PROXY
Reverse proxies you can change safely.
BETAnginx and HAProxy routes, upstream pools, traffic splitting, rate limits, access control, WAF, fail2ban and Squid egress, all rendered, linted and checked before reload, probed after, and rolled back automatically if the probe fails.
SEE IT RUN
THE MANUAL WAY
What makes manual proxy changes difficult.
THE RELOAD THAT TOOK EVERYTHING DOWN
One new site referenced a certificate file that did not exist yet. nginx refused to start, and every other site on the server went down with it.
THE ALLOW-LIST THAT ALLOWED EVERYONE
Someone added "allow 10.0.0.0/8" to lock an admin path down. Without a closing deny, nginx let everyone else through as well, and nothing flagged it.
THE RATE LIMIT THAT WAS AN OUTAGE
A limit was set to stop a scraper. It was set too low, real users started getting 503s, and for an hour it looked exactly like a backend failure.
WHAT TALOS DOES
Six safeguards on every proxy change.
Lint, check, swap, probe, roll back
Config is rendered from the routes you define, linted, validated by the proxy itself, swapped in atomically, then probed. A failed probe restores the previous config without anyone touching it.
Pools that cannot empty themselves
Health checks can take a failing target out of rotation, but never the last one serving, so a health check cannot turn a partial outage into a full one.
Canaries, stickiness and protocols
Weighted traffic splits, consistent-hash stickiness, retries, WebSocket, gRPC and server-sent events, and plain TCP routes alongside HTTP.
Rate limits that start in dry run
A new limit counts and logs before it rejects anything, so you see what it would have blocked. The audit flags any limit left in dry run.
Access control that closes itself
Every allow-list gets its closing deny. Basic, forward and mutual-TLS auth, trusted-proxy chains, a WAF and fail2ban, all set per route and applied as one change.
Egress and high availability
Squid forward proxies for outbound traffic, and keepalived pairs so a proxy node can fail without the address going with it.
HOW IT RUNS
Every action is a tracked job.
WHAT MAKES THIS DIFFERENT
A config that will not start is caught before it is loaded.
nginx will refuse to start over a single missing certificate file, and when it does, every site on that node goes down with the one that was wrong. So Talos treats a TLS listener with no certificate it can resolve as a blocking error, not a warning, and refuses to render it. The same idea runs through the type: the security audit reads what you meant (the routes and rules) rather than searching config text, and accepting one of its findings needs a written reason, because that note is the only record of why a risk was allowed.
RELATED CAPABILITIES
Discover one proxy node first.
Talos reads the config that is already there before it renders a line of its own.