A comprehensive open source load balancer

What comprehensive actually means

Plenty of things call themselves an open source load balancer. Most of them will happily spread requests over a list of servers, which is the easy part. The gap between that and a site you can leave running shows up in the jobs nobody puts on the feature list.

The whole list

Forty six feature pages, each one saying what the thing is for, where it falls short and what to use instead when it is the wrong tool. Grouped by what you are trying to do:

Traffic

• Sites One hostname and every rule that goes with it.
• Backend pools The list of servers behind a site, and how traffic is shared.
• Active health checks Probe every backend on a schedule and pull the dead ones out.
• Load balancing methods Round robin, least connections, hashing and consistent hashing.
• Sticky sessions Send the same visitor back to the same backend.
• Slow start Ease traffic onto a server that just came back.
• Adaptive weighting Give the faster backends more of the work.
• Path routing Send /api one way and everything else another.
• TCP and UDP proxying Balance a database, a mail server or a game server.
• Caching Keep a copy of what does not change and stop asking for it.
• Rate and connection limits Cap how fast and how much one visitor can ask for.
• Error pages Replace the bare nginx error with something of your own.
• Maps and key value lookups One lookup table, used by as many sites as you like.
• Static files and redirects Serve files off disk or forward an old address.

Certificates and TLS

• Let's Encrypt certificates Free certificates that renew themselves, in a cluster.
• Certificate lifecycle Issue, renew, replicate and retire, without a calendar.
• Paid certificate authorities Buy from DigiCert or Sectigo and still automate it.
• Post quantum key exchange X25519MLKEM768 first, classic curves behind it.
• TLS settings Protocols, ciphers, stapling and HTTP/2 or HTTP/3.
• Backend TLS Speak https to your own servers, and verify it properly.

Security

• Web application firewall ModSecurity with the OWASP Core Rule Set, per site.
• WAF learning sessions Watch real testing, then keep only the exceptions you need.
• WAF profiles One tuned rule set shared by every site that needs it.
• Country blocking Cut scanner noise and meet a rule about where you serve.
• Login watch Catch password spraying, not just brute force.
• Access lists Who may reach a site, by address, with a password on top.
• Backend trust tokens Prove to your own servers that a request came from the fleet.
• Users, roles and TOTP Three roles, a second factor, and recovery codes.
• Single sign on OIDC with PKCE, groups mapped to roles.
• Audit log Who changed what, when, and from where.
• How the software is hardened An unprivileged container and a small root agent.

Fleet

• Clustering Every node holds the whole config. No central controller.
• Two phase apply Nothing goes live until every node says the config is valid.
• Active and standby One node takes changes, both serve traffic.
• DNS failover and GSLB Hand out the address of a node that is actually up.
• The tunnel Reach a backend that has no public address at all.
• The nginx build nginx from source with 80 modules, rebuilt from the GUI.
• Upgrades One node at a time, tested before anything is replaced.
• Backup and restore One encrypted file that rebuilds the fleet somewhere else.
• Change history and rollback Every apply kept, and put back with one click.
• Import an existing config Read the nginx you already run and see what it becomes.

Visibility

• Utilization charts Requests, connections, processor and memory over time.
• The dashboard What every node is doing, on one screen.
• The JSON API Everything the GUI does, available to a script.

Built on nginx, not hiding it

nginx does the work. This drives it. Every site becomes a server block, every pool becomes an upstream, and the generated config is on screen at any time for you to read before it goes live. There is no proprietary data plane and no lock in, because the thing serving your traffic is the same nginx everybody else runs.

It is built from source with around eighty modules, which is considerably more than the distribution package carries, and it can be rebuilt from the GUI when you need one more. The module list says exactly what is compiled in.

What it does not do

A comprehensive tool that pretends to have no gaps is just an incomplete tool with better marketing. The honest list:

• It is not a CDN. There are no edge locations, and DNS steering is not the same thing as serving from a city near your visitor.
• There is no Kubernetes ingress controller. If your world is Kubernetes, use an ingress controller made for it.
• There is no service mesh integration and no sidecar story.
• There is no vendor to call at three in the morning. That is the real trade for the price.

The comparison pages go further, including where the paid products genuinely win.