HTTP load balancing in
one static binary
A zero-dependency reverse proxy and load balancer for Linux. Smooth weighted round-robin, health-aware routing, content-aware health checks, TLS with SNI, and a browser admin with two-factor auth. No modules, no runtime, no agent: just one binary.
Linux · macOS · Windows · amd64 & arm64 · single static binary, ~8 MB
A load balancer, not a dependency tree.
The whole data plane in one Go binary built on the standard library alone:
no modules in go.mod, no CGO, nothing to install on the box.
Zero dependencies
Pure Go standard library, statically linked. TOTP, QR codes, PBKDF2, health
checks and the admin UI are all built in. scp one file and run it.
→ No runtime, no agent, no supply chain to audit.
Smart balancing
Smooth weighted round-robin spreads load by per-origin weight, or health-aware affinity pins a client to an origin with rendezvous hashing and an optional signed cookie.
→ Even spread, or sticky sessions, your call.
Health checks that see content
An active JSON heartbeat plus an optional content-aware probe: an origin serving garbled or corrupted pages its heartbeat can't see is pulled, and auto-returns once the content recovers.
→ Catch a broken backend before your users do.
Cloudflare-native
Real client IP from CF-Connecting-IP, an edge-only lockdown that
serves Cloudflare IPs alone, and Origin CA certificates for Full (strict). It also
speaks RFC 7239 Forwarded.
→ Your origins see the real visitor, not the edge.
Live control, no restart
Change weights, drain an origin, flip a setting from the ctl CLI or
the admin API and it takes effect at once, then persists to the config file. Reload
on SIGHUP.
→ Reweight a fleet mid-incident without a bounce.
TLS and SNI
Terminate HTTPS with multiple certificates chosen per handshake by hostname, hot add, replace or remove with no restart, HTTP/2 included. Ideal for a Cloudflare Origin CA cert per zone.
→ Many zones, one listener, zero downtime swaps.
Browser admin with 2FA
A full control plane in the browser, protected by two-factor auth (TOTP enrolled by QR), multiple admin accounts and an IP allowlist. Serve it on a Cloudflare-fronted hostname, no SSH tunnel.
→ Manage the fleet from anywhere, safely.
Built-in observability
A live analytics dashboard with traffic breakdowns by host, country and path, plus
a Prometheus-style /metrics endpoint. Passive circuit breaker on
transport errors and 5xx.
→ See what's happening without bolting on a stack.
Retries and failover
Idempotent requests retry on another origin on a transport failure, with a slow-start ramp for recovered backends and an optional response check that fails over on a garbled body.
→ A single flaky origin never becomes a 502.
Questions, answered
Is thisway free?
Yes. The release binaries are free to download and self-host on your own servers. There is no account, no licence server and no subscription.
What platforms does thisway run on?
It is built for Linux (amd64 and arm64) as a single static binary with no runtime to install, and release builds are also provided for macOS (Intel and Apple Silicon) and Windows. Every release ships a CHECKSUMS.txt so you can verify each download.
Does thisway need Cloudflare?
No. thisway works as a standalone load balancer, but it is built to sit behind Cloudflare: it reads the real client IP from CF-Connecting-IP, can lock itself down to Cloudflare edge IPs only, and terminates TLS with a Cloudflare Origin CA certificate for Full (strict) mode.
How do the health checks work?
An active checker sends a JSON heartbeat, plus an optional content-aware probe that fetches a real page and requires valid text: an origin serving corrupted or garbled content is pulled from rotation and auto-returns once it recovers. A passive circuit breaker also trips origins on transport errors and repeated 5xx, and idempotent requests retry on another origin.
Can I manage thisway without SSH?
Yes. There is a browser admin control plane with two-factor authentication (TOTP, enrolled by QR code) that can be served on a Cloudflare-fronted hostname, and a ctl command-line tool. Settings such as weights, draining and toggles change live with no restart and persist to the config file.
Grab the binary.
Free to download and self-host. Pop your email in and the download starts straight away: we'll only tell you about major releases, nothing else, and you can unsubscribe any time.
One static binary, then run it
Pick your platform on the next step, then drop the binary on your box, make it executable and check the version. Linux (amd64 and arm64), macOS and Windows builds are all offered.
$ chmod +x thisway-linux-amd64
$ ./thisway-linux-amd64 -version
loadbalancer v1.1.1 (go1.26.5, linux/amd64)
Every release ships a CHECKSUMS.txt. Verify a download with
shasum -a 256 -c CHECKSUMS.txt before you run it.
Also by us
Flanders, a fast native macOS MySQL and MariaDB client, and Tumbler, a native PDF viewer and editor for Mac and Windows. Both free while in beta.