UWAS

Unified Web Application Server

One binary to serve them all.

Apache + Nginx + Varnish + Caddy + cPanel → UWAS

Note: UWAS is production-ready with 50+ installed instances.

What is UWAS?

UWAS replaces your entire web server stack and hosting control panel with a single Go binary. Auto HTTPS, built-in caching, PHP support, .htaccess compatibility, reverse proxy, WebSocket forwarding, WAF, multi-user access control, and a 42-page React dashboard with 254+ API endpoints.

One binary. Zero hassle.

Current Snapshot (v0.6.42)

• Dashboard pages: 42 (web/dashboard/src/pages)
• Admin API routes: 254 (route registrations under /api/v1 in internal/admin/routes.go + analytics hooks)
• Go packages: 57 (from go list ./...)
• CLI commands: 19
• Test status: go test ./... passing (parallel)
• 70 security/stability fixes + 14 hot-path perf wins since v0.4.0 (see CHANGELOG)

v0.6.x highlights (standalone apps + hard legacy cutover):

• Apps are first-class objects under /etc/uwas/apps.d/<name>.yaml
• Domains expose apps with reverse proxy upstreams such as apps://my-api
• Domains use a dedicated Add Redirect flow for www.<domain> redirects, with per-host SSL, 301/302 selection, and no alias/cache/security noise on redirect records
• Domain creation can choose the canonical host: domain.com, www.domain.com, or both hostnames without redirecting
• Dockerized Software Library actions self-repair missing Docker Compose on Debian/Ubuntu, clean up failed installs, and show needs Docker Compose instead of leaving broken cards as vague unknown states
• Packages exposes Docker Compose as an Infrastructure dependency with a dashboard Fix Compose action for Software Library hosts
• Software Library compose templates are compatible with both modern docker compose and legacy docker-compose
• Installed Software Library web apps can connect, change, or unlink public auto-SSL proxy domains without reinstalling the app
• File Manager, built-in SFTP, dashboard SFTP users, and SSH keys open app domains at the app work_dir
• Creating an empty Node.js, Python, Ruby, or Go app seeds a tiny runnable demo
• Native app restart stops the full process tree so npm/node children do not keep old ports bound
• The Applications dashboard uses an inline app builder instead of a creation overlay
• Legacy domain-keyed type=app config and migration endpoints are removed
• Docker apps support image or BuildKit build context workflows

v0.5.0 highlights (refactor + perf + observability sweep, 43 commits):

• TLS handshake allowlist is now lock-free (atomic pointer instead of mutex + linear scan)
• IPACL / GeoIP / CORS / WAF middleware run as predicates on the hot path (no per-request wrapper allocation)
• API-key authentication is O(1) (secondary hash index alongside the username map)
• Cache LRU promotion debounced; per-host mutex on access-log writes; ACME renewal split from cert-map iteration
• New internal/respond package centralizes JSON responses with operator-visible 5xx logging
• Per-handler latency histogram (uwas_handler_duration_seconds{handler,quantile})
• Behavioural change: plaintext api_key fallback is now opt-in (global.users.allow_legacy_plaintext_api_key, default false). Operators upgrading from v0.4.x with a plaintext key must set the flag or migrate to hashed credentials.

Features

Web Server

• Auto HTTPS — Let's Encrypt certificates with zero configuration
• HTTP/3 (QUIC) — Via quic-go with Alt-Svc header advertisement
• Built-in Cache — Varnish-level caching with grace mode, tag-based purge, ESI (Edge Side Includes)
• PHP Ready — FastCG

... View full README on GitHub