Zero-allocation serving
The request path allocates nothing. Pools are sized at startup from compile-time constants and printed in the banner, asserted against RLIMIT_NOFILE before a port is bound.
zgix
A zero-allocation L4/L7 edge proxy, in Zig.
All memory reserved at startup, every limit a compile-time constant, exhaustion sheds load at a defined rung of the ladder. HTTP/3 over QUIC is experimental but observed like everything else.
HTTP/3 over QUIC
Experimental h3_listeners terminate QUIC-TLS and proxy over a pooled HTTP/1.1 leg — verdict counters and access-log records included.
SNI multi-tenant TLS
Terminate TLS 1.3 with up to 16 certificate pairs per listener, or relay blind by SNI. One :443 fronts many TLS services.
WebSocket tunnels
An opt-in upgrade relay with its own bounded pool, so long-lived sessions never starve HTTP of buffers.
Declarative JSON config
One file, unknown fields refused, --check prices the config before anything binds. Replaced by process handoff, never reloaded.
Prometheus-grade observability
zgix_* counter families, per-endpoint health, RED histograms, a JSON access log, a bounded log tail on the scrape, and a bundled control panel.
Quick start
Build from source (Zig 0.17), then run the binary against one JSON config:
git clone https://github.com/chy3xyz/zgix
cd zgix
zig build -Doptimize=ReleaseSafe
The binary takes exactly one argument, the path to a JSON config. --check loads it, prices every pool and measures the fd demand — everything a start does up to the banner — then exits without binding a port:
zgix --check config.json # validate and price it, bind nothing
zgix config.json # start the proxy
A minimal config — one L4 listener forwarding to one origin — is the whole file; every other block has defaults:
{
"listeners": [
{ "bind": "127.0.0.1:8080", "l4": { "cluster": "origin" } }
],
"clusters": {
"origin": { "endpoints": ["127.0.0.1:9000"] }
}
}
Start in Getting started, browse the guides, or jump to the reference.
zgix is experimental software. HTTP/3 in particular is a deliberately narrow path — no filters, no rate limits — and its counters carry an h3_ prefix so you can watch it independently of the TCP path.