Compatibility target · NGINX Plus
ngx-sharp is an independently controlled NGINX-compatible application delivery platform. It keeps the NGINX Plus operating model your estate already depends on — API v9, active health checks, key-value zones, zone synchronization, JWT/JWE and OIDC — and adds HTTP/3 on both sides of the proxy.
Organizations standardize on NGINX because it is compact, predictable, and widely understood. The operational dependency rarely stops at reverse proxying. Replace the platform and a single procurement decision detonates into parallel engineering work:
ngx-sharp removes the first seven by preserving the NGINX Plus operating model — and answers the eighth by putting the package, the release process, the feature ports, and the roadmap under an independent product.
For the targeted NGINX Plus operating model, ngx-sharp is designed to replace it in place. Migration becomes a staging-and-validation exercise rather than a redesign.
| Compatibility surface | ngx-sharp behaviour |
|---|---|
| Executable and service | Preserves the nginx executable and service identity |
| Configuration | The standard NGINX configuration prefix, syntax, and NGINX Plus directives |
| Logs, PID, cache, state | Preserves the conventional NGINX filesystem layout |
| Dynamic modules | The standard module directory; advertises the nginx-plus-r37.0 ABI/dependency target |
| Debian transition | Declares standard replacement relationships for nginx and nginx-plus packages |
| Status automation | Preserves the versioned NGINX Plus API through v9, with earlier-version compatibility endpoints |
| Runtime configuration | Preserves Plus-style zoned-upstream and key-value API writes; changes survive restarts |
| Process control | Includes the NGINX Plus Control REST API alongside standard Unix signals |
| Health and balancing | Active checks, least time, sticky modes, slow start, and request queues |
| Identity | Plus-style JWT/JWE and a native OIDC relying party |
| Cluster state | Plus-style zone synchronization for keyvals, rate limits, and sticky-learn |
| Platform coverage | Packaged for the same operating systems and releases as NGINX Plus |
| Distribution | GPG-signed packages over a private mutual-TLS APT repository |
“Drop-in” has a precise boundary. ngx-sharp is ABI-compatible with NGINX Plus and preserves its operational contracts, so NGINX Plus dynamic modules load against it unchanged. It is an independent product, not an F5 binary.
The integrated NGINX Plus enterprise feature families, shipped as one binary and one Debian package. The enterprise control plane is built in, not assembled from third-party modules.
The standard event-driven runtime, unchanged in behaviour and configuration model.
A versioned JSON data model through API v9, with compatibility endpoints for earlier versions.
Probes run independently of user traffic, so a failing backend leaves rotation before production discovers it.
Enterprise balancing controls for production traffic, not just round robin.
Runtime data becomes NGINX variables without a reload — inside the same API and sync model as the rest of the platform.
Live request-processing state shared between nodes — not configuration files copied around.
Policy enforced before traffic reaches the application, without assembling auth from Lua, sidecars, and middleware.
Inbound QUIC from clients and outbound HTTP/3 to proxied upstream services in one platform.
Beyond ordinary HTTP proxying, the Stream and mail subsystems ship in the same package.
Operational data plus deployment-ready presentation for the tools you already run.
stub_status where legacy tools need itDesigned to enter an existing NGINX host with minimal operational change.
Optional capabilities are not compiled in — they ship as dynamic modules that ngx-sharp builds and releases itself.
Most platforms terminate HTTP/3 at the front door and fall back to HTTP/1.1 behind it. ngx-sharp goes beyond the original NGINX Plus baseline: it establishes HTTP/3 connections to proxied upstream services as well.
Clients reach the edge over QUIC, and the edge reaches your services over QUIC too — one platform, one configuration, no protocol downgrade in the middle.
Header compression and flow control are configurable on the inbound and outbound paths alike, so header-heavy API traffic is not left sitting on defaults.
QUIC connections keep working across configuration reloads and binary upgrades, so everyday changes do not drop long-lived sessions.
HTTP/3 and TLS statistics surface through the same API your dashboards and Prometheus collection already read. The new path is as observable as the old one.
# QUIC in from clients listen 443 quic reuseport; listen 443 ssl; http3 on; location / { # ...and QUIC back out proxy_http_version 3; proxy_pass https://app_pool; } upstream app_pool { zone app_pool 1m; least_time header; server 10.0.3.11:443 slow_start=30s; server 10.0.3.12:443; }
Both NGINX Plus and Angie PRO are capable platforms. The question is not which product is feature-rich — it is which operational contract your estate is already built on.
| Feature family | ngx-sharp | NGINX Plus |
|---|---|---|
| NGINX data plane and configuration model | Included | Official implementation |
| API v9 rich status | Included | Included |
| Writable upstream API | Included | Included |
| Control REST API | Included | Included |
| Active HTTP, gRPC, TCP, UDP health checks | Included | Included |
| HTTP and Stream keyvals | Included | Included |
| Persistent runtime state | Included | Included |
| Least time, slow start, queues, sticky modes | Included | Included |
| Zone synchronization | Included | Included |
| JWT/JWE authentication | Included | Included |
| Native OIDC relying party | Included | Included |
| HTTP and Stream enterprise modules | Included | Included |
| Dashboard and Prometheus integration | Included | Included or packaged |
| HTTP/3 proxy connections to upstreams | Beyond the NGINX Plus baseline | Not in the baseline |
| Independently controlled repo, release and roadmap | Yes | Vendor-controlled |
| Dynamic module set (certificates, Brotli, Lua, OpenTelemetry…) | Built and shipped by ngx-sharp | Official F5 repository |
| Official F5 provenance and support | No | Yes |
“Full feature set” means the integrated NGINX Plus enterprise feature families shipped by ngx-sharp — not a representation that ngx-sharp is the F5 product, nor that every optional module in F5's repository is bundled.
| Capability | ngx-sharp | Angie PRO | Customer impact |
|---|---|---|---|
| NGINX Plus API v9 | Native compatible target | Angie /status and /config differ | Existing Plus automation stays on its current contract |
| Plus Control REST API | Included | No compatible endpoint | Process-control clients need redesign on Angie |
| Dynamic upstream mutation | Plus API model | Angie PRO API model | Both capable; schemas, identity, verbs and transactions differ |
| HTTP and Stream active checks | Included | Included as PRO probes | Both proactive; configuration and state models differ |
| Integrated Plus keyvals | HTTP + Stream, persistent, API-managed | Third-party module; not Plus-compatible | ngx-sharp avoids an add-on and an API migration |
| Zone synchronization | Keyvals, rate limits, sticky state | No general Plus-style zone sync | ngx-sharp shares multiple classes of live state natively |
| JWT / JWE | Integrated signed and encrypted tokens | Third-party JWT/JWS module | Broader native identity contract in ngx-sharp |
| Native OIDC | Integrated relying party | Lua plus external library | Less custom auth code and fewer dependencies |
| Sticky sessions | Cookie, route, learn + zone sync | Cookie, route, learn + external store | Angie PRO is strong on external storage; ngx-sharp aligns with Plus state |
| Queue and advanced balancing | Queue, least time, slow start | Queue, feedback balancing, slow start | Both strong; algorithms are not identical |
| Inbound HTTP/3 | Included | Included | Equivalent headline capability |
| Outbound HTTP/3 | Included | Included | Both support HTTP/3 upstreams |
| ACME | Shipped as a dynamic module | Integrated | Both available; ngx-sharp builds and ships its own ACME module |
| Native custom metrics and templates | Dashboard + Prometheus module | Native metrics, templates, Console Light | Angie PRO advantage for built-in custom metrics |
| Docker-label discovery | Not included | Included | Angie PRO advantage in container-centric discovery |
| DoH, RDP preread, Angie logging | No Angie-equivalent modules | Included | Angie PRO advantage where these are requirements |
| NGINX paths and Debian replacement | Preserved | Angie product conventions | ngx-sharp minimizes estate migration |
| NGINX Plus module and package identity | Advertised target | Separate product family | ngx-sharp supports NGINX Plus dependency migration |
Some Angie outcomes can be assembled with third-party modules, Lua, Redis, or external automation. That is different from having the capability inside the product's native control plane.
The base package carries the integrated enterprise control plane. Everything optional ships as a dynamic module — and every one of them is built, versioned, and released by ngx-sharp, from the same tree and on the same schedule as the server itself. They target the NGINX Plus module ABI, so nothing changes about how you load and configure them.
One vendor builds the server and its modules, so a release is a single coherent thing to qualify — not a server plus a shopping list of separately versioned add-ons.
Procurement and architecture reviews turn on precise language. These are the statements we stand behind, and the ones we will never make — in writing, before you commit to an evaluation.
Bring your configuration, your API clients, your dashboards, and your module list. A qualified proof of value runs against your estate, in your staging environment, with your rollback path intact.