Modern HTTP/3 ingress for the APIs you already run.

Impulse is an open-source edge runtime that terminates HTTP/3 over QUIC, applies explicit traffic policy, and forwards requests to existing HTTP/1.1 or HTTP/2 services.

This beta release is intended for controlled production rollout. Review status, general-availability blockers, and limitations.

Read the quickstart View on GitHub

HTTP/1.1 and HTTP/2 backendsSelf-hosted Linux runtimeNative HTTP/3 over QUIC

OPERATOR VIEW / EXAMPLE

Example generation

Active

Illustrative

Request traffic

Rate + latencymetrics

Backend state

Health + loadruntime

Policy outcomes

Allow + rejectaudit

Request path

Ingress

HTTP/3 + QUIC

Decision

Route + Select

Policy

Authentication + Admission

Upstream

HTTP/1.1 or HTTP/2

Metrics · logs · traces · auditNot live telemetry

The operational problem

The edge gets hardest when traffic stops being normal.

Basic forwarding is only the beginning. Under pressure, platform teams need explicit routing, policy, and terminal outcomes.

Backend instability

Retries and unchecked concurrency can turn an isolated backend failure into a wider outage.

Unclear policy outcomes

When authentication, quota, admission, and routing blur together, rejected requests become difficult to explain.

Unsafe traffic changes

Routing and resilience updates need validation, controlled activation, and a retained rollback path.

Fragmented operational signals

Metrics, logs, traces, and audit events need a shared vocabulary to tell the same request story.

One runtime, explicit decisions

Traffic control that stays understandable under pressure.

Routing, authentication, admission, quota, and backend outcomes use shared runtime and telemetry contracts.

Modern ingress

Terminate native HTTP/3 over QUIC, with HTTP/1.1 and HTTP/2 bootstrap ingress for broad client compatibility.

Deterministic routing

Route by host, wildcard host, path prefix, and method with explicit, predictable resolution semantics.

Health-aware balancing

Choose from six load-balancing strategies backed by active health checks, passive signals, and automatic recovery.

Explicit resilience controls

Apply admission control, quotas, retries, hedging, circuit breakers, and bounded resource use where your traffic needs them.

Explicit trust boundaries

Secure upstreams with mutual TLS (mTLS), protect requests with JSON Web Tokens (JWTs) or API keys, and operate through role-aware administration.

Correlated operator signals

Correlate Prometheus metrics, structured logs, OpenTelemetry Protocol (OTLP) traces, audit events, and live runtime snapshots.

Adopt without rewriting

Modern clients in. Existing services out.

Impulse terminates modern traffic at the edge, converges both ingress paths on one policy pipeline, and dispatches to the backend protocol your services already use.

Impulse runtime architecture

Data plane and control plane boundaries

Active runtime generation

Data planerequest → response

Downstream

Native ingress

HTTP/3 · QUIC · UDP

Bootstrap ingress

HTTP/1.1 or HTTP/2 · TCP/TLS

→

Shared request path

One policy model for both ingress paths

active

Intake

canonical context

Route

resolve upstream

Select

choose backend

Pre-auth

brownout + rate limits

Local authentication

API key + JWT

External authorization

provider decision

Post-auth

quota + protection

Dispatch

bridge + transport

Response normalization · streaming guardrails · outcome recording · backend feedback

→

Upstream

HTTPS backend

HTTP/2 · TLS · optional mTLS

HTTP backend

HTTP/1.1 · connection pool

shared state and feedback

Runtime control

Validated generations

Validate · preview · activate · history · rollback

Backend lifecycle

Resolution, health, membership

Domain Name System (DNS) refresh · active checks · passive feedback · client rotation

Operator surfaces

Inspect request outcomes

Control API · metrics · logs · traces · audit · watchdog

Configuration you can reason about

Validate, preview, activate, and roll back.

Impulse lowers validated YAML into an immutable runtime generation. Operators see the diff before activation and keep a bounded path back to a known-good state.

config.yaml

YAML

version: 1

listen:
  protocol: http3
  port: 9889
  tls:
    cert: certs/proxy-cert.pem
    key: certs/proxy-key-pkcs8.pem

upstream:
  api_backend:
    load_balancing:
      type: round-robin
    route:
      path_prefix: /api
    backends:
      - id: api-1
        address: http://127.0.0.1:8001

Staged runtime changes

Inspect per-domain changes, reject incompatible updates, and atomically swap accepted generations.

validatepreviewactivaterollback

An observability bundle

Start with shipped dashboards, recording rules, alerts, and service-level objective (SLO) definitions aligned to the runtime vocabulary.

PrometheusGrafanaOTLP

Deploy with intent

Put Impulse in front of an existing service.

Follow the quickstart with an existing backend, then move toward a staged rollout with monitoring and rollback readiness.

Read the quickstart View source