High-performance TLS reverse proxy with built-in WAF. Written in Rust. Single binary. Zero dependencies.
Native benchmark on Apple M4, 5 runs x 10s, c=100. Rust backend. Tracked per-commit in bench-history.json. Full results
| nginx | HAProxy | Envoy | Caddy | Traefik | Pingora | Zion | |
|---|---|---|---|---|---|---|---|
| Language | C | C | C++ | Go | Go | Rust | Rust |
| Memory safety | No | No | No | GC | GC | Yes | Yes |
| Built-in WAF | No | No | No | No | No | No | Aho-Corasick, dual-mode |
| RAM cache | No | Yes | No | No | No | No | L1+L2 |
| TLS hot-reload | Signal | Signal | xDS | Auto | File watch | Custom | ArcSwap |
| Config format | Custom | Custom | YAML/xDS | JSON/API | YAML/API | Rust code | TOML |
| Binary size | ~1.5MB | ~3MB | ~40MB | ~40MB | ~100MB | Library | ~4MB |
| Singleflight | No | No | No | No | No | No | Yes |
| HTTP/3 QUIC | Patch | No | Yes | Yes | Yes | No | Feature-gated |
| JWT/OIDC auth | No | No | Yes | Yes | Yes | No | Feature-gated |
cargo build --release
ZION_CONFIG=zion.toml ./target/release/zion[server]
listen_https = "0.0.0.0:443"
[tls]
cert_path = "/etc/ssl/zion/tls.crt"
key_path = "/etc/ssl/zion/tls.key"
[upstreams]
backend = "http://127.0.0.1:8000"
[[route]]
path = "/api/{*rest}"
upstream = "backend"
waf = true