Documentation
How to install SSLB3, build it, configure it, and understand the parts that are not obvious. Start with installing; come back for the rest when you need it.
Installing
Kubernetes with kubectl or Helm, or a Linux host with systemd. Container images and the values worth setting.
Configuration
Listeners, serverfarms, real servers, TLS, health checks, and overriding any setting from the environment.
Kernel fast path
When the kernel forwards a layer 4 service instead of SSLB3, how eligibility is decided, and what it costs.
Metrics and the statistics page
A Prometheus endpoint and a live statistics page, both built in, both rendered from live state.
Building from source
Cargo, the prerequisites per platform, the container images — and the current state of Windows support.
Source code
Where it lives, how the workspace is laid out, which crate does what, and how to contribute.
What SSLB3 is
One process that accepts connections and forwards them. It terminates TLS, speaks HTTP/1.1, HTTP/2 and HTTP/3, can route on host and path from its own configuration, can hand a decision to a Lua script where that is the clearer way to express it, and can copy bytes for a protocol it has never heard of. Backends are grouped into serverfarms, health checked on their own schedule, and selected by a balancing algorithm per farm.
Two things are layered on top of that engine and neither is required by it. The ingress controller configures the engine from Kubernetes objects. The kernel fast path hands a plain layer 4 service to nftables or IPVS when SSLB3 has nothing to add to it.
That layering is deliberate and worth knowing when reading anything else here: the engine is complete on its own and is configured by a file. Everything else is an addition that can be absent.
A note on defaults
Almost everything that could surprise you is off until you ask for it. Intrusion detection thresholds are all zero, meaning "do not watch this", because a rate that is abusive for one deployment is ordinary for the next. The metrics endpoint and the statistics page are off because they are unauthenticated and describe your whole deployment. Health checking is off per farm until configured.
The exception is the fast path, which defaults to auto — because the host is asked what it can do rather than assumed, and because eligibility is narrow enough that an HTTP deployment moves nothing.