sozu-proxy/sozu

Sozu is a reverse proxy server, meaning it sits between the internet and the actual servers running your application. When users visit your website, their requests first reach Sozu, which then passes them to the right backend server and returns the response. This arrangement lets you manage traffic, handle encryption, and add a security layer without changing your application code. The main characteristic Sozu advertises is that it is "always-up." Most proxy software requires a restart when you change its configuration or install an update, which causes a brief interruption in service. Sozu handles configuration changes and even software upgrades while it is actively processing requests, so there is no downtime for users. Configuration updates arrive through a secure socket connection rather than requiring a config file reload. Sozu handles SSL and TLS encryption, the technology that puts the "https" in website addresses. By terminating that encryption at the proxy layer, backend servers are freed from managing certificates and encrypting traffic, and can focus on their own logic. Multiple cryptographic backends are supported, including options for post-quantum security and FIPS 140-3 compliance for organizations with strict regulatory requirements. The project is written in Rust, a programming language known for its memory safety properties. Memory safety errors are a common source of security vulnerabilities in server software, and Rust's design prevents many of these by construction. Workers are also sandboxed, so even if one is compromised it cannot affect the others. Pre-built binaries are available for Linux on multiple architectures. The project is also available as a Docker image and can be compiled from source. The license is the GNU Affero General Public License version 3, with a note that the license applies to software built on top of Sozu's code but not to traffic simply passing through it.