Readable configuration
Raddexfile directives have explicit scopes and write-order semantics.
Raddex
A small, predictable reverse-proxy gateway in Rust
Raddex is a reverse-proxy gateway built on Cloudflare Pingora. It provides one readable configuration file for HTTP/HTTPS routing, automatic TLS, static files, upstream balancing, and selected TCP/UDP services.
Why Raddex?
Section titled “Why Raddex?”- Predictable configuration. Site directives follow the order you write; there is no hidden global ordering table.
- Automatic HTTPS. ACME HTTP-01, Cloudflare DNS-01, and TLS-ALPN-01 are available alongside static certificates, internal certificates, and mTLS. TLS-ALPN-01 is limited to eligible ACME sites on port 443 and cannot be combined with DNS-01.
- A small operational surface. Validate with
raddex check, reload with SIGHUP, and upgrade the binary without dropping the listener topology. - A clear protocol boundary. Raddex can pass UDP traffic, including QUIC datagrams, but HTTP/3 termination remains a separate QUIC service.
What is included in v0.3.6?
Section titled “What is included in v0.3.6?”| Capability | Release status |
|---|---|
| HTTP/1.1 and downstream HTTP/2 | Supported |
Upstream HTTP/1.1, https://, h2://, and h2c:// |
Supported |
| Multiple domains, IPv6, exact and one-label wildcard matching | Supported |
| Static files, compression, auth guards, rate limits, logs, and metrics | Supported |
| TCP, SNI passthrough, TCP TLS termination, and UDP proxying | Supported |
| Transparent TCP and UDP flow handoff | Linux-only |
| QUIC / HTTP/3 termination | Separate sidecar required |
Raddex is still pre-1.0. “Supported” means the behavior is implemented and covered by the v0.3.6 verification suite; consult the capability matrix for deployment prerequisites and exclusions.
TLS without glue code
Automatic ACME certificates and per-site TLS settings live beside routing.
Safe operations
Check before start, reload the routing snapshot, and upgrade the binary.
HTTP and Layer 4
Use the same process for HTTP sites and carefully bounded TCP/UDP listeners.
Choose a path
Section titled “Choose a path”Quick startProxy a local service in a few commands.
InstallationInstall a verified release or deploy from source.
HTTPS and TLSChoose ACME, static certificates, mTLS, or upstream TLS.
RoutingMatch hosts, paths, headers, methods, IPs, and protocols.
Layer 4Proxy TCP and UDP with explicit limits and boundaries.
OperationsRun, observe, reload, upgrade, and troubleshoot a deployment.
Directive referenceLook up syntax, scope, defaults, and examples.
Capability matrixSee what is supported, Linux-only, or outside Raddex.