Ferron on Ubuntu 24.04 LTS

Ferron is an open source web server written in Rust, built for speed and memory safety. It serves static websites, works as a reverse proxy and load balancer in front of your own application servers, terminates TLS with automatic or manual certificates, and speaks HTTP/1.1 and HTTP/2 (with experimental HTTP/3). It is a lean, modern alternative to nginx and Caddy for fronting websites and APIs. This cloudimg image runs Ferron 2.8.1 from the official release binary on Ubuntu 24.04 LTS as a hardened systemd service.

Ferron is configured from a single, readable KDL file at /etc/ferron/ferron.kdl. You declare virtual hosts, per path locations, reverse proxying, response header rewriting, HTTP basic authentication, IP allow and block lists and rate limiting in one place, then apply changes with a graceful reload that does not drop connections. There is no database and no web console, so your configuration lives in version controllable text.

The image is functional out of the box. On first boot Ferron serves a cloudimg landing page over both HTTP on port 80 and HTTPS on port 443, and to demonstrate the reverse proxy working end to end it also proxies the /backend path to a small local backend on the same virtual machine, which is a second Ferron instance bound to loopback only. So a bare virtual machine both serves static content and proxies a real request immediately, with nothing else to deploy; you then point Ferron at your own site and your own backends. Ferron the web server has no login and no password, so this image ships no shared or default credential of any kind. No TLS key material ships either: the HTTPS certificate and its private key are generated uniquely on your virtual machine at first boot, and the web server is gated so it cannot serve HTTPS before that has happened.

Ferron is distributed under the MIT License, free and open source with no per CPU or per deployment fee. cloudimg is not affiliated with or endorsed by the Ferron project. cloudimg provides packaging, the secure by default configuration, per instance TLS automation, security patching, and 24/7 support with a guaranteed 24 hour response SLA.