Run your nginx boxes as one load balancer.
Failover LB puts a web page in front of nginx. Sites, backend pools with real health checks, certificates that renew themselves across a cluster, a firewall for your applications, and failover that works even when a whole server is gone. It costs nothing and it is yours to keep.
Replay of a real install run on a clean Ubuntu 26.04 machine. Press play to watch it again.
The problem
Two nginx servers is not a pair of load balancers
It is two servers that happen to run the same software and will slowly stop agreeing with each other. The gap between those two things is what this software fills.
Config drift
Somebody fixes one box at two in the morning and forgets the other. Six weeks later a failover puts traffic on a server with last quarter's rules on it.
A dead backend nobody noticed
Free nginx only finds out a backend is broken after a real visitor already got the error. Somebody always has to be first, and that somebody is a customer.
Certificates that quietly stop renewing
In a cluster, only the node that currently owns the public address can answer the challenge. Which node that is changes, and the usual setup never notices.
A typo that takes the fleet down
One bad directive pushed to both servers and nginx refuses to start on both. The rollback is a person with a terminal and a bad feeling.
The commercial answer costs real money
NGINX Plus is about $1,500 a node a year, and its firewall is roughly $2,000 more. Appliances start higher. Plenty of people simply do not have that.
Failover that only moves what arrives
If a whole server is gone, nothing reaches it, so nothing it might have done matters. Only the DNS lookup can send people somewhere else.
What it does
Every change is checked on every node before any node uses it
You press one button. The whole configuration is built from the database, staged on each server, and tested with the real nginx binary on each one. Only when every server agrees does any server reload.
If one node says no, both staged copies are thrown away and nothing goes live. A configuration that would stop nginx starting cannot get halfway across your fleet. A server that was switched off during the change gets it queued and replayed when it comes back, so it catches up instead of drifting.
A walk through of what the apply prints, including the case where one node refuses.
Watch it work
From an empty screen to a live site
A guided walkthrough of the real screens, in the order you would actually use them. Press play, or step through it yourself.
Built from screenshots of a live node. Use the arrows, or the left and right keys, to move at your own pace.
The short list
What you get on day one
There are more than forty feature pages on this site. These are the ones people install it for.
Real health checks
Every node probes every backend on a schedule and rewrites the upstream with the bad one marked down. This is the headline feature of the paid nginx, done from out here.
Read moreCertificates that work in a cluster
The fleet works out which node can answer the challenge at every renewal, pushes the token everywhere first, and copies the result to every node.
Read moreA real web application firewall
ModSecurity with the OWASP Core Rule Set, per site, starting in watching mode. Learn from real testing, keep the few exceptions you need, then block.
Read morePost quantum key exchange
Built against OpenSSL 3.5.7, so X25519MLKEM768 is offered first with the classic curves behind it. Traffic captured today stays private later.
Read moreDNS failover between sites
Your nodes answer DNS for a zone you delegate to them, and leave out any node that is not healthy. This is the part that survives a whole building going dark.
Read moreReach backends with no public address
One command on the machine and it dials out to every load balancer over WireGuard. No firewall change, no public address, no ticket to anybody.
Read moreNo central controller
Every node holds the entire configuration and syncs with its peers. There is nothing extra to install and nothing whose loss stops you managing the rest.
Read moreImport the nginx you already run
Paste in your current config and see exactly what it would become. Nothing is written until you say so, and nothing is dropped without telling you.
Read moreOne file rebuilds the fleet
An encrypted archive with every site, pool, zone, setting, account and certificate in it. Enough to stand the whole thing up on new servers.
Read moreHow it fits together
One container per nginx server, and nothing in the middle
The manager has to live on the same machine as the nginx it drives, because it talks to a small root agent over a socket on that box. Your application servers never learn that any of this exists.
Certificates
The fiddly part, handled properly
Getting a free certificate on one server is easy. Getting one on a cluster where the public address moves is where most setups quietly break two months later.
- Which node can answer is worked out fresh at every renewal, against public DNS.
- The challenge token goes to every node before validation starts, because the certificate authority chooses which one it connects to.
- The issued certificate and key are copied to every node, with the key kept at 0600 and owned by root.
- The certbot timer is switched off on purpose, so you do not get a mailbox of failures from the nodes that could never have answered.
- Paid authorities that speak ACME work the same way, including the account credentials your supplier gives you.
What a renewal prints when nobody is watching, which is most of the time.
An honest comparison
We score ourselves second out of four
The comparison page in the product rates 39 capabilities against NGINX Plus, Kemp LoadMaster and HAProxy ALOHA. Eighteen of those rows go against us, and each one says why. That is the same table, published here.
#1
140
HAProxy ALOHA
out of 195 stars
#2
138
Failover LB
this project, and it is free
#3
130
NGINX Plus
about $1,500 a node a year
#4
128
Kemp LoadMaster
from about $2,500 once
Adding up stars is the crudest reading of a table like that. It says a request queue and a support contract weigh the same, and they do not. The row we lose worst is the first one: there is nobody to ring at three in the morning. That is the real price.
Why this exists
It was built for a non profit, and then given away
I run hackrange.com, a non profit. Its web infrastructure had grown into something that needed a proper load balancer: one place to terminate TLS, certificates that renew without anybody remembering, a firewall in front of the applications, and a second server that could take over.
The commercial products all do this. They also cost more per year than the whole project spends on hosting. So I built the thing I needed, on free nginx, and made it configurable from a web page so it did not need me to run it.
It is free because plenty of other people are in the same position. A charity, a school, a small team, a hobby project that got popular. None of them should have to choose between a load balancer they can manage and a load balancer they can afford.
What the non profit actually needed
- Centralize
- One place that owns every public hostname, instead of rules spread across a dozen boxes.
- Offload TLS
- Terminate at the edge, with certificates that renew on their own and land on every node.
- Protect
- A WAF in front of applications that were never written with the public internet in mind.
- Modern crypto
- Post quantum key exchange, because traffic captured today gets decrypted later.
- Survive a failure
- A second server that takes over on its own, including when the first one is gone entirely.
- Cost nothing
- No license, no per node fee, no renewal that has to be argued for every year.
Searchable answers
Around 200 answers to the questions people actually ask
Not a manual you have to read in order. Type what you are trying to do and the list narrows as you type, all of it in the browser with nothing to load.
Certificates
Issue, renew, upload, wildcard, paid authority, and what to do when one fails.
Something is broken
502s, grayed out buttons, a page with no styling, a node that will not rejoin.
The firewall
Turn it on safely, learn what your app really does, and stop blocking yourself.
Failover
Cluster failover, DNS failover, planned maintenance and testing it on purpose.
Measured, not estimated
An hour of continuous traffic against a real two node fleet
Real site, real backends, real certificates. These are the numbers that came out, not the numbers anybody hoped for.
The honest caveat
The test could not find the limit. Throughput stopped rising at about 3,000 requests a second, and at that moment the load balancers were using roughly 6% of their processors. What ran out was bandwidth on the machine generating the load, not anything belonging to the fleet. So the real capacity is higher than these numbers, possibly a lot higher, and we do not know by how much.
Getting started
Two commands on a fresh server
You need one or two servers running Ubuntu 22.04 or newer, with internet access and root. That is the entire shopping list. The installer is safe to run again if something goes wrong.
1. Install the manager
sudo git clone https://git.failoverlb.net/failoverlb.git /data/docker/failoverlb \
&& sudo /data/docker/failoverlb/failoverlb_setup.sh2. Build nginx
sudo /data/docker/failoverlb/nginx-installer.sh installThe second one takes the longest, because it compiles nginx 1.30.4 from source against OpenSSL 3.5.7 with every module the GUI knows how to configure. Then open the address the installer printed and sign in.
The second server joins the first with a token that works once and expires in two hours.
It is free, and it is meant to be used
No license key, no per node fee, no sales call. Clone it, run the installer, and see whether it does what you need. If it does not, nothing has been spent.