About

BareProxy is an operating system for web traffic, at an early stage. It started by asking how little machinery it takes to provide the part of nginx that most sites and applications use, and answers with a small kernel and a long stream of plugins around it. Version 0.3.0 is out, with a host for WebAssembly plugins and plugins written in Rust: open source, with binaries for Linux, macOS and Windows on the releases page. This site shows where the project stands.

Why the Project Exists

Most sites use a small part of nginx. They need TLS, a folder served as a site, routing by host name and path, requests spread over backends that are actually up, config changes that don’t drop traffic, and a way to find out what happened to a request when something breaks. The servers that do this well carry decades of features most sites never touch. Each of those features is code that runs at the edge, in front of everything else.

Two events made the project worth starting. Cloudflare’s outages of 18 November and 5 December 2025 both began with a config change that reached every server within seconds. Then in May 2026, NGINX Rift showed that a heap overflow had sat in nginx’s rewrite module since 2008. BareProxy’s answer to both is less machinery. Every config is checked in full before it can go live, the code is memory-safe Go, and there is no regex rewrite engine to get wrong.

What the Project Is Building

  • The kernel: BareProxy Core. TLS, routing, static files, backend health, live config changes and request tracing, in one binary. The platform
  • The apps: plugins. WebAssembly plugins loaded at run time, each in its own sandbox, written in any language. The plugin host is in 0.2.0, 0.3.0 sets up plugins in Rust, 0.4.0 ships the first two, maintenance and failover pages and CORS, 0.5.0 adds header and rewrite rules, and 0.6.0 redirects from a file. Twenty-one plugins are on the list, from maintenance pages and AI crawler control to caching, logins, analytics, canary releases and RenderCache, built easiest first. Each one is optional, and the core needs none of them. The plugin catalog
  • Tools that explain. why tells the story of any request, explain shows how a request would be handled, and plan says what a config change will do before it goes live. See them at work

How the Project Works

  • A small kernel. A feature every site needs goes in the core. Anything else becomes a plugin, or waits.
  • Explain everything. Every request leaves one record, and every decision can be explained by the same code that made it, whether it served a file or called a backend.
  • Measure, then say it. Speed and memory are measured against nginx with the same routes, and published with the commands that reproduce them. The measurements and test logs are in the results folder of the repository. A number on this site is either measured or marked as a design budget.

License and Availability

BareProxy 0.6.1 is open source under the Apache License 2.0. Copyright 2026 BareProxy.com. The code is on GitHub, and each release’s binaries for Linux (amd64 and arm64), macOS (Apple silicon and Intel) and Windows, with their checksums, are on its releases page. Releases are built, tested and published by the repository’s own workflow. The whole project is under Apache 2.0 for now. Later, premium add-ons may be offered under different licenses.

Linux is where BareProxy has been run in earnest; the macOS and Windows builds pass a smoke test on every release. The demo runs the real code in your browser, so you can see it work before you download anything.