# Ferron ## 产品介绍 Ferron 是一个使用 Rust 编写的现代 Web 服务器，支持静态文件、反向代理、HTTP/2、实验性 HTTP/3、自动 TLS 和可扩展模块。本应用默认提供一个安全收敛的单服务 HTTP 拓扑，适合通过 1Panel HTTPS 反向代理发布。 ## 主要功能 - 提供静态网站托管、反向代理和负载均衡 - 支持 HTTP/1.1、HTTP/2 和实验性 HTTP/3 - 支持自动 TLS、自定义证书和多虚拟主机 - 使用 KDL 配置并支持模块化扩展 ## 访问说明 默认地址为 `http://127.0.0.1:8080`。建议在 1Panel 中创建 HTTPS 反向代理后再向不受信任网络开放服务。 ## 默认部署 - 默认监听宿主机 `127.0.0.1:8080`，容器内部使用 HTTP 端口 `80`。 - `APP_DATA_DIR/www` 保存网站文件，初次安装时仅在缺失时写入示例首页。 - `APP_DATA_DIR/config/ferron.kdl` 是主配置文件，升级和重复初始化不会覆盖已有配置。 - `APP_DATA_DIR/acme` 保留可选自动 TLS 缓存，目录归属上游 `nobody` 用户（UID/GID `65534:65534`）。 - 访问日志和错误日志分别写入容器标准输出和标准错误，可直接通过 1Panel 查看。 ## 安全说明 - 容器使用上游 `nobody` 用户运行，根文件系统只读，丢弃全部 Linux capabilities，并启用 `no-new-privileges`。 - 网站和 KDL 配置在容器内只读挂载；通过 1Panel 文件管理器或宿主机编辑后，重启应用以应用配置变更。 - 默认配置不启用 TLS，也不公开 `443/tcp` 或 `443/udp`。如需 Ferron 直接管理证书，请根据官方文档修改 KDL 和 Compose 端口，并确保域名解析、ACME 挑战和防火墙配置正确。 - 静态网站通常不提供身份认证。不要在公开目录中放置密钥、备份或其他敏感文件。 ## 备份与升级 升级前备份整个 `APP_DATA_DIR`。恢复时应同时恢复 `config`、`www` 和 `acme`，并保持 `acme` 目录归属 UID/GID `65534:65534`。 ## Introduction Ferron is a modern Rust web server with static hosting, reverse proxying, HTTP/2, experimental HTTP/3, automatic TLS, and extensible modules. This package uses a constrained single-service HTTP topology intended for publication through a 1Panel HTTPS reverse proxy. ## Features - Host static websites and configure reverse proxies with load balancing - Serve HTTP/1.1, HTTP/2, and experimental HTTP/3 - Use automatic TLS, custom certificates, and multiple virtual hosts - Extend a KDL-based configuration with modules ## Default Deployment - The host bind defaults to `127.0.0.1:8080`, mapped to container port `80`. - Website files live under `APP_DATA_DIR/www`; the starter page is written only when missing. - The main configuration is `APP_DATA_DIR/config/ferron.kdl` and is never overwritten by upgrades or repeated initialization. - Optional automatic-TLS state is retained under `APP_DATA_DIR/acme`, owned by upstream UID/GID `65534:65534`. - Access and error logs use the container standard streams for direct viewing in 1Panel. ## Security And Operations - The container runs as upstream `nobody`, with a read-only root filesystem, all Linux capabilities dropped, and `no-new-privileges` enabled. - Website and KDL mounts are read-only inside the container. Edit them with the 1Panel file manager or on the host, then restart the app for configuration changes. - Direct TLS is disabled and port 443 is not published by default. Follow upstream documentation before enabling automatic TLS or HTTP/3. - Back up the complete `APP_DATA_DIR` before upgrades and retain UID/GID `65534:65534` on the `acme` directory when restoring. ## References - Project: - Stable release: - Docker installation: - Configuration: - License: (MIT)