graygnuorg / pound

Pound __Pound__ is a reverse proxy, load balancer and HTTPS front-end for Web servers. It was initially developed to distribute the load among several Web-servers and to allow for a convenient SSL wrapper for those Web servers that do not offer it natively. Since then, it has acquired a lot more features. __Pound__ is distributed under the GNU General Public License, Version 3, or (at your option) any later version. The original version of __pound__ was written by Robert Segall at Apsis GmbH. In 2018, Sergey Poznyakoff added support for OpenSSL 1.x to the then current version of the program (2.8). That version of __pound__, hosted on *github* was further modified by Rick O'Sullivan and Frank Schmirler, who added WebSocket support. On April 2020, Apsis started development of __pound__ 3.0 - essentially an attempt to rewrite __pound__ from scratch, introducing dependencies on some third-party software. On 2022-09-19, Robert announced that he stops further development and maintenance of __pound__. Following that, Sergey decided to continue development of the program starting from his fork. What Pound Is • a *reverse-proxy*: it passes requests from client browsers to one or more backend servers. • a *load balancer*: it distributes requests from client browsers among several backend servers, while keeping session information. • an *SSL wrapper*: it decrypts HTTPS requests from client browsers and passes them as plain HTTP to the backend servers. • an *HTTP/HTTPS sanitizer*: it verifies requests for correctness and accepts only well-formed ones. • a *fail-over server*: should a backend server fail, *pound* will take note of the fact and stop passing requests to it until it recovers. • a *request redirector*: requests may be distributed among servers according to the requested URL. *Pound* is a very small program, easily audited for security problems. It can run as setuid/setgid and/or in a chroot jail. *Pound* does not access the hard-disk at all (except for reading certificate files on start, if required) and should thus pose no security threat to any machine. What Pound Is Not • Although __pound__ is able to serve static content, it is not a Web server: its main purpose is to pass requests and responses back and forth between clients and actual web servers (*backends*). • __Pound__ is not a Web accelerator: no caching is done -- every request is passed to a backend server "as is". Notice On Project Versioning I took over __pound__ development at its 2.x branch. The branch 3.x, which emerged for a short time before the original project was abandoned, I consider to be a failed experiment. To ensure consistent versioning and avoid confusion, my versioning of __pound__ starts with 4.0. Documentation Documentation in texinfo and manpage formats is available in the distribution. A copy of the documentation is available online. Build requirements To build, __pound__ needs OpenSSL version 1.1.x or 3.0.x. If you compile it on a Debian-based system, you need to install the package prior to building __pound__. If you plan using Perl-compatible regular expressions, install PCRE2 (the package, on debian). You may wish to install Lua for extending __pound__ functionality, ( ). Additional software is needed for testing. See Testing, for details. Compilation If you cloned __pound__ from the repository, you will need the following tools in order to build it: • GNU Autoconf, version 2.71 or later. • GNU Automake, version 1.16.5 or later. • GNU Libtool, version 2.4.2 or later. First, run This will prepare the necessary infrastructure files ( 's etc.) If you are building __pound__ from a tarball, the above step is not needed, since all the necessary files are already included in it. To prepare __pound__ for compilation, run . Its command line options will decide where on the filesystem the binary will be installed, where it will look for its configuration file, etc. When run without options, the binary will be installed at and it will look for its configuration in file . If you run it as: then the binary will be installed at and it will read its configuration from . For a detailed discussion of , , and other generic configure options, refer to Autoconf documentation. Apart from the generic ones, there are also several *pound-specific* configuration options: • Enable tests of DNS-based dynamic backends. The dynamic backends are enabled using the option (see below). The corresponding tests involve the use of an experimental pre-loaded library and are by default disabled. Use this option to enable them. These tests also require the perl module. See below, for details. • or Enable or disable support for DNS-based dynamic backends. You will need the GNU adns library to be able to use it. On debian-based systems, it can be installed by By default, dynamic backends are enabled whenever this library is present. • or Enable or disable the use of Lua extension. By default, it is enabled if the Lua library and header files are installed and are of suitable version. You will need Lua version 5.3.5 or 5.4 for this to work. Use , if you don't need this feature or want to get a smaller binary without extra dependencies. The option takes an optional argument, specifying the Lua version to compile with. Use this if you have several Lua versions installed in parallel, and wish to select one of them. If is not able to detect the presense of Lua files (e.g. if those are installed in a non-standard location), use the LUA_CFLAGS and LUA_LIBS variables to indicate their location. E.g.: • or Enable or disable use of the or library. This library allows you to use Perl-compatible regular expressions in __pound__ configuration file. By default, its presence is determined automatically; is preferred over . To force compiling with the older , use . To disable support, use . • or __Pound__ calls the function as part of its shutdown sequence. In GNU libc, this function…