Open-source alternatives to Varnish Cache

Tengine is an enhanced Nginx web server distribution designed for high-traffic environments. It functions as a high-performance reverse proxy, dynamic load balancer, and HTTP/3 proxy server, integrating an embedded Lua scripting engine to allow for custom business logic and dynamic request processing. The project distinguishes itself through a focus on modern transport protocols and efficiency, featuring native support for QUIC and HTTP/3 to reduce connection latency. It implements userspace UDP forwarding to bypass the kernel for higher throughput and provides the ability to dynamically upda

Contour is a Kubernetes ingress controller that manages external HTTP and TCP traffic by orchestrating Envoy proxy instances. It functions as a control plane that translates declarative Kubernetes API objects into dynamic proxy configurations, enabling real-time traffic management without requiring infrastructure restarts. The system distinguishes itself through a focus on multi-tenant cluster networking and delegated configuration. By allowing routing rules to be partitioned across namespaces, it enables multiple teams to securely manage their own traffic policies within a shared cluster. It

Express Gateway is a centralized API gateway built on the Express.js framework, designed to serve as a single entry point for microservices architectures. It manages incoming network traffic by routing requests to backend services based on defined path-based rules while enforcing security policies and authentication protocols at the edge. The system distinguishes itself through a configuration-driven approach that utilizes a centralized definition file to dictate routing logic and policy application. It features a hot-reloading engine that allows for real-time updates to routing rules and sec

The NGINX Ingress Controller is a Kubernetes-native traffic manager that handles external requests and routes them to internal services. It translates Kubernetes API objects and annotations into proxy configurations to manage incoming HTTP, TCP, and UDP traffic. The controller distinguishes itself through advanced traffic steering and security integration. It supports blue-green and canary traffic splitting, as well as content-based and regex path routing. Security is handled at the edge via a web application firewall, denial-of-service protection, and a variety of authentication methods incl

This project provides a comprehensive architectural framework and set of standardized patterns for building, securing, and scaling production-ready Node.js applications. It serves as a foundational guide for establishing consistent development workflows, operational observability, and reliable service integration across distributed software systems. The framework distinguishes itself by emphasizing a schema-first approach to API development, ensuring that interface definitions drive the creation of server stubs, client libraries, and type definitions. It promotes a cloud-native posture by int

Meshery is a service mesh management plane and cloud native infrastructure orchestrator. It provides a visual design-as-code environment for modeling microservices and infrastructure components through declarative blueprints, functioning as a centralized platform for designing, deploying, and managing service mesh infrastructure. The platform is distinguished by its ability to translate visual designs into active deployments and its use of gRPC-based adapters to integrate with diverse infrastructure providers. It features a multi-tenant architecture that manages shared workspaces and role-bas

Elsa Core is a workflow engine framework designed for defining, executing, and managing long-running business processes. It functions as a distributed workflow orchestrator and event-driven trigger system, capable of operating as a multi-tenant platform with secure data isolation. The project distinguishes itself through a flexible approach to workflow definitions, supporting a visual drag-and-drop designer, programmatic C# definitions, and portable JSON specifications. It provides a highly extensible architecture allowing for the development of custom activities and the use of a dynamic expr

Zoraxy is a network administration tool centered on HTTP reverse proxy management. It provides a centralized graphical interface for routing web traffic from public domains to internal backend services, utilizing a Go-based proxy to intercept and forward requests. The project extends beyond standard web routing by offering a browser-based SSH interface for remote server administration and command execution. It also supports transport-layer TCP and WebSocket forwarding to manage non-HTTP traffic between external clients and internal ports. Broad capabilities include automated TLS certificate

Sozu is a high-performance, memory-safe reverse proxy and load balancer built in Rust. It is designed to manage HTTP, TCP, and UDP traffic through a multi-process architecture that leverages isolated worker processes to ensure fault tolerance and efficient resource utilization across multi-core hardware. The project distinguishes itself through a focus on continuous availability and dynamic control. It features a unique binary hot-reloading mechanism and a Unix-socket-based control plane, allowing administrators to update proxy configurations, modify listener settings, and even replace the pr

This project is a Node.js HTTP reverse proxy middleware designed to route incoming HTTP and WebSocket traffic to target backend services. It functions as a dynamic routing engine and API gateway tool, providing the capability to consolidate multiple backend services behind a single entry point. The middleware features a WebSocket proxy bridge that manages protocol upgrade handshakes to maintain persistent bidirectional communication. It also includes a request and response transformer used to intercept and modify headers, bodies, and URL paths during transit. The system provides broad traffi

Linkerd is a Kubernetes service mesh that manages network traffic between microservices. It functions as a transparent networking proxy, layer 7 traffic manager, and mutual TLS security layer, providing observability and reliability for service-to-service communication without requiring changes to application code. The project distinguishes itself through a sidecar-proxy architecture that intercepts TCP and application-level traffic to provide automatic mutual TLS encryption and identity verification. It enables cross-cluster service networking to link multiple clusters and implements cloud-n

BPB-Worker-Panel is a control panel designed for deploying and managing VLESS and Trojan proxies hosted on Cloudflare Workers. It functions as a proxy subscription generator and a manager for secure DNS over HTTPS servers and WireGuard configuration provisioning. The project distinguishes itself through network traffic obfuscation capabilities, utilizing packet fragmentation and SNI spoofing to evade detection. It provides specialized administration for Cloudflare Warp and Warp Pro connections, including the ability to optimize endpoints and export WireGuard configurations. The system covers

opennextjs-aws is a serverless infrastructure adapter and deployment tool that transforms Next.js build artifacts into compatible packages for hosting on AWS Lambda and S3. It functions as a deployment adapter that maps framework-specific outputs to serverless functions and object storage. The project distinguishes itself by implementing serverless-specific optimizations, including a cache manager that synchronizes incremental static regeneration and fetch caches via S3 or DynamoDB. It features a cold start optimizer that uses bundle minification and scheduled function warming to reduce laten

Redbird is a Node.js reverse proxy used to route external network traffic to internal servers. It functions as a layer 7 load balancer that maps incoming requests from specific domains or hosts to target upstream servers, shielding backend services from direct public exposure. The project features dynamic route management, allowing routing rules to be updated programmatically at runtime. It synchronizes these routes automatically by polling external sources such as Docker containers and etcd clusters to align proxy configurations with service lifecycles. Additional capabilities include SSL a

This project is a Bing AI proxy gateway and web-based chat interface. It functions as a Go reverse proxy that routes HTTP traffic to external AI endpoints, allowing users to bypass regional network restrictions and login requirements. The system utilizes SOCKS5 proxy tunneling and environment-variable configuration to circumvent IP-based blocking and regional firewalls. It manages authentication by injecting predefined session cookies into outgoing requests to maintain private AI sessions and unlock personalized features. The application integrates a Vue-based single page application for the

ServiceStack is a high-performance .NET web framework designed for building type-safe APIs using strongly-typed request and response objects. It functions as a message-based API engine that decouples business logic from the transport layer, allowing services to be exposed via multiple protocols including HTTP, gRPC, and various message queue providers. The framework is distinguished by its type-safe API generator, which produces native client SDKs and data transfer objects from service metadata across multiple languages. It also includes a distributed service gateway for microservices orchest

This repository is a technical documentation site and a collection of guides and references for implementing networking, security, and cloud infrastructure services. It functions as a static-site generated portal and a headless content platform, separating source files from the presentation layer to enable flexible rendering. The project utilizes markdown-based documentation stored in a version-controlled Git repository. It provides specialized technical content including an AI platform documentation for building agents and managing inference, a cloud infrastructure guide for DNS and CDN conf

Wretch is a chainable HTTP client library and Fetch API wrapper designed to simplify network request configuration, response parsing, and error handling. It functions as a network request manager and middleware framework for managing the end-to-end lifecycle of HTTP calls. The project is distinguished by a fluent interface for request configuration and a modular extension system. It utilizes a programmable response resolver to automate parsing and a plugin-based architecture to add new capabilities to request and response objects. The library covers a broad range of operational capabilities,

BFE is a Layer 7 HTTP and HTTPS traffic distributor that routes requests based on content inspection and configurable policies, managed through a RESTful API. It operates as a reverse proxy, distributing incoming traffic across backend servers according to user-defined rules. The project distinguishes itself through a domain-specific language for content-aware routing, allowing traffic to be directed by inspecting request headers, paths, and payloads. It supports multiple configurable load balancing policies and includes a plugin-based extension system for adding custom modules and middleware

Rainloop Webmail is a self-hosted, browser-based email application that connects to external mail servers using IMAP and SMTP protocols. It operates as a stateless client, fetching data directly from servers without requiring a local database to store messages. The system supports multi-account email management, allowing users to link multiple email identities to a single session for simultaneous access across different browser tabs. It includes a plugin-based extension system and tools for user interface customization and branding. The application provides capabilities for email workflow au

This project is a content delivery network implementation that uses a web server and scripting language to cache content at the edge and reduce latency for end users. It functions as a distributed system designed to store backend responses on edge nodes and route incoming client requests through a proxy. The system utilizes custom request logic to handle edge caching strategies, including the delivery of stale content during origin failures. It implements request coalescing to merge simultaneous requests for the same resource into a single upstream call to prevent backend overload. The proje

This project is a Cloudflare Workers Docker proxy and container registry mirror. It functions as an HTTP request proxy that relays requests to container registries, such as Docker Hub, to bypass regional access restrictions and accelerate image downloads. The service incorporates identity masking to hide the proxy from automated scanners. This is achieved through the use of custom landing pages for unauthorized requests and filtering based on user agents. The system manages network traffic via edge-based request proxying and stateless routing. It utilizes stream-based payload relaying to han

Ockam is an end-to-end encryption framework and distributed identity provider designed to establish secure communication between applications and devices. It provides a secure network overlay that utilizes cryptographic identities and attribute-based access control to implement zero trust network access. The project distinguishes itself through metadata-driven multi-hop routing and a pluggable transport layer, allowing encrypted traffic to move across diverse network topologies without requiring virtual IP overlays. It specifically enables secure tunneling for legacy applications by wrapping

Flagger is a Kubernetes operator designed to automate the lifecycle of application deployments through progressive delivery. It functions as a controller that monitors custom resource definitions to orchestrate complex release strategies, including canary, blue/green, and A/B testing. By continuously reconciling the desired cluster state with the actual environment, it ensures that deployments adhere to defined specifications while managing the underlying infrastructure required for traffic routing. The project distinguishes itself through a sophisticated metric-driven analysis loop that eval

FusionCache is a hybrid distributed caching library that coordinates local memory and distributed storage to balance access speed with global consistency. It functions as a resilient data access layer, utilizing a pluggable serialization framework to convert cached objects into various binary or text formats for compatibility across diverse storage environments. The system maintains cluster consistency through a distributed cache synchronizer that propagates invalidations and state updates across multiple nodes via a shared messaging backplane. It improves reliability by serving stale cache d

Pomerium is an identity-aware reverse proxy designed to provide zero-trust access control for internal infrastructure. It functions as a centralized gateway that verifies user identity, device context, and group membership for every request before granting access to protected applications, services, or API servers. By integrating directly with external identity providers, it replaces traditional VPNs with granular, policy-based access enforcement. The platform distinguishes itself by extending zero-trust principles beyond standard web traffic to include non-HTTP protocols, such as TCP and UDP

Agentic is a tool marketplace and management platform designed for the Model Context Protocol. It provides a gateway and proxy that enables the discovery, publishing, and distribution of vetted tools for agentic AI frameworks. The platform specializes in Model Context Protocol monetization, allowing developers to transform services into paid products through integrated authentication, usage-based billing, and subscription management. It also includes a converter that transforms OpenAPI specifications into compatible protocol servers for use in AI workflows. The system covers a broad range of