Aralez (Արալեզ), Reverse proxy built on top of Cloudflare's Pingora
Aralez (Արալեզ), Reverse proxy built on top of Cloudflare's Pingora
Aralez is a high-performance Rust reverse proxy with zero-configuration automatic protocol handling, TLS, and upstream management, featuring Consul and Kubernetes integration for dynamic pod discovery and health-checked routing, acting as a lightweight ingress-style proxy.
What Aralez means ? Aralez = Արալեզ Named after the legendary Armenian guardian spirit, winged dog-like creature, that descend upon fallen heroes to lick their wounds and resurrect them.
Built on Rust, on top of Cloudflare’s Pingora engine, Aralez delivers world-class performance, security and scalability — right out of the box.
x-api-key header/jwt APIfile Upstreams are declared in config file.consul Upstreams are dynamically updated from Hashicorp Consul.kubernetes Upstreams are dynamically updated from kubernetes api server.main.yaml| Key | Example Value | Description |
|---|---|---|
| threads | 12 | Number of running daemon threads. Optional, defaults to 1 |
| runuser | aralez | Optional. Username for running aralez after dropping root privileges (requires launch as root) |
| rungroup | aralez | Optional. Group for running aralez after dropping root privileges (requires launch as root) |
| daemon | false | Run in background (boolean) |
| upstream_keepalive_pool_size | 500 | Pool size for upstream keepalive connections |
| pid_file | /tmp/aralez.pid | Path to PID file |
| config_address | 0.0.0.0:3000 | HTTP API address for pushing upstreams.yaml from remote location |
| proxy_tls_grade | high, medium, unsafe | Grade of TLS ciphers. high matches Qualys SSL Labs A+ (defaults to medium) |
| proxy_address_http | 0.0.0.0:6193 | Aralez HTTP bind address |
| proxy_address_tls | 0.0.0.0:6194 | Aralez HTTPS bind address (Optional) |
| proxy_configs | /etc/aralez/ | Direcotry containing configuration files, must be writeable by user aralez |
| upstreams_conf | /etc/aralez/upstreams.yaml | Location of the upstreams file |
| access_log | access | Configure access logging. Values: access, error |
| log_level | info | Log level: info, warn, error, debug, trace, off |
| log_file | /tmp/aralez.log, 20, 5, compress | Optional, the location of log file, file size in megabytes, number of log files to keep, compress files .valueas are separated by comma. Defaults to None, 100, 5, No |
| hc_method | HEAD | Healthcheck method: HEAD, GET, POST (UPPERCASE) |
| hc_interval | 2 | Interval for health checks in seconds |
| file_server_folder | /some/local/folder | Optional. Local folder to serve |
| file_server_address | 127.0.0.1:3002 | Optional. Local address for file server |
| config_api_enabled | true | Enable/disable remote config push capability |
| cache_size_mb | 50 | Optional. Enable internal cache with size in megabytes of value. Cache is entirely disabled when this line is commented out. |
| cache_ttl | 10 | Optional. Set Default TTL in seconds for cached items, works if cache control headers are not set via upstream. Defaults to 60 if cache_size_mb is set. |
Download the prebuilt binary for your architecture from releases section of GitHub repo Make the binary executable chmod 755 ./aralez-VERSION and run.
File names:
| File Name | Description |
|---|---|
aralez-x86_64-musl.gz |
Static Linux x86_64 binary, without any system dependency |
aralez-x86_64-glibc.gz |
Dynamic Linux x86_64 binary, with minimal system dependencies |
aralez-x86_64-compat-musl.gz |
Static Linux x86_64 binary, compatible with old pre Haswell CPUs |
aralez-x86_64-compat-glibc.gz |
Dynamic Linux x86_64 binary, compatible with old pre Haswell CPUs |
aralez-aarch64-musl.gz |
Static Linux ARM64 binary, without any system dependency |
aralez-aarch64-glibc.gz |
Dynamic Linux ARM64 binary, with minimal system dependencies |
sadoyan/aralez |
Docker image on Debian 13 slim () |
glibc builds are in general faster, but have few, basic, Glibc dependencies:
musl builds are 100% portable, static compiled binaries and have zero system dependencies. In general musl builds have a little less performance.
The most intensive tests shows 107k-110k requests per second on Glibc binaries against 97k-100k Musl ones.
For running Aralez on very old hardware, CPUs prior Haswell, (launched before 2013) use aralez-x86_64-compat-*.gz
For getting the best performance on newer hardware use aralez-x86_64-*.gz.
Via docker
docker run -d -v /path/to/config:/etc/aralez:rw -p 80:80 -p 443:443 sadoyan/aralez
docker run -d -v /path/to/config:/etc/aralez:rw -p 80:80 -p 443:443 sadoyan/aralez:compat
docker run -d -v /path/to/config:/etc/aralez:rw -p 80:80 -p 443:443 ghcr.io/sadoyan/aralez:latest
docker run -d -v /path/to/config:/etc/aralez:rw -p 80:80 -p 443:443 ghcr.io/sadoyan/aralez:compatDockerfile :
FROM debian:trixie-slim
RUN apt-get update && apt-get install -y ca-certificates curl net-tools iputils-ping
RUN apt-get clean && rm -rf /var/lib/apt/lists/*
COPY aralez /usr/local/bin/aralez
RUN chmod +x /usr/local/bin/aralez
RUN mkdir -p /etc/aralez/certs/upstreams
WORKDIR /etc/aralez
ENTRYPOINT ["/usr/local/bin/aralez", "-c", "/etc/aralez/main.yaml"]./aralez -c path/to/main.yamlAssuming Aralez in installed in /opt/aralez folder
cat > /etc/systemd/system/aralez.service ` header.
- To obtain JWT a token, you should send **generate** request to built in api server's `/jwt` endpoint.
- `master_key`: should match configured `masterkey` in `main.yaml` and `upstreams.yaml`.
- `owner` : Just a placeholder, can be anything.
- `valid` : Time in minutes during which the generated token will be valid.
**Example JWT token generation request**
```bash
PAYLOAD='{
"masteNo open issues yet, or sync has not completed.