featherbit
A high-performance API gateway delivered as a single Rust binary. Routes are visual node graphs — 80+ plugins wired together through success and error ports — serving HTTP/1.1, HTTP/2, WebSocket, and raw TCP/UDP.
policies:
- name: echo-policy
error_handler: error-handler
nodes:
- id: listener
type: listener
- id: rewrite
type: proxy-rewrite
config: { phase: request, strip_path_prefix: /api }
- id: backend
type: upstream
config:
targets:
- host: ${ECHO_BACKEND_HOST:-localhost}
port: ${ECHO_BACKEND_PORT:-3000}
- id: client
type: client
edges:
- from: listener.out
to: rewrite.in
- from: rewrite.success
to: backend.in
- from: backend.success
to: client.in
A request flows listener → plugins → client. Every node also has an error port, so failures route to handlers instead of raw 500s.
Node-graph routing policies
Each route is a directed graph of plugin nodes wired through success and error ports — declared in YAML, edited visually, validated on save.
80+ native plugins
Proxying, transforms, auth (key/basic/JWT/HMAC/LDAP/OIDC), authz, rate limiting, traffic control, 17 loggers, tracing, serverless.
Lua scripting
Drop an execute(ctx) script into the pipeline. Scripts are validated at policy compile time and indistinguishable from native nodes.
TLS, mTLS & SNI
TLS termination with hot-reloading certificates, per-hostname SNI certs, and mTLS that exposes the client identity — fingerprint, CN, SAN — to the graph.
HTTP/2 & WebSocket
HTTP/2 negotiated per connection (ALPN over TLS, h2c on plaintext). WebSocket routes run the policy graph, then relay — including RFC 8441 over HTTP/2.
L4 TCP/UDP streams
Proxy raw TCP and UDP to a load-balanced pool, with SNI-based routing for TLS passthrough — no termination required.
HA clustering with etcd
Point the config source at etcd and replicas converge on the same routes, policies, and consumers. Stateless single-binary mode stays the default.
Hot-reload & graceful shutdown
Config, policies, and scripts take effect without a restart; failed reloads keep the last good config serving. On SIGTERM, in-flight requests drain before exit.
Metrics, tracing & the web UI
Per-route and per-node Prometheus metrics, OpenTelemetry/Zipkin tracing, health and readiness probes — plus an embedded node-graph editor.