it, then sees squid itself refuse loopback, 169.254.169.254, an unsafe port, CONNECT to 25 and a non-loopback client. Original role, live-tested on Rocky Linux 10.
ansible-consul-server
HashiCorp Consul as a single-node server from the upstream release (sha256-verified), as a hardened system service with HTTP, DNS, RPC and both serf listeners on loopback and its configuration checked by consul validate before it lands. The live test waits for a leader, writes a KV key through the API, reads it back and reads the member alive. Original role, live-tested on Rocky Linux 10.
ansible-dante
Dante SOCKS5 server from EPEL for the accounts the role makes, and only those: each expired for every other service, since its password otherwise opened SSH tunnels, and private, link-local and loopback ranges out of reach by address or by name. The live test is refused by each range, another account and SSH. Original role, live-tested on Rocky Linux 10.
ansible-frr
FRR from AppStream: BGP that announces only your prefixes, accepts from each neighbour only what you list for it, signs sessions with TCP MD5, and applies a change without dropping them. The live test peers with a real BGP speaker in its own namespace; a filtered prefix stays out of the kernel and a wrong password keeps the session down. Original role, live-tested on Rocky Linux 10.
ansible-headscale
Headscale, the self-hosted Tailscale control server, from the upstream release binary (sha256-verified) as a hardened system service on loopback with sqlite; configtest runs as the service user (it opens the database). The live test creates a user over the unix socket, issues a reusable pre-auth key for it, reads the user back from the key, destroys it. Original role, live-tested on Rocky 10.
ansible-kea-dhcp4
Kea DHCPv4 from AppStream: your subnets, pools, options and reservations in Kea's own keys, checked with kea-dhcp4 -t and applied by reload, leases on disk. The live test runs a raw-socket DHCP client in a namespace: an address with router, DNS and lease time, the reserved address for its MAC, and nothing on a segment no subnet covers. Original role, live-tested on Rocky Linux 10.