Features

Everything Ferron ships with: automatic TLS, modern HTTP, reverse proxying, and observability that makes production debugging fast.

Foundation

One binary, production-grade defaults

Ferron is written in Rust and ships as a single binary with safe defaults, so there is less to install, less to tune, and less that can go wrong.

Memory-safe by construction

The entire server is written in Rust, so whole classes of memory-safety bugs that plague C-based servers simply do not exist. No buffer overflows, no use-after-free.

  • No significant C dependencies in the hot path
  • Safe concurrency without data races

Single static binary

One file to deploy and upgrade. No interpreter, no runtime to install, no dependency sprawl on your servers.

  • Systemd, Docker, and bare-metal friendly
  • Replace-the-binary upgrades

Async runtime, tuned by default

A multithreaded async runtime drives predictable performance under load with no tuning knobs required. On Linux, io_uring accelerates large static files and high-concurrency proxying, with automatic fallback.

  • Predictable under high concurrency
  • Optional io_uring with epoll fallback
See the benchmarks

Runs where you run

Prebuilt packages and images cover the platforms production actually uses, from servers to Raspberry Pis and mainframes.

  • Linux, Windows, macOS, FreeBSD, Docker
  • x86-64, ARM64, ARMv7, RISC-V, s390x, PowerPC
Get Ferron

Configuration

Configuration is a feature

A compact, readable config file replaces sprawling server blocks. Validate it before you deploy, reuse pieces across hosts, and reload without dropping connections.

Readable config files

Host blocks with plain directives say what they mean. A reverse proxy with automatic TLS is two lines, not twenty.

  • Compact block syntax (.conf)
  • JSON config for automation
Read the docs

Reuse, don't repeat

Snippets, includes, and named matchers let you define a pattern once and share it across every host you serve.

  • Snippets and file includes
  • Reusable conditional matchers
Read the docs

Validate before you deploy

Catch mistakes on your machine, not in production. Validation checks syntax and structure; doctor adds best-practice warnings.

  • ferron validate for syntax and structure
  • ferron doctor for best practices
Read the docs

Reload without downtime

Apply new configuration without dropping connections, via a signal or the admin API. The API also exposes status and runtime endpoints for health checks and inspection.

  • SIGHUP and POST /reload
  • GET /status and /runtime endpoints
Read the docs

Automatic TLS

TLS you never think about

Public hosts get certificates issued and renewed automatically. Private infrastructure gets its own CA. Either way, secure defaults apply without extra configuration.

Automatic certificates

ACME issuance and renewal happen on their own for public hosts, with any RFC 8555-compliant CA. HTTP-to-HTTPS redirects are on by default.

  • Let's Encrypt and any ACME CA
  • HTTP-01, TLS-ALPN-01, and DNS-01 challenges
  • Automatic renewal before expiry
Read the docs

On-demand issuance

Serve domains you don't know ahead of time. Certificates are issued lazily on first connection, so SaaS-style custom domains scale without pre-provisioning.

  • Lazy first-connection issuance
  • Scales to thousands of domains
Read the docs

Bring your own trust

Not everything faces the public internet. Use your own certificates or run an internal CA for private services and development.

  • Manual certificates and keys
  • Local CA for internal networks
  • mTLS client authentication
Read the docs

Hardened transport

Modern protocol versions and safe cipher defaults, plus the details that keep TLS fast and trustworthy over time.

  • TLS 1.2 and 1.3 with safe defaults
  • Automatic OCSP stapling with caching
  • Session ticket key rotation
Read the docs

HTTP server

Serve, proxy, and run apps

One server for static sites, reverse-proxied backends, and PHP or CGI apps, with routing, caching, and compression built in rather than bolted on.

Modern protocols by default

HTTP/1.1, HTTP/2, and HTTP/3 are all enabled out of the box. Clients negotiate the best transport they support with nothing to configure.

  • HTTP/1.1, HTTP/2, H2C, HTTP/3
  • Production-ready QUIC throughput
Read the docs

Static file serving

Point a host at a directory and you're done: index files, directory listings, and precompressed sidecars for faster downloads.

  • Index files and directory listings
  • Precompressed zstd, Brotli, and gzip sidecars
Read the docs

Reverse proxy and load balancing

Forward to one backend or balance across many, with pluggable strategies, health-aware routing, and retries that can't cascade into storms.

  • random, round-robin, least-conn, p2c-ewma
  • Circuit breaking and active health checks
  • Retry budgets against cascading failures
  • DNS SRV and multi-IP upstream discovery
Read the docs

PHP, CGI, and forward proxy

Host classic apps directly: PHP via FastCGI, legacy CGI and SCGI workloads, or act as a forward proxy for controlled egress.

  • PHP-FPM via FastCGI
  • CGI and SCGI support
  • Forward proxy mode
Read the docs

Routing and rewriting

Match requests on path, method, headers, IP, or expressions, then rewrite, redirect, map variables, or split traffic for canary deploys.

  • Composable conditional matchers
  • Rewrites, redirects, and variables
  • Canary traffic splitting
Read the docs

Compression and caching

Shrink responses on the fly and serve repeat requests from cache, including an LSCache-compatible edge cache that accelerates WordPress.

  • gzip, Brotli, deflate, and zstd
  • File and edge caching
  • LSCache-compatible WordPress acceleration
Read the docs

Access control and abuse defense

Layered defenses at the edge: authentication, rate limits, automatic bans for misbehaving clients, security headers, and mTLS.

  • Basic auth and forwarded auth
  • Rate limiting and automatic abuse bans
  • Security headers and mTLS
Read the docs

Observability

Built for production debugging

When something breaks at 3 AM, Ferron shows you exactly what happened to any request: correlated across logs, traces, and metrics instead of scattered across tools.

Trace IDs on every request

Every request carries a trace ID through logs and upstreams, following the W3C Trace Context standard. Find one ID, find the whole story.

  • W3C traceparent and baggage propagation
  • Trace ID echoed in responses and logs
Read the docs

Correlated structured logs

Access and application logs in JSON or text, linked by trace ID so a single grep reconstructs the full request path across services.

  • JSON and text formats
  • Per-host access logs
  • Single-grep debugging
Read the docs

OTLP-native tracing

Export spans and logs over OpenTelemetry Protocol to Jaeger, Tempo, or your collector of choice: no sidecars or agents required.

  • OTLP export built in
  • Works with any OTLP collector
Read the docs

Prometheus metrics and dashboards

A scrape endpoint exposes server and proxy health in Prometheus format, with ready-made Grafana dashboards for traffic, backends, and TLS.

  • Prometheus scrape endpoint
  • Ready-made Grafana dashboards
  • StatsD output also available
Read the docs

Operations

Friendly to operators and automation

A helpful CLI, machine-readable config, and a local admin API make Ferron easy to run by hand and easy to run at scale.

A CLI that helps

Run, validate, convert, and daemonize from one binary, with debug logging one flag away when you need to see what the server sees.

  • run, validate, adapt, daemon
  • --verbose debug logging
Read the docs

Config as data

Adapt the human-friendly config to JSON for auditing, diffing, and generation by your existing tooling. The admin API serves the live config too.

  • ferron adapt to JSON
  • Live config via admin API
Read the docs

Runtime inspection

Ask the running server how it's doing: uptime, connections, request counts, reload history, and per-backend proxy health.

  • Status and runtime endpoints
  • Proxy upstream health visibility
Read the docs

Automation-ready

Reloads over HTTP, health endpoints for supervisors and load balancers, and file-plus-memory certificate storage that survives restarts.

  • HTTP-triggered reloads
  • Supervisor-friendly health checks
Read the docs

Not sure which path fits?

Compare configuration patterns in the docs, then try Ferron in minutes.

Documentation Download