Build

Requires Rust 1.80+.

# Build (Rust 1.80+)
cargo build --release -p omlb

Validate, then run

--check parses the whole file and then cross-checks it: every route has to point at an upstream that exists, every address has to parse, cert files have to be on disk, ACME settings have to make sense. Anything wrong means a non-zero exit — wire it into CI and a broken edge config never leaves the merge request.

# Validate a config, then run it
./target/release/omlb --check -c config/omlb.yaml
./target/release/omlb -c config/omlb.yaml

A minimal config

Proxy example.com to two backends over automatic HTTPS:

tls:
  acme:
    enabled: true
    contacts: ["mailto:you@example.com"]
    terms_of_service_agreed: true
    domains: [example.com]

listeners:
  - { name: https, address: "0.0.0.0:443", tls: { managed: true }, http2: true, ipv6: true }  # ipv6: also bind [::]:443

upstreams:
  app:
    algorithm: power_of_two
    backends: [{ addr: "10.0.0.1:8080" }, { addr: "10.0.0.2:8080" }]
    health_check: { kind: http, path: /healthz }

routes:
  - { name: app, match: { host: example.com }, upstream: app }

security:
  enabled: true
  rate_limit_rps: 100
  ban_paths: [/.env, /.git/, /wp-login.php]

Twenty-odd lines, and this edge now issues its own certificate, balances across two backends with health checks, retries around a dead one, and bans scanners probing for .env files — on IPv4 and IPv6 both. Every other mode it supports is on the configuration page →

Is it for you?

omlb fits when your edge is a box or two — a VPS, bare metal, the homelab that became load-bearing — and you'd rather run one process than four. It expects backends it can read from the config or find as labeled containers on the same host. It won't chase Kubernetes endpoints or Consul entries around, and it has no mTLS, HTTP/3, or regex routing yet — if any of those are load-bearing for you, take Traefik or Envoy with our blessing. The comparison page is honest about all of it, symbol by symbol.