BareProxy is the studio’s web server and reverse proxy, and since 0.2.0 it runs WebAssembly plugins. Version 0.11.0, out on 13 October, ships the ninth of them. A plugin is a small .wasm file: one line in the config adds it to a site, deleting the line takes it away, and the core stays the same size whichever plugins a site runs.
The core itself is about 5,000 lines of Go. It does TLS, routing, static files and backend health, and it changes a running config through plan, apply and rollback. The operating system post explains why everything else lives in plugins.
Nine Plugins in Six Days
The first two came in 0.4.0 on 8 October and the ninth on 13 October. They were built easiest first, so each could go out the day it worked:
- 0.4.0: maintenance and failover pages for when the app behind is down, and CORS, with preflights answered at the proxy
- 0.5.0: header and rewrite rules, security headers included
- 0.6.0: redirects from a plain file, where a 100,000-line redirect list loads in under half a second
- 0.7.0: geo rules from a local country database
- 0.8.0: request signing, and links that expire
- 0.9.0: A/B and canary splits
- 0.10.0: rate limiting and a basic WAF
- 0.11.0: link previews, which fill in missing Open Graph tags when Slack, WhatsApp, LinkedIn or another fetcher asks for a page
All nine are written in Rust. Since 0.3.0, an empty Rust plugin adds about 15 microseconds per request; the same do-nothing plugin in Go adds about 25. They run on wazero, a WebAssembly runtime written in Go, so the whole proxy still ships as one static binary. VPN Works runs its plugins on the same runtime.
What the Core Picked Up
Small plugins first was a way of testing the plugin host before the big ones arrive, and the core changed four times on the way. Now an answer that a plugin sends itself goes back out through the earlier plugins, which is how the maintenance page picks up its CORS headers. check and plan start every plugin before a change goes live and name the file and line of a bad setting. Plugins got counters shared by all their running copies, which a rate limit needs to count right. And a plugin can now let a response body stream past untouched, so link previews cost ordinary visitors nothing. The write-up on the first nine has the detail.
Twelve More to Come
Twelve more plugins are planned, and they’re the bigger ones, a day or more of work each. AI crawler control is first, then bot challenges, Markdown serving and cookie consent. The plugin program lists them all. 0.11.0 is on the releases page for Linux, macOS and Windows, with the nine plugins beside it.