Routing

Routes are defined inside listeners via the routes field. Each route has a match rule and a backend target. First match wins.

Path-Based Routing

Match requests by URL path prefix (path_prefix) or regex (path_regex).

Path-based routing

listeners:
  - name: https_public
    protocol: https
    bind: ":8443"
    tls:
      cert: /etc/nvelox/tls/server.crt
      key: /etc/nvelox/tls/server.key
    routes:
      - match:
          path_prefix: /api/
        backend: api_servers

      - match:
          path_prefix: /ws/
        backend: websocket_servers

      - match:
          path_prefix: /
        backend: web_servers  # catch-all

Host-Based Routing

Route based on the Host header using the match.host field. Useful for virtual hosting.

Host-based routing

listeners:
  - name: https_public
    protocol: https
    bind: ":8443"
    tls:
      cert: /etc/nvelox/tls/wildcard.crt
      key: /etc/nvelox/tls/wildcard.key
    routes:
      - match:
          host: api.example.com
        backend: api_servers

      - match:
          host: app.example.com
        backend: web_servers

SNI Routing

For TLS listeners, route based on the Server Name Indication (SNI) extension using sni_routes at the listener level. This allows routing before HTTP request parsing begins.

SNI routing

listeners:
  - name: https_public
    protocol: https
    bind: ":8443"
    tls:
      cert: /etc/nvelox/tls/server.crt
      key: /etc/nvelox/tls/server.key
    sni_routes:
      - server_name: secure.example.com
        backend: secure_servers
      - server_name: internal.example.com
        backend: internal_servers

ACLs (Access Control Lists)

Restrict access by client IP using ip_allowlist and ip_denylist at the listener level, or fine-grained acl rules with match conditions.

ip_allowlist — CIDR ranges permitted to connect
ip_denylist — CIDR ranges blocked from connecting
acl — Rules matching source_ip, method, or headers with allow/deny actions

IP allowlist/denylist

listeners:
  - name: https_public
    protocol: https
    bind: ":8443"
    tls:
      cert: /etc/nvelox/tls/server.crt
      key: /etc/nvelox/tls/server.key
    ip_allowlist:
      - "10.0.0.0/8"
      - "192.168.0.0/16"
    ip_denylist:
      - "10.0.100.0/24"

Header manipulation

listeners:
  - name: https_public
    protocol: https
    bind: ":8443"
    tls:
      cert: /etc/nvelox/tls/server.crt
      key: /etc/nvelox/tls/server.key
    routes:
      - match:
          path_prefix: /api/
        backend: api_servers
        headers:
          request_add:
            X-Forwarded-Proto: "https"
            X-Request-Source: "nvelox"
          response_add:
            X-Server: "nvelox"