Rota

WHAT IS IT?

Rota is a self-hosted proxy rotation platform. The core is a Go proxy server listening on port 8000: your clients connect to it like any other proxy, and each request exits through a different pool IP according to the configured strategy. Around that, a Next.js dashboard tracks pool health live and TimescaleDB keeps request history for analysis.

WHY IS IT INTERESTING?

• Four rotation strategies: random, round-robin, least active connections, or rotation at a fixed interval. Named pools add a sticky mode that holds the same IP for N requests.
• Automatic list import: you declare URLs pointing at ip:port lists, each with its own protocol and refresh interval in minutes. A scheduler catches up overdue sources every minute.
• Geolocation and filtered pools: every proxy is geolocated through ip-api.com, with country, region, city, ISP and coordinates. Pools are built by mixing countries, cities, ISP substrings and custom tags, in auto or manual sync.
• Proxy accounts with failover: users with bcrypt passwords, each attached to a main pool and an ordered set of fallbacks. http://user:pass@host:8000 routes through that chain, and a request cascades to the next pool when the first has no live IP left.
• Health checks and alerts: asynchronous checks against a URL of your choice, cron scheduling per pool (*/30 * * * *), and a webhook fired when the active proxy count drops below a threshold, with a configurable cooldown.
• Multi-protocol and chaining: HTTP, HTTPS, SOCKS4, SOCKS4a and SOCKS5, with the option to chain to an upstream proxy such as Burp Suite or OWASP ZAP.
• Guardrails on auth: JWT across the whole API, per-IP blocking after N failed logins, a global lockout past a traffic threshold, and origin validation on WebSockets. The TRUST_PROXY_HEADERS flag decides whether X-Forwarded-For is trusted, so the rate limit cannot be bypassed with a forged header.

USE CASES

• Run web collection campaigns behind a pool of IPs that refreshes itself.
• Spread load tests across several exit points.
• Route security research traffic through a proxy chain, with Burp or ZAP upstream.
• Give each team or project its own proxy account, with a dedicated geographic pool and fallbacks.
• Watch a fleet of bought or gathered proxies and purge dead IPs automatically.

The default deployment is one docker compose up -d with no config file: Caddy serves the dashboard, the API and the WebSockets from a single origin, handles the TLS certificate as soon as SITE_ADDRESS carries a domain, and the initial admin password is generated then written to the logs.