Edge gateway · Rust

One binary at the boundary of your network.

Zion terminates TLS 1.3, inspects every request with a zero-regex WAF, serves hot paths from a two-level RAM cache, and proxies the rest — one auditable executable in place of nginx, a WAF module, a cache, and a geo-tagger. Explicit knobs, not a black box.

Read the guide zion import nginx Source

§1

Capabilities

Sharp primitives, each cheap enough to leave on under load.

TLStermination

rustls on aws-lc-rs with hardware AES. Multi-SNI, session tickets, 0-RTT. Certificates swap via ArcSwap with zero dropped connections on reload.

WAFinspection

Aho-Corasick in a single O(N) pass — five gates, Shannon entropy, simd-json structural limits. A shadow mode logs without blocking.

Cachetwo-level

L1 thread-local intrusive LRU + L2 sharded DashMap, generation coherence, request coalescing. No stale read after an update.

Protocol1.1 / 2 / 3

HTTP/2 upstream multiplexing, WebSocket pipe, zero-buffer SSE, HTTP/3 QUIC (feature-gated). ACME auto-HTTPS on by default in the release build.

Edgesovereign

Per-IP rate limit and concurrent-connection cap, IT/EU origin tagging with no GeoIP database, Ed25519-signed mesh reputation, an L7 tarpit.

Opsobservable

Prometheus /metrics, hot config reload, a live zion top TUI. Cosign-signed container, CycloneDX SBOM, SLSA provenance.

§2

Start

From zero to a running daemon in about a minute.

Installquickstart

Build the release binary, run zion auto for an ephemeral cert + config, and you have TLS in front of a backend. → Quick start

Migratefrom nginx

Convert an existing config with zion import nginx — a validated zion.toml and an honest findings report. → Guide

Configurereference

One hot-reloaded TOML file: routes, upstreams, WAF profiles, TLS, ACME, CORS. → Configuration