Native edge control
A native Rust load balancer built on Pingora: L4 and HTTP proxying, automatic certificates, edge policy, high availability, and one configuration model that says exactly what can change live.
--checkOne system, clear seams
Certificate automation, origin selection, request policy, failover, and observability usually arrive as a small fleet of services and scripts. OMLB brings those concerns into a single binary without pretending they are all the same kind of change.
Explore the configuration surfaceCapabilities
Built for focused single-host and paired-node deployments, with each subsystem visible in the config that operates it.
HTTP/1.1, HTTP/2, and optional HTTP/3 sit alongside raw TCP proxying. Terminate TLS at the edge or connect to TLS backends with SNI verification.
ACME manages HTTP-01 and Cloudflare DNS-01 certificates, including wildcards. The live SNI store accepts renewed and supplied certificates without a process restart.
Match host, prefix, method, headers, query predicates, or opt-in host and path regexes; then balance with weighted round-robin, random, p2c, or Ketama hashing.
TCP and HTTP checks, passive outlier ejection, retries, timeouts, draining, cache, and compression keep origin work deliberate rather than accidental.
A pre-routing security gate supplies per-IP rate limits, CIDR allowlists, scanner-trap bans, and optional strike bans. Native filters cover common request policy.
VRRPv3 coordinates an IPv4 virtual IP between two nodes. DNS-SRV and Consul discovery reconcile backend membership off the request path.
Architecture
The proxy uses Rust and Pingora for reverse-proxy work, pooled upstream connections, and graceful socket-handoff restarts. Cacheable GET responses can be served from a bounded in-memory LRU; compression and native filters run only where configured.
Validate YAML before deployment, layer scalar OMLB_* overrides, and let the watcher atomically apply the portions of a running configuration that are safe to change. Discovery, certificate renewal, HA heartbeats, and plugin administration stay out of client request handling.
Configuration
Configuration is schema-checked and cross-validated before startup. A reload applies only safe operational changes atomically; requests already in flight keep the generation they started with.
omlb --check -c config.yamltls:
acme:
enabled: true
contacts: ["mailto:ops@example.com"]
terms_of_service_agreed: true
domains: [app.example.com]
listeners:
- { name: https, address: "0.0.0.0:443", tls: { managed: true }, http2: true }
upstreams:
app:
algorithm: power_of_two
backends: [{ addr: "10.0.0.1:8080" }, { addr: "10.0.0.2:8080" }]
health_check: { kind: http, path: /healthz }
routes:
- { name: app, match: { host: app.example.com }, upstream: app }Operating boundaries
OMLB is intentionally specific about where it fits, and where a different platform is the better engineering choice.
It requires TLS, shares the listener address and port over UDP, and currently supports one configured HTTP/3 listener.
DNS-SRV and Consul are supported; Kubernetes endpoint watching and xDS are not. Discovery pools cannot also be static or Docker-managed pools.
VRRP moves an IPv4 VIP; the security gate’s ban state is per instance and is not replicated between peers.
Structural changes are rejected rather than partially applied. Use a graceful restart for listeners, backends, pools, algorithms, health, TLS/SNI, or HA.
Prometheus, structured JSON or journald logs, and the local admin API are available; distributed tracing is not.
Built-in Rust filters cover common policy. Runtime WASM plugins are available, but remain experimental.
Start with the real interface