Use mitm:false when the proxy should authorize a connection without decrypting it. The client negotiates TLS directly with the real origin through a raw splice.

What still works¶

• top-down connection-phase matching on host, port, and proto;
• per-client effective rule files and proxied client uuid;
• resolved-address egress[] policy, including DNS-rebinding protection;
• explicit proxy authentication;
• one access-log record per tunnel, plus metrics and traces.

{ "uuid": "docs-docker-egress", "http": [ { "match": { "host": "httpbingo.org", "port": "443", "proto": "https" }, "mitm": false }, { "match": { "host": "example.com", "port": "443", "proto": "https" }, "mitm": false } ] }

Apply it with PUT /rules/{client-ip}. Requests to either named origin on port 443 are spliced. An unlisted origin matches no rule and receives 511 before an upstream socket is opened.

What you give up¶

Encrypted method, path, headers, and body remain invisible. Consequently, message-phase matching, header/credential injection, body replacement, and broker decisions about individual encrypted requests are unavailable. A mitm:false rule cannot contain message-phase match fields or mutation blocks.

Next: run the Docker tutorial or learn identity and rule phases.