Reverse Proxies & Load Balancers

This page is the infra-flavored complement to the API Gateways page in the web-dev section.

Single-binary, easy

• ★ Caddy — automatic HTTPS via Let's Encrypt; one config file; modules for plugins. The default for new self-host setups.
• Traefik — Docker / Kubernetes-aware; auto-discovers services; great for container-heavy stacks. Strong CRD support on k8s.

High-performance / classic

• ★ HAProxy — TCP and L7 load balancer; very mature; battle-tested at huge scale. The choice for "I need rock-solid load balancing."
• ★ Nginx — universal; works as web server, reverse proxy, LB, mail proxy. Open-source + Plus.
• OpenResty — Nginx + Lua scripting; for when you need programmable proxies.
• Envoy — modern L7 proxy; the foundation under Istio / Contour / Gloo. Powerful, complex.

Programmable / Kubernetes-native

• See Kubernetes Ingress for ingress-nginx, Traefik, Contour, Cilium Gateway.
• Pingora (Cloudflare) — Rust framework for building proxies; Cloudflare uses it internally.

L4 / IP-level

• MetalLB — bare-metal load balancer for k8s; layer-2 or BGP modes.
• kube-vip — control-plane HA + L2 / BGP load balancing.
• keepalived + HAProxy — classic VRRP-based active-passive LB pair.
• IPVS / LVS — kernel-level L4 LB.
• Gobetween — small Go-based L4 LB.

Cloud-managed

• AWS ALB / NLB / GLB — AWS-native; pricey egress.
• GCP Cloud Load Balancing — global anycast.
• Cloudflare Load Balancing — geo + health-check based.
• Azure Load Balancer / Application Gateway — Azure-native.
• Fly.io's built-in — anycast; uses Fly Proxy.

Reverse-proxy-as-edge

• Cloudflare Workers — programmable proxy at the edge; see serverless.
• Fastly Compute@Edge — same niche.

TLS / certs

• ★ Let's Encrypt + Caddy = handled.
• certbot + Nginx / HAProxy / Apache — classic ACME client.
• acme.sh — POSIX shell; tiny.
• lego — Go-based ACME client.
• Cloudflare Origin CA — 15-year origin-only cert; pair with CF in front.

Patterns to adopt

• ★ Default to Caddy for new self-host setups. Nginx / HAProxy where you need their specific features.
• Health checks at the LB level; don't rely on application-level only.
• Connection draining during deploys; HAProxy + Connection: close works.
• HTTP/2 + HTTP/3 — both worth enabling; QUIC is widely deployed in 2026.
• Two LB instances for HA, with keepalived or DNS round-robin.
• TLS termination at the LB, then re-encrypt to backend if compliance requires it.

Pick this if…

• Default new self-host: Caddy.
• High-throughput LB: HAProxy.
• Container / Docker label-driven: Traefik.
• Programmability + plugins: Nginx + OpenResty or Envoy.
• Bare-metal k8s LB: MetalLB or kube-vip.
• Existing Nginx setup: stay; migrate to Caddy when refactoring.