SHShine-neko·May 19, 2026
Hi HN,
Sōzune is a reverse proxy I've been building on top of Sōzu (https://github.com/sozu-proxy/sozu), the Rust proxy from Clever Cloud. Sōzu is fast and reload-without-downtime, but it's a low-level building block — you talk to it over a socket and
feed it config. Sōzune wraps it with the part most people actually want from a proxy in 2026: it discovers your services automatically (Docker/Podman labels, Swarm, Kubernetes Ingress + Gateway API, Nomad, an HTTP endpoint, or a plain YAML
file), provisions and renews Let's Encrypt certs, and applies every change live with no restart.
The mental model is Traefik, but the data plane is Sōzu instead of a Go proxy. That's the bet I'd most like feedback on.
Try it:
# compose.yaml
services:
sozune:
image: kemeter/sozune:latest
ports: ["80:80", "443:443"]
Read the rest
volumes:
- /var/run/docker.sock:/var/run/docker.sock
whoami:
image: traefik/whoami
labels:
- "sozune.enable=true"
- "sozune.http.whoami.host=whoami.localhost"
docker compose up -d
curl -H "Host: whoami.localhost" http://localhost
What works today: HTTP/HTTPS/WebSocket/raw TCP, HTTP/2 over ALPN, wildcard + regex hostnames, header rewriting, method-based routing, forwardAuth (Authelia/Authentik), Docker HEALTHCHECK-gated readiness, and a dashboard for diagnostics.
What's deliberately not there yet: DNS-01 / wildcard certs, IPAllowList, per-router TLS options, GRPCRoute/TCPRoute on the Gateway API. The roadmap is public and honest about the gaps.
Questions I'd genuinely like answered:
- Is "Traefik UX on a Sōzu data plane" a reason to switch, or a curiosity? What would make it a reason?
- For people running Traefik/Caddy/nginx in prod: what's the one feature whose absence is a hard no?
- Anyone running Sōzu directly — does a higher-level layer on top help or get in your way?
Repo: https://github.com/kemeter/sozune — Site & docs: https://sozune.kemeter.io — MIT licensed. I'll be around all day to answer.