From ca4667c03513666c412b3278794fbfd6ddc2d225 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
<41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 16 Sep 2026 17:15:02 +0000
Subject: [PATCH] Update HTML documentation from man pages
---
doc/html/man5/3proxy.cfg.5.html | 101 ++++++++++++++++++++++++++++----
1 file changed, 90 insertions(+), 11 deletions(-)
diff --git a/doc/html/man5/3proxy.cfg.5.html b/doc/html/man5/3proxy.cfg.5.html
index bb16776..cbd26f7 100644
--- a/doc/html/man5/3proxy.cfg.5.html
+++ b/doc/html/man5/3proxy.cfg.5.html
@@ -18,6 +18,7 @@
PCRE FILTERING
PCRE Commands
PCRE Parameters
+OPTIONAL SERVICES
BUILT IN HTTP SERVER
Operations
What a rule adds to the answer
@@ -114,10 +115,17 @@ handshake), may be used to redirect any TLS-based traffic
auto Proxy with protocol autoselection between proxy /
socks / tlspr
-pop3p POP3 proxy (default port 110)
-imapp IMAPv4 proxy (default port 143)
-smtpp SMTP proxy (default port 25)
-ftppr FTP proxy (default port 21)
+pop3p POP3 proxy (default port 110), in a build which
+has one: otherwise the service is tlspr speaking POP3
+to negotiate STARTTLS, under this name.
+imapp IMAPv4 proxy (default port 143), or tlspr
+speaking IMAP, as above.
+smtpp SMTP proxy (default port 25), or tlspr
+speaking SMTP, as above.
+ftppr FTP proxy (default port 21), in a build with FTP
+support. Without it the service is known but answers
+nothing, and ftp:// is not a URL the HTTP proxy
+fetches.
admin Web interface (default port 80)
dnspr caching DNS proxy (default port 53)
tcppm TCP portmapper. Destination address (DSTADDR) can
@@ -828,15 +836,40 @@ grouped. Proxy inside the group is selected randomly. If few
groups are specified one proxy is randomly picked from each
group and chain of proxies is created (that is second proxy
connected through first one and so on). Weight is used to
-group proxies. Weight is a number between 1 and 1000.
+group proxies. A weight is a share of the whole, written
+either as a fraction of one, anything beginning with 0 or
+with a point, or the old way, in thousandths:
+.5 and 0.5 and 500 are all a half
+.333 and 333 are both 333 thousandths
+1000 and 1.0 and 100% are all the whole
+share
+50.5% and .505 and 505 are all the same
+share
+0 is a fallback, described below
+A fraction takes up to nine digits after the point,
+.333333333 being the finest share there is, and the
+old notation may now carry further digits after a point of
+its own, so 123.456 means the same as .123456.
+Weights are scanned as integers, nothing is read as a
+floating point number. 1.0, with as many zeroes after
+the point as you care to write, is the one weight read as it
+looks rather than in thousandths, so that the whole share
+can be written as a fraction too: a bare 1 is still a
+thousandth of it, and 1.5 still one and a half of
+them. A weight ending in % is a percentage, and takes
+up to seven digits after the point.
Weights are summed and proxies are grouped together until
-the weight of the group is 1000. That is:
+the weight of the group is the whole share. A group which
+falls short of it by no more than a thousandth, which three
+weights of 333 do, is taken for a whole one rather
+than for a group with a remainder, so a share which cannot
+be divided evenly needs no adjusting by hand. That is:
allow *
parent 500 socks5 192.168.10.1 1080
parent 500 connect 192.168.10.1 3128
makes 3proxy to randomly choose between 2 proxies for all
-outgoing connections. These 2 proxies form 1 group
-(summarized weight is 1000).
+outgoing connections. These 2 proxies form 1 group (their
+weights are the whole share between them).
allow * * * 80
parent 1000 socks5 192.168.10.1 1080
parent 1000 connect 192.168.20.1 3128
@@ -976,13 +1009,36 @@ Changes the external address for a given connection to
1.2.3.4 (equivalent to -e1.2.3.4)
Optional username and password are used to authenticate on
parent proxy. Username of ´*´ means username
-must be supplied by user.
+must be supplied by user.
+A parent which fails is taken out of the choice for the rest
+of that connection, so the next attempt, see
+parentretries, goes to another member of the group
+instead of the same parent again. Its share is spread over
+the parents of the group which are left, in proportion to
+their weights.
+Weight 0 marks a fallback parent. Such a parent takes no
+share of the random choice, and none of the share left over
+by a parent which failed, and is only used once every
+weighted parent of its group has failed, which is how a
+parent used only when another one is down is configured:
+
+allow *
+parent 1000 socks5 192.168.10.1 1080
+parent 0 socks5 192.168.20.1 1080
+Several fallbacks are tried in the order they are written.
+Reaching a fallback costs an attempt, so
+parentretries has to be at least as large as the
+number of parents to try.
+When every parent of a group has failed the request fails as
+well, rather than being sent without a parent.
parentretries
<number>
-Number of retries to connect to parent proxy. Default is
-1.
+Number of attempts to reach a parent proxy. Default is 2.
+Each attempt picks a parent again, leaving out the ones
+which already failed, so this is also the number of
+different parents a request may be tried through.
nolog
<n>
@@ -1520,6 +1576,29 @@ the connection data. Warning: Regular expressions
don’t require authentication and cannot replace
authentication and/or allow/deny ACLs.
+OPTIONAL SERVICES
+
+
+
+
+The mail proxies
+and FTP are built when they are asked for, and are not in a
+default build. MAILPROXY=true builds pop3p,
+imapp and smtpp, and FTP=true builds
+ftppr and the ftp:// scheme of the HTTP proxy;
+with CMake the switches are -D3PROXY_USE_MAILPROXY=ON
+and -D3PROXY_USE_FTP=ON. The standalone binaries of
+those services are built with them and not without.
+A configuration naming a service which was not built is
+still read. The three mail proxies become tlspr
+negotiating STARTTLS in that protocol, which is what most of
+their use amounts to now that the mail protocols are used
+over TLS, and a parent chain naming pop3,
+imap or smtp does the same. ftppr is
+answered by nothing: a client reaching it is turned away and
+the refusal logged, since there is no protocol to fall back
+on.
+
BUILT IN HTTP SERVER