v3.1 is out — RealWeb realtime hub & Node.js/Python apps

The blazing fast Rust web server

Combines Nginx's reverse-proxy power, Apache's PHP hosting flexibility and Caddy's zero-friction TOML setup — in a single, memory-safe Rust binary.

Install Now View on GitHub Read the docs →

v3.1.0 — HTTP/1.1 and HTTP/2 by default; HTTP/3 over QUIC and automatic HTTPS are optional build features, off unless you enable them. Also on Docker Hub as endurasolution/flashlin.

~ one-line install

$ curl -fsSL https://flashlin.com/install_linux.sh | bash

=> Detecting OS ................ Ubuntu 24.04 LTS
=> Installing FlashLin binary ... done
=> UDP 443 opened for HTTP/3 ... done
=> Starting systemd service ..... active (running)

FlashLin installed successfully.
Config: /etc/flashlin/server.toml

57,688 req/s

64 KiB static files with sendfile — Ubuntu 24.04, 2 pinned cores

Linux distributions on x86_64 and arm64

HTTP versions — 1.1, 2 and optional 3 over QUIC

binary — no OpenSSL, no runtime to install

HTTP/3 · QUIC
HTTP/2
TLS · rustls
Let's Encrypt ACME
RealWeb
WebSocket
Node.js
Python
PHP-FPM
Brotli · gzip
sendfile(2)
Prometheus
IPv4 + IPv6
Docker
systemd
HTTP QUERY

Why FlashLin

Faster.Proxied.Hosted.Secured.

Four things FlashLin gets right out of the box — pick a tab, or let it play through.

Zero-copy static delivery

An opt-in sendfile(2) fast path hands eligible static files straight from disk to socket, matching Nginx at 64 KiB with real, reproducible benchmarks — not marketing numbers.

server.toml

[server]
sendfile          = true
direct_static_io  = true

# 64 KiB file, sendfile enabled:
# FlashLin 57,688 req/s · Nginx 67,269 · Apache 37,961
# See /docs/performance for full methodology

Features

Everything you need

Everything shipping in v3.1 — realtime, app hosting, protocols, proxying, caching and certificate automation.

v3.1

RealWeb realtime hub

Built-in channels over WebSocket: signed tokens, permissions, resume after reconnect, presence and HTTP publish.

v3.0

Node.js + Python apps

FlashLin starts, restarts and health-checks your backends, load-balances instances and routes with app = "name".

v3.0

Official Docker image

endurasolution/flashlin on Docker Hub, with Compose files for HTTP, HTTPS and PHP-FPM.

v3.0

Hardened control plane

Per-IP connection caps, IPv6 /64 rate limiting, optional control token and dual-stack IPv4/IPv6 listening.

HTTP/1.1 + HTTP/2

Async request handling on Tokio and Hyper, with TLS ALPN negotiation over HTTPS.

HTTP/3 over QUIC

Optional h3/Quinn listener sharing one HTTPS origin with TCP. Off unless enabled.

Automatic HTTPS (ACME)

Let's Encrypt issuance, cached accounts and renewal via TLS-ALPN-01, no restart required.

TLS / HTTPS

rustls-based TLS — no OpenSSL dependency.

Reverse proxy + failover

Pooled upstream connections, round-robin groups and passive failure cooldown.

WebSocket proxying

Bidirectional HTTP/1.1 upgrade tunnels forwarded to your backend application.

HTTP QUERY method

Method, body and headers preserved end-to-end, with body-preserving failover.

Validated hot reload

Opt-in --watch applies a fully validated config snapshot without dropping connections.

PHP-FPM / FastCGI

Full FastCGI protocol support for hosting PHP applications directly.

Virtual hosts

Per-domain .toml files with independent routes, TLS and security rules.

In-memory response cache

TTL-based RAM caching scoped per virtual host, with fresh-file validation.

Gzip + Brotli

Precompressed .br/.gz sidecar negotiation plus bounded async dynamic compression.

Streaming & byte ranges

64 KiB streamed reads, single/suffix ranges, If-Range and precompressed assets.

Security headers + rate limiting

Per-host rate limits, IP allow/deny rules, path traversal and dotfile protection.

Prometheus metrics

Loopback-only GET /metrics covering every response dispatch path.

Memory-safe, single binary

Safe Rust throughout, with unsafe limited to a few OS calls for app supervision. One executable, no runtime dependencies.

How it works

One binary in front of everything

Every request passes through the same pipeline — TLS and protocol handling, limits, caching and routing — before reaching your files, apps or live channels.

BrowsersMobile appsAPI clients

FlashLin

one Rust binary

TLS · HTTP/1.1 · 2 · 3

Rate limits · IP rules · headers

Cache · Brotli / gzip

Virtual hosts · router

Static files

sendfile, ranges

Node.js / Python

supervised apps

PHP-FPM

FastCGI

RealWeb hub

live channels

New in v3.1 · RealWeb

Realtime, built into the server

RealWeb is FlashLin's own realtime hub. It runs over standard WebSocket framing, so it works in every browser and through any proxy — and adds the security and reliability raw WebSockets leave to you.

Turn on the hub

One section in server.toml. FlashLin holds every connection itself — your backend never touches a socket.

server.toml

[realweb]
enabled         = true
secret          = "…32+ random characters…"
allowed_origins = ["https://example.com"]
public_channels = ["news/*"]

Connect from the browser

The dependency-free client is served by FlashLin. It reconnects, resubscribes and resumes without duplicates.

index.html

<script src="/realweb/client.js"></script>
<script>
const rw = new RealWeb("/realweb", {
  token: () => fetch("/api/token").then(r => r.text()),
});
rw.subscribe("chat/lobby", (data, meta) =>
  console.log(meta.from, data));
rw.publish("chat/lobby", { text: "hi" });
</script>

Publish from any backend

Sign a standard JWT per user with any library, and push events with one loopback HTTP request.

$ curl -X POST http://127.0.0.1/flashlin/realweb/publish \
    -d '{"ch":"news/site","data":{"msg":"deployed"}}'
{"seq":42,"delivered":1873}

$ flashlin realweb status

Authentication
WebSocket: None built in; browsers can't send headers
RealWeb: Signed, expiring tokens with per-channel rights
Cross-site hijacking
WebSocket: Any page can open a socket
RealWeb: Origin checked at the handshake
Dropped connection
WebSocket: Messages sent meanwhile are lost
RealWeb: Resume from the last sequence number
Delivery
WebSocket: Fire and forget
RealWeb: Every publish acknowledged
Slow or abusive clients
WebSocket: Unbounded buffering, no limits
RealWeb: Bounded queues, size and flood limits
Backend work
WebSocket: Hold every socket yourself
RealWeb: One HTTP POST per event

	Plain WebSocket	RealWeb
Authentication	None built in; browsers can't send headers	Signed, expiring tokens with per-channel rights
Cross-site hijacking	Any page can open a socket	Origin checked at the handshake
Dropped connection	Messages sent meanwhile are lost	Resume from the last sequence number
Delivery	Fire and forget	Every publish acknowledged
Slow or abusive clients	Unbounded buffering, no limits	Bounded queues, size and flood limits
Backend work	Hold every socket yourself	One HTTP POST per event

Plain WebSocket proxying to your own app is unchanged. Messages are serialized once and shared across subscribers, then written in batches. Read the RealWeb guide for tokens, channels and the wire protocol.

Install

Install in seconds

A universal installer for x86_64 and arm64 — TCP 80/443 and UDP 443 are opened automatically for optional HTTP/3.

Download & install

One command detects your distro and architecture, then installs the binary and a systemd service.

curl -fsSL https://flashlin.com/install_linux.sh | bash

Edit config

Adjust the generated server.toml — ports, caching, compression, security and optional HTTP/3 or ACME.

sudo nano /etc/flashlin/server.toml

Add a virtual host

Drop one .toml file per domain into the domains directory — no central config edits needed.

sudo nano /etc/flashlin/domains/example.com.toml

Manage the service

flashlin itself wraps the systemd service, plus a loopback-only cache purge — see flashlin --help.

sudo flashlin start
flashlin status
flashlin purge cache

Supported distributions (x86_64 / arm64) — tap one for install notes

Ubuntu Debian Kali Mint Pop!_OS Raspberry Pi OS CentOS RHEL Rocky Linux AlmaLinux Fedora Oracle Linux Arch Manjaro openSUSE Alpine Gentoo

Prefer containers? Run the official Docker image

endurasolution/flashlin on Docker Hub (linux/amd64). Pin the full version tag for deployments — mounting your own config and site is covered in Getting started.

docker run -d --name flashlin -p 80:80 endurasolution/flashlin:3.1.0

Configure

Domains and HTTPS, without a control panel

Everything below is plain TOML — no dashboard to click through, no separate certbot cron job. Edit a file, reload, done.

Add a domain

Drop one .toml file per site into the domains directory — no central config edits, no restart needed.

/etc/flashlin/domains/example.com.toml

[domain]
name    = "example.com"
aliases = ["www.example.com"]
root    = "/var/www/example.com/public"

[[routes]]
path = "/"
root = "/var/www/example.com/public"

Request a Let's Encrypt certificate

Turn on the acme build feature once, then list every domain that should get automatic HTTPS in server.toml.

/etc/flashlin/server.toml

[tls]
enabled = true
http_port = 80
redirect_http_to_https = true

[tls.acme]
domains      = ["example.com", "www.example.com"]
email        = "admin@example.com"
cache_dir    = "/etc/flashlin/acme"
production   = false   # switch to true once staging looks right
accept_terms = false   # read the CA agreement, then set true

Apply it without downtime

Validate first, then hot-reload — FlashLin swaps to the new config and certificate on the next request, no dropped connections.

$ flashlin --check /etc/flashlin/server.toml
Configuration OK

$ flashlin --watch /etc/flashlin/server.toml
=> example.com: certificate issued (Let's Encrypt, staging)
=> Watching for changes every 2s

Staging first, always — Let's Encrypt rate-limits real certificates, and staging ones tell you everything works before you switch production = true. The full walkthrough — routing, reverse proxying a domain, required DNS and port setup — is in Domain configuration and HTTPS.

Performance

Measured, not marketed

Real measurements against Nginx and Apache on the same machine — including the parts that don't flatter us.

Three-way comparison — Ubuntu 24.04, static files, sendfile enabled

median req/s · higher is better

CPU-isolated Docker harness: two pinned server cores, two pinned client cores, identical files, compression and response caching off. Sendfile(2) enabled on Nginx and Apache (their default for a fair comparison) and on FlashLin (opt-in server.sendfile+ server.direct_static_io). Median of 3 repetitions at concurrency 32, zero request failures.

File	FlashLin	Nginx	Apache	FlashLin p99
1 KiB	75,553	119,845	42,306	0.96 ms
64 KiB	57,688	67,269	37,961	1.35 ms
4 MiB	2,798	2,966	2,752	27.94 ms

Recorded 19 September 2026 in a Docker/Ubuntu 24.04 container on a shared development machine, not dedicated benchmark hardware — treat this as directionally reproducible rather than an absolute capacity number. FlashLin's large-file result depends on the opt-in sendfile fast path; both flags default off (see enabling it safely). Full methodology, caveats and raw results in Performance and limits.

Test suite

78 tests pass with all features enabled (HTTP/3 and ACME) on Rust 1.95. Real loopback TCP/UDP sockets and certificate-verifying clients — not mocks.

Coverage includes protocol negotiation, QUERY forwarding, WebSocket tunnels, static delivery, byte ranges, body limits, timeouts, hot reload, certificate rotation, cached ACME, the sendfile fast path (loopback GET/HEAD/conditional/keep-alive/ fallback), connection caps and shutdown draining.

Earlier Windows dev baseline

FlashLin alone, on different hardware and an earlier build. Kept for history — not comparable to the Linux figures above.

File	Median req/s	Median p99
1 KiB	629.3	84.7 ms
64 KiB	527.8	105.3 ms
4 MiB	131.4	366.7 ms

Roadmap

What shipped, and what's next

v3.1 is released. Here is what v2.0 through v3.1 include, and the work already lined up next.

Shipped through v3.1

v3.1 — RealWeb realtime hub: signed tokens, Origin checks, channel permissions, resume after reconnect, acknowledged publishes, presence, slow-client and flood limits, HTTP publish and a JS client
v3.0 — Supervised Node.js and Python apps: crash restarts with backoff, health checks, multiple instances, graceful stop
v3.0 — Official Docker image on Docker Hub, per-IP connection caps, IPv6 /64 rate limiting, optional control token, dual-stack IPv4/IPv6 listening
Zero-copy sendfile(2) static delivery (opt-in) — matches or beats Nginx and Apache on large files in our CPU-isolated benchmark, see Performance below
Optional HTTP/3 over QUIC (h3 + Quinn), sharing one HTTPS origin with TCP
HTTP QUERY method — proxied with method, body and headers preserved end-to-end
WebSocket upgrade forwarding with bidirectional reverse-proxy tunnels
Pooled upstream connections, round-robin groups and passive failover
Automatic HTTPS via ACME — cached issuance, renewal, TLS-ALPN-01
Validated hot config reload via opt-in --watch, no dropped connections
Precompressed .br/.gz negotiation, byte ranges, streamed static delivery
Per-virtual-host cache and rate-limit scoping, static directory mounts

Planned for upcoming releases

RealWeb across several servers (clustering) and durable message history
Load testing RealWeb and app supervision at scale on Linux
Multi-architecture (arm64) Docker images
Closing the small-file throughput gap under high concurrency (still behind Nginx there)
io_uring as a second zero-copy backend alongside sendfile(2)
Independent SNI certificates for different hosted domains
Fully streamed uploads, active upstream health checks, PHP-FPM pooling
HTTP/3 extended CONNECT, WebTransport and 0-RTT request support
Expanded observability and tracing, log rotation, cache management
Continuous cross-platform CI and a published benchmark suite