The usual 3400 lines lock file and AGENTS.md raise some questions about the aforementioned security, though.
Very bizarre, never seen that before.
Thumbprints:
- 60949a09aab8677f87a0b9eda7099a03ca510fb3
- 1b146798f0dc93773247e86312f1b730c4eeebb3https://github.com/losfair/zeroserve/blob/main/CADDY_COMPAT....
For my own stuff that's not meant for a wider audience, I sometimes use mTLS in front of my apps, alongside self-signed certs (my own CA) that shouldn't show up in certificate transparency logs.
This site also seems to be requesting a certificate from the user. Normally you probably don't want that for public facing resources.
AFAIK eBPF can be hardware offloaded. If you have the use case.
People that trully need performance are not going to use a random server that has 0 support/ track record.
zeroserve is a high-performance HTTPS server that runs eBPF scripts in userspace (intro). Now it's got a Caddy-compat mode - when provided a Caddyfile, zeroserve JIT-compiles it to eBPF and then to native x86_64/ARM64 machine code, and runs it in an io_uringevent loop.
| protocol | server | throughput | p50 | p99 | peak RSS |
|---|---|---|---|---|---|
| https | zeroserve-clang | 38,948 req/s | 1.45ms | 3.91ms | 30.9 MiB |
| https | zeroserve-tcc | 36,653 req/s | 1.67ms | 4.00ms | 34.2 MiB |
| https | caddy | 12,529 req/s | 4.74ms | 13.11ms | 67.4 MiB |
| https | nginx | 37,424 req/s | 1.57ms | 4.24ms | 25.7 MiB |
HTTPS reverse proxy, 2 threads, AMD Ryzen 7 3700X. Check CI for original run result.
Try it with your Caddyfile:
curl -fL -o zeroserve https://github.com/losfair/zeroserve/releases/download/v0.2.11/zeroserve-$(uname -m)-linux
chmod +x zeroserve
./zeroserve --caddy /etc/caddy/Caddyfile
curl http://127.0.0.1:8080
zeroserve runs turing-complete eBPF and you can call custom code from your Caddyfile. For example, to reverse-proxy a path to an S3-compatible bucket with AWS SigV4 auth, grab io.su3.aws-sigv4.c and then:
# zeroserve --plugin io.su3.aws-sigv4.c --caddy Caddyfile
example.com {
route /s3/* {
uri strip_prefix /s3
rewrite * /my-bucket{uri}
# Call the `sign_request` method in the eBPF middleware `io.su3.aws-sigv4.o`
zeroserve_call io.su3.aws-sigv4 sign_request {
access_key_id "minioadmin"
secret_access_key "minioadmin"
}
reverse_proxy http://127.0.0.1:9000
}
}
© 2022-2026 Heyang Zhou ·