ScaleGuard: Open-Source Load Balancer, WAF & Reverse Proxy

Q: How do I install ScaleGuard?

On macOS or Linux run curl -fsSL https://scaleguard.dev/install.sh | sh. With Docker, run ./scaleguard-docker.sh from a clone. Both generate an admin password and serve the admin UI at /adminui.

Q: Is it an ngrok alternative?

Yes. SafeExpose is the open-source (MIT) tunnel client: safeexpose 3000 publishes a local service at your own domain with HTTPS. Code: dhaneeshtb/scalegurad-safeexpose.

Control plane

Everything live. Nothing to reload.

Routes, certificates, firewall, rate limits, DNS and cluster health in one web UI, with the same operations over a REST API.

ScaleGuard admin UI overview: live topology, route performance and traffic insights — The ScaleGuard admin UI showing live topology and traffic.

ScaleGuard admin UI overview in the light theme — The ScaleGuard admin UI showing live topology and traffic.

Why ScaleGuard

Putting a service on the internet shouldn't take eight tools.

Eight tools, eight configs. ScaleGuard is all of them in one process, configured live.

Today

Load balancerits own config
Reverse proxyits own reload
Certificate clientcron job
WAF rulesmodule or add-on
Rate limiteranother service
DNS serverzone files
Logs & metricsa whole stack
Tunnela SaaS account

With ScaleGuard

1 JAR · 1 web UI · 1 REST API

Load balancingReverse proxyAuto-TLSWAFRate limitingDNSAnalyticsTunnelsCloud functionsClustering

A story · internal apps

How a team took control of its internal infrastructure.

From “nobody knows what is exposed” to one front door. An illustrative team, seven steps.

Who comes in

Office & VPN10.0.0.0/8

Partner servicetoken · read scope

Laptop demosafeexpose 3000

The internetscanners, bots

ScaleGuardthe one front door

HTTPS everywhere
Who may enter
WAF · rate limits
Every request logged

Internal apps

Metrics dashboard:3001 · open to anyonemetrics.tools.example.comoffice + VPNWAF on

Admin panel:8081 · shared passwordadmin.tools.example.comoffice + VPN5 req/s per client

Staging API:9000 · no authstaging-api.tools.example.comtoken · scopedWAF on

Wiki:8090 · old TLS certwiki.tools.example.comoffice + VPNcached 5 min

Sam's demodemo.tools.example.comoffice + VPNgone when Sam stops

Status webhookhooks.tools.example.com/statuscloud functionno server to run

no record of who calls what 1,284 requests today · 14 blocked · p95 31 ms · searchable with SQL

01
Fourteen tools, fourteen ways in.

Dashboards, admin panels, a staging API, a wiki. Each on its own port, with its own login and its own expiring certificate.
02
One front door.

One command installs ScaleGuard. Each app gets a named HTTPS route with Quick Mapping, and the apps stop listening to the world.
03
Only the right people.

Each route has its own allow-list. Partners get scoped OAuth tokens that can be revoked on their own.
04
Even internal apps get protected.

A per-route WAF, rate limits and one-click blocks. Abuse gets a 403 or 429 and the app never sees it.
05
Sharing a laptop demo.

safeexpose 3000 demo publishes it as a normal route, behind the same rules. Ctrl+C removes it.
06
Glue without another server.

Small endpoints and webhooks become cloud functions in the admin UI, with no new service to patch.
07
Seeing everything, staying up.

Every request is logged and searchable with SQL. A second node keeps the front door up through restarts.

How it works

Follow a request through the gateway.

Every request passes the same checks, in the same order, whether it is proxied to a backend, answered from the cache or handled by a cloud function. Pick a scenario and watch where it goes.

Clientbrowser · app · gRPC
TLS & protocolHTTP/1 · 2 · 3
IP rulesallow · deny · block
Rate limitper client · route
WAFOWASP CRS
AuthOAuth 2.0 · keys
Backendsload balanced

200 OK

Routed to a healthy backendRound-robin across 10.0.0.5 and 10.0.0.6, with passive health checks watching the answer.

GET /api/orders  200  backend:10.0.0.5:3000  12.4ms

Every request is recorded in the built-in analytics (DuckDB) with a trace ID you can search and query with SQL.

Get started

From nothing to serving traffic in three steps.

Java 21 or Docker. No config files.

1

Install

One command. It generates your admin password.

$ curl -fsSL https://scaleguard.dev/install.sh | sh
==> Java 21 found
==> Downloading release
==> Checksum OK
==> Generated an admin password: ••••••••••••••••••••
==> ScaleGuard is installed
    Admin UI : http://localhost:8080/adminui/

2
Open the admin UI

Sign in at /adminui.

3

Add a route

Pick a domain, list backends. HTTPS is automatic.

$ curl -X POST "http://localhost:8080/config/quickmapping?scaleguard=true" \
    -H "Authorization: $TOKEN" \
    -d '{"name":"app",
         "sourceURL":"https://app.example.com",
         "targets":["http://10.0.0.5:3000","http://10.0.0.6:3000"]}'

Install script

macOS and Linux.

curl -fsSL https://scaleguard.dev/install.sh | sh
scaleguard status

Docker

One script. Add --postgres or --dns.

./scaleguard-docker.sh
./scaleguard-docker.sh up --postgres

Expose a laptop app

Publish a local port at your own domain.

safeexpose 3000
→ https://app-3000.your-domain

Flagship · SafeExpose

Put any app on the internet with one command.

SafeExpose is the open-source, self-hosted alternative to ngrok that ships with ScaleGuard. It publishes a service from your laptop or a private network at your own domain, with automatic HTTPS, through the same gateway that protects the rest of your infrastructure.

One command. safeexpose 3000 and your local app is live. Name it with safeexpose 3000 demo.
Your domain, your certificate. No random URLs, no vendor account, no request quotas.
Controlled. Tunnels are normal routes, so allow-lists, WAF, rate limits and analytics apply. Ctrl+C removes the route.
Built to stay up. Reconnects with back-off after Wi-Fi changes and sleep, re-creates the tunnel if the server restarted, and dev-server hot reload (WebSockets) works.

Fully open source, MIT. Client and server are both on GitHub. Read it, fork it, run it on your own infrastructure. github.com/dhaneeshtb/scalegurad-safeexpose

$ safeexpose 3000 demo
Exposing localhost:3000 at https://demo.tools.example.com
(Ctrl+C to stop; it reconnects by itself if the network drops)
Tunnel up: localhost:3000 -> router.example.com:50001
Connection lost (link went quiet). Reconnecting in 2 s...
Tunnel up: localhost:3000 -> router.example.com:50001

Install

$ curl -fsSL https://raw.githubusercontent.com/dhaneeshtb/scalegurad-safeexpose/main/install.sh | sh

Needs Java 11+; the installer tells you how to get it. Windows: PowerShell installer in the repo.

Everything included

Everything included. Nothing bolted on.

No plugins, no paid tier. One open-source build.

Load balancing & reverse proxy

HTTP/1.1, HTTP/2, HTTP/3, gRPC, WebSockets and TCP. Health checks, retries and routing by host, path or header.

Web application firewall

Per-route policies, your own rules and OWASP CRS import. 44 of 44 test attacks blocked.

Rate limiting & IP rules

Per-client limits, IP allow/deny lists and timed blocks, shared across the cluster.

Automatic HTTPS

Let's Encrypt certificates for every route, ordered and renewed for you.

Authoritative DNS

Host your zones on the gateway. Served names answer with every node's IP.

SafeExpose tunnels flagship

Open-source, self-hosted ngrok alternative. safeexpose 3000 and you are live. See how.

Analytics you can query

Every request lands in embedded DuckDB. Dashboards, latency and a SQL console, with no log stack.

Active-active clustering with DR

Every node serves traffic. Automatic master election and a standby site. Break a node and watch.

Cloud functions

Answer a route with a sandboxed Groovy function instead of a server. See an example.

The admin UI

A control plane you will actually want to open.

Every setting is editable live, and nothing needs a reload. The same operations are available over the REST API.

ScaleGuard route editor with a live preview of the request path

Cloud functions

Answer a route with code, not a server.

Write a small Groovy function in the admin UI and attach it to any route. headers, query and the parsed body are just variables. It inherits the route's auth, rate limit, WAF, CORS and caching, and runs in a sandbox.

Sandboxed. No files, processes, reflection or threads; hard time, memory and size limits.
You set the permissions. Outbound calls are off until you allow them, with host allowlists and SSRF protection.
Scales and replicates. Compiled once, bounded concurrency, hot reload, synced across the cluster.
Test in the UI. Sample request panel, run logs and ready-made examples.

Functions share the gateway's JVM, so treat authors as trusted staff. Read exactly what the sandbox does and does not guarantee.

// headers, query and body are ready-made variables
def r = http.get(
  "https://api.open-meteo.com/v1/forecast" +
  "?latitude=${query.lat}&longitude=${query.lon}" +
  "&current=temperature_2m")

if (!r.ok) {
  return res.status(502).json([error: 'upstream ' + r.status])
}
return [temperature: r.json().current.temperature_2m]

High availability & disaster recovery

Active-active by default. A second site on standby.

Every node serves traffic. A majority elects the master. A standby site takes over with one call. No shared database, no etcd.

ClientsDNS · any load balancer · anycast

Primary site active-active

node-1master

node-2follower

node-3follower

DR site standby · still serving

node-5standby

node-6standby

Serving traffic: 5 of 5 nodes
Master: node-1 · term 7
Configuration changes: accepted

Everything is healthy.Three voting nodes share the work. Two DR nodes copy every change and also serve traffic.

Measured on local test clusters: new master in 2.9–3.8 s. Tested behaviour.

Every node serves traffic

Add a node, add capacity. Lose one, lose only its share.

A ledger instead of a database

Config changes go into a tamper-evident hash chain on every node.

No split brain

A master needs a majority. A cut-off minority keeps serving but accepts no changes.

Disaster recovery in one call

If the primary site is lost, POST /cluster/dr/promote (or one button) makes the DR site primary.

Shared where it matters

Rate limits, refresh tokens and analytics are cluster-wide.

Three commands

Same admin login on every node. Use an odd number (3 or more) of voting nodes. DR nodes add one flag.

# three active-active nodes: each lists the other two
$ java -Dport=80 -Dscaleguard.nodeName=a \
    -Dscaleguard.cluster.advertise=http://10.0.0.10:80 \
    -Dscaleguard.cluster.peers=10.0.0.11:80,10.0.0.12:80 \
    -DadminUser=admin -DadminPassword=… -jar scaleguard.jar

# a DR node in another region
$ java … -Dscaleguard.cluster.dr=true \
    -Dscaleguard.cluster.advertise=http://10.1.0.10:80 \
    -Dscaleguard.cluster.peers=10.0.0.10:80,10.0.0.11:80,10.0.0.12:80 \
    -jar scaleguard.jar

# after losing the primary site
$ curl -X POST http://10.1.0.10/cluster/dr/promote?scaleguard=true

Performance

Close to NGINX on one core. Honest about the rest.

Built on Netty with io_uring, epoll or kqueue picked automatically. Same backend, same wrk, 64 keep-alive connections, one CPU core each, small responses (October 2026).

93%of NGINX throughput on small responses

2×+the throughput of Envoy on the same core

80–110kauthoritative DNS answers per second

157krequests/s on 2 proxy cores (ARM64)

Requests per second as a share of NGINX (higher is better)

NGINX 1.29

100%

HAProxy 3.4

~98%

ScaleGuard

~93%

ScaleGuard + analytics on every request

~62%

Envoy 1.39

~40%

Traefik 3.7

~22%

Caddy 2.11

~18%

Where the C proxies are ahead: tail latency (JVM garbage collection; p99 about 8 ms vs 2.6 ms) and memory (about 200 MB with a 256 MB heap vs 15–25 MB). Results drift between runs, so each proxy is a share of NGINX measured in alternating runs. Methodology and how to reproduce.

How it compares

What you get out of the box.

Out of the box. Checked October 2026.

Capability	ScaleGuard	NGINX OSS	HAProxy	Traefik	Caddy
L7 load balancing & reverse proxy	Yes	Yes	Yes	Yes	Yes
HTTP/3 (QUIC)	Yes	Yes	Yes	Yes	Yes
Web application firewall	Built in, per route	Module	Enterprise	Plugin	Plugin
OWASP CRS with anomaly scoring	Import in the UI	Module (ModSecurity)	Enterprise	No	Plugin
Request analytics with SQL	Built in	Logs only	Logs only	No	No
Multi-node config sync, shared rate limits	Built in	NGINX Plus	Partial	Hub	No
Authoritative DNS server	Yes	No	No	No	No
Self-hosted tunnels (ngrok-style)	Yes	No	No	No	No
Web UI that edits configuration	Yes	No	No	Read-only	No
Live changes via API, no reload	Yes	NGINX Plus	Partial	Yes	Yes
Open source	MIT	Yes	Yes	Yes	Yes

NGINX and HAProxy are ahead on hardening and per-request overhead. ScaleGuard's edge is breadth in one process.

Questions

Frequently asked questions.

What is ScaleGuard?

A free, open-source application gateway in one Java process: load balancer, reverse proxy, WAF, rate limiting, automatic HTTPS, DNS, tunnels, analytics and cloud functions, configured from a web UI or REST API.

How do I install ScaleGuard?

On macOS or Linux run curl -fsSL https://scaleguard.dev/install.sh | sh. With Docker, run ./scaleguard-docker.sh from a clone. Both generate an admin password and serve the admin UI at /adminui.

What does it need to run?

Java 21 or newer, or Docker. SQLite by default, PostgreSQL optional. Cache and analytics use embedded DuckDB, so there is no other server to run.

Is ScaleGuard free?

Yes. MIT license, no paid tier.

How does it compare with NGINX and HAProxy?

About 93% of NGINX throughput in one-core small-response benchmarks. NGINX and HAProxy are ahead on tail latency, memory and hardening. ScaleGuard adds a UI, WAF, analytics, DNS, tunnels, clustering and functions without extra modules.

Can I use it for internal apps?

Yes. Each app gets a named HTTPS route with IP allow-lists, scoped OAuth tokens, a WAF, rate limits and a request log. It is not a single-sign-on provider for people.

Is it an ngrok alternative?

Yes. SafeExpose is the open-source (MIT) tunnel client: safeexpose 3000 publishes a local service at your own domain with HTTPS. Code: dhaneeshtb/scalegurad-safeexpose.

Can it run as a cluster with disaster recovery?

Yes. Run three or more active-active nodes with automatic master election and no shared database. A standby DR site can be promoted with one call. If a node fails, the others keep serving.

Are cloud functions safe?

They run in a layered Groovy sandbox with no file, process or thread access, hard limits, and network calls off unless the admin allows hosts. They share the JVM, so they are not a hard security boundary; trust their authors.

Your whole edge.One process.

Everything live. Nothing to reload.

Putting a service on the internet shouldn't take eight tools.

Today

With ScaleGuard

How a team took control of its internal infrastructure.

Fourteen tools, fourteen ways in.

One front door.

Only the right people.

Even internal apps get protected.

Sharing a laptop demo.

Glue without another server.

Seeing everything, staying up.

Follow a request through the gateway.

From nothing to serving traffic in three steps.

Install

Open the admin UI

Add a route

Install script

Docker

Expose a laptop app

Put any app on the internet with one command.

Everything included. Nothing bolted on.

Load balancing & reverse proxy

Web application firewall

Rate limiting & IP rules

Automatic HTTPS

Authoritative DNS

SafeExpose tunnels flagship

Analytics you can query

Active-active clustering with DR

Cloud functions

A control plane you will actually want to open.

Answer a route with code, not a server.

Active-active by default. A second site on standby.

Primary site active-active

DR site standby · still serving

Every node serves traffic

A ledger instead of a database

No split brain

Disaster recovery in one call

Shared where it matters

Three commands

Close to NGINX on one core. Honest about the rest.

What you get out of the box.

Frequently asked questions.

What is ScaleGuard?

How do I install ScaleGuard?

What does it need to run?

Is ScaleGuard free?

How does it compare with NGINX and HAProxy?

Can I use it for internal apps?

Is it an ngrok alternative?

Can it run as a cluster with disaster recovery?

Are cloud functions safe?

Run your edge from one place.

Your whole edge.
One process.