[opensourcedex]

zoraxy is a free, open source networking & connectivity project written in HTML and released under AGPL-3.0. It has 5,490 GitHub stars, 323 forks and 159 open issues, and was last pushed 30 hours ago. On this registry it ranks #24 of 34 tracked projects in Networking & Connectivity, with 5 head-to-head comparisons available.

What is zoraxy?

Zoraxy is a general purpose HTTP reverse proxy and forwarding tool, now written in Go, aimed at homelab owners, makers, and small operations teams who need to route traffic to several self-hosted services without hand-maintaining proxy configuration files.

What it is

Zoraxy is a proxy server with a web interface and in-system instructions that covers HTTP/2 reverse proxying, automatic WebSocket proxying, virtual directories, alias hostnames, custom headers, load balancing, redirection rules, and basic auth, alongside a stream proxy for TCP and UDP. TLS is handled inside the tool: certificates can be set up and deployed with SNI and SAN support, renewed automatically through ACME, and issued with a DNS challenge against the DNS providers listed by the lego project. It ships as release binaries for Windows, Linux amd64, and Linux arm64, runs on Raspberry Pi, other ARM single-board computers, and Android phones through Termux, and is available in Docker. Launch behaviour is controlled by start parameters including -port, -conf, -dbpath, -autorenew, and -acmetestmode, with the database backend selectable between leveldb, boltdb, and auto, where fsdb is used on unsupported platforms such as RISCV. The registry lists the repository language as HTML, while the project itself is written in Go, as the tagline states.

The concrete problem it addresses is proxy configuration that has to be written and maintained by hand: the README names Nginx and NPM as the tools administrators commonly arrive from, and offers an experimental nginx to Zoraxy configuration converter for that migration. It sits in the Go and self-hosting ecosystem, filed under Infrastructure & Operations / Networking & Connectivity and tagged with topics including http-proxy, reverse-proxy, stream-proxy, tcp-proxy, cluster-gateway, subdomain, port-forward, and homelab.

Key capabilities

  • HTTP/2 reverse proxy with automatic WebSocket proxying that requires no separate set-up.
  • TLS/SSL deployment with ACME auto-renewal, SNI and SAN certificate support, and DNS challenge for Let's Encrypt through the supported lego DNS providers.
  • Access control combining basic auth, forward-auth for Authelia and Authentik, OAuth2, reCAPTCHA, and blacklisting or whitelisting by country or IP address using single IPs, CIDR ranges, or wildcards.
  • Stream proxy for both TCP and UDP traffic, in addition to HTTP forwarding, redirection rules, and load balancing.
  • An integrated up-time monitor and a Web-SSH terminal inside the same interface.
  • Utilities including CIDR IP converters, an mDNS scanner, Wake-On-Lan, a debug forward proxy, an IP scanner, and a port scanner.
  • A plugin system, dark theme mode, and a choice between basic single-admin management mode and an external permission management system for integration with existing setups.

Who uses it and how

  • Homelab owners and makers growing a handful of services across multiple servers use standalone mode, the default, where a single account manages the proxy much like a basic home router.
  • Administrators moving off Nginx or NPM can run the experimental nginx to Zoraxy config converter before rebuilding their routing rules in the interface.
  • Raspberry Pi 4 or newer owners take the arm64 release, older Pis use arm (armv6), and other ARM SBCs or Android devices under Termux follow the same Linux method with the matching CPU architecture build.
  • Windows users download the executable and double click it, while Linux users start it with sudo ./zoraxy -port=:8000.
  • Container-based deployments follow the instructions in the /docker folder of the repository.

Getting started

Download the release binary for Windows, Linux amd64, or Linux arm64 and run it; on Linux that is sudo ./zoraxy -port=:8000. Docker users should consult the /docker folder, and anyone building from source needs Go 1.23 or higher, followed by go mod tidy and go build inside ./zoraxy/src/.

How it compares

Zoraxy positions itself against Nginx and Nginx Proxy Manager, the two tools the README names when it offers a converter for importing an existing Nginx configuration. Where Nginx is driven by configuration files, Zoraxy exposes the same routing work through a web interface with detailed in-system instructions, which is the distinction the project emphasises for people new to reverse proxying. The converter is described as experimental, so a migration should be verified rather than assumed.

When to use it — and when not to

A self-hoster has to run the proxy's database backend, whether leveldb, boltdb, or auto, keep the configuration folder in order, and configure SMTP if password reset should work. Teams needing fine-grained multi-user permissions will not get them from the basic single-admin mode alone and must wire in the external permission management system, and anyone wanting a vendor-managed service should look elsewhere, since distribution is through self-hosted binaries and Docker. The README relies on a community-written tutorial for first-time setup, the converter is still experimental, and the tracker carries 159 open issues, although the last push in September 2026 indicates active development.

project readme (upstream, from github) — read inline

Zoraxy

A general purpose HTTP reverse proxy and forwarding tool. Now written in Go!

Features

  • Simple to use interface with detail in-system instructions

  • Reverse Proxy (HTTP/2)

    • Virtual Directory
    • WebSocket Proxy (automatic, no set-up needed)
    • Basic Auth
    • Alias Hostnames
    • Custom Headers
    • Load Balancing

  • Redirection Rules

  • TLS / SSL setup and deploy

    • ACME features like auto-renew to serve your sites in https
    • SNI support (and SAN certs)
    • DNS Challenge for Let's Encrypt and these DNS providers

  • Blacklist / Whitelist by country or IP address (single IP, CIDR or wildcard for beginners)

  • Stream Proxy (TCP & UDP)

  • Integrated Up-time Monitor

  • Web-SSH Terminal

  • Plugin System

  • Utilities

    • CIDR IP converters
    • mDNS Scanner
    • Wake-On-Lan
    • Debug Forward Proxy
    • IP Scanner
    • Port Scanner

  • Community Contributed Features

    • Forward-Auth Support (e.g. Authelia, Authentik)
    • Oauth2 Support
    • reCAPTCHA

  • Others

    • Basic single-admin management mode
    • External permission management system for easy system integration
    • SMTP config for password reset
    • Dark Theme Mode

Downloads

Windows / Linux (amd64) / Linux (arm64)

For other systems or architectures, please see Releases

Getting Started

Installing Zoraxy Reverse Proxy: Your Gateway to Efficient Web Routing

Thank you for the well written and easy to follow tutorial by Reddit user itsvmn! If you have no background in setting up reverse proxy or web routing, you should check this out before you start setting up your Zoraxy.

Switching from Nginx / NPM?

Check out our new (experimental) nginx to Zoraxy config converter!

Launch Config Converter

Build from Source

Requires Go 1.23 or higher

git clone https://github.com/tobychui/zoraxy
cd ./zoraxy/src/
go mod tidy
go build

sudo ./zoraxy -port=:8000

Usage

Zoraxy provides basic authentication system for standalone mode. To use it in standalone mode, follow the instructions below for your desired deployment platform.

Standalone Mode

Standalone mode is the default mode for Zoraxy. This allows a single account to manage your reverse proxy server just like a basic home router. This mode is suitable for new owners to homelabs or makers starting growing their web services into multiple servers. A full "Getting Started" guide can be found here.

Linux
sudo ./zoraxy -port=:8000
Windows

Download the binary executable and double click the binary file to start it.

Raspberry Pi

The installation method is same as Linux. If you are using a Raspberry Pi 4 or newer models, pick the arm64 release. For older version of Pis, use the arm (armv6) version instead.

Other ARM SBCs or Android phone with Termux

The installation method is same as Linux. For other ARM SBCs, please refer to your SBC's CPU architecture and pick the one that is suitable for your device.

Docker

See the /docker folder for more details.

Start Parameters

Usage of zoraxy:
  -acmetestmode
        Run ACME in test/staging mode
  -autorenew int
        ACME auto TLS/SSL certificate renew check interval (seconds) (default 86400)
  -cfgupgrade
        Enable auto config upgrade if breaking change is detected (default true)
  -conf string
        Configuration folder path (default "./conf")
  -db string
        Database backend to use (leveldb, boltdb, auto) Note that fsdb will be used on unsupported platforms like RISCV (default "auto")
  -dbpath string
        Database path (default "./sys.db")
  -default_inbound_enabled
        If web server is enabled by default (default true)
  -default_inbound_port int
        Default web server listening port (default 443)
  -dev
        Use external web folder for UI development
  -docker
        Run Zoraxy in docker compatibility mode
  -earlyrenew int
        Number of days to early renew a soon expiring certificate (days) (default 30)
  -enablelog
        Enable system wide logging, set to false for writing log to STDOUT only (default true)
  -experimental_proxy_protocol
        Enable PROXY protocol v1/v2 support for TLS listener (experimental)
  -fastgeoip
        Enable high speed geoip lookup, require 1GB extra memory (Not recommend for low end devices)
  -log string
        Log folder path (default "./log")
  -mdns
        Enable mDNS scanner and transponder (default true)
  -mdnsname string
        mDNS name, leave empty to use default (zoraxy_{node-uuid}.local)
  -noauth
        Disable authentication for management interface
  -plugin string
        Plugin folder path (default "./plugins")
  -port string
        Management web interface listening port (default ":8000")
  -reset_ac
        Reset admin account username and password to default and exit
  -sshlb
        Allow loopback web ssh connection (DANGER)
  -tmp string
        Temporary folder path (default "./tmp")
  -update_geoip
        Download the latest GeoIP data and exit
  -uuid string
        sys.uuid file path (default "./sys.uuid")
  -version
        Show version of this server
  -webroot string
        Static web server root folder. Only allow change in start paramters (default "./www")

External Permission Management Mode

If you already have an upstream reverse proxy server in place with permission management, you can use Zoraxy in noauth mode. To enable noauth mode, start Zoraxy with the following flag:

./zoraxy -noauth=true

[!WARNING] For security reasons, you should only enable no-auth if you are running Zoraxy in a trusted environment or with another authentication management proxy in front.*

Screenshots

More screenshots on the wikipage Screenshots!

FAQ

There is a wikipage with Frequently-Asked-Questions!

Global Area Network Controller

Moved to official plugin repo, see ztnc plugin

Web SSH

Web SSH currently only supports Linux based OSes. The following platforms are supported:

  • linux/amd64
  • linux/arm64
  • linux/armv6 (experimental)
  • linux/386 (experimental)

Loopback Connection

Loopback web SSH connections, by default, are disabled. This means that if you are trying to connect to an address like 127.0.0.1 or localhost, the system will reject your connection for security reasons. To enable loopback for testing or development purpose, use the following flags to override the loopback checking:

./zoraxy -sshlb=true

Community Maintained Sections

Some section of Zoraxy are contributed by our amazing community and if you have any issues regarding those sections, it would be more efficient if you can tag them directly when creating an issue report.

Looking for Maintainer

  • ACME integration (Auto-renew & Zoraxy integration)

  • Zoraxy Auth (Build-in basic SSO feature)

  • Logging (including analysis & attack prevention) Module

Thank you so much for your contributions!

Notes on Security Advisories

Due to recent automated / AI generated advisories, we will no longer accept security advisories directly open on Github.

If you spot a secuity issue and want to create a security advisories, please contact us via Discord and provide your Github username. Then we will assign you an advisory number for filling in your advisory title. For advisories that do not have a advisory number, we will close it immediately.

Updates 2026-06-26

Due to recent floods of AI generated security advisory, Private vulnerability reporting feature of this repo is temporary closed. If you have a critical issue to report, you can reach our maintainer on Discord.

Sponsor This Project

If you like the project and want to support us, please consider a donation. You can use the links below

License

This project is open-sourced under AGPL. I open-sourced this project so everyone can check for security issues and benefit all users. This software is intended to be free of charge. If you have acquired this software from a third-party seller, the authors of this repository bears no responsibility for any technical difficulties assistance or support.

Frequently asked questions

Is zoraxy free to use?

zoraxy is open source under the AGPL-3.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does zoraxy do?

A general purpose HTTP reverse proxy and forwarding tool. Now written in Go!

What is zoraxy written in?

zoraxy is primarily written in HTML. Its source is publicly available at https://github.com/tobychui/zoraxy, and it has 5,490 GitHub stars.