Skip to content
ryoproxy
./architecture

A control plane that never opens a port on your router

Three layers and one rule. The control plane holds policy and history; the on-site agent holds the credentials and does the work; your router never accepts a connection from the internet.

[inbound ports on your router]
none
[credentials]
stay on site, with the agent
[deployment]
self-hosted, single tenant

./topology

Topology

Operators reach the platform over HTTPS. Every agent dials out to it, never the other way around — your routers stay unreachable from the internet.

  1. 01operators

    Operator dashboard

    fleet, lines, proxies, VPN

    Automation clients

    scripts and workers, scoped keys

    authenticated HTTPS session
  2. 02control plane

    Control plane

    policy, roles, audit trail

    State store

    configuration and history

    outbound tunnel, opened by the agent
  3. 03on-site agent

    Router agent

    one per router, holds the credentials

    Proxy runtime

    serves the per-WAN endpoints

    Forwarding runtime

    routes selected traffic upstream

    local network only
  4. 04your hardware

    MikroTik RouterOS

    PPPoE, WAN, firewall, WireGuard

./request-path

Request path

One operator action, end to end.

  1. 01Dashboard actionThe operator UI issues an authenticated request with a short-lived JWT and a CSRF token.
  2. 02Control plane validationRole, agent assignment and capability flags are checked, the intent is persisted and the activity log gets an entry.
  3. 03Agent dispatchThe request is routed to the target agent over the connection that agent already holds open, rate-limited per service.
  4. 04Local executionThe agent carries out the request against the router or the runtime it targets, entirely on the local network.
  5. 05Router state changesObjects are created, updated or removed on the router itself, in an order that preserves existing rule chains.
  6. 06Streamed resultProgress and new state are pushed back as they happen, and a reconnect never shows stale data as current.

./specs

Platform specifications

Defaults shipped by the platform. Everything here is tunable per deployment unless the value is a protocol constraint.

platform & stack

Deployment
self-hosted, single tenant, containerised
Router target
MikroTik RouterOS 7
Agent
one container per router, on your network
Operator access
browser dashboard and scoped API keys
Data at rest
router and proxy credentials encrypted
Tenancy
routers scoped per user, roles enforced server-side

transport & liveness

Inbound ports on your router
none
Agent link
outbound only, opened by the agent
Session
short-lived tokens, CSRF protected
Live updates
streamed, not polled
Idle cost
no router calls while nobody is watching
Recovery
automatic reconnect with backoff

capacity & limits

Proxy endpoints
hundreds per node, one per WAN address
Protocols
HTTP and SOCKS, with upstream forwarding
PPPoE lines
bulk provisioning, per-line rotation schedule
WireGuard
253 clients per agent, own subnet each
VLAN
allocated automatically from free ranges
Managed config
22 RouterOS categories per router

automation defaults

WAN watchdog
sweeps every 2 minutes, redials a dead line
IP checks
every line re-checked on a 2-minute cycle
IP history
90-day retention, cleaned up automatically
Auto-rotate
blocked lines rotate, then back off
Alerts
Telegram notifications and bulk IP checks
Brute-force defence
graduated blocking with a whitelist