Documentation
How to install SSLB3, build it, configure it, and understand the parts that are not obvious. Start with installing; come back for the rest when you need it.
Installing
Kubernetes with kubectl or Helm, or a Linux host with systemd. Container images and the values worth setting.
Configuration
Listeners, serverfarms, real servers, TLS, health checks, and overriding any setting from the environment.
Configuration reference
Every setting the configuration file understands, section by section, with what each accepts and its default.
Annotation reference
Every annotation an Ingress can carry, what each one accepts, and what happens when you leave it out. Plus the ones that deliberately do not exist.
L4Ingress reference
The TCP and UDP custom resource, field by field: what is required, what is optional, and how two objects claiming a port resolve.
Lua interface reference
Every hook SSLB3 calls and every function a script can reach — request, body and response hooks, admin endpoints, and the json, yaml, regex and file libraries.
Kernel fast path
When the kernel forwards a layer 4 service instead of SSLB3, how eligibility is decided, and what it costs.
HTTP/3 behind an AWS network load balancer
Why QUIC needs a load balancer of its own, how a connection ID names the pod holding the connection, and the classic BPF filter that keeps a moved client on its worker.
Metrics and the statistics page
A Prometheus endpoint and a live statistics page, both built in, both rendered from live state.
Building from source
Cargo, the prerequisites per platform, the container images — and the current state of Windows support.
Source code
Where it lives, how the workspace is laid out, which crate does what, and how to contribute.
What SSLB3 is
One process that accepts connections and forwards them. It terminates TLS, speaks HTTP/1.1, HTTP/2 and HTTP/3, can route on host and path from its own configuration, can hand a decision to a Lua script where that is the clearer way to express it, and can copy bytes for a protocol it has never heard of. Backends are grouped into serverfarms, health checked on their own schedule, and selected by a balancing algorithm per farm.
Three things are layered on top of that engine and none is required by it. The ingress controller configures the engine from Kubernetes objects. The API gateway is a request script that holds traffic to OpenAPI contracts. The kernel fast path hands a plain layer 4 service to nftables or IPVS when SSLB3 has nothing to add to it.
That layering is deliberate and worth knowing when reading anything else here: the engine is complete on its own and is configured by a file. Everything else is an addition that can be absent.
A note on defaults
Almost everything that could surprise you is off until you ask for it. Intrusion detection thresholds are all zero, meaning "do not watch this", because a rate that is abusive for one deployment is ordinary for the next. The metrics endpoint and the statistics page are off because they are unauthenticated and describe your whole deployment. Health checking is off per farm until configured.
The exception is the fast path, which defaults to auto — because the host is asked what it can do rather than assumed, and because eligibility is narrow enough that an HTTP deployment moves nothing.