gobetween

gobetween stays at Layer 4, balancing raw TCP, TLS, and UDP rather than parsing HTTP. That keeps it fast and protocol-agnostic, and it pairs the proxy with TLS termination, TLS pass-through, and ACME certificates so encrypted traffic works without a separate front end.

What sets it apart is that the backend list does not have to be static. Discovery plugins pull live targets from Docker, Consul, LXD, SRV records, plaintext or JSON endpoints, or an exec script, so the pool tracks your infrastructure as it changes. Configuration comes from TOML or JSON files, a URL, or Consul KV, and a management REST API exposes current config, server lists, stats, and metrics at runtime.

Written in Go, gobetween ships as a single binary with a snap install option and is in maintenance mode while still accepting pull requests. Self-host on any platform. MIT licensed.