Proxying and Routing

Route HTTP, HTTPS, WebSocket, and gRPC traffic to upstream services. Longest-path matching maps requests to backends. Serve static files directly without an upstream.

Load Balancing and Health

Distribute traffic across backends with round-robin, weighted, or failover strategies. Circuit breakers and health checks remove unhealthy upstreams automatically.

Automatic TLS

Certificates are issued and renewed automatically through Let's Encrypt or any compatible ACME CA. Manual certificate configuration is also supported.

Traffic Policy

Rate limiting, network policy enforcement, identity resolution, and request filtering run as composable middleware in the request pipeline. Request smuggling protection is applied automatically.

Extensibility

Write custom middleware in any language that compiles to WebAssembly. Extensions run in a sandboxed environment with access to request and response context.

Observability

Structured logging, OpenTelemetry tracing, and an admin API for health checks, upstream status, traffic statistics, and live configuration reload.