1 · Introduction
WSLProxy in 20 minutes
Architecture, live rules, WAF, traffic splits, admin UI, MCP, and CLI — the complete product tour.
Open-source · multi-POP · live-config
Live-config API gateway. Rules without reloads.
WSLProxy is a self-hosted reverse proxy and edge control plane on OpenResty — virtual hosts, WAF, traffic splits, geo stats, MCP, and CLI — driven from JSON that takes effect without restarting nginx for every rule change.
$ wslproxy-cli pull -d ./cfg --resources servers,rules,waf ✓ synced 42 servers · 118 rules · 6 waf policies $ wslproxy-cli check nginx -o json ✓ openresty -t ok · healthz=200 $ wslproxy-cli push -d ./cfg --yes --verify # rules hot — no nginx reload for match changes ✓ applied · verified
Watch
WSLProxy in 20 minutes
Live-config routing, WAF, traffic splits, MCP, and CLI — without reloading nginx for every rule change.
Full walkthrough on YouTube · More in How-to videos
How-to videos
Learn the platform, feature by feature
A growing list of walkthroughs — start with the introduction, then jump into shorter feature videos.
One edge, every control
Everything you need at the POP
Route, protect, observe, and automate — each capability hot on the request path or a flag away from reload.
Geographic traffic
Top Countries and a world map on the admin dashboard — every request tagged via IP2Location into live traffic stats.
Dynamic routing
Path, IP, country, JWT, S3, and cookie match with priority and specificity — no OpenResty reload for rule changes.
WAF & security
Policy packs, anomaly scoring, monitor or block, rate limits, CAPTCHA, and geo deny lists at the edge.
Full WAF guide →Traffic engineering
Weighted, canary, sticky, and least-conn backends with promote/rollback and upstream health.
Auto SSL & cache
Let’s Encrypt auto-ssl, force HTTPS, edge static cache, optional Varnish and Docker blob cache.
UI · REST · MCP · CLI
React Admin and Next.js ops, Swagger CRUD, MCP for agents, and wslproxy-cli for GitOps pipelines.
How traffic moves
Match once. Decide per request.
OpenResty loads server and rule JSON on the hot path. Only server-block nginx changes need a reload flag.
rewrite
gateway_ack
Load host config, score candidate rules (path, IP, country, JWT…), run rate limit and WAF, stash the winner.
access
gateway_resp
Honor response code: proxy (305), redirect, HTML block, CAPTCHA (306), or 403 — then resolve backend and timeouts.
balancer
Peer + timeouts
Weighted, canary, sticky, or least-conn selection with per-server connect/send/read timeouts.
Blog
Notes from the edge control plane
Deep dives and feature write-ups — listed here as they ship.
Feature deep dive
Geographic Traffic Distribution by country
How Top Countries and the world choropleth work — IP2Location on the hot path, traffic_stats, and atlas-ready codes.
Get going
Own the edge you run
Clone the repo, bring up Docker with ./dev.sh, or deploy POPs with Ansible — then drive config like code.