NearlyFreeSpeech.NET rewrites critical request router in Rust, retires C++ version

A single Rust process now sits on the critical path for nearly every request at NearlyFreeSpeech.NET, deciding whether traffic is cached, proxied, routed, redirected, blocked, or sent on to a backend daemon. The company said its frontend is not a marketing layer at all, but the servers in front of member sites, and that setup depends on four custom Apache HTTP Server modules. One of those modules hands almost all request decisions to a custom process called nfsncore, which the company said can take everybody down if it fails.

That is why the rewrite mattered. In its April 17 post, NearlyFreeSpeech.NET said nfsncore had been rewritten in Rust and was already running on all servers, with the C++ version no longer running as of the day before publication. The process handles custom IP access controls, backend selection, redirects to aliases, wildcard aliases, Strict-Transport-Security, maintenance mode, offline sites, ACME requests for certificate refresh, and filtering broken or invalid requests. Even the wildcard alias path, the company said, is used by only two people, which makes the stack’s edge cases feel less theoretical and more like the kind of long-tail operational detail that can haunt a host if it is left to rot.

The decision reads as infrastructure discipline rather than a language trend chase. NearlyFreeSpeech.NET said the usual answer to rewrite questions is often no, but this code path was too business-critical to leave in place without weighing safety, correctness, and maintainability against migration cost. The company has been operating since 2002, says its business is built around fairness, innovation, and free speech, and describes itself as a clustered hosting network with a custom-developed interface and feature set. Its pricing is pay-as-you-go, with a deposit as low as $0.25 to start hosting.

The Rust move also fits a broader pattern at the company. In August 2023, NearlyFreeSpeech.NET announced a swap from Intel Xeon servers to AMD Epyc hardware and said most content serving would move from Phoenix, Arizona, to New York City, New York. In May 2024, it rolled out automatic TLS for all member sites and said it aimed to have TLS available on all aliases by the end of June. Taken together, those changes point to a provider modernizing the parts of its stack that matter most, one operational layer at a time. For Rust in production, that is the real win: not a side experiment, but the code that holds the front door open.