One Slash in front of everything.
Web server. Reverse proxy. Ingress controller.
Slash is a web server, reverse proxy and Kubernetes Ingress controller written from scratch in Rust. HTTP/3 and automatic HTTPS out of the box, configured with one short file.
Every request, handled once.
Slash terminates TLS, inspects the request, compresses the response and routes it to a site, a PHP app, a container or a pod. One process, one configuration, no modules to compile.
A typical server
This is a typical server today.
A config file nobody wants to touch. Certificates renewed by a cron job. A firewall module compiled by hand.
Every new site is another block copied from the last one, then a reload, then a hope that nothing dropped.
Slash replaces that with one file you can read in a minute.
Slashfile
Four sites. Five lines.
email admin@example.com
example.com, www.example.com proxy localhost:3000
blog.example.com wordpress /var/www/blog
api.example.com laravel /var/www/api
docs.example.com files /srv/docs
That is a complete Slashfile: automatic HTTPS from Let’s Encrypt, HTTP/3, PHP through php-fpm and static files.
slash check validates it with line numbers and suggestions for typos. slash reload validates again, then swaps the new configuration in atomically without dropping a connection.
Where it fits
Serve it, or stand in front of it.
- Web server
- Static files are read directly, PHP runs through php-fpm with WordPress and Laravel presets. One binary in place of Nginx or Apache on a single server.
- Reverse proxy
- In front of Node.js, Go, Java, Python or Docker containers. Slash handles TLS, the WAF, load balancing and health checks; your applications speak plain HTTP.
- Ingress controller
slash-ingressruns next to Slash in the pod, reads Ingress v1 objects and understands common ingress-nginx annotations, so existing Ingresses move over unchanged.
HTTP/1.1, HTTP/2, HTTP/3, WebSocket, gRPC, TCP, UDP and TLS passthrough by SNI.
AssaultCuirass WAF
Armour for every request.
Heavy-Duty, Memory-Safe Web Application Firewall Powered by Rust.
AssaultCuirass runs the OWASP CRS v4 request rules on Slash’s own Rust engine. No ModSecurity, and every regular expression runs in linear time, so a crafted request cannot stall it.
- 89.5% attacks blocked at paranoia level 1
- 0.13 ms cost per clean request
- 37,000 payloads in the test set
shop.example.com proxy localhost:3000
waf # detect: log only
/api waf block # answer 403 here
waf skip 942430 ARGS:search # a false positive
SPMPlus
A panel, when you want one.
SPMPlus (Slash Proxy Manager Plus) is the optional reverse proxy manager for Slash. Proxy and panel are separate processes, so Slash keeps serving visitors while the panel is stopped or updated.
Every change is validated, shown as a diff, swapped in atomically and recorded in the version history. Admins sign in with passkeys or TOTP.
Built in
Nothing to bolt on.
- Let’s Encrypt: HTTP-01, TLS-ALPN-01, DNS-01 (Cloudflare) and ARI, or upload your own certificates
- Round-robin load balancing with active and passive health checks
- zstd, Brotli and gzip compression, plus a micro-cache
- Rate limiting per route, answered with
429andRetry-After - Security header preset per host, on by default
- Real client IPs behind load balancers: trusted proxies, PROXY protocol v1/v2
- Static files and single-page apps; dotfiles and escaping symlinks are never served
- Hot reload: validated first, swapped atomically
- TLS 1.3, argon2id, secrets encrypted at rest
Performance
Measured, not promised.
- 92,169 requests per second, 1,000 HTTP/1.1 connections
- 0 errors with 10,000 concurrent HTTPS users
- 28 MB Slash at idle
- 60 KB or less per open connection
bench/concurrency.sh on one i5-10600 (6 cores) under WSL2, with the load generator, a test upstream and Slash sharing the same CPU.