Why rws
Most web stacks are four tools in a trench coat: a server, a certificate client, a scheduler to renew, and a proxy. rws is one binary that does all four, and a Rust library when you need more.
One binary, one file
Static site, HTTPS, reverse proxy and gateway in one executable, configured in one rws.config.toml. No certbot, no cron job, no separate proxy process to keep in step.
Its own HTTP stack
HTTP/1.1 parsing, routing, middleware, WebSocket, SSE, CORS, ranges, JWT and the ACME client are written in the crate, and so is the HTTP/2 server, checked by h2spec and fuzzing. HTTP/3 uses quinn and h3; TLS uses rustls, so there is no OpenSSL.
Config and code share one engine
Everything the TOML file does is a type you can use from Rust. Moving from configuration to code doesn't mean moving to another tool.
Tested against the real thing
CI fuzzes every parser that sees untrusted input, runs h2spec, the Gateway API conformance suite and the ACME flow against Let's Encrypt's test CA on every push.
Fast, with the numbers public
Up to 5.2 times Caddy's throughput and less CPU per request than nginx in every published scenario, from CI runs anyone can open and rerun.
Semantic versioning
Breaking changes only in a major version, each with a migration guide.
rws fits when
- You want HTTPS and a proxy without a stack of tools. One process gets certificates, serves files and balances your apps.
- You run Rust services. Start with config, and when you need code, the same engine is a library.
- You want a Kubernetes gateway that is also a plain server. The Gateway API controller is the same binary you run on a VM.
Pick something else when you need
- Lowest memory and decades of operations knowledge: nginx. It uses less memory than rws in every benchmark scenario, and almost every problem you can hit with it has been written up.
- A large plugin ecosystem with automatic HTTPS: Caddy. Its modules cover DNS providers, auth systems and storage backends rws does not.
- Routing discovered from Docker labels: Traefik. Containers announce their own routes; rws reads routes from its file or the Gateway API.
- A service mesh: Istio or Linkerd. rws is a gateway and a server, not a sidecar.