The blazing fast Rust web server
Combines Nginx's reverse-proxy power, Apache's PHP hosting flexibility and Caddy's zero-friction TOML setup — in a single, memory-safe Rust binary.
v2.0.0 — HTTP/1.1 and HTTP/2 by default; HTTP/3 over QUIC and automatic HTTPS are optional build features, off unless you enable them.
$ curl -fsSL https://flashlin.com/install_linux.sh | bash
=> Detecting OS ................ Ubuntu 24.04 LTS
=> Installing FlashLin binary ... done
=> UDP 443 opened for HTTP/3 ... done
=> Starting systemd service ..... active (running)
FlashLin installed successfully.
Config: /etc/flashlin/server.tomlWhy FlashLin
Faster.Proxied.Secured.
Three things FlashLin gets right out of the box — pick a tab, or let it play through.
Zero-copy static delivery
An opt-in sendfile(2) fast path hands eligible static files straight from disk to socket, matching Nginx at 64 KiB with real, reproducible benchmarks — not marketing numbers.
[server]
sendfile = true
direct_static_io = true
# 64 KiB file, sendfile enabled:
# FlashLin 57,688 req/s · Nginx 67,269 · Apache 37,961
# See /docs/performance for full methodologyFeatures
Everything you need
Everything shipping in v2.0 — protocols, proxying, caching and certificate automation.
HTTP/1.1 + HTTP/2
Async request handling on Tokio and Hyper, with TLS ALPN negotiation over HTTPS.
HTTP/3 over QUIC
Optional h3/Quinn listener sharing one HTTPS origin with TCP. Off unless enabled.
Automatic HTTPS (ACME)
Let's Encrypt issuance, cached accounts and renewal via TLS-ALPN-01, no restart required.
TLS / HTTPS
rustls-based TLS — no OpenSSL dependency.
Reverse proxy + failover
Pooled upstream connections, round-robin groups and passive failure cooldown.
WebSocket proxying
Bidirectional HTTP/1.1 upgrade tunnels forwarded to your backend application.
HTTP QUERY method
Method, body and headers preserved end-to-end, with body-preserving failover.
Validated hot reload
Opt-in --watch applies a fully validated config snapshot without dropping connections.
PHP-FPM / FastCGI
Full FastCGI protocol support for hosting PHP applications directly.
Virtual hosts
Per-domain .toml files with independent routes, TLS and security rules.
In-memory response cache
TTL-based RAM caching scoped per virtual host, with fresh-file validation.
Gzip + Brotli
Precompressed .br/.gz sidecar negotiation plus bounded async dynamic compression.
Streaming & byte ranges
64 KiB streamed reads, single/suffix ranges, If-Range and precompressed assets.
Security headers + rate limiting
Per-host rate limits, IP allow/deny rules, path traversal and dotfile protection.
Prometheus metrics
Loopback-only GET /metrics covering every response dispatch path.
Memory-safe, single binary
Zero unsafe Rust code. No runtime dependencies — just one executable.
Install
Install in seconds
A universal installer for x86_64 and arm64 — TCP 80/443 and UDP 443 are opened automatically for optional HTTP/3.
Download & install
One command detects your distro and architecture, then installs the binary and a systemd service.
curl -fsSL https://flashlin.com/install_linux.sh | bashEdit config
Adjust the generated server.toml — ports, caching, compression, security and optional HTTP/3 or ACME.
sudo nano /etc/flashlin/server.tomlAdd a virtual host
Drop one .toml file per domain into the domains directory — no central config edits needed.
sudo nano /etc/flashlin/domains/example.com.tomlManage the service
flashlin itself wraps the systemd service, plus a loopback-only cache purge — see flashlin --help.
sudo flashlin start
flashlin status
flashlin purge cacheConfigure
Domains and HTTPS, without a control panel
Everything below is plain TOML — no dashboard to click through, no separate certbot cron job. Edit a file, reload, done.
Add a domain
Drop one .toml file per site into the domains directory — no central config edits, no restart needed.
[domain]
name = "example.com"
aliases = ["www.example.com"]
root = "/var/www/example.com/public"
[[routes]]
path = "/"
root = "/var/www/example.com/public"Request a Let's Encrypt certificate
Turn on the acme build feature once, then list every domain that should get automatic HTTPS in server.toml.
[tls]
enabled = true
http_port = 80
redirect_http_to_https = true
[tls.acme]
domains = ["example.com", "www.example.com"]
email = "admin@example.com"
cache_dir = "/etc/flashlin/acme"
production = false # switch to true once staging looks right
accept_terms = false # read the CA agreement, then set trueApply it without downtime
Validate first, then hot-reload — FlashLin swaps to the new config and certificate on the next request, no dropped connections.
$ flashlin --check /etc/flashlin/server.toml
Configuration OK
$ flashlin --watch /etc/flashlin/server.toml
=> example.com: certificate issued (Let's Encrypt, staging)
=> Watching for changes every 2sStaging first, always — Let's Encrypt rate-limits real certificates, and staging ones tell you everything works before you switch production = true. The full walkthrough — routing, reverse proxying a domain, required DNS and port setup — is in Domain configuration and HTTPS.
Performance
Measured, not marketed
Real measurements against Nginx and Apache on the same machine — including the parts that don't flatter us.
Three-way comparison — Ubuntu 24.04, static files, sendfile enabled
median req/s · higher is betterCPU-isolated Docker harness: two pinned server cores, two pinned client cores, identical files, compression and response caching off. Sendfile(2) enabled on Nginx and Apache (their default for a fair comparison) and on FlashLin (opt-in server.sendfile+ server.direct_static_io). Median of 3 repetitions at concurrency 32, zero request failures.
| File | FlashLin | Nginx | Apache | FlashLin p99 |
|---|---|---|---|---|
| 1 KiB | 75,553 | 119,845 | 42,306 | 0.96 ms |
| 64 KiB | 57,688 | 67,269 | 37,961 | 1.35 ms |
| 4 MiB | 2,798 | 2,966 | 2,752 | 27.94 ms |
Recorded 19 September 2026 in a Docker/Ubuntu 24.04 container on a shared development machine, not dedicated benchmark hardware — treat this as directionally reproducible rather than an absolute capacity number. FlashLin's large-file result depends on the opt-in sendfile fast path; both flags default off (see enabling it safely). Full methodology, caveats and raw results in Performance and limits.
Test suite
78 tests pass with all features enabled (HTTP/3 and ACME) on Rust 1.95. Real loopback TCP/UDP sockets and certificate-verifying clients — not mocks.
Coverage includes protocol negotiation, QUERY forwarding, WebSocket tunnels, static delivery, byte ranges, body limits, timeouts, hot reload, certificate rotation, cached ACME, the sendfile fast path (loopback GET/HEAD/conditional/keep-alive/ fallback), connection caps and shutdown draining.
Earlier Windows dev baseline
FlashLin alone, on different hardware and an earlier build. Kept for history — not comparable to the Linux figures above.
| File | Median req/s | Median p99 |
|---|---|---|
| 1 KiB | 629.3 | 84.7 ms |
| 64 KiB | 527.8 | 105.3 ms |
| 4 MiB | 131.4 | 366.7 ms |
Roadmap
What shipped, and what's next
v2.0 is released. Here is what it includes, and the work already lined up for the releases after it.
Shipped in v2.0
- Zero-copy sendfile(2) static delivery (opt-in) — matches or beats Nginx and Apache on large files in our CPU-isolated benchmark, see Performance below
- Optional HTTP/3 over QUIC (h3 + Quinn), sharing one HTTPS origin with TCP
- HTTP QUERY method — proxied with method, body and headers preserved end-to-end
- WebSocket upgrade forwarding with bidirectional reverse-proxy tunnels
- Pooled upstream connections, round-robin groups and passive failover
- Automatic HTTPS via ACME — cached issuance, renewal, TLS-ALPN-01
- Validated hot config reload via opt-in --watch, no dropped connections
- Precompressed .br/.gz negotiation, byte ranges, streamed static delivery
- Per-virtual-host cache and rate-limit scoping, static directory mounts
Planned for upcoming releases
- Closing the small-file throughput gap under high concurrency (still behind Nginx there)
- io_uring as a second zero-copy backend alongside sendfile(2)
- Independent SNI certificates for different hosted domains
- Fully streamed uploads, active upstream health checks, PHP-FPM pooling
- HTTP/3 extended CONNECT, WebTransport and 0-RTT request support
- Expanded observability and tracing, log rotation, cache management
- Continuous cross-platform CI and a published benchmark suite