# Proxy God — Rotating Proxy Chain Manager for Windows

Auto-fetches, validates and rotates multi-hop proxy chains with a live GUI, Windows kill-switch firewall, system proxy enforcement, and tray icon. Works on top of NordVPN (or any VPN) as the outer tunnel.

```
YOU → NordVPN (OS tunnel) → Hop 1 → Hop 2 → Hop 3 → Internet
```

---

## Features

- **Auto proxy pool** — fetches from Proxifly CDN every 30 min, validates concurrently
- **Multi-hop GOST chains** — 2–8 hops, randomly picked from validated pool
- **Obfuscation modes** — Auto, HTTP-only, SOCKS5-only, Random Mix
- **Manual chain builder** — drag/reorder hops, pin your own IPs
- **Exit IP verification** — checks real exit IP every health cycle, rotates if it matches your real IP
- **Windows system proxy** — sets `HKCU` registry proxy so all WinINet apps use the chain
- **Firewall kill-switch** — `netsh` rules that block all outbound except GOST + NordVPN when running as Admin
- **Tray icon** — green/yellow/red circle, right-click menu
- **Boot persistence** — Task Scheduler logon task

---

## Requirements

- **Windows 10/11 x64**
- **Python 3.10+** (or use the pre-built `.exe`)
- **NordVPN** (recommended but optional — any VPN works)

---

## Quick Start (from source)

```cmd
git clone https://gitea.thetempleofdoom.com/drjones/proxy-god.git
cd proxy-god
pip install -r requirements.txt
python run.py
```

> Run as **Administrator** for full kill-switch firewall enforcement.

---

## Build standalone `.exe`

```cmd
build_exe.bat
```

Output: `dist\ProxyChainManager.exe` + copied to Desktop.

---

## Usage

1. Launch `ProxyChainManager.exe` (accept UAC prompt for Admin)
2. Configure settings in **Settings** tab if needed (defaults work fine)
3. Click **▶ Start** — the app will:
   - Download GOST (one time, ~9 MB) and add Defender exclusion
   - Fetch proxy lists from Proxifly CDN
   - Validate them concurrently
   - Build a random N-hop chain
   - Verify the exit IP is different from your real IP
   - Set Windows system proxy
   - Engage firewall kill-switch (Admin only)
4. Close window → minimizes to tray (chain keeps running)
5. Click **Quit** or tray → Quit to fully stop

---

## Chain Builder Tab

- **Obfuscation mode** — selects which protocols to include in chains
- **Hop count slider** — 2–8 hops
- **Manual chain** — enter proxies manually, reorder with ↑↓, enable "Use this chain" to pin it
- **Paste current** — copies the auto-selected chain into the editor
- **Sources** — add/remove proxy list URLs (JSON format from Proxifly)

---

## Settings Reference

| Setting | Default | Description |
|---|---|---|
| Local port | 18888 | HTTP proxy port — point apps here |
| Health check sec | 180 | How often to re-verify exit IP |
| Full refresh sec | 1800 | How often to re-fetch + re-validate |
| Concurrency | 64 | Parallel proxy validators |
| Max candidates | 400 | Max proxies sampled for validation per cycle |
| Timeout sec | 12 | Per-proxy validation timeout |
| Kill-switch | ON | Block all outbound traffic except GOST + Nord |

---

## Architecture

```
app.py          GUI (CustomTkinter, 3 tabs)
service.py      Background thread — pool management, GOST lifecycle, health check
gost_util.py    Downloads and manages gost.exe
firewall.py     netsh kill-switch rules
sysproxy.py     Windows registry system proxy (WinINet broadcast)
tray.py         pystray tray icon
config.py       Settings dataclass + JSON persistence
validator.py    Async proxy validation + exit IP checking
fetcher.py      Proxifly JSON fetcher
```

---

## Proxy Sources

Default sources use [proxifly/free-proxy-list](https://github.com/proxifly/free-proxy-list) CDN:
- `https://cdn.jsdelivr.net/gh/proxifly/free-proxy-list@main/proxies/protocols/http/data.json`
- `https://cdn.jsdelivr.net/gh/proxifly/free-proxy-list@main/proxies/protocols/socks5/data.json`
- `https://cdn.jsdelivr.net/gh/proxifly/free-proxy-list@main/proxies/protocols/https/data.json`

You can add any URL returning a JSON array of `{"proxy":"http://ip:port", ...}` objects.

---

## Notes

- Free public proxies are **untrusted** — do not send sensitive unencrypted data
- NordVPN (or any VPN) as the OS tunnel means the proxy operators only see the VPN exit IP, not your ISP IP
- Kill-switch requires **Admin** — UAC prompt appears on launch
- Works on cloned VMs — all listeners bind to `127.0.0.1`, not the machine's LAN IP