Builds & Features
Fluxheim is compiled with feature sets. Pick the smallest build that contains what your deployment needs.
Common builds
| Build | Use it for |
|---|---|
| full | General production server with web, proxy, cache, TLS, ACME, PHP-FPM, metrics, and tracing. |
| wasm | Dedicated Wasm build based on the full production profile, with bounded policy hooks, ACME, metrics, and OpenTelemetry. |
| proxy | Reverse proxy without local static hosting or cache. |
| cache | Cache edge in front of another origin. |
| load-balancer | Focused upstream balancing and health checks. |
| php | Static web plus PHP-FPM applications such as WordPress. |
Profile examples
cargo build --release --no-default-features --features profile-full,acme-client,metrics,metrics-otlp,otel-tracing,otel-otlp
cargo build --release --no-default-features --features profile-wasm,acme-client,metrics,metrics-otlp,otel-tracing,otel-otlp
cargo build --release --no-default-features --features profile-cache-edge,acme-client
cargo build --release --no-default-features --features profile-proxy-edge,acme-client
cargo build --release --no-default-features --features profile-web-server,php-fpm,acme-client
cargo build --release --no-default-features --features profile-load-balancer-edge,acme-clientPingora-free normal builds
Starting with 1.6.34, normal Fluxheim release profiles use the Fluxheim-owned native runtime and no longer compile Pingora crates.
Dedicated Wasm build based on the full production profile, with bounded policy hooks, ACME, metrics, and OpenTelemetry.
Unsupported native runtime shapes still fail closed with explicit blockers instead of falling back to legacy adapters.
Feature families
| Family | What it adds |
|---|---|
web | Static file serving and local web routes. |
proxy | Reverse proxy routes and upstream handling. |
cache | Shared cache policy, memory and disk tiers, purge, and cache tooling. |
php-fpm | FastCGI bridge and optional managed PHP-FPM supervision. |
metrics | Prometheus metrics and optional OTLP metrics export. |
wasm | Optional WebAssembly policy runtime with bounded access, header, route, and cache hooks; disabled by default. |
Things that cannot go together
- Pick exactly one TLS backend.
- Privacy builds do not include cache, metrics, tracing, OTLP export, or Wasm features.
- Focused edge images intentionally omit modules outside their job.
- Run the feature validator before packaging custom feature strings.
FIPS backend evidence
Fluxheim provides separately pinned CI proof environments for the OpenSSL-FIPS and rustls/AWS-LC-FIPS profiles. They build and run the exact profile binary, exercise downstream and certificate-verified upstream TLS, reject incompatible policy, and record compiler, provider, dependency, binary, and image identities.
This is reproducible backend evidence, not product-level FIPS validation. Keep the proof containers separate from normal release images and review the evidence for the exact build you deploy.
Read the FIPS evidence guide