ExyonQ Proxy (EQProxy)

Language: English.

Reverse proxy and load balancer written in Rust, targeting progressive functional parity with the reference proxy together with verifiable improvements in diagnostics, configuration, administration, extensibility and security.

Status: v0.6.2 (2026-10-20) — patch over v0.6.1 «rules, routing and traffic». A real TCP and HTTP/1.1 proxy (crates eqproxy-core/config/net/cli) with typed routing rules per listener — host/path/method/header/cookie/map/IP conditions, first match wins — and four rule actions: use_backend, split (weighted canary with weight = 0 rollback, optionally pinned by hash_policy so a key keeps its target, and optionally mirrored to a shadow backend), redirect and direct_response. On top of the v0.5 dataplane (strict framing, per-phase timeouts, TLS termination and backend TLS, ALPN h1, mTLS, multi-certificate SNI, active TCP/HTTP health checks, passive failure detection, safe idempotent retries, bounded queues, PROXY protocol v1/v2, hot config + certificate reload under traffic, backend keep-alive pool): set/add/del request headers and response headers with $remote_addr/ $host/$scheme templates, weighted round-robin + leastconn + slow start, source/cookie affinity, non-blocking dynamic DNS, canary by header/cookie/weight, hot data maps updated without a config reload, per-rule rate limiting, CORS/HSTS, basic + subrequest authentication, WebSocket/CONNECT tunnels, max_stream_duration, certificates selected by SNI (exact name, then wildcard, then the listener default), and the eqproxy CLI (validate, explain with per-rule trace and timeout_on_fire, schema — the public JSON Schema for editor completion, diff, plan, offline apply/rollback, doctor), with 327 tests green plus two Docker-gated harnesses run before the release: differential corpus 23/23 cases against HAProxy 3.4.6, nginx, the ingress-nginx data plane and static Envoy v1.34.2, and the migration matrix 65/65 checks (four real source configs and their eqproxy.toml translation routing identically; evidence in docs/evidence/v06-migration/). No HTTP/2 yet. Release v0.6.2 (binaries for darwin/linux amd64+arm64 and multi-arch image, see Install). Performance vs 3.4.6 on netcup-bench (amd64, medians of 5, evidence): S-H1-04 (10 listeners, 100 backends, 20 rules) 18 207 vs 15 957 rps (p95 4.45 vs 5.92 ms), S-H1-05 (500 backends + health checks) 15 624 vs 3 466 rps (p95 5.16 vs 31.4 ms); the arm64 campaign (evidence) leads in both scenarios with S-H1-04 gaps within noise.

Scope honesty: v0.6.2 is not declared production ready (Phase 9 gate pending). The whole v0.6 roadmap is delivered (32/32 scope boxes, 6/6 version-gate criteria); what remains is outside this version by design and listed in the CHANGELOG: the reference filters that only exist as WASM (v0.9, so ecosystem extension stays WASM-only), maps consumed through equals matching only, and HTTP/2. The 24h soak gate passed on netcup-bench (2026-10-18: 17.28M requests, 0 errors, steady RSS 8.86 MiB / peak 9.32 MiB, clean SIGINT shutdown; budgets in BENCHMARK_PLAN.md §9).

Docs language: documentation is published in English only.

Quick start

cargo run -p eqproxy-cli -- config validate --config eqproxy.toml.example
cargo run -p eqproxy-cli -- run --config eqproxy.toml.example

Install from release v0.6.2

Binaries and checksums live on the release page.

Every release carries four prebuilt binaries: eqproxy-darwin-arm64, eqproxy-darwin-amd64, eqproxy-linux-arm64 and eqproxy-linux-amd64. The Linux ones are statically linked against musl (file reports static-pie linked on amd64 and statically linked on arm64, no NEEDED entries, no interpreter), so they need no libc, no glibc version and no packages at all: they run on any Linux distribution of that architecture, and also on FROM scratch. Each release ships the Docker Scout report of both image architectures (SCOUT-<version>-linux-amd64.md, …-arm64.md).

# Pick your platform artifact:
#   eqproxy-darwin-arm64 | eqproxy-darwin-amd64
#   eqproxy-linux-arm64  | eqproxy-linux-amd64   (static, musl)
curl -sSLO https://github.com/ExyonQ/EQProxy/releases/download/v0.6.2/eqproxy-linux-amd64
curl -sSLO https://github.com/ExyonQ/EQProxy/releases/download/v0.6.2/SHA256SUMS.txt
shasum -a 256 -c SHA256SUMS.txt --ignore-missing   # Linux: sha256sum -c --ignore-missing SHA256SUMS.txt
chmod +x eqproxy-linux-amd64
./eqproxy-linux-amd64 --version

# Smoke test with a minimal config (validate is offline, binds nothing):
cat > eqproxy.toml <<'EOF'
schema_version = 1
[listener.web]
listen = "127.0.0.1:8080"
mode = "http"
backend = "api"
[backend.api]
server = "127.0.0.1:9000"
EOF
./eqproxy-linux-amd64 config validate --config eqproxy.toml

Docker (linux/amd64 + linux/arm64), same digests on both registries:

docker pull exyonq/eqproxy:0.6.2           # Docker Hub (docs + examples on the repo page)
docker pull ghcr.io/exyonq/eqproxy:0.6.2   # GitHub Container Registry
docker run --rm exyonq/eqproxy:0.6.2 --version

Documentation

Document	Contents
SPEC.md	Specification: goals, priorities, architecture, state taxonomy
THREAT_MODEL.md	Threat model and non-protections statement
BENCHMARK_PLAN.md	Honest benchmark plan and operator-task study
docs/differential-corpus.md	Declared shared-semantics corpus vs HAProxy, nginx, ingress-nginx and Envoy
docs/migration/README.md	Migration matrix: the same deployment in the four source formats and in EQProxy
docs/adr/	Architecture decision records

Key decisions

• Comparison reference: versions 3.4.6 LTS (primary) + 3.0.29 LTS (legacy deployed) of the reference proxy. See ADR-0003.
• Production platform: Linux x86_64 (glibc). See ADR-0001.
• Configuration format: study in ADR-0002, decision pending approval.
• Network stack: tokio + hyper 1.x + rustls; HTTP/3 is mandatory scope (Phase 5, experimental until interop is passed). See ADR-0004.
• Performance goal: match or beat the reference proxy 3.4.6 LTS on connections, memory, CPU and P50/P95/P99 latencies in the scenarios of BENCHMARK_PLAN.md. First measurements (S-TCP-01/S-H1-01/S-TLS-01, evidence): Comparable after the A16 keep-alive pool; the rest of the matrix is Not measured (no data, no claim).
• Code: 100 % safe Rust (#![forbid(unsafe_code)], no exceptions); extensions WASM-only (Lua discarded due to FFI unsafe).
• Parity scope: the OSS edition of the reference proxy only.
• Migration: configuration converter from the reference proxy to EQProxy (CLI eqproxy config import) with its own parser for the reference configuration format and a conversion report; directives are never silently dropped.

License

Dual: MIT OR Apache-2.0, at the recipient's choice.