8 ms·

Show HN: I'm rewriting a web server written in Rust for speed and ease of use

68 points by dorianniemiec 1y ago

Hello! I got quite some feedback on a web server I'm building, so I'm rewriting the server to be faster and easier to use. I (and maybe some other contributors?) have optimized the web server performance, especially for static file serving and reverse proxying (the last use case I optimized for very recently). I also picked a different configuration format and specification, what I believe is easier to write. Automatic TLS is also enabled by default out of the box, you don't need to even enable it manually, like it was in the original server I was building. Yesterday, I released the first release candidate of my web server's rewrite. I'm so excited for this. I have even seen some serving websites with the rewritten web server, even if the rewrite was in beta. Any feedback is welcome!

luckydata 1y ago
what are the advantages vs something like https://caddyserver.com https://caddyserver.com?
- nicce 1y ago
  It is about min-maxing. If you have backend written in Rust which uses Hyper, for example, Caddy will be bottleneck. Depending of course from the type of the backend (is it limited by other I/O and Caddy bottleneck does not matter)
- Quarrel 1y ago
  I've never used ferron, but if you look at the graphs, he gives comparisons. So, I guess, performance + easy of use. Obviously, caddy is much more mature though.
  - oldpersonintx2 1y ago
    [dead]
earthnail 1y ago
Edit: just tried it for serving a fastapi. It's fantastic. Instant TLS via Let's Encrypt. There may be other webservers that are equally easy, but this one is certainly easier than Apache or ngninx, which I used so far. Love it. -- Reach out to the guys at Kamal. They wrote their own reverse proxy because they thought Traefik was too complex, but they might be super happy about yours if Ferron is more powerful yet easy to configure because it might solve more of Kamal’s problems. Not affiliated with Kamal at all, just an idea.
- zsoltkacsandi 1y ago
  They wrote their proxy because the declarative configuration of the existing proxies does not fit into their deployment flow.
- dorianniemiec 1y ago
  Thank you so much! I want to put a line from your comment on Ferron's website as social proof. :)
  - earthnail 1y ago
    Absolutely, go for it. Feel free to use my real name if you want to: https://linkedin.com/in/tcwalther https://linkedin.com/in/tcwalther I previously founded and sold an AI startup to Spotify; that doesn't actually make me smarter than the average HN user (mostly just more lucky) but it probably looks nice on a social proof section.
mynewaccount00 1y ago
> Security is imperative > Install with sudo curl bash
- theandrewbailey 1y ago
  It's the Linux equivalent of downloading and running random binaries in Windows.
  - voidUpdate 1y ago
    *running as administrator
    - magackame 1y ago
      Gonna steal all your files, passwords and crypto as a regular user anyway?
- tonyhart7 1y ago
  lmao
- hacker_homie 1y ago
  This is kinda funny, but what is a better alternative for new projects on Linux?
  - gregoriol 1y ago
    Why not the usual package repositories and distribution by the official ones?
    - jraph 1y ago
      That's a slow process and you need someone to do the packaging, either yourself or a volunteer, and this for each distro. Which is not trivial to master and requires time. The "new" qualifier in the parent comment is key here. Open build service [1] / openSUSE Build Service [2] might help a bit there though, providing a tool to automate packaging for different distributions. [1] https://openbuildservice.org/ https://openbuildservice.org/ [2] https://build.opensuse.org/ https://build.opensuse.org/
johnofthesea 1y ago
Just for curiosity there is also: https://github.com/cablehead/http-nu https://github.com/cablehead/http-nu Which seems like interesting UX.
k_bx 1y ago
I was previously waiting for River https://github.com/memorysafety/river/ https://github.com/memorysafety/river/ to take off, it's built on top of previously open-sourced library by Cloudflare for revese-proxying, but just like many other "grant-based" projects it just died when funding stopped. I really like the spirit and simplicity of Ferron, will try it out when I have a chance. Been waiting for gradually throw out nginx for a while now, nothing clicked all the checkboxes.
- dorianniemiec 1y ago
  Thank you! Excited to see what will you serve with Ferron.
rvz 1y ago
This has a good chance to succeed. Good luck.
- dorianniemiec 1y ago
  Thank you!
GrayShade 1y ago
Hey! Sorry, I didn't get the chance to test it yet (like I promised when you launched), but can you say more about the rewrite? The title made me think you're porting it from Rust to another language :-).
- dorianniemiec 1y ago
  No problem! I'm rewriting the codebase of Ferron (the rewrite is still in Rust), to follow some suggestions people made for the web server (faster async runtime, different configuration format). The original codebase would have been bit hard to work on to follow these suggestions...
jokethrowaway 1y ago
Kudos! This is great, I started working on a similar project but never had the discipline to sit through all the edge cases. Maybe I'll start building it on top of ferron! I would love to have a minimalistic DIY serverless platform where I can compile rust functions (or anything else, as long as it matches the type signature) to a .so, dynamically load the .so and run the code when a certain path is hit. You could even add JS support relatively easily with v8 isolates. Lots of potential!
- dorianniemiec 1y ago
  Thank you! :) Wishing the best for your concept too!
selectnull 1y ago
There is something funny going on in the benchmarking section. If you look at the charts, they don't benchmark the same servers in 4 examples. Each of the 4 charts have data for Ferron and Caddy, but then include data for lighttpd, apache, nginx and traefik selectively for each chart, such that each chart has exactly four selected servers. That doesn't inspire confidence.
- troupo 1y ago
  > That doesn't inspire confidence. The problems start even higher on the page in "The problem with popular web servers" section that doesn't inspire confidence either. From "nginx configs can become verbose" (because nginx is not "just" a web server [1]) to non-sequiturs like "Many popular web servers (including Apache and NGINX) are written in programming languages and use libraries that aren't designed for memory safety. This caused many issues, such as Heartbleed in OpenSSL" [1] Sidetrack: https://x.com/isamlambert/status/1979337340096262619 https://x.com/isamlambert/status/1979337340096262619 Until ~2015, GitHub Pages hosted over 2 million websites on 2 servers with a multi-million-line nginx.conf, edited and reloaded per deploy. This worked incredibly well, with github.io ranking as the 140th most visited domain on the web at the time. Nginx performance is fine (and probably that's why it's not included in the static page "benchmark")
  - sim7c00 1y ago
    its funny he mentions unsafe code in apache and nginx and then complains about openSSL bug (one thats more than 10 years old btw). if this is a sense of the logic put into the application, no memory safe language will save it from the terrible bugs!
    - dorianniemiec 1y ago
      Heartbleed might be more than 10 years old, but it was a serious vulnerability indeed... From https://www.heartbleed.com https://www.heartbleed.com > The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users. Also, the program being memory-safe doesn't mean it's bug-free, other bugs not related to memory safety exist (like path traversals are due to improper sanitation or checking of the input).
supermatt 1y ago
Looks awesome, but the docs page seems to be returning a 200 yet is completely empty and is showing `x-ferron-cache: HIT` header. Maybe a misconfiguration somewhere?
- atraac 1y ago
  Works perfectly fine here in Brave/Chromium
  - supermatt 1y ago
    Not sure if this will help to debug. Definitely not working for me in Safari. Could be a downstream cache I guess? The browser is using iCloud Private relay. I have "disable cache" checked in the network inspector. The only plugin installed is 1password, but I get the same problem when disabled. Restarted browser with same issue. Seems to work when in private mode, but not without. Summary URL: https://ferron.sh/docs https://ferron.sh/docs Status: 200 Source: Network Request Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9 Priority: u=0, i Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: none User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Safari/605.1.15 Response Accept-Ranges: bytes Cache-Control: public, max-age=900 Content-Encoding: br Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none'; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://analytics.ferron.sh https://analytics.ferron.sh; connect-src 'self' https://analytics.ferron.sh https://analytics.ferron.sh Content-Type: text/html Date: Tue, 21 Oct 2025 10:07:46 GMT ETag: W/"ba17d6fadf70c9f0f3b08511cd897f939b6130afbed2906b841119cd7fe17a39-br" Server: Ferron Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding, If-Match, If-None-Match, Range X-Content-Type-Options: nosniff x-ferron-cache: HIT X-Frame-Options: deny
habibur 1y ago
Looking at the graphs, I would recommend it would have been better to market it as "just as performant as nginx and htproxy" instead of "faster than all ...". While highlighting the simplicity as the added benefit above those all.
- amelius 1y ago
  But nginx has acquired a lot of features over the years, which has pros and maybe also cons.
- dorianniemiec 1y ago
  Thank you for the feedback! I did the reverse proxy benchmarks for NGINX, when someone opened a GitHub issue about missing NGINX benchmarks, and asked about benchmark comparisons. It turned out that yeah, Ferron is close to NGINX's reverse proxy performance.
Etheryte 1y ago
I know it's not popular to care about these things these days, but please consider a different installation mechanism than curl piped into sudo bash. It's irresponsible and normalizes a practice that never should've happened.
- olalonde 1y ago
  Can we stop with this nonsense already? If you trust them enough to run their server code, why wouldn't you trust them with the installation script?
  - adastra22 1y ago
    I don’t trust them enough to run as root.
    - udev4096 1y ago
      But you have to. Nginx, caddy, traefik, etc cannot run without root or even if you can, it would be way more limiting
      - QuantumNomad_ 1y ago
        Only for binding to ports under 1024 really, like 80 (http) and 443 (https). Once it has bound to the ports it can drop down to running as a low-privilege user (usually named www or httpd or similar). On Linux you can allow your program to bind to those ports even without running the program itself as root. https://superuser.com/questions/710253/allow-non-root-process-to-bind-to-port-80-and-443 https://superuser.com/questions/710253/allow-non-root-proces...
        dorianniemiec 1y ago
        When installed for example with the installer script, Ferron would run on a specialized user for running the web server. Ferron itself would also have "CAP_NET_BIND_SERVICE" capability set on its binary, so that it doesn't have to run as root.
rglullis 1y ago
> Any feedback is welcome! Read https://www.joelonsoftware.com/2006/12/09/simplicity/ https://www.joelonsoftware.com/2006/12/09/simplicity/ and ask yourself if you are truly solving anyone's problem or if you are just looking for a way to rationalize the amount of time you are spending on a hobby.
- ramon156 1y ago
  Wow, what a harsh comment. You make it sound like we should squeeze any form of efficiency out of people or you're wasting time
  - rglullis 1y ago
    > like we should squeeze any form of efficiency The complete opposite. It's OP that's trying to "optimize the web server for reverse proxying and static file serving", when what we have out there is more than enough. > or you're wasting time "Wasting time" is not a problem. If OP is doing working on things because it brings them pleasure and they are hoping to learn from it, more power for them. What bugs me about these types of posts is when people are set on the "build a better mouse trap" mentality and want others to validate them. It may sound "harsh" to you, but if I came up asking for "any type of feedback" when I'm trying to figure out if the idea is worth persuing, I'd be pretty upset if I kept chasing an invisible dragon because the community was more concerned about "hurting my feelings" instead of being upfront and give some warning like this might be interesting to you but it's not solving any real pain point. Keep that in mind when deciding if work on this will be worthwhile.
    - dorianniemiec 1y ago
      > It's OP that's trying to "optimize the web server for reverse proxying and static file serving", when what we have out there is more than enough. I have optimized it, so it would be faster than the original server I have been working on. > (...) give some warning like this might be interesting to you but it's not solving any real pain point. Keep that in mind when deciding if work on this will be worthwhile. If you feel the project isn't solving a real pain point for you, you don't have to use it! I was showcasing my web server to interested people on Hacker News.
austin-cheney 1y ago
I wrote my own web server from scratch last year the exact same reasons: starting from scratch with Apache and NGINX is too painful for my needs. Here are my learnings: * TLS (HTTPS) can be easily enabled by default, but it requires certificates. This requires a learning curve for the application developer but can be automated away from the user. * The TLS certs will not be trusted by default until they are added to the OS and browser trust stores. In most cases this can be fully automated. This is most simple in Windows, but Firefox still makes use of its own trust store. Linux requires use of a package to add certs to each browser trust store and sudo to add to the OS. Self signed certs cannot be trusted in OSX with automation and requires the user to manually add the certs to the keychain. * Everything executes faster when WebSockets are preferred over HTTP. An HTTP server is not required to run a WebSocket server allowing them to run in parallel. If the server is listening for the WebSocket handshake message and determines the connection to instead be HTTP it can allow both WebSocket and HTTP support from the same port. * Complete user configuration and preferences for an HTTP or WebSocket server can be a tiny JSON object, including proxy and redirection support by a variety of addressable criteria. Traffic redirection should be identical for WebSocks and HTTP both from the users perspective as well as the internal execution. * The server application can come online in a fraction of a second. New servers coming online will also take just milliseconds if not from certificate creation.
- dorianniemiec 1y ago
  Oh, nice to meet you! > TLS (HTTPS) can be easily enabled by default, but it requires certificates. This requires a learning curve for the application developer but can be automated away from the user. Yeah, these certificates can be obtained from Let's Encrypt automatically. > Everything executes faster when WebSockets are preferred over HTTP. An HTTP server is not required to run a WebSocket server allowing them to run in parallel. If the server is listening for the WebSocket handshake message and determines the connection to instead be HTTP it can allow both WebSocket and HTTP support from the same port. Oh, seems like an interesting observation!
NeutralWanted 1y ago
[dead]
yincong0822 1y ago
That’s awesome — congrats on reaching the release candidate stage! I’m curious about the performance improvements you mentioned. Did you benchmark against other Go web servers like Caddy or fasthttp? Also really like that you’ve made automatic TLS the default — that’s one of those “quality of life” features that make a huge difference for users. I’m working on an open-source project myself (AI-focused), and I’ve been exploring efficient ways to serve streaming responses — so I’d love to hear more about how your server handles concurrency or large responses.
- dorianniemiec 1y ago
  Thank you! > Did you benchmark against other Go web servers like Caddy or fasthttp? I have already benchmarked Ferron against Caddy! :) > so I’d love to hear more about how your server handles concurrency or large responses. Under the hood, Ferron uses Monoio asynchronous runtime. From Monoio's GitHub repository (https://github.com/bytedance/monoio https://github.com/bytedance/monoio): > Moreover, Monoio is designed with a thread-per-core model in mind. Users do not need to worry about tasks being Send or Sync, as thread local storage can be used safely. In other words, the data does not escape the thread on await points, unlike on work-stealing runtimes such as Tokio. > For example, if we were to write a load balancer like NGINX, we would write it in a thread-per-core way. The thread local data does not need to be shared between threads, so the Sync and Send do not need to be implemented in the first place. Ferron uses an event-driven concurrency model (provided by Monoio), with multiple threads being spread across CPU cores.
Gepsens 1y ago
Hey really cool. Am proficient in Rust if you need any help.
- dorianniemiec 1y ago
  Thank you! You can contribute to https://github.com/ferronweb/ferron https://github.com/ferronweb/ferron, if you want to.
ansc 1y ago
Great to see! Would love to try it, but I depend on graceful updates of configuration (i.e. adding and removing backends primarily). I can't find anything about that. Is it supported, either through updating configs or through API?
- dorianniemiec 1y ago
  Thank you! Yes, graceful restarts in Ferron are supported on Linux, Unix, and alike. You just need to send a SIGHUP signal to Ferron process, or simply do "systemctl reload ferron" or "/etc/init.d/ferron reload" as root.
npodbielski 1y ago
So I have to connect my domain to your IP adres? Why there is perfectly fine HTTP auth method for let's encrypt. This is strange and not necessary.
- dorianniemiec 1y ago
  Well, you're probably talking about the automatic TLS demo. People installing Ferron on their servers don't have to use this demo!
  - npodbielski 1y ago
    No, I do not think so. In the linked page there is mention: "Point a subdomain named ferrondemo of your domain name (for example, ferrondemo.example.com) to either: CNAME demo.ferron.sh or A 194.110.4.223" This is really strange and make my Spidey sense tingle. If the goal is to just point your domain to this server it should not require DNS auth. Just HTTP is fine. DNS sure if you want optimize reverse proxy, because that would be also possible to do via http auth for every subdomain separately. If you just need some www server quickly pointing your domain to some other dude domain is not the way to go. This feels weird.
    - dorianniemiec 1y ago
      > If you just need some www server quickly pointing your domain to some other dude domain is not the way to go. Yeah. But as I said before, people installing Ferron on their servers don't need to use this demo. Oh, and people using this demo don't need to install Ferron on their servers. I just added two notices to this demo: > Note: After completing the demo, it's recommended to delete the subdomain you have just created to prevent security issues. > This demo setup is optional and exists only to demonstrate automatic TLS functionality. You do not need to point any subdomain to demo servers for normal use of Ferron.
      - npodbielski 1y ago
        Oh you are the author. I think we do not understand each other. Look at this: https://letsencrypt.org/docs/challenge-types/#http-01-challenge https://letsencrypt.org/docs/challenge-types/#http-01-challe... If this is for demo, even more DNS is not necessary. Just code your web server to serve challenge for that particular Uri, and you are done. I do not think so that you need wildcard cert for the demo. Just fixed subdomain is fine. Also you do not have to wait for DNS to propagate with HTTP method.
sceptic123 1y ago
"I don't like nginx config so I'm going to write a whole application just so that I don't have to write nginx config". Maybe just write an nginx config generator instead? It's also interesting that the actual config looks quite a lot like nginx config.
HumanOstrich 1y ago
Your title is confusing. It sounds like you are rewriting a web server _already_ written in Rust to a _different_ language. Now that I'd be in favor of. "It's written in Rust so it's memory safe!"
- dorianniemiec 1y ago
  Ah... I also saw one more person confused about the title... By the way the rewrite is still in Rust.
renshijian 1y ago
Ferron provides a concise and efficient way to handle state management in front-end frameworks. It adopts a responsive design concept and can greatly simplify the development process of complex applications. Its clear API and lightweight architecture allow developers to quickly implement dynamic interfaces without sacrificing performance. Overall, it is a tool worth paying attention to in modern front-end development, especially for projects with high performance requirements
- dorianniemiec 1y ago
  But Ferron isn't a state management library for front-end frameworks, it's a web server!
66yatman 1y ago
I don't trust the benchmarks

68 points by dorianniemiec 1y ago

luckydata 1y ago

what are the advantages vs something like https://caddyserver.com https://caddyserver.com?

nicce 1y ago
It is about min-maxing. If you have backend written in Rust which uses Hyper, for example, Caddy will be bottleneck. Depending of course from the type of the backend (is it limited by other I/O and Caddy bottleneck does not matter)
Quarrel 1y ago
I've never used ferron, but if you look at the graphs, he gives comparisons. So, I guess, performance + easy of use. Obviously, caddy is much more mature though.
- oldpersonintx2 1y ago
  [dead]

earthnail 1y ago

Edit: just tried it for serving a fastapi. It's fantastic. Instant TLS via Let's Encrypt. There may be other webservers that are equally easy, but this one is certainly easier than Apache or ngninx, which I used so far. Love it. -- Reach out to the guys at Kamal. They wrote their own reverse proxy because they thought Traefik was too complex, but they might be super happy about yours if Ferron is more powerful yet easy to configure because it might solve more of Kamal’s problems. Not affiliated with Kamal at all, just an idea.

zsoltkacsandi 1y ago
They wrote their proxy because the declarative configuration of the existing proxies does not fit into their deployment flow.
dorianniemiec 1y ago
Thank you so much! I want to put a line from your comment on Ferron's website as social proof. :)
- earthnail 1y ago
  Absolutely, go for it. Feel free to use my real name if you want to: https://linkedin.com/in/tcwalther https://linkedin.com/in/tcwalther I previously founded and sold an AI startup to Spotify; that doesn't actually make me smarter than the average HN user (mostly just more lucky) but it probably looks nice on a social proof section.

mynewaccount00 1y ago

> Security is imperative > Install with sudo curl bash

theandrewbailey 1y ago
It's the Linux equivalent of downloading and running random binaries in Windows.
- voidUpdate 1y ago
  *running as administrator
  - magackame 1y ago
    Gonna steal all your files, passwords and crypto as a regular user anyway?
tonyhart7 1y ago
lmao
hacker_homie 1y ago
This is kinda funny, but what is a better alternative for new projects on Linux?
- gregoriol 1y ago
  Why not the usual package repositories and distribution by the official ones?
  - jraph 1y ago
    That's a slow process and you need someone to do the packaging, either yourself or a volunteer, and this for each distro. Which is not trivial to master and requires time. The "new" qualifier in the parent comment is key here. Open build service [1] / openSUSE Build Service [2] might help a bit there though, providing a tool to automate packaging for different distributions. [1] https://openbuildservice.org/ https://openbuildservice.org/ [2] https://build.opensuse.org/ https://build.opensuse.org/

johnofthesea 1y ago

Just for curiosity there is also: https://github.com/cablehead/http-nu https://github.com/cablehead/http-nu Which seems like interesting UX.

k_bx 1y ago

I was previously waiting for River https://github.com/memorysafety/river/ https://github.com/memorysafety/river/ to take off, it's built on top of previously open-sourced library by Cloudflare for revese-proxying, but just like many other "grant-based" projects it just died when funding stopped. I really like the spirit and simplicity of Ferron, will try it out when I have a chance. Been waiting for gradually throw out nginx for a while now, nothing clicked all the checkboxes.

dorianniemiec 1y ago
Thank you! Excited to see what will you serve with Ferron.

rvz 1y ago

This has a good chance to succeed. Good luck.

dorianniemiec 1y ago
Thank you!

GrayShade 1y ago

Hey! Sorry, I didn't get the chance to test it yet (like I promised when you launched), but can you say more about the rewrite? The title made me think you're porting it from Rust to another language :-).

dorianniemiec 1y ago
No problem! I'm rewriting the codebase of Ferron (the rewrite is still in Rust), to follow some suggestions people made for the web server (faster async runtime, different configuration format). The original codebase would have been bit hard to work on to follow these suggestions...

jokethrowaway 1y ago

Kudos! This is great, I started working on a similar project but never had the discipline to sit through all the edge cases. Maybe I'll start building it on top of ferron! I would love to have a minimalistic DIY serverless platform where I can compile rust functions (or anything else, as long as it matches the type signature) to a .so, dynamically load the .so and run the code when a certain path is hit. You could even add JS support relatively easily with v8 isolates. Lots of potential!

dorianniemiec 1y ago
Thank you! :) Wishing the best for your concept too!

selectnull 1y ago

There is something funny going on in the benchmarking section. If you look at the charts, they don't benchmark the same servers in 4 examples. Each of the 4 charts have data for Ferron and Caddy, but then include data for lighttpd, apache, nginx and traefik selectively for each chart, such that each chart has exactly four selected servers. That doesn't inspire confidence.

troupo 1y ago
> That doesn't inspire confidence. The problems start even higher on the page in "The problem with popular web servers" section that doesn't inspire confidence either. From "nginx configs can become verbose" (because nginx is not "just" a web server [1]) to non-sequiturs like "Many popular web servers (including Apache and NGINX) are written in programming languages and use libraries that aren't designed for memory safety. This caused many issues, such as Heartbleed in OpenSSL" [1] Sidetrack: https://x.com/isamlambert/status/1979337340096262619 https://x.com/isamlambert/status/1979337340096262619 Until ~2015, GitHub Pages hosted over 2 million websites on 2 servers with a multi-million-line nginx.conf, edited and reloaded per deploy. This worked incredibly well, with github.io ranking as the 140th most visited domain on the web at the time. Nginx performance is fine (and probably that's why it's not included in the static page "benchmark")
- sim7c00 1y ago
  its funny he mentions unsafe code in apache and nginx and then complains about openSSL bug (one thats more than 10 years old btw). if this is a sense of the logic put into the application, no memory safe language will save it from the terrible bugs!
  - dorianniemiec 1y ago
    Heartbleed might be more than 10 years old, but it was a serious vulnerability indeed... From https://www.heartbleed.com https://www.heartbleed.com > The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users. Also, the program being memory-safe doesn't mean it's bug-free, other bugs not related to memory safety exist (like path traversals are due to improper sanitation or checking of the input).

supermatt 1y ago

Looks awesome, but the docs page seems to be returning a 200 yet is completely empty and is showing `x-ferron-cache: HIT` header. Maybe a misconfiguration somewhere?

atraac 1y ago
Works perfectly fine here in Brave/Chromium
- supermatt 1y ago
  Not sure if this will help to debug. Definitely not working for me in Safari. Could be a downstream cache I guess? The browser is using iCloud Private relay. I have "disable cache" checked in the network inspector. The only plugin installed is 1password, but I get the same problem when disabled. Restarted browser with same issue. Seems to work when in private mode, but not without. Summary URL: https://ferron.sh/docs https://ferron.sh/docs Status: 200 Source: Network Request Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9 Priority: u=0, i Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: none User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Safari/605.1.15 Response Accept-Ranges: bytes Cache-Control: public, max-age=900 Content-Encoding: br Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none'; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://analytics.ferron.sh https://analytics.ferron.sh; connect-src 'self' https://analytics.ferron.sh https://analytics.ferron.sh Content-Type: text/html Date: Tue, 21 Oct 2025 10:07:46 GMT ETag: W/"ba17d6fadf70c9f0f3b08511cd897f939b6130afbed2906b841119cd7fe17a39-br" Server: Ferron Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding, If-Match, If-None-Match, Range X-Content-Type-Options: nosniff x-ferron-cache: HIT X-Frame-Options: deny

habibur 1y ago

Looking at the graphs, I would recommend it would have been better to market it as "just as performant as nginx and htproxy" instead of "faster than all ...". While highlighting the simplicity as the added benefit above those all.

amelius 1y ago
But nginx has acquired a lot of features over the years, which has pros and maybe also cons.
dorianniemiec 1y ago
Thank you for the feedback! I did the reverse proxy benchmarks for NGINX, when someone opened a GitHub issue about missing NGINX benchmarks, and asked about benchmark comparisons. It turned out that yeah, Ferron is close to NGINX's reverse proxy performance.

Etheryte 1y ago

I know it's not popular to care about these things these days, but please consider a different installation mechanism than curl piped into sudo bash. It's irresponsible and normalizes a practice that never should've happened.

olalonde 1y ago
Can we stop with this nonsense already? If you trust them enough to run their server code, why wouldn't you trust them with the installation script?
- adastra22 1y ago
  I don’t trust them enough to run as root.
  - udev4096 1y ago
    But you have to. Nginx, caddy, traefik, etc cannot run without root or even if you can, it would be way more limiting
    - QuantumNomad_ 1y ago
      Only for binding to ports under 1024 really, like 80 (http) and 443 (https). Once it has bound to the ports it can drop down to running as a low-privilege user (usually named www or httpd or similar). On Linux you can allow your program to bind to those ports even without running the program itself as root. https://superuser.com/questions/710253/allow-non-root-process-to-bind-to-port-80-and-443 https://superuser.com/questions/710253/allow-non-root-proces...
      - dorianniemiec 1y ago
        When installed for example with the installer script, Ferron would run on a specialized user for running the web server. Ferron itself would also have "CAP_NET_BIND_SERVICE" capability set on its binary, so that it doesn't have to run as root.

rglullis 1y ago

> Any feedback is welcome! Read https://www.joelonsoftware.com/2006/12/09/simplicity/ https://www.joelonsoftware.com/2006/12/09/simplicity/ and ask yourself if you are truly solving anyone's problem or if you are just looking for a way to rationalize the amount of time you are spending on a hobby.

ramon156 1y ago
Wow, what a harsh comment. You make it sound like we should squeeze any form of efficiency out of people or you're wasting time
- rglullis 1y ago
  > like we should squeeze any form of efficiency The complete opposite. It's OP that's trying to "optimize the web server for reverse proxying and static file serving", when what we have out there is more than enough. > or you're wasting time "Wasting time" is not a problem. If OP is doing working on things because it brings them pleasure and they are hoping to learn from it, more power for them. What bugs me about these types of posts is when people are set on the "build a better mouse trap" mentality and want others to validate them. It may sound "harsh" to you, but if I came up asking for "any type of feedback" when I'm trying to figure out if the idea is worth persuing, I'd be pretty upset if I kept chasing an invisible dragon because the community was more concerned about "hurting my feelings" instead of being upfront and give some warning like this might be interesting to you but it's not solving any real pain point. Keep that in mind when deciding if work on this will be worthwhile.
  - dorianniemiec 1y ago
    > It's OP that's trying to "optimize the web server for reverse proxying and static file serving", when what we have out there is more than enough. I have optimized it, so it would be faster than the original server I have been working on. > (...) give some warning like this might be interesting to you but it's not solving any real pain point. Keep that in mind when deciding if work on this will be worthwhile. If you feel the project isn't solving a real pain point for you, you don't have to use it! I was showcasing my web server to interested people on Hacker News.

austin-cheney 1y ago

I wrote my own web server from scratch last year the exact same reasons: starting from scratch with Apache and NGINX is too painful for my needs. Here are my learnings: * TLS (HTTPS) can be easily enabled by default, but it requires certificates. This requires a learning curve for the application developer but can be automated away from the user. * The TLS certs will not be trusted by default until they are added to the OS and browser trust stores. In most cases this can be fully automated. This is most simple in Windows, but Firefox still makes use of its own trust store. Linux requires use of a package to add certs to each browser trust store and sudo to add to the OS. Self signed certs cannot be trusted in OSX with automation and requires the user to manually add the certs to the keychain. * Everything executes faster when WebSockets are preferred over HTTP. An HTTP server is not required to run a WebSocket server allowing them to run in parallel. If the server is listening for the WebSocket handshake message and determines the connection to instead be HTTP it can allow both WebSocket and HTTP support from the same port. * Complete user configuration and preferences for an HTTP or WebSocket server can be a tiny JSON object, including proxy and redirection support by a variety of addressable criteria. Traffic redirection should be identical for WebSocks and HTTP both from the users perspective as well as the internal execution. * The server application can come online in a fraction of a second. New servers coming online will also take just milliseconds if not from certificate creation.

dorianniemiec 1y ago
Oh, nice to meet you! > TLS (HTTPS) can be easily enabled by default, but it requires certificates. This requires a learning curve for the application developer but can be automated away from the user. Yeah, these certificates can be obtained from Let's Encrypt automatically. > Everything executes faster when WebSockets are preferred over HTTP. An HTTP server is not required to run a WebSocket server allowing them to run in parallel. If the server is listening for the WebSocket handshake message and determines the connection to instead be HTTP it can allow both WebSocket and HTTP support from the same port. Oh, seems like an interesting observation!

NeutralWanted 1y ago

[dead]

yincong0822 1y ago

That’s awesome — congrats on reaching the release candidate stage! I’m curious about the performance improvements you mentioned. Did you benchmark against other Go web servers like Caddy or fasthttp? Also really like that you’ve made automatic TLS the default — that’s one of those “quality of life” features that make a huge difference for users. I’m working on an open-source project myself (AI-focused), and I’ve been exploring efficient ways to serve streaming responses — so I’d love to hear more about how your server handles concurrency or large responses.

dorianniemiec 1y ago
Thank you! > Did you benchmark against other Go web servers like Caddy or fasthttp? I have already benchmarked Ferron against Caddy! :) > so I’d love to hear more about how your server handles concurrency or large responses. Under the hood, Ferron uses Monoio asynchronous runtime. From Monoio's GitHub repository (https://github.com/bytedance/monoio https://github.com/bytedance/monoio): > Moreover, Monoio is designed with a thread-per-core model in mind. Users do not need to worry about tasks being Send or Sync, as thread local storage can be used safely. In other words, the data does not escape the thread on await points, unlike on work-stealing runtimes such as Tokio. > For example, if we were to write a load balancer like NGINX, we would write it in a thread-per-core way. The thread local data does not need to be shared between threads, so the Sync and Send do not need to be implemented in the first place. Ferron uses an event-driven concurrency model (provided by Monoio), with multiple threads being spread across CPU cores.

Gepsens 1y ago

Hey really cool. Am proficient in Rust if you need any help.

dorianniemiec 1y ago
Thank you! You can contribute to https://github.com/ferronweb/ferron https://github.com/ferronweb/ferron, if you want to.

ansc 1y ago

Great to see! Would love to try it, but I depend on graceful updates of configuration (i.e. adding and removing backends primarily). I can't find anything about that. Is it supported, either through updating configs or through API?

dorianniemiec 1y ago
Thank you! Yes, graceful restarts in Ferron are supported on Linux, Unix, and alike. You just need to send a SIGHUP signal to Ferron process, or simply do "systemctl reload ferron" or "/etc/init.d/ferron reload" as root.

npodbielski 1y ago

So I have to connect my domain to your IP adres? Why there is perfectly fine HTTP auth method for let's encrypt. This is strange and not necessary.

dorianniemiec 1y ago
Well, you're probably talking about the automatic TLS demo. People installing Ferron on their servers don't have to use this demo!
- npodbielski 1y ago
  No, I do not think so. In the linked page there is mention: "Point a subdomain named ferrondemo of your domain name (for example, ferrondemo.example.com) to either: CNAME demo.ferron.sh or A 194.110.4.223" This is really strange and make my Spidey sense tingle. If the goal is to just point your domain to this server it should not require DNS auth. Just HTTP is fine. DNS sure if you want optimize reverse proxy, because that would be also possible to do via http auth for every subdomain separately. If you just need some www server quickly pointing your domain to some other dude domain is not the way to go. This feels weird.
  - dorianniemiec 1y ago
    > If you just need some www server quickly pointing your domain to some other dude domain is not the way to go. Yeah. But as I said before, people installing Ferron on their servers don't need to use this demo. Oh, and people using this demo don't need to install Ferron on their servers. I just added two notices to this demo: > Note: After completing the demo, it's recommended to delete the subdomain you have just created to prevent security issues. > This demo setup is optional and exists only to demonstrate automatic TLS functionality. You do not need to point any subdomain to demo servers for normal use of Ferron.
    - npodbielski 1y ago
      Oh you are the author. I think we do not understand each other. Look at this: https://letsencrypt.org/docs/challenge-types/#http-01-challenge https://letsencrypt.org/docs/challenge-types/#http-01-challe... If this is for demo, even more DNS is not necessary. Just code your web server to serve challenge for that particular Uri, and you are done. I do not think so that you need wildcard cert for the demo. Just fixed subdomain is fine. Also you do not have to wait for DNS to propagate with HTTP method.

sceptic123 1y ago

"I don't like nginx config so I'm going to write a whole application just so that I don't have to write nginx config". Maybe just write an nginx config generator instead? It's also interesting that the actual config looks quite a lot like nginx config.

HumanOstrich 1y ago

Your title is confusing. It sounds like you are rewriting a web server _already_ written in Rust to a _different_ language. Now that I'd be in favor of. "It's written in Rust so it's memory safe!"

dorianniemiec 1y ago
Ah... I also saw one more person confused about the title... By the way the rewrite is still in Rust.

renshijian 1y ago

Ferron provides a concise and efficient way to handle state management in front-end frameworks. It adopts a responsive design concept and can greatly simplify the development process of complex applications. Its clear API and lightweight architecture allow developers to quickly implement dynamic interfaces without sacrificing performance. Overall, it is a tool worth paying attention to in modern front-end development, especially for projects with high performance requirements

dorianniemiec 1y ago
But Ferron isn't a state management library for front-end frameworks, it's a web server!

66yatman 1y ago

I don't trust the benchmarks