A proxy that started as one weekend's frustration
Ferrule came out of a five-person remote team building a booking platform in 2022. Between them they ran a Rails API, a Vite frontend, a background worker, and a websocket service — and every laptop had a slightly different nginx.conf, a slightly different set of mkcert certificates, and a Procfile that only sometimes matched the README.
One engineer spent a weekend gluing a small HTTP proxy to a small process supervisor, config-driven by a single TOML file, and pushed it to the rest of the team on Monday. Within a month all four other engineers were running it instead of their own setups. It was open-sourced in March 2023, once two unrelated teams inside the same company had asked to use it on their own repositories.
It has stayed small on purpose. There is no plugin system, no clustering, no dashboard that phones home. It answers for your local services and gets out of the way.
The goal was never to replace Traefik. It was to stop losing twenty minutes a week to a proxy config that four people were editing by hand.
What the project won't compromise on
Boring is a feature
Ferrule does noticeably less than a service mesh. Every proposed capability is weighed against the odds it becomes something you have to debug at 11pm before a demo.
Config over code
If a behavior can be expressed as a TOML key instead of a plugin API, it becomes a TOML key. There is no plugin API, and the maintainers would like to keep it that way.
One binary, no runtime dependencies
No shared libraries to install, no companion daemon, nothing that needs its own container. If it doesn't fit in the binary, it doesn't ship.
Fail loud locally, never fail open on trust
A broken ferrule.toml refuses to start, with a specific error and a line number. A TLS trust decision, on the other hand, is never silently downgraded — Ferrule would rather show you a warning than pretend a certificate is fine.
Who keeps it running
Three people review everything that lands in main. All of them run Ferrule daily on their own machines — that's still the main way bugs get found.
Noor Kavanagh
Original author · TLS engineWrote the first prototype in a weekend in 2022 to stop losing time to mismatched local proxy configs. Still reviews every pull request that touches certificate handling.
Theo Brandt
Process supervisor · CLICame from running bare-metal init systems and pushed for the restart/backoff model after always-only restarts turned out to be a foot-gun in an early release.
Priya Ostrowski
Docs · releases · packagingJoined after filing eleven documentation issues in a single month. Now owns the release checklist and packaging for every supported platform.
How decisions get made
Ferrule is MIT licensed — use it, fork it, ship it inside something commercial, no attribution required beyond keeping the license file. There's no company or foundation behind it; it's maintained on the three maintainers' own time.
There's no formal RFC process. Anything bigger than a bug fix starts as an issue on the tracker describing the problem, not the solution. A change ships once two of the three maintainers agree it's worth the added surface area — and per the principles above, "no" is a perfectly common outcome.
Get in touch
Bug reports and feature requests go on the issue tracker. For quick questions, the project chat room is #ferrule:matrix.org — maintainers are there most weekdays. There's no support email and no sales team; it's a volunteer project.