Skip to content
ryoproxy
./architecture

A control plane that never opens a port on your router

0

inbound router ports

on-site

router credentials

self-hosted

single tenant

./topology

Topology

  1. 01operators

    Operator dashboard

    Automation clients

    authenticated HTTPS session
  2. 02control plane

    Control plane

    State store

    outbound tunnel, opened by the agent
  3. 03on-site agent

    Router agent

    Proxy runtime

    Forwarding runtime

    local network only
  4. 04your hardware

    MikroTik RouterOS

./request-path

Request path

  1. 01Dashboard action

    The operator UI issues an authenticated request with a short-lived JWT and a CSRF token.

  2. 02Control plane validation

    Role, agent assignment and capability flags are checked, the intent is persisted and the activity log gets an entry.

  3. 03Agent dispatch

    The request is routed to the target agent over the connection that agent already holds open, rate-limited per service.

  4. 04Local execution

    The agent carries out the request against the router or the runtime it targets, entirely on the local network.

  5. 05Router state changes

    Objects are created, updated or removed on the router itself, in an order that preserves existing rule chains.

  6. 06Streamed result

    Progress and new state are pushed back as they happen, and a reconnect never shows stale data as current.

./specs

Platform specifications

platform & stack
Deployment
self-hosted, single tenant, containerised
Router target
MikroTik RouterOS 7
Agent
one container per router, on your network
Operator access
browser dashboard and scoped API keys
Data at rest
router and proxy credentials encrypted
Tenancy
routers scoped per user, roles enforced server-side
transport & liveness
Inbound ports on your router
none
Agent link
outbound only, opened by the agent
Session
short-lived tokens, CSRF protected
Live updates
streamed, not polled
Idle cost
no router calls while nobody is watching
Recovery
automatic reconnect with backoff
capacity & limits
Proxy endpoints
hundreds per node, one per WAN address
Protocols
HTTP and SOCKS5, with upstream forwarding
PPPoE lines
bulk provisioning, per-line rotation schedule
WireGuard
253 clients per agent, own subnet each
VLAN
allocated automatically from free ranges
Managed config
22 RouterOS categories per router
automation defaults
WAN watchdog
sweeps every 2 minutes, redials a dead line
IP checks
every line re-checked on a 2-minute cycle
IP history
90-day retention, cleaned up automatically
Auto-rotate
blocked lines rotate, then back off
Alerts
Telegram notifications and bulk IP checks
Brute-force defence
graduated blocking with a whitelist