Every screen
All of it, captured from a live node
Nothing on this page is a mockup or a design comp. Every image is a real screen from a running fleet with real sites, real certificates and real backends on it.
Click any screenshot to open it full size. Once it is open, use the arrow keys to move through the set, click the picture again to see it at its true pixel size, and press Escape to close it.
Guided
Or watch it, in order
A guided walkthrough built from these screenshots. There is no recorded video on this site.
Traffic
Traffic · 18 screens
What every node is doing right now, pool health, certificate counts, and whether anything is saved but not live.
Every hostname you serve, with its mode, its pool and its certificate.
Server names, the mode, the pool, the certificate and the listeners.
Sending part of a site to a different pool, to disk, or somewhere else entirely.
Only the options this build of nginx can actually run are shown at all.
The generated server block, read only, or hand written if you switch it over.
Every pool, its method, how many members are up, and which sites use it.
One row per server: address, port, weight, limits and state.
The method, hashing, consistent hashing and sticky sessions.
Interval, timeout, what counts as healthy, and a string that has to appear in the body.
The two features rebuilt from outside the nginx process.
A shared secret on every proxied request, with a paste ready snippet for five stacks.
Rate limits, connection limits, caches and access lists, shared by any site.
Lookup tables that read one thing about a request and set a value you use elsewhere.
Balancing a database, a mail server or anything that is not web traffic.
Replacing the bare nginx error with something of your own, per site or per path.
Paste an existing nginx config and see exactly what it would become. Nothing is written.
Requests, connections, processor and memory over time, from fifteen minutes to thirty days.
Security
Security · 10 screens
ModSecurity with the OWASP rules, per site, starting in watching mode.
A tuned rule set saved once and shared by any number of sites.
Tick the countries that may reach a site. The rest get a 403 before your backend sees them.
Catching password spraying, which slips past both a lockout and a rate limit.
Every certificate with its expiry, its source, and which nodes hold a copy.
Register a commercial certificate authority once and it renews like a free one.
Three roles, a required second factor, shared across every node.
Every change and every sign in, with the actor and the source address.
Your password, your authenticator, your recovery codes and your sessions.
Password first, then a six digit code. The allowlist is checked before this page renders.
Fleet
Fleet · 8 screens
Every node, its role, its state, its config version and its nginx build.
Zones, names, answers, and the exact records to create at your domain host.
Reaching a backend with no public address at all, over WireGuard.
What each node is running, and a rebuild that tests before it replaces.
What is saved but not live, and every version that has been applied.
One encrypted file that rebuilds the fleet somewhere else.
Fleet wide choices: certificates, DNS, management networks, the country database and the WAF rules.
Thirty nine capabilities scored against three commercial products, shipped in the product itself.
About these images
How they were made
A headless browser, against a live node
Each one was captured at a high pixel density from a signed in session on a running fleet, then scaled down. What you see is what the software renders.
Real data, with the names changed
These are the sites, pools and certificates of the non profit this was built for, so the counts, the health and the expiry dates are all genuine. The hostnames themselves were swapped for placeholders before each capture, because there is no reason to publish somebody's origin servers.
Nothing drawn on top
No annotations, no arrows, no cleaned up empty states. Where a page says there is nothing configured yet, that is what a fresh install looks like.
Two fresh servers is all it takes
Ubuntu 22.04 or newer, root access, and about twenty minutes. The installer does the rest and it is safe to run twice.