Rustango — un framework web tout-en-un pour Rust

Project Overview

Rustango is my open-source web framework for Rust: Django's batteries with Rust's guarantees. The premise is that Django's real promise was never its syntax — it was that the framework had already made the boring decisions for you. Rustango keeps that promise in a compiled, memory-safe language, so the same model definition drives the database, the admin, and the API while the compiler turns a whole category of production incidents into build errors.

Everything arrives in one crate — ORM and migrations, admin, auth, REST with OpenAPI, templates, forms, background jobs and i18n — and ships as a single binary with no runtime or interpreter to install. Version 0.56 is the current release; the documentation site is itself built on Rustango CMS.

Key Features

• Typed ORM with a derive-macro model layer and a chainable, compiler-checked QuerySet — column names are real symbols, so a typo fails the build
• Migration engine that diffs models against the database and generates migration files, with multi-tenancy handled as a first-class concern (shared registry schema plus per-tenant schemas)
• Auto-admin: annotate a model and get full CRUD — list views with filters, search and pagination, generated forms, bulk actions
• REST ViewSets with auto-generated OpenAPI and Swagger UI, plus serializers and support for the QUERY method
• Complete auth stack: sessions, password and account flows (reset, verify, magic link), JWT, API keys, HMAC request signing, and SSO via OpenID Connect
• Server-rendered HTML views on Tera templates, a forms layer with CSRF protection, signals, signed URLs and full-page caching
• Background jobs, WebSockets and SSE, file and media handling, transactional email, and i18n
• Production MCP server: register a tool with one macro and any MCP client can discover and call it over JSON-RPC, with fail-closed per-agent authorization, OAuth 2.1, and user-owned keys whose capabilities follow the tenant's live RBAC
• A manage CLI that wires routing, tenancy, migrations, agent provisioning and custom commands into the same binary
• One backend across PostgreSQL, MySQL and SQLite; documentation published in four languages across seven versioned releases

Performance

The framework ships a reproducible, one-command benchmark harness comparing Rustango against Django (gunicorn and Hypercorn), Laravel (php-fpm and Octane) and a hand-written Go net/http baseline — six runtimes serving functionally identical blog sites on identical data and a 4 CPU / 2 GB hardware cap.

• Non-cached blog index: 4,781 req/s — 5.6x Django on gunicorn and 11.7x Laravel on php-fpm
• Redis-cached paths, where served traffic actually lives: 25,546 req/s on the index and 35,781 on detail, ahead of the Go baseline on both
• Pure CPU-bound compute: 14,341 req/s, roughly 26-32x Django and ahead of Go, which pays for its slightly lower median latency with GC pauses in the tail
• Flat 18.5 MiB of RAM under load with no garbage collector — less than the Go binary uses under load, and below what any interpreted runtime uses sitting idle
• 258 requests/sec per MiB of RAM, the highest of any runtime measured

The honest reading: the Go standard library leads on uncached throughput, and that is the point. Rustango delivers Go-class performance while handing you the batteries-included framework Go makes you write yourself.

Architecture

Routing sits on Axum and Tokio, so the async story is the mature one the Rust ecosystem already trusts. Models carry a schema the migration engine can diff; the same field metadata powers inserts, updates, the admin's form widgets and the OpenAPI schemas. Optional capabilities are feature-gated — the MCP module, for instance, compiles to nothing unless explicitly enabled — which keeps a default build lean. Release builds use LTO at opt-level 3 and deploy as one binary you build, copy and run.