Skip to main content

Straw documentation

Straw is a self-hosted HTTP/HTTPS egress proxy. Applications send an HTTP request to Control, Control assigns it to an Egress worker over NATS, and that worker makes the outbound request. Clients can use the REST request API or Control's standard HTTP/HTTPS forward-proxy ingress.

Straw is designed for one trusted deployment boundary. It does not include tenants, accounts, billing, quotas, or an analytics database. NATS is the only required backing service. Optional JetStream, Redis, and object-storage profiles add durable runtime policy, shared Control coordination, and large-body receipts.

Start here​

  1. Follow the quickstart to run Straw locally and send a request.
  2. Choose a released build or build the local Compose stack.
  3. Read the architecture to understand the three services.
  4. Use the request API, proxy ingress, CLI, or SDKs from your application.
  5. Review configuration, deployment, and security before exposing Control outside a development machine. Use runtime administration when policy must change without restarts.

What Straw does​

  • forwards HTTP and HTTPS requests through independently scalable workers;
  • accepts standard absolute-form HTTP proxy requests and HTTP/1.1 CONNECT tunnels;
  • keeps workers off the public API network;
  • preserves duplicate and ordered request/response headers;
  • enforces request size and timeout limits;
  • supports an optional deployment-wide bearer token;
  • exposes Prometheus metrics, health endpoints, and structured JSON logs;
  • supports selectable outbound TLS fingerprint profiles;
  • optionally provides a durable Config/Admin API and API-parity dashboard;
  • optionally stores verified request and response bodies as expiring receipts in local or S3-compatible object storage.

What Straw does not do​

Straw is not a browser automation system, hosted proxy network, tenant management platform, SOCKS proxy, TLS interception service, or indefinite traffic archive. Its request interfaces are POST /api/v1/requests and the forward-proxy behavior on Control's API listener; optional administration remains deployment-scoped and belongs to the operator.

The source is available under the MIT License.