Roadmap

BareProxy is an operating system for web traffic: a small kernel, and a stream of plugins on top of it. The kernel came first. Now the plugins come, one at a time, easiest first. Each step ships when its tests pass and its numbers are measured.

Stage What it brings Status
0.1 Alpha The core as a web server and reverse proxy, with explain, why and plan, safe config changes, automatic certificates, a browser demo and measurements against nginx. Open source under Apache 2.0, with Linux binaries Done
0.1.0 The Alpha’s code as the first release on GitHub, with binaries for Linux, macOS and Windows, and releases that build, test and publish themselves Done
Next More hardening, and macOS and Windows run further than the release smoke test Next
0.2.0, plugin host WebAssembly plugins loaded at run time, through wazero and the Proxy-Wasm interface, shown in why, explain, plan, status and the history Done
0.3.0, plugins in Rust A workspace for plugins written with the Proxy-Wasm Rust SDK, a Rust test plugin the host is tested with, plugin builds in CI and in every release, and cheaper calls into a plugin Done
0.4.0, plugins 1 and 2 Maintenance and failover pages and CORS, released as .wasm files with the binaries, and check catching a plugin config the plugin refuses Done
0.5.0, plugin 3 Header and rewrite rules, and a plugin’s own answer passing through the plugins before it, so a maintenance page carries CORS headers Done
0.6.0, plugin 4 Redirects from a file, and check catching a broken line in a file a plugin loads Done
0.7.0, plugin 5 Geo rules, with BareProxy’s own reader for country database files Done
0.8.0, plugin 6 Request signing: signed requests to the app, and links that expire Done
0.9.0, plugin 7 A/B and canary splits, with the routing left to the core’s own rules Done
0.10.0, plugin 8 Rate limiting and basic WAF, with counters BareProxy keeps for all of a plugin’s instances Done
0.11.0, plugin 9 Link previews, the last of the quick ones Done
0.12.0, plugin 10 AI crawler control, each bot’s claim checked against the addresses its operator publishes Done
0.13.0, plugin 11 Bot challenges, a proof-of-work puzzle for clients that say they’re browsers, with nothing kept per visitor Done
0.14.0, plugin 12 Markdown serving, Markdown files served as web pages straight from a folder, with no build step Done
0.15.0, plugin 13 Cookie consent, a banner with no JavaScript, and cookies and scripts held back until a visitor agrees Done
0.16.0, in the kernel A webhook inbox that keeps every event until the app takes it, and a DNS and TLS drift watcher for certificates and records Now
Plugins 14 to 16 Two or three days each: status pages, OpenTelemetry export, analytics Next
Plugins 17 to 21 The longest: auth gate, response cache, the AI crawler payment gate, the image optimizer and RenderCache Planned
Later HTTP/2 to backends, and with it gRPC; the PROXY protocol from load balancers in front Planned

Built in the Alpha

The first cut of 2 October had the core: the config grammar, routing, static files, pools with health checks, HTTPS from certificate files, one record per request, explain and why. The Alpha adds the rest of what makes a config change safe, the tools around it, and automatic certificates.

  • plan. Says which requests a config change hands to a different place, and warns about a rule that can never match.
  • apply with plan IDs. Checks the whole config, shows the plan and swaps it in at once. A plan ID makes it refuse if anything changed since the plan was made.
  • rollback and history. The last 100 versions are kept, and any of them can go live again.
  • Draining. A removed backend gets no new requests, and requests already on it finish.
  • Listener changes without a restart. A config can add or remove a port while the server runs.
  • A broken file at startup. BareProxy runs the last good version and says so.
  • Automatic certificates. An HTTPS site with tls auto, or with no tls line, gets a certificate from Let’s Encrypt or any ACME CA. BareProxy keeps it in the state folder and renews it 30 days before it expires. Wildcard and catch-all sites still need certificate files. It is tested against Let’s Encrypt’s Pebble test CA, and not yet against Let’s Encrypt itself.
  • Tracing, finished. tail, status and events; an in-memory record store, so why finds recent requests fast; trace log rotation; and W3C traceparent, so records line up with the application’s own traces.
  • A browser demo. The real code compiled to WebAssembly: check a config, explain a request, plan a change.
  • Acceptance tests. Generated requests checked against explain, generated config pairs checked against plan, broken configs, and traversal and smuggling cases.
  • A load test at the design’s full size. 2,000 requests per second for 60 seconds over HTTP/1.1, HTTP/2 and WebSocket, with 20 applies during the run. It sent 120,020 requests and messages, with 0 failed, 0 connections reset and 0 WebSocket messages lost. The log, load-test.log, is in the results folder of the repository.
  • Measurements against nginx. Speed, memory and binary size, with the same routes on the same machine, measured on the final build of the Alpha. nginx handled 1.9 to 3.2 times as many requests per core (computed from the best runs), and BareProxy isn’t built to beat it on speed. The bench summary and the test logs are in the results folder of the repository.

The Plugin Stream

The plugin host is in 0.2.0, and plugins in Rust are set up in 0.3.0. The plugins come next, written in Rust, easiest first, so each one ships as soon as it can. The estimates are coding time; each plugin also gets its tests and its page updated before it ships.

  1. Maintenance and failover pages, built, in 0.4.0
  2. CORS, built, in 0.4.0
  3. Header and rewrite rules, built, in 0.5.0
  4. Redirects from a file, built, in 0.6.0
  5. Geo rules, built, in 0.7.0
  6. Request signing, built, in 0.8.0
  7. A/B and canary splits, built, in 0.9.0
  8. Rate limiting and basic WAF, built, in 0.10.0
  9. Link previews, built, in 0.11.0
  10. AI crawler control, built, in 0.12.0
  11. Bot challenges, built, in 0.13.0
  12. Markdown serving, built, in 0.14.0
  13. Cookie consent, built, in 0.15.0
  14. Uptime checks and status pages, two or three days of coding
  15. OpenTelemetry export, two or three days of coding
  16. Analytics without JavaScript, about three days of coding
  17. Auth gate, three or four days of coding
  18. Response cache, three or four days of coding
  19. AI crawler payment gate, four or five days of coding
  20. Image optimizer, about a week of coding
  21. RenderCache, one to two weeks of coding

The plugins that need a helper program beside BareProxy (an image encoder, a headless browser) come last. Alongside the plugins: more hardening of the kernel, and macOS and Windows taken further than the smoke test each release passes today. The plugin catalog groups every plugin by area.

What Stays Fixed

Every stage keeps the core’s rules. Matchers stay exact values, prefixes or sets, and a bad config never replaces a good one. New features arrive as plugins unless every site needs them; the kernel stays small.

How to Take Part

The code repository on GitHub has the code, and its releases page has the binaries for Linux, macOS and Windows. Teams who would like to run a pilot on their own site or traffic can get in touch.