VPN & Proxy

Two things on one page, built on the same exits. Credentials you can put into any device, browser or client — Ocalt as your proxy provider. And OUTBOUND, which points those same exits back at your own scripts, so a FETCH or a browser session leaves from another country.

Leaving From Somewhere Else

Every request a script makes leaves from Ocalt’s own address unless you say otherwise. OUTBOUND VIA sends it through Ocalt’s exit instead, so the site you are calling sees that address rather than this one.

Through the Exit, and Back Again

OUTBOUND VIA "exit"
AFTER FETCH "https://api.ipify.org" SET ?there
AFTER EMIT "seen as: " & ?there

AFTER OUTBOUND DIRECT
AFTER FETCH "https://api.ipify.org" SET ?here
AFTER EMIT " | and now: " & ?here

OUTBOUND sets execution state, the way HEADER does for the response. It takes effect from that statement onward and applies to every outbound call the script makes — FETCH, CURL, browser sessions, webhooks. Those verbs are unchanged: they read the state rather than taking an argument. OUTBOUND DIRECT puts it back, and a script that sets an exit and never clears it keeps using it for the rest of its run — including calls to your own site, which would then travel out and back for no reason.

A PROXY written on the statement itself always wins over OUTBOUND. A script that names a proxy on the line in front of you means it, and ambient state should never quietly override something written explicitly.

What the Exit Is

NEW PROXY "exit" SET ?exit
AFTER EMIT ?exit("address")

PROXY LIST SET ?all
AFTER FOREACH ?all SET ?e
OPEN
  EMIT ?e("address") & " — " & ?e("up")
CLOSE

Leaving through a proxy that is not ours

An exit does not have to be Ocalt’s. OUTBOUND VIA PROXY takes any proxy you can reach — Tor, a scraping service, a machine of your own somewhere else. Ocalt carries none of that traffic; it only points your requests at it.

Someone Else’s Proxy

OUTBOUND VIA PROXY "socks5h://user:pass@proxy.example.com:1080"
AFTER FETCH "https://api.ipify.org" SET ?r
AFTER EMIT ?r

(* Tor, if you are running one *)
AFTER OUTBOUND VIA PROXY "socks5h://127.0.0.1:9050"
(* — refused. See below. *)

The scheme is required: socks5://, socks5h://, http:// or https://. Prefer socks5h, which asks the proxy to resolve the hostname rather than resolving it here.

A proxy on a private or loopback address is refused, as is Ocalt’s own address. An exit is a way out to the internet, never a way back into Ocalt or into a network you should not be able to reach from here — and pointing at Ocalt to reach Ocalt is circular anyway. Use OUTBOUND VIA "exit" for our exits.

What the Exit Is

The exit is a tunnel Ocalt maintains. A script does not configure it, mint anything, or hold a credential for it — OUTBOUND VIA is the whole interface, and NEW PROXY only reports what is there.

There is one exit today. PROXY LIST returns what exists rather than a fixed set, so a script written against the list keeps working as that changes — where one written against a hardcoded name would not.

What an Exit Cannot Reach

An exit carries your traffic to the internet. It is not a way into Ocalt: private addresses, loopback and Ocalt’s own address are refused through it, exactly as they are refused to a script. A proxy session has no more reach than the account behind it.

Full Verb Reference

Verb	Description
`OUTBOUND VIA "exit"`	Every outbound call from here on leaves through Ocalt’s exit
`OUTBOUND DIRECT`	Back to leaving from Ocalt itself
`NEW PROXY SET ?p`	What the exit is. Returns `address`, `via`, `up`
`NEW VPN SET ?v`	The same, named for the other habit
`PROXY LIST SET ?all`	Every exit, with whether it is up
`VPN LIST SET ?all`	The same list
`OUTBOUND VIA PROXY "url"`	Leave through a proxy that is not ours