Local Docker
./dev.sh brings up OpenResty, Redis, and the admin UI with hot-reload for Lua.
WSLProxy
Live-config API gateway on OpenResty. Change rules, WAF, and traffic splits without reloading nginx — drive it from UI, REST, MCP, or CLI.
How traffic moves
Match once. Decide per request.
OpenResty loads server and rule JSON on the hot path. Only server-block nginx changes need a reload flag — rules and WAF stay live.
rewrite
gateway_ack
Load host config, score candidate rules (path, IP, country, JWT…), run rate limit and WAF, stash the winner.
access
gateway_resp
Honor response code: proxy (305), redirect, HTML block, CAPTCHA (306), or 403 — then resolve backend and timeouts.
balancer
Peer + timeouts
Weighted, canary, sticky, or least-conn selection with per-server connect/send/read timeouts.
Platform
Built for real edge ops
Not a brochure CDN — a control plane you run on your POPs, VMs, or k3s.
Dynamic routing
Priority-aware rules with geo, IP, JWT, and path matching. Attach many rules per virtual host.
WAF policy packs
Detection rules, anomaly scoring, monitor or block modes, and an events API — including the v2 engine.
Traffic engineering
Canary weights, promote/rollback, topology views, and passive/active upstream health.
Multi-POP + DNS
Declare edge locations and provision Cloudflare A records with guardrails so unmanaged DNS stays untouched.
SSL & cache
auto-ssl / Let’s Encrypt, force HTTPS, edge static cache, optional Varnish and Docker blob cache.
Two-layer ingress
Outer POP plus optional k3s wslproxy-ingress Helm chart — tune timeouts on both layers.
Control plane
UI, API, agents, and pipelines
Same surface whether a human clicks, a script runs, or Cursor calls MCP.
- Admin UI React Admin for day-to-day CRUD; Next.js dashboard for logs and AI-assisted analysis.
- REST + Swagger Full CRUD for servers, rules, WAF, traffic, cache — JWT auth like the UI.
- MCP Resources and tools for Claude / Cursor: validate_config, CRUD, traffic, POPs/DNS.
-
wslproxy-cli
Pull → edit → push JSON; check nginx/health; ship via
ghcr.io/bwalia/wslproxy-cli.
# GitHub Actions / GitLab CI
docker run --rm \
-e WSLPROXY_BASE_URL \
-e WSLPROXY_TOKEN \
ghcr.io/bwalia/wslproxy-cli:latest \
check nginx -o json
# Config as files
wslproxy-cli pull -d ./cfg --resources servers,rules,waf
wslproxy-cli push -d ./cfg --yes --verify
Get going
Three ways in
Ansible / Helm
Bare-metal POPs via Ansible; k3s ingress via the Helm chart under ingress-controller/.
Docs & demos
WAF demo packs, MCP guides, CLI examples, and architecture diagrams in the repo.
Browse docs →Own the edge you run.
Open source gateway, real POPs, agent-ready control plane — start from the repo and ship config like code.