Pleiades exposes a REST API for managing pools, members, services, health checks, and geo rules. Enable it via api.enabled: true in your config.
This document describes all configuration fields supported by Nexus GSLB. The canonical struct is internal/config/config.go.
This guide describes how to deploy Nexus GSLB in development and production, including Kubernetes, Docker, systemd bare-metal, and a multi-region topology using NATS super-clusters.
This guide covers day-2 operations: monitoring, troubleshooting, routine tasks, and failure handling.
Common failure modes and step-by-step playbooks. Each section starts with symptoms, then diagnosis commands, then fixes.
Pleiades exposes Prometheus-compatible metrics at a configurable HTTP endpoint when enabled. All metrics include constant labels cluster and node when these are set in the config.
Filter chains let you compose multiple routing steps per DNS query. Instead of locking a service to a single algorithm, you declare an ordered list of filters that are applied in sequence — narrowing the candidate set at each step until a terminal filt...
Geo rules allow you to steer specific source IP ranges to specific pool endpoints, overriding the pool’s default load-balancing algorithm for those prefixes. Each rule maps a source CIDR block to a single endpoint address with an optional priority for…
The latency algorithm routes DNS queries using three signals:
RUM routing steers DNS answers using latency measured from real visitors' browsers, not from cluster-node health probes. A small JavaScript beacon on your site fetch-times each pool member; Nexus aggregates the results per client subnet and the rum fil...
The topology view is an interactive graph showing the live state of your GSLB configuration — services, pools, members, filter chains, and health checks — as a connected node graph. Health badge colours update in real time via a WebSocket connection…
Query Path Tracer The Query Path Tracer runs a dry-run simulation of the DNS resolution algorithm for any service and client IP you choose. It replays the exact filter chain tha ...
Nexus GSLB can auto-populate pool members from external service registries. When a service registers or deregisters with the registry, Nexus adds or removes the corresponding pool member automatically — no manual API calls required.
Pleiades performs active health checks against all configured endpoints and exposes the last-known status to the load balancer and (optionally) to the global state sync publisher.
When a pool loses all healthy members — whether from failed health checks, warm-up gates holding members back, or the minHealthy threshold not being met — DNS queries for services that use that pool would normally return NXDOMAIN or an empty answer.
Each pool can require a minimum number of healthy members before it will serve any DNS responses. When the healthy member count drops below the threshold, the pool is treated as fully unavailable — the service returns no answer rather than a degraded one.
External health signals let an outside monitor — CloudWatch, Datadog, or any webhook — post a health verdict for a pool member, which Nexus blends with its own health-check probe before deciding whether to answer DNS with that member. This closes the g...
When a new member is added to a pool or a disabled member is re-enabled, it immediately enters the live DNS rotation. For backends that take time to initialise — JVM warm-up, cache population, connection pool priming — this can result in the first few…
Remote probe agents (gslb-probe) extend Nexus GSLB health and latency vantage beyond the cluster nodes. Drop a small probe-only binary anywhere — an edge VM, a Kubernetes pod, a branch office, a cloud region where no full node runs — and it contributes...
Nexus already has the raw signal — per-service query volume and qtype mix are counted on the hot path regardless. Insights adds a rolling per-hour-of-day baseline on top and alerts through the existing channels (webhook, email, PagerDuty, OpsGenie) whe...
Nexus GSLB supports distributed tracing via OpenTelemetry (OTel). Traces complement Prometheus metrics: metrics give aggregate throughput and latency; traces show the per-request path through the daemon for debugging individual queries or health probe…
Delegated domains allow you to register DNS zones that this Nexus GSLB cluster is authoritative for. Once a domain is delegated, the cluster serves authoritative DNS responses for that zone — including DNSSEC-signed responses if DNSSEC is enabled.
Nexus GSLB implements RFC 5936 full zone transfer (AXFR) and RFC 1995 incremental zone transfer (IXFR, served as AXFR fallback). This allows secondary nameservers, CDN providers, and monitoring tools to pull a consistent snapshot of the zone.
Nexus GSLB implements RFC 2136 Dynamic DNS Update with TSIG authentication (RFC 2845). This allows ACME clients such as Caddy, acme.sh, certbot, and lego to write and delete DNS challenge records for automated TLS certificate issuance and renewal.
RPZ intercepts a query name before normal resolution and applies a rule: NXDOMAIN a known-bad domain, explicitly allow (PASSTHRU) an otherwise-blocked name, or CNAME it to a sinkhole. Rules are managed via the API/WebUI/gslbctl — there is no YAML confi...
Nexus GSLB’s RRL protects against DNS amplification and DDoS attacks by enforcing a per-source-IP query rate limit. It is independent of the global licensed RPS cap — a single abusive IP exhausts only its own bucket and does not affect other clients.
DNS Transport SecurityNexus GSLB supports four DNS transports. UDP and TCP are always active when the DNS server starts. DNS over TLS (DoT, RFC 7858) and DNS over HTTPS (DoH, RFC 8 ...
Nexus GSLB includes an embedded BGP speaker (GoBGP v3) that injects and withdraws routes based on health check results. This lets the daemon participate directly in your network’s routing fabric alongside its DNS-layer load balancing.
Nexus GSLB includes a built-in HTTP redirect service comparable to NS1's Redirect Manager. It listens on a configurable port, matches incoming requests by Host header against a stored rule table, and responds with HTTP 301, 302, 307, or 308. Rules are ...
Datastore (rqlite)Nexus GSLB stores all data-plane objects — pools, members, services, health checks, geo rules, redirects, TSIG keys, TXT records, users, tenants, roles, settings ...
This guide walks you through enabling global state synchronization for health and membership across multiple gslbd instances using NATS with JetStream.
Pleiades supports multiple isolated tenants on a single instance. Each tenant has its own pools, members, services, health checks, and geo rules; API calls from one tenant cannot read or modify another tenant’s resources.
Nexus GSLB uses role-based access control (RBAC). Each user is assigned a single role; each role carries a set of permission atoms that gate individual API endpoints.
Nexus GSLB enforces per-tier requests-per-second (RPS) limits and feature gates via cryptographically signed license tokens. The DNS server consults the licensing manager on every query — if the token bucket is exhausted the query is rejected with SERV...
Pleiades tracks per-tenant DNS query and API call counts and stores them in hourly buckets, providing the data foundation for consumption-based billing and capacity planning.
gslb-mcp is a Model Context Protocol server that exposes Nexus GSLB cluster state and configuration to AI platforms. Operators can query the live topology, get AI-assisted recommendations, and (optionally) apply configuration changes — all from tools…
The GSLB WebUI is a modern Next.js-based dashboard for managing the GSLB system. It provides real-time monitoring and configuration capabilities through an intuitive interface.
Guidance on health check intervals, algorithm selection, SQLite tuning, backup strategy, and cluster topology. Each section describes the tradeoff and gives a concrete recommendation for common deployment sizes.