Boosting Performance: zeroserve's New Caddy Compatibility

zeroserve is a cutting-edge, high-performance HTTPS server designed to execute eBPF scripts directly within userspace.

Recently, a Caddy-compat mode was introduced. This allows users to provide a standard Caddyfile, which zeroserve then processes through a sophisticated pipeline: it JIT-compiles the configuration into eBPF, transforms that into native x86_64 or ARM64 machine code, and finally executes it within an io_uring event loop.

The Compilation Pipeline

The transformation from a configuration file to machine code can be visualized as follows:

Performance Benchmarks

The following data represents an HTTPS reverse proxy setup utilizing 2 threads on an AMD Ryzen 7 3700X processor.

Protocol	Server	Throughput	p50 Latency	p99 Latency	Peak RSS
`https`	`zeroserve-clang`	38,948 req/s	1.45ms	3.91ms	30.9 MiB
`https`	`zeroserve-tcc`	36,653 req/s	1.67ms	4.00ms	34.2 MiB
`https`	`caddy`	12,529 req/s	4.74ms	13.11ms	67.4 MiB
`https`	`nginx`	37,424 req/s	1.57ms	4.24ms	25.7 MiB

Key Takeaways

Using $\LaTeX$ to quantify the gains over standard Caddy:

Throughput Increase: $\approx \frac{38,948}{12,529} \approx 3.1\text{x}$
Latency Reduction: $\approx 1 - \frac{1.45}{4.74} \approx 70\%$

~~Traditional servers are enough~~ $\rightarrow$ zeroserve provides a massive leap in efficiency while maintaining compatibility.

Getting Started

You can deploy zeroserve using your existing Caddyfile by following these steps:

Download the binary
Set execution permissions
Launch with the Caddy flag

# Download the appropriate binary for your architecture
curl -fL -o zeroserve https://github.com/losfair/zeroserve/releases/download/v0.2.11/zeroserve-$(uname -m)-linux

# Make it executable
chmod +x zeroserve

# Run using your Caddyfile
./zeroserve --caddy /etc/caddy/Caddyfile

# Test the connection
curl http://127.0.0.1:8080

Advanced Extensibility

Because zeroserve supports turing-complete eBPF, you aren't limited to standard Caddy directives. You can invoke custom logic directly from your Caddyfile.

Example: S3 Proxy with AWS SigV4

To proxy a specific path to an S3-compatible bucket requiring AWS SigV4 authentication, you can use the io.su3.aws-sigv4.c plugin.

Configuration Example:

# Start zeroserve with the SigV4 plugin
# zeroserve --plugin io.su3.aws-sigv4.c --caddy Caddyfile

example.com {
    route /s3/* {
        uri strip_prefix /s3
        rewrite * /my-bucket{uri}
        
        # Execute the `sign_request` method from the eBPF middleware
        zeroserve_call io.su3.aws-sigv4 sign_request {
            access_key_id "minioadmin"
            secret_access_key "minioadmin"
        }
        
        reverse_proxy http://127.0.0.1:9000
    }
}