mitmproxy

A free and open source interactive HTTPS proxy.

Detected by mitmproxy, mitmdump, mitmweb | macOS, Linux, Windows |mitmproxy.org

Sync it mitmproxy.toml

Sync rules

What travels, what stays, what never leaves

mitmproxy in your home directory Every rule on this page, by file

proxyauthupstream_authcert_passphrase

Lifted into your secret store; the rest of the file syncs.

· mitmproxy-ca.pem Never synced

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/mitmproxy.tomlThe file this page is generated from

id = "mitmproxy"

name = "mitmproxy"

homepage = "https://mitmproxy.org"

description = "A free and open source interactive HTTPS proxy."

# The project's mark, from the square installer asset in its repository.

icon = "https://raw.githubusercontent.com/mitmproxy/mitmproxy/main/release/windows-installer/Assets/logo.150x150.png"

detect = ["mitmproxy", "mitmdump", "mitmweb"]

# https://docs.mitmproxy.org/stable/concepts/options/ — "The mitmproxy tools

# share a common YAML configuration file located at ~/.mitmproxy/config.yaml",

# and the `confdir` option is documented as "Location of the default mitmproxy

# configuration files. Default: ~/.mitmproxy". A plain home dotdir, not an XDG

# or platform base directory, so it is written literally.

paths = ["~/.mitmproxy/config.yaml"]

exclude = []

# https://docs.mitmproxy.org/stable/concepts/certificates/ lists what else the

# directory holds: mitmproxy-ca.pem is "the certificate *and the private key*

# in PEM format", while mitmproxy-ca-cert.pem, mitmproxy-ca-cert.p12 and

# mitmproxy-ca-cert.cer are the certificate alone, for handing to clients.

# Only the first is a credential; the public copies are regenerated from it and

# are not listed either way.

secret = ["~/.mitmproxy/mitmproxy-ca.pem"]

# Read at startup; mitmproxy then holds the parsed options in memory, and a

# running proxy is exactly when a rewrite would be noticed.

# Three options from the same options page whose value is a credential:

# proxyauth "Require proxy authentication. Format: "username:pass" ..."

# upstream_auth "Add HTTP Basic authentication to upstream proxy and

# reverse proxy requests. Format: username:password."

# cert_passphrase "Passphrase for decrypting the private key provided in the

# --cert option."

# The docs push users to put the last two in config.yaml precisely so they do

# not appear in the process list, so this is where they land.

[[secret_paths]]

file = "~/.mitmproxy/config.yaml"

match = { key_path = ["proxyauth", "upstream_auth", "cert_passphrase"] }

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/mitmproxy. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these keeps the credential file out.