wEdge
A web and application server in Rust: static sites, TLS, reverse proxy and metrics in one memory-safe binary, with safe defaults.
Latest release: v0.2.0 (3 November 2026). Licence: Apache-2.0.
Release v0.2.0Source on GitHubIssues
Features
- HTTP/1.1 and HTTP/2, with limits on headers, URIs, connections and every timeout.
- Static files: virtual hosts, ETag and Last-Modified, byte ranges, pre-compressed Brotli and gzip, path traversal protection, no directory listing.
- TLS with rustls: a certificate per virtual host by SNI, TLS 1.2 and later only, HSTS, HTTP to HTTPS redirects, security headers.
- Reverse proxy: round-robin upstreams with health checks, safe forwarding headers, body limits, timeouts.
- Operations: access and error logs (text or JSON), Prometheus metrics, hot configuration reload, systemd, OpenRC and Windows service.
- Configuration: one
wedge.tomlplusconf.d/, validated against a JSON Schema before use; secrets only by reference (env:orfile:). - Debug capture: an opt-in log of every request at each layer.
Version 0.2.0 adds a new Windows installer and an admin status page with administrator logins; see the release news.
Quick start
mkdir -p site && echo '<h1>Hello</h1>' > site/index.html
cat > wedge.toml <<'EOT'
[server]
listen = ["127.0.0.1:8080"]
default_vhost = "site"
[[vhost]]
name = "site"
root = "site"
EOT
wedge run -c wedge.tomlPlatforms
Status below is the project's own, from its install guides (checked 9 November 2026).
| Platform | Status |
|---|---|
| Debian 12 | Tested |
| Ubuntu 24.04 LTS | Tested |
| Kali Linux (rolling) | Tested |
| Fedora 40 | Tested |
| RHEL 9 and compatible (Rocky Linux, AlmaLinux) | Tested |
| Alpine Linux 3.20 | Tested |
| Windows 10/11 and Windows Server (x86_64) | Tested on a Windows 11 desktop and in CI |
| macOS (Apple silicon and Intel) | Untested |
Other Linux distributions can use the static musl tarball and follow the Alpine guide.
Downloads (v0.2.0)
All files come from the GitHub release. Verify them before use (next section).
| Platform | Files |
|---|---|
| Debian, Ubuntu, Kali | amd64 .deb, arm64 .deb |
| Fedora, RHEL and compatible | x86_64 .rpm, aarch64 .rpm |
| Other Linux (static, musl) | x86_64, aarch64 |
| Linux (glibc) | x86_64, aarch64 |
| Windows (x86_64) | Installer (.msi), zip |
| macOS (untested) | Apple silicon, Intel |
| Container image | ghcr.io/openedge-labs/wedge:0.2.0; OCI archives for amd64 and arm64 |
| Checksums, SBOM, key | SHA256SUMS, CycloneDX SBOM, GPG public key |
The Windows installer is not yet Authenticode-signed. Until the project's code-signing application is approved, Windows reports an unknown publisher.
How to verify a download
Every release file has a Sigstore signature (<file>.sigstore.json) and, except the public key, is listed in SHA256SUMS and has a GitHub build provenance attestation. The .deb and .rpm packages are also GPG-signed.
sha256sum --ignore-missing -c SHA256SUMS
gh attestation verify <file> --repo OpenEdge-Labs/wedge
cosign verify-blob <file> --bundle <file>.sigstore.json \
--certificate-identity-regexp '^https://github.com/(OpenEdge-Labs|alinganpatra20004)/wedge/' \
--certificate-oidc-issuer https://token.actions.githubusercontent.comReleases after 0.1.1 use the newer Sigstore bundle format; cosign 3 verifies them, and cosign 2.4 or later needs --new-bundle-format. Details, including the GPG fingerprint, are in the security policy.
Documentation and source
- Install guides
- User guide and configuration reference
- Threat model and verification log
- Source code, all releases, issues, security policy
Licence: Apache License 2.0.