Operator guide

Quick start

Start with a local listener, a health-checked upstream pool, and one exact-host route. Validate before OMLB binds a socket.

What to evaluate

OMLB is a Rust HTTP reverse proxy and load balancer with a single YAML configuration. It can terminate TLS, serve HTTP/1.1 and HTTP/2, optionally serve HTTP/3 on a TLS listener, route requests to named pools, run active health checks, and expose separate local control-plane endpoints.

Use it where static pools, Docker-managed pools, DNS SRV, or Consul catalog discovery fit the deployment. Read upstreams and discovery before choosing a backend source, and treat HA as a two-node, same-L2 VIP design rather than a general cluster manager.

Build and validate

cargo build --release -p omlb
./target/release/omlb --check --config config/omlb.yaml
./target/release/omlb --config config/omlb.yaml

--check loads the base file and any Web UI overlay, parses the schema, and runs cross-reference and safety validation. It exits before starting the proxy. The normal process also watches the configuration file; a changed file is loaded and either applied or rejected while the last accepted configuration continues serving.

Smallest useful HTTP config

listeners:
  - name: public
    address: "0.0.0.0:8080"

upstreams:
  app:
    algorithm: power_of_two
    backends:
      - addr: "127.0.0.1:9001"
      - addr: "127.0.0.1:9002"
    health_check:
      kind: http
      path: /health

routes:
  - name: app
    match: { host: app.example.com }
    upstream: app

The routing table is ordered: the first route whose match succeeds handles the request. Here, only Host: app.example.com reaches app. Use a route without a host constraint as an intentional catch-all, and place it last.

First production checks

  1. Run --check against the exact file to deploy.
  2. Verify each backend health URL and its expected status before putting the listener in front of clients.
  3. Keep admin, metrics, and Web UI listeners on loopback; access them through a protected tunnel or local collector.
  4. For TLS, use the TLS guide and confirm the ACME challenge path is reachable before changing DNS.

Continue with the configuration model and reload boundary for the fields that require a graceful restart.