Sōzu is a lightweight HTTP reverse proxy server built in Rust that can be reconfigured at runtime without restarting.
The tool addresses the operational burden of traditional reverse proxies that require restarts for configuration changes or upgrades. Sōzu solves this through hot configuration: it accepts configuration updates via secure Unix sockets while continuing to process requests. The proxy can upgrade itself in place without dropping connections, remaining always-up during the entire process. It handles TLS termination for backend servers, supporting multiple cryptographic backends at compile time including ring, AWS-LC with post-quantum and FIPS 140-3 options, and OpenSSL. Performance is optimized through Rust's memory safety guarantees and zero-copy HTTP parsing via the Kawa library, which translates HTTP messages without unnecessary data duplication.
Sōzu suits teams running services that cannot tolerate downtime during proxy updates or configuration changes, particularly those managing infrastructure where frequent redeployment is costly. It works well for deployments requiring TLS termination at the edge while keeping backend servers focused on application logic. The tool's sandboxed worker processes provide defense-in-depth even if a worker is compromised. Organizations needing post-quantum cryptography or FIPS compliance can select the appropriate compile-time feature. The project includes sozu top, a live terminal dashboard for monitoring cluster status, backend health, and HTTP/2 flood-mitigation metrics in real time.
The project maintains a steady release cadence with pre-built binaries for multiple Linux targets and architectures, Docker images published to Docker Hub, and cryptographic signatures via sigstore keyless signing and SLSA build provenance. Development activity shows consistent attention to security practices and cross-platform support, with explicit handling of edge cases like musl libc compilation on ARM64. The maintainers actively document deployment scenarios and provide comprehensive command-line tooling alongside the core proxy functionality.
