Bare Metal Deployment

Install

Download the latest binary:

curl -fsSL https://download.sbproxy.dev | sh

Or with Homebrew:

brew install soapbucket/tap/sbproxy

Verify the installation:

sbproxy version

Run Directly

sbproxy serve -c /etc/sbproxy/sb.yml

Systemd Service

Create a systemd unit file at /etc/systemd/system/sbproxy.service:

[Unit]
Description=SBproxy reverse proxy and AI gateway
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=sbproxy
Group=sbproxy
ExecStart=/usr/local/bin/sbproxy serve -c /etc/sbproxy/sb.yml
ExecReload=/bin/kill -HUP $MAINPID
Restart=always
RestartSec=5
LimitNOFILE=65535

# Security hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/sbproxy /etc/sbproxy/certs
PrivateTmp=true

[Install]
WantedBy=multi-user.target

Setup

Create the service user and directories:

# Create a dedicated user
sudo useradd --system --no-create-home --shell /usr/sbin/nologin sbproxy

# Create config and data directories
sudo mkdir -p /etc/sbproxy /var/lib/sbproxy
sudo chown sbproxy:sbproxy /var/lib/sbproxy

# Copy your config
sudo cp sb.yml /etc/sbproxy/sb.yml
sudo chown sbproxy:sbproxy /etc/sbproxy/sb.yml

Manage the Service

# Enable and start
sudo systemctl daemon-reload
sudo systemctl enable sbproxy
sudo systemctl start sbproxy

# Check status
sudo systemctl status sbproxy

# View logs
sudo journalctl -u sbproxy -f

# Reload config (zero downtime)
sudo systemctl reload sbproxy

# Restart
sudo systemctl restart sbproxy

Config Validation

Validate your config before applying changes:

sbproxy validate -c /etc/sbproxy/sb.yml

Binding to Privileged Ports

To bind to ports 80 and 443 without running as root, grant the binary the required capability:

sudo setcap 'cap_net_bind_service=+ep' /usr/local/bin/sbproxy

Then update your config:

proxy:
  http_bind_port: 80
  https_bind_port: 443