OpenLoadBalancer

Minimal-dependency L4/L7 load balancer for any backend. One binary. Written in pure Go. Only stdlib + golang.org/x/{crypto,net,text} — no external frameworks. Works with Node.js, Python, Java, Go, Rust, .NET, PHP — anything that speaks HTTP or TCP.

curl -sSL https://openloadbalancer.dev/install.sh | sh

Create olb.yaml:

admin:
  address: "127.0.0.1:8081"

listeners:
  - name: http
    address: ":80"
    routes:
      - path: /
        pool: web

pools:
  - name: web
    algorithm: round_robin
    backends:
      - address: "10.0.1.10:8080"
      - address: "10.0.1.11:8080"
    health_check:
      type: http
      path: /health
      interval: 10s

olb start --config olb.yaml

That's it. HTTP proxy on :80, admin API on :8081, health checks every 10s, round-robin across two backends.

# Linux / macOS
curl -sSL https://openloadbalancer.dev/install.sh | sh

# Windows (PowerShell)
irm https://openloadbalancer.dev/install.ps1 | iex

# Docker (GHCR)
docker pull ghcr.io/openloadbalancer/olb:latest
docker run -d -p 80:80 -p 8081:8081 \
  -v ./olb.yaml:/etc/olb/configs/olb.yaml \
  ghcr.io/openloadbalancer/olb:latest

# Homebrew
brew tap openloadbalancer/olb && brew install olb

# Build from source
git clone https://github.com/openloadbalancer/olb.git && cd olb && make build

Requires Go 1.26+. Only stdlib + golang.org/x/{crypto,net,text}.

Proxy: HTTP/HTTPS, WebSocket, gRPC, SSE, TCP (L4), UDP (L4), SNI routing, PROXY protocol v1/v2, Request Shadowing/Mirroring

Load Balancing: 16 algorithms — Round Robin, Weighted RR, Least Connections, Weighted Least Connections, Least Response Time, Weighted Least Response Time, IP Hash, Consistent Hash (Ketama), Maglev, Ring Hash, Power of Two, Random, Weighted Random, Rendezvous Hash, Peak EWMA, Sticky Sessions

Geo-DNS Routing: Geographic location-based traffic routing (country, region, city)

Security: TLS termination + SNI, ACME/Let's Encrypt, mTLS, OCSP stapling, 6-layer WAF (IP ACL, rate limiting, request sanitizer, detection engine with SQLi/XSS/path traversal/CMDi/XXE/SSRF, bot detection with JA3 fingerprinting, response protection with security headers + data masking), circuit breaker

Middleware: 16 components — Recovery, body limit, WAF (6-layer pipeline), IP filter, real IP, request ID, timeout, rate limit, circuit breaker, CORS, headers, compression (gzip), retry, cache, metrics, access log

Observability: Web UI dashboard (8 pages), TUI (olb top), Prometheus metrics, structured JSON logging, admin REST API (15+ endpoints), Grafana dashboard

Operations: Hot config reload (SIGHUP or API), Raft clustering + SWIM gossip, service discovery (Static/DNS/Consul/Docker/File), MCP server for AI integration, plugin system, 30+ CLI commands, distributed rate limiting, request shadowing/mirroring

OpenLoadBalancer includes a built-in Model Context Protocol (MCP) server that enables AI agents (Claude, GPT, Copilot) to monitor, diagnose, and manage the load balancer.

• SSE (Server-Sent Events): GET /sse for streaming + POST /message for commands — MCP spec compliant
• HTTP POST: POST /mcp for simple request/response (backwards compatible)
• Stdio: Line-delimited JSON-RPC over stdin/stdout for local CLI tools

admin:
  mcp_address: ":8082"
  mcp_token: "your-secret-token"   # Bearer token auth
  mcp_audit: true                   # Log all tool calls

{
  "mcpServers": {
    "olb": {
      "url": "http://localhost:8082/sse",
      "headers": {
        "Authorization": "Bearer your-secret-token"
      }
    }
  }
}

Benchmarked on AMD Ryzen 9 9950X3D:

56+ end-to-end tests across 70 packages with 95.3% coverage:

Supports YAML, JSON, TOML, and HCL with ${ENV_VAR} substitution.

admin:
  address: "127.0.0.1:8081"

middleware:
  rate_limit:
    enabled: true
    requests_per_second: 1000
  cors:
    enabled: true
    allowed_origins: ["*"]
  compression:
    enabled: true

waf:
  enabled: true
  mode: enforce
  detection:
    enabled: true
    threshold: {block: 50, log: 25}
  bot_detection: {enabled: true, mode: monitor}
  response:
    security_headers: {enabled: true}

listeners:
  - name: http
    address: ":8080"
    routes:
      - path: /api
        pool: api-pool
      - path: /
        pool: web-pool

pools:
  - name: web-pool
    algorithm: round_robin
    backends:
      - address: "10.0.1.10:8080"
      - address: "10.0.1.11:8080"
    health_check:
      type: http
      path: /health
      interval: 5s

  - name: api-pool
    algorithm: least_connections
    backends:
      - address: "10.0.2.10:8080"
        weight: 3
      - address: "10.0.2.11:8080"
        weight: 2

See docs/configuration.md for all options.

geodns:
  enabled: true
  default_pool: default-pool
  rules:
    - id: us-traffic
      country: US
      pool: us-pool
      fallback: default-pool
    - id: eu-traffic
      country: EU
      pool: eu-pool
    - id: asia-traffic
      country: JP
      region: Tokyo
      pool: asia-pool

shadow:
  enabled: true
  percentage: 10.0  # Mirror 10% of traffic
  copy_headers: true
  copy_body: false
  timeout: 30s
  targets:
    - pool: staging-pool
      percentage: 100.0

waf:
  enabled: true
  rate_limit:
    enabled: true
    store:
      type: redis
      address: "localhost:6379"
      database: 0
    rules:
      - id: per-ip
        scope: ip
        limit: 1000
        window: 1m

olb start --config olb.yaml         # Start proxy
olb stop                             # Graceful shutdown
olb reload                           # Hot-reload config
olb status                           # Server status
olb top                              # Live TUI dashboard
olb backend list                     # List backends
olb backend drain web-pool 10.0.1.10:8080
olb health show                      # Health check status
olb config validate olb.yaml         # Validate config
olb cluster status                   # Cluster info

                    ┌─────────────────────────────────────────────────┐
                    │              OpenLoadBalancer                    │
  Clients ─────────┤                                                  │
  HTTP/S, WS,      │  Listeners → Middleware → Router → Balancer → Backends
  gRPC, TCP, UDP   │  (L4/L7)     (16 types)   (trie)   (16 algos)  │
                    │                                                  │
                    │  WAF (6 layers) │ TLS │ Cluster │ MCP │ Web UI  │
                    │  GeoDNS │ Shadow │ Discovery │ Prometheus      │
                    └─────────────────────────────────────────────────┘

See CONTRIBUTING.md. Key rules:

1. Minimal external deps — stdlib + golang.org/x/{crypto,net,text} only
2. Tests required — 85% coverage, don't lower it
3. All features wired — no dead code in engine.go
4. gofmt + go vet — CI enforced

Apache 2.0 — LICENSE