sozu-proxy/sozu

Features

• HTTP Reverse Proxies - Provides a high-performance, memory-safe reverse proxy that supports dynamic configuration and zero-downtime upgrades.
• Zero-Downtime Binaries Upgrades - Supports replacing the running binary with a newer version while maintaining existing connections and state.
• Infrastructure Shielding - Shields backend services from direct network exposure by acting as a secure gateway and isolating worker processes in sandboxes.
• Ingress Load Balancers - Distributes incoming requests across multiple backend clusters to optimize resource utilization and ensure high availability.
• Process Supervision - Ensures continuous service availability by automatically restarting worker processes that fail during operation.
• Load Balancers - Distributes incoming HTTP, TCP, and UDP traffic across multiple backend clusters to ensure service availability.
• Session and Traffic Routing - Manages clusters and backend servers through an event loop that accepts configuration updates at runtime without interrupting active connections.
• TLS Termination - Handles encryption and decryption at the edge to offload cryptographic processing from backend servers.
• Traffic Proxying - Routes incoming network requests to backend services using support for multiple protocols with encryption termination.
• Traffic Routing - Routes incoming requests to configured backend clusters using a multi-process architecture that scales across available CPU cores.
• Socket-Based Binary Hot-Reloading - Replaces the running proxy binary while preserving active network connections via socket handoffs.
• Constant-Time Authentication - Restricts frontend access using authentication with constant-time password comparison to prevent timing side-channel attacks.
• Backend Health Trackers - Lists active backends and clusters with performance data and visual alerts for connectivity or threshold violations.
• Worker Process Isolation - Restricts worker process privileges to shield backend infrastructure and prevent unauthorized access to system resources.
• Traffic Load Balancers - Routes HTTP, TCP, and UDP traffic across backend clusters with real-time configuration and health monitoring.
• Zero-Downtime Upgrades - Routes web traffic to backend services while performing configuration and binary upgrades without dropping active connections.
• IP Header Managers - Strips or injects client IP headers to ensure backend applications receive accurate source information while preventing header spoofing.
• Distributed Trace Propagation - Passes distributed tracing headers through the network to maintain request continuity across multiple proxy hops.
• Dynamic Configuration Managers - Enables runtime updates to proxy settings and cluster definitions via a command socket without service restarts.
• Flood Mitigations - Applies per-listener thresholds for frame types and protocol violations to protect against common denial-of-service attack vectors.
• Connection Optimizers - Adjusts stream limits and timeout thresholds to improve data throughput and manage resource consumption effectively during active network sessions.
• HTTP/2 Proxy Development - Handles connections between clients and backends with support for protocol negotiation, stream prioritization, and built-in protection against protocol-based flood attacks.
• Traffic Analyzers - Reports active stream counts, flow control status, and frame counters to monitor protocol-specific performance and security violations.
• Version Negotiation - Exchanges supported communication standards during the initial handshake to ensure the most efficient protocol is used.
• Stream Multiplexing Management - Handles multiple concurrent streams over a single connection with support for flow control, priority scheduling, and built-in flood mitigation.
• Edge Traffic Management - Terminates TLS connections and enforces access control policies at the network edge to protect backend infrastructure.
• Proxy Infrastructure Managers - Manages proxy listeners and backend clusters through a live control plane that accepts runtime configuration changes.
• SNI Binding Validations - Validates that incoming HTTP requests match the hostname covered by the served security certificate to prevent misdirected requests.
• HTTP/2 - Parses and manages individual request streams within HTTP/2 connections to enforce flow control and protocol-specific security policies.
• Runtime Control Sockets - Exposes a local command interface via Unix sockets for dynamic configuration updates and administrative tasks.
• TCP Proxies - Transmits raw byte streams between frontends and backends to support non-HTTP protocols or direct socket-level communication.
• Traffic Protocol Inspection - Analyzes and manages HTTP/2 streams and protocol-specific traffic to mitigate flood attacks.
• UDP Proxies - Routes datagram-based traffic like DNS and syslog through load-balanced listeners with active health monitoring.
• Frontend Authentication - Requires and validates credentials on specific frontends to restrict access to backend services.
• Administrative Access Restrictions - Validates the identity of connected clients using socket credentials to ensure only authorized users can issue configuration commands.
• Network Attack Mitigations - Protects against common protocol and network-level attacks by filtering malicious traffic patterns and enforcing rate limits.
• Proxy Security Header Enforcements - Injects security headers on HTTPS connections to mandate secure browser communication and prevent protocol downgrades.
• Request Rate Limiting - Protects backend services from overload by enforcing request volume limits on incoming traffic.
• TLS Certificate Management - Configures default or hostname-based certificates for HTTPS listeners to secure incoming traffic.
• Non-Blocking Event Loops - Processes network events using a non-blocking loop to handle high concurrency with minimal overhead.
• Process Isolation Architectures - Distributes incoming traffic across isolated worker processes to leverage multi-core hardware and ensure fault isolation.
• Shared-Nothing Architectures - Maintains proxy state within individual worker processes to eliminate lock contention and improve performance.
• Event Auditors - Streams a color-coded log of control-plane events and state changes to identify system transitions or failures as they occur.
• Runtime Visualizers - Monitors clusters, backends, listeners, and security events in real-time using a live terminal-based interface.
• Health Checks - Monitors the status of backend services to ensure traffic is only routed to healthy and responsive instances.
• Metrics Exporters - Exports internal state and performance statistics using standard protocols to external monitoring systems.
• Real-time Performance Monitoring - Displays real-time metrics for clusters, backends, and listeners through an interactive terminal interface.
• Security Audit Logs - Logs all configuration mutations and administrative actions to secure files for compliance and security visibility.
• Control Plane Audit Logs - Logs all privileged configuration mutations and administrative commands to a structured audit sink for security compliance.
• Telemetry Exporters - Streams telemetry and metrics to external monitoring systems using standard protocols for real-time performance tracking.
• Parsing Validators - Exercises frame parsing logic against arbitrary inputs to detect memory safety issues and vulnerabilities in header and body processing.
• Request Context Propagation - Generates or propagates unique request identifiers across proxy hops to enable end-to-end tracing and correlation.

Star history