Skip to content
tcpsystems
Version: Current

Massprox Architecture

Massprox Architecture

Section titled “Massprox Architecture”

Status as of 2026-11-05: Massprox is partially operational. A 2026-10-20 snapshot reported 206,808 candidates and 16 verified proxies. The gatherer loop (mass-proxy-gather) was inactive on scaleblade as of 2026-10-18.

Massprox gathers, verifies, and ranks HTTP(S) proxies. It supports search federation. It also enforces egress rules for search traffic.

Core loop

Section titled “Core loop”

Massprox runs a verify loop:

  1. Read seed list URLs.
  2. Scrape and parse ip:port candidates.
  3. Run a TCP dial check.
  4. Run an HTTP or HTTPS verify check.
  5. Score and rank results.
  6. Export ranked proxies and status.

State is stored in a SQLite frontier. Status is written to proxies/mass-status.json.

Main components

Section titled “Main components”
Package Role
internal/gather Main loop and env config
internal/netx TCP and HTTP worker pools
internal/parse Candidate and list parsing
internal/rank Proxy scoring
internal/store SQLite frontier and writes
internal/status Atomic status snapshot
internal/ops Operator surface and egress self-test
internal/discover New list URL helpers

Operator surface

Section titled “Operator surface”

massprox-ops provides a loopback-only operator interface. It supports JSON-RPC style commands, audit logging, token lifecycle tasks, and an egress self-test.

Common checks:

  • massprox-ops egress-test
  • massprox-ops list-verified
  • massprox-ops status

See Massprox Operator Runbook.

Egress enforcement

Section titled “Egress enforcement”

Massprox must follow egress law.

Network controls

Section titled “Network controls”
  • UID 988 traffic uses routing table 51820.
  • IPv4 egress routes through the controlled gateway (194.180.36.11 via wg0).
  • IPv6 egress for UID 988 is rejected.
  • DNS uses /etc/massprox/resolv.conf with approved resolvers (1.1.1.1, 9.9.9.9).

Service guard

Section titled “Service guard”

Critical services can use ExecCondition to run the egress self-test before start. If the test fails, the service must not start.

Safety rules

Section titled “Safety rules”
  • Do not probe restricted addresses.
  • Do not bypass the proxy pool for search traffic.
  • Do not disable egress guards without approval.
  • Do not store secrets in docs or git.

See Verify Egress Compliance.

Concurrency and limits

Section titled “Concurrency and limits”

Massprox uses bounded worker pools. It is designed to avoid unbounded goroutine growth.

Variable Default Notes
OUT proxies State directory
TARGET 1000000 Candidate target per run
VERIFY_CONC 2048 HTTP verify slots (capped)
RECHECK_CONC 1024 Recheck slots
TCP_CONC 8192 TCP dial slots (capped)
SCRAPE_CONC 128 Scrape slots (capped)
TCP_TIMEOUT 400ms Dial timeout

See Massprox Configuration.

Dated status

Section titled “Dated status”
Date Observation
2026-10-18 mass-proxy-gather inactive (stopped) on scaleblade.
2026-10-20 Snapshot: 204,808 candidates, 16 verified (reported).
2026-11-05 Docs status: search dead until restored; massprox pool present but gatherer inactive.

Treat these as snapshots. Verify live state before operations.

Restoration pointers

Section titled “Restoration pointers”
  1. Verify egress guard and routing on the target host.
  2. Check proxies/mass-status.json and pool size.
  3. Start mass-proxy-gather.service only after egress checks pass.
  4. Monitor logs and metrics.
  5. Recheck proxy quality and failure reasons.

See Search Restoration Runbook.

Section titled “Related pages”