Caddy
Reverse Proxy & GatewaysFast, multi-platform web server with automatic HTTPS
Replaces Nginx, Apache
Best Lightweight Reverse Proxy & Gateways for self-hosting
The 52 best Lightweight reverse proxy & gateways you can self-host, ranked by community traction.
acme.sh
Reverse Proxy & GatewaysPure shell ACME client for TLS certificates
Replaces Certbot
AdGuard Home
Reverse Proxy & GatewaysNetwork-wide DNS ad and tracker blocker
Replaces Pi-hole, NextDNS
NPS
Reverse Proxy & GatewaysLightweight proxy server for intranet penetration
Replaces ngrok
Nginx
Reverse Proxy & GatewaysHigh-performance web server and reverse proxy
Replaces Apache, IIS
Pingora
Reverse Proxy & GatewaysRust framework to build fast, reliable network services
Replaces Nginx
Anubis
Reverse Proxy & GatewaysProof-of-work proxy to block AI scraper bots
Replaces Cloudflare Bot Management
DDNS-Go
Reverse Proxy & GatewaysAutomatic dynamic DNS updater with a web interface
Replaces No-IP, DynDNS
Shadowsocks-libev
Reverse Proxy & GatewaysLightweight encrypted SOCKS5 proxy
Replaces commercial VPN proxies
OAuth2 Proxy
Reverse Proxy & GatewaysReverse proxy that adds authentication to any web app
Replaces Cloudflare Access
dnscrypt-proxy
Reverse Proxy & GatewaysEncrypted DNS proxy supporting DNSCrypt and DoH
Replaces Cloudflare WARP
Tengine
Reverse Proxy & GatewaysNginx-derived web server with extra features
Replaces Nginx
FrankenPHP
Reverse Proxy & GatewaysModern PHP application server built on Caddy
Replaces nginx, Apache HTTP Server
SmartDNS
Reverse Proxy & GatewaysLocal DNS server that picks the fastest results
Replaces Pi-hole, dnsmasq
lego
Reverse Proxy & GatewaysLet's Encrypt and ACME client written in Go
Replaces Certbot
Tinyauth
Reverse Proxy & GatewaysSimplest way to protect your apps with a login screen
Replaces Cloudflare Access
Fabio
Reverse Proxy & GatewaysZero-config load balancer driven by Consul
Replaces HAProxy, Nginx
Blocky
Reverse Proxy & GatewaysFast DNS proxy and ad-blocker for local networks
Replaces Pi-hole, AdGuard Home
HAProxy
Reverse Proxy & GatewaysReliable, high-performance TCP/HTTP load balancer
Replaces F5 BIG-IP, AWS ELB
dae
Reverse Proxy & GatewayseBPF-based transparent proxy with traffic splitting
Replaces Clash
Tinyproxy
Reverse Proxy & GatewaysLightweight HTTP and HTTPS forward proxy daemon
Replaces Squid
3proxy
Reverse Proxy & GatewaysTiny multi-protocol proxy server suite
Replaces Squid
Zoraxy
Reverse Proxy & GatewaysGeneral-purpose HTTP reverse proxy and forwarding tool
Replaces Nginx Proxy Manager
WireGuard UI
Reverse Proxy & GatewaysWeb interface for managing WireGuard configurations
Replaces OpenVPN Access Server
sslh
Reverse Proxy & GatewaysProtocol multiplexer that shares one port between services
Replaces HAProxy
go-shadowsocks2
Reverse Proxy & GatewaysModern Shadowsocks proxy implementation in Go
Replaces VPN
Caddy Docker Proxy
Reverse Proxy & GatewaysGenerate Caddy reverse proxy config from Docker labels
Replaces Traefik
Emissary-ingress
Reverse Proxy & GatewaysKubernetes-native API gateway built on Envoy
Replaces AWS API Gateway, Kong
Contour
Reverse Proxy & GatewaysKubernetes ingress controller powered by Envoy
Replaces AWS ALB Ingress
relayd
Reverse Proxy & GatewaysOpenBSD load balancer and relay daemon
Replaces HAProxy, F5 BIG-IP
Coraza WAF
Reverse Proxy & GatewaysOpen-source enterprise-grade web application firewall
Replaces ModSecurity, Cloudflare WAF
mosdns
Reverse Proxy & GatewaysFlexible plugin-based forwarding DNS server
Replaces AdGuard DNS
Sozu
Reverse Proxy & GatewaysHot-reconfigurable HTTP reverse proxy in Rust
Replaces HAProxy, Nginx
Skipper
Reverse Proxy & GatewaysHTTP router and reverse proxy for service composition
Replaces Nginx, Traefik
Squid
Reverse Proxy & GatewaysCaching and forwarding HTTP web proxy
Replaces Cloudflare Gateway
Gateway API
Reverse Proxy & GatewaysNext-generation Kubernetes traffic routing standard
Replaces Kubernetes Ingress
Sablier
Reverse Proxy & GatewaysScale services to zero and start them on demand
Replaces AWS Lambda
KrakenD
Reverse Proxy & GatewaysUltra-high-performance API gateway
Replaces AWS API Gateway, Kong
Angie
Reverse Proxy & GatewaysDrop-in nginx fork with extended features
Replaces nginx
River
Reverse Proxy & GatewaysConfigurable reverse proxy from the Pingora project
Replaces nginx, HAProxy
Traefik Mesh
Reverse Proxy & GatewaysLightweight service mesh built on Traefik
Replaces Istio, Linkerd
Apache Traffic Server
Reverse Proxy & GatewaysFast, scalable caching proxy server
Replaces Varnish, Squid
gobetween
Reverse Proxy & GatewaysModern L4 load balancer and reverse proxy
Replaces HAProxy, NGINX Plus
frp-panel
Reverse Proxy & GatewaysWeb management panel for the frp reverse proxy
Replaces ngrok
caddy-l4
Reverse Proxy & GatewaysLayer 4 proxy module for the Caddy server
Replaces HAProxy
Pingap
Reverse Proxy & GatewaysReverse proxy built on Cloudflare's Pingora framework
Replaces nginx
Ehco
Reverse Proxy & GatewaysNetwork relay tool for forwarding traffic over many transports
Replaces Shadowsocks
ctrld
Reverse Proxy & GatewaysFlexible DNS forwarding proxy with per-client policy
Replaces NextDNS
HAProxy Kubernetes Ingress
Reverse Proxy & GatewaysKubernetes ingress controller based on HAProxy
Replaces AWS ALB Ingress
Traefik Geoblock
Reverse Proxy & GatewaysGeo-blocking middleware plugin for Traefik
Replaces Cloudflare WAF
Privoxy
Reverse Proxy & GatewaysPrivacy-enhancing web proxy with content filtering
Replaces commercial ad-filtering proxies
Pound
Reverse Proxy & GatewaysLightweight reverse proxy and HTTPS load balancer
Replaces NGINX, HAProxy
No apps match these filters.
At a glance
| App | Deploy effort | Difficulty | Min. RAM | License | ★ Stars |
|---|---|---|---|---|---|
| Caddy | ≈5-minute setup | Easy | 64 MB | Apache-2.0 | 77,932 |
| acme.sh | Read-the-docs project | Easy | 32 MB | GPL-3.0 | 47,812 |
| AdGuard Home | ≈5-minute setup | Easy | 128 MB | GPL-3.0 | 37,403 |
| NPS | Under-an-hour setup | Medium | 64 MB | GPL-3.0 | 34,244 |
| Nginx | Under-an-hour setup | Medium | 64 MB | BSD-2-Clause | 31,884 |
| Pingora | Read-the-docs project | Hard | 128 MB | Apache-2.0 | 27,615 |
| Anubis | Under-an-hour setup | Easy | 64 MB | MIT | 23,362 |
| DDNS-Go | Under-an-hour setup | Easy | 64 MB | MIT | 17,416 |
| Shadowsocks-libev | Under-an-hour setup | Medium | 32 MB | GPL-3.0 | 16,184 |
| OAuth2 Proxy | Under-an-hour setup | Medium | 128 MB | MIT | 15,173 |
Quick picks
- Most adopted: Caddy (77,932 GitHub stars).
- Lightest footprint: Tinyproxy (from 16 MB RAM, against 512 MB for the heaviest here).
- Fastest to deploy: Caddy (verified single-container compose).
- Licensing: 17 of 52 use Apache-2.0; check the rest individually if you plan to modify and redistribute.
Every option here is open-source and self-hostable, tagged Lightweight within the reverse proxy & gateways category. Deploy effort is graded from published container recipes, not vendor claims — see the methodology.