BareProxy is a small kernel with a stream of plugins on top. The kernel is a web server and reverse proxy: TLS, routing, files straight from a folder, health checks, and config changes that drop nothing. Everything else is a plugin, a sandboxed WebAssembly app you add with one config line: AI crawler control, prerendering for bots, caching, logins, analytics and more, twenty-one on the way. Whatever runs, BareProxy tells you what happened to every request and why. Open source under the Apache License 2.0, for Linux, macOS and Windows.
5,437
Lines of Go in the core and its command, plugin hook-ups included
11.6 MB
The stripped, static Linux amd64 binary with the plugin host, measured
151
Tests in the repository, unit and acceptance
2
Modules outside the standard library: x/crypto from the Go team, and wazero for plugins
The binary is the 0.3.0 build for Linux amd64, made with Go 1.27.1, with the plugin host. Lines and tests are counted on the current source, lines without tests, comments or blank lines. The test logs and the benchmark results are in the results folder of the GitHub repository.
release
BareProxy 0.2.0 is out, and it can run plugins. A plugin is a WebAssembly module, written to Proxy-Wasm, the plugin interface Envoy and Istio use, and run on wazero, a …
release
BareProxy 0.3.0 is out. It doesn’t ship a plugin yet. It settles how the plugins get written: in Rust, with the Proxy-Wasm Rust SDK, the same one Envoy plugins use. …
platform
BareProxy started as a question: how little machinery does it take to do the part of nginx most sites use? The answer turned out to be a small core. With plugins in place …
plugins
BareProxy’s core stays bare. Everything else comes as plugins, and a plugin is now a WebAssembly module that BareProxy loads at run time. That replaces the earlier …
release
Every BareProxy release comes in five builds: Linux on x86-64 and ARM, macOS on Apple silicon and Intel, and Windows on x86-64. The plugins don’t come in builds at …
release
BareProxy 0.1 Alpha is out. It adds the part of the design that makes a config change safe: plan says which requests a change will hand to a different place, apply makes …
platform
Most sites use a small part of nginx. They terminate TLS, serve a folder, route by host and path, spread requests over backends that are up, change config without …
plugins
Status: planned, number 7 of 21 in BareProxy’s build order. The plugins are built easiest first, and this one is about a day of coding: a cookie and a header; the …
plugins
Status: planned, number 10 of 21 in BareProxy’s build order. The plugins are built easiest first, and this one is a day or two of coding: bot rules, address lists …
Download BareProxy from GitHub and point it at a Hugo build, or at an nginx config you'd like to shrink. Then write and say which plugin you'd want first.