Sōzune

Sōzune (pronounce Sozuné) is a modern reverse proxy built on Sōzu. It discovers your services across Docker, Podman, Swarm, Kubernetes, Nomad, or a YAML file, manages Let's Encrypt certificates automatically, and applies your changes without restarting.

Features

• Multi-platform service discovery — Docker, Podman, Swarm, Kubernetes (Ingress + Gateway API), Nomad, an HTTP endpoint, or a YAML file.
• Automatic HTTPS — ACME (Let's Encrypt) provisioning and renewal, no intervention. HTTP-01 and DNS-01 (Cloudflare, OVH, Gandi, Scaleway), including wildcard certificates.
• HTTP/2 — negotiated through ALPN on every TLS listener.
• Hot reload — REST API applies changes on the fly, no downtime.
• Wildcard & regex hostnames — *.example.com, /cdn[0-9]+/.example.com.
• Multi-protocol — HTTP, HTTPS, WebSocket, raw TCP passthrough.

Quick start

# compose.yaml
services:
  sozune:
    image: ghcr.io/kemeter/sozune:latest
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./config.yaml:/etc/sozune/config.yaml

  whoami:
    image: traefik/whoami
    labels:
      - "sozune.enable=true"
      - "sozune.http.whoami.host=whoami.localhost"

# config.yaml
providers:
  docker:
    enabled: true

proxy:
  http:
    listen_address: 80
  https:
    listen_address: 443

docker compose up -d
curl -H "Host: whoami.localhost" http://localhost

Documentation

• Installation · Quick start
• Providers — Docker · Swarm · Kubernetes · Nomad · HTTP
• Configuration file & env vars
• REST API
• Routing — Hostnames · Path matching · Load balancing · TCP
• TLS — Overview · ACME / Let's Encrypt
• Middleware — Basic auth · Forward auth · Custom headers · Strip prefix · Add prefix · Redirects · Rate limit · Response compression · Backend timeout · Error pages
• Advanced — Health checks · WebSocket · Access logs · Debugging

Architecture

┌─────────────────┐       ┌─────────────────┐
│   Docker API    │ ────▶ │     Sōzune      │
│   (events)      │       │  (discovery)    │
└─────────────────┘       └─────────────────┘
                           ▲       │
┌─────────────────┐        │       │
│   Config file   │ ───────┘       │
│  (entrypoints)  │                │
└─────────────────┘                ▼
                           ┌─────────────────┐       ┌─────────────────┐
                           │     Storage     │ ────▶ │      Proxy      │
                           │  (entrypoints)  │       │     (Sōzu)      │
                           └─────────────────┘       └─────────────────┘
                                    │
                                    ▼
                           ┌─────────────────┐
                           │    REST API     │
                           │  (monitoring)   │
                           └─────────────────┘

Default ports

Port	Service
80	HTTP proxy
443	HTTPS proxy
3035	REST API
3036	ACME HTTP-01 challenge (loopback)
3037	Internal middleware proxy (loopback)

Contributing

Pull requests welcome.

License

MIT — see LICENSE.md.