What is BeaRust?

BeaRust is an open-source reverse proxy, load balancer, and Web Application Firewall (WAF), built in Rust and packaged as a single Docker Compose stack.

The short version: install it with one Docker Compose command, manage it from a browser-based UI, and never have to spelunk a config file for routine changes. Underneath that simple install is a real load balancer with multiple algorithms, a built-in WAF, IP and bot security, rate limiting, traffic analytics, and free multi-node clustering. BeaRust's Rust data plane exists for the same reason people choose Rust for this kind of software: predictable performance and memory safety, without a garbage collector in the request path.

What actually runs

BeaRust ships as one process with two listeners. A Rust data plane (built on Pingora) serves HTTP/1.1 and HTTP/2 traffic: it matches the request host and path to a route, picks a healthy backend from that route's upstream pool, and forwards the request. An Axum control plane exposes an authenticated management API, and the bundled browser UI is a client of that same API — there is no separate backend to run.

• Routing: host and path-prefix matching to named upstream pools.
• Load balancing: round-robin, least-connections, weighted, IP-hash, or adaptive-weight (based on observed response times) — or a custom plugin algorithm.
• Health checks: TCP or HTTP, per backend.
• Protocol support: WebSocket passthrough, native TLS, optional HTTP/3, JSON logs, graceful shutdown, atomic SIGHUP config reloads.
• Certificates: authenticated upload, or automated ACME (Let's Encrypt HTTP-01, Cloudflare DNS-01).

What's optional, and why that matters

Security controls (WAF, IP rules, bot protection, rate limiting), analytics, multi-node clustering, WASM plugins, and the AI advisor are real, but none of them are switched on just because BeaRust is running. Each is configuration- or environment-driven — the AI advisor, for instance, stays disabled until you supply both a provider URL and an API key. This is deliberate: a new deployment should start as a small, predictable proxy, and you decide when to add depth. See feature status for exactly what's on by default versus opt-in, architecture for where each subsystem runs, and the roadmap for what's planned but not yet shipped.

Get started

1. Install BeaRust — the quick-start section needs no source checkout, just a published Docker image.
2. Create the first administrator.
3. Define an upstream pool and route.

By default, the data plane listens on 8080 for application traffic, and the control API and UI listen on 8081, published to 127.0.0.1 only until you deliberately put it behind your own access layer.