HTTP/1.1 native // HTTP/2 router // HTTP/3 in tree

Layerline

A Zig web server built to own the edge directly: serve static sites, run PHP, proxy apps, terminate TLS, expose admin controls, and keep the config close to the machine.

View GitHub Install Live health

ORIGIN SURFACEedge listener

LainaLayerline's route operator: mascot, config guide, and protocol signal.

Virtual hostsPer-domain files, SNI certs, wildcard names, route-local overrides

PHP and FastCGIphp-cgi fallback, php-fpm pooling, front-controller mode

Reverse proxyRetries, policies, keep-alive reuse, ejection, circuit recovery

Admin controlsDisabled by default, first-launch setup, settings, config previews

Server surface

Enough pieces to host real sites without hiding behind another server.

Static hot path

Darwin sendfile, bounded buffered fallback, byte ranges, ETags, precompressed sidecars, and configurable cache policy.

App routing

Named routes can serve static trees, PHP apps, or reverse-proxied services with route-local roots, timeouts, and upstream policy.

TLS ownership

Native TLS 1.3, ALPN, SNI certificate selection, certbot webroot automation, and a port-80 redirect/ACME listener.

Operational visibility

Prometheus-style metrics, structured JSON access logs, admin status, route dumps, cert views, and config validation.

Modern protocols

HTTP/1.1 and native HTTP/2 route today. The native QUIC/TLS HTTP/3 path is in-tree and currently serving the default response.

Direct deploys

Systemd, launchd, Docker, per-domain config files, and deployment docs are part of the repository, not a later wrapper.

Config model

Main runtime settings plus nginx-style per-domain files.

Main server config

Listener, process limits, protocol toggles, defaults, admin state, logging, and global runtime behavior stay in one main file.

host = 0.0.0.0
port = 443
static_dir = public
serve_static_root = true
domain_config_dir = domains-enabled
tls = true
http_redirect = true
admin_ui = false

Per-domain config

Each site gets a focused file with server names, root, proxy/PHP behavior, certificates, redirects, headers, and named routes.

# domains-enabled/layerline.conf
server_name = layerline.dev www.layerline.dev
root = /srv/layerline/public
index = index.html
serve_static_root = true
route = docs /docs/* static
route_dir.docs = /srv/layerline/docs
proxy = http://127.0.0.1:3000

Admin UI

Control panel built into the same server, off until you turn it on.

Layerline's admin UI creates access on first launch, then gives operators a browser surface for site management, main settings, redacted config previews, route tables, certificate state, metrics, and validation.

Add new sites by writing enabled domain config files.
Save main server settings with a backup beside the config.
Inspect redacted config previews without leaking tokens or private key paths.
Validate activation config and TLS material before managed restart.

admin_ui = true
admin_ui_path = /_layerline/admin
admin_credentials_path = /etc/layerline/admin.credentials
domain_config_dir = domains-enabled

Against the old guard

The goal is Caddy/nginx scale, with more direct control from Zig.

Capability	Layerline	Caddy	nginx
Config style	Main runtime config plus per-domain site files	Caddyfile and JSON admin API	Main config plus sites-enabled patterns
Static files	Sendfile, ranges, ETags, precompressed sidecars	Mature static serving	Mature static serving
TLS	Native TLS 1.3, SNI certs, certbot automation	Automatic certificates as a core feature	Manual or external ACME tooling
PHP	CGI fallback and direct FastCGI/php-fpm	Reverse proxy to PHP/FastCGI setups	Mature FastCGI integration
Proxy pools	Retries, policies, keep-alive, ejection, circuit recovery	Strong reverse proxy defaults	Mature upstream module
Admin surface	Disabled by default browser UI plus local socket	Admin API, no default full control panel	No built-in browser UI
HTTP/3	Native QUIC/TLS path in progress	Production-ready HTTP/3 support	Available in modern builds/configs

Layerline already serves layerline.dev and fronts memorylayer.run as the active edge. It can serve normal HTTP/1.1 and HTTP/2 routes, own TLS, proxy apps, host PHP, and expose admin diagnostics. Full HTTP/3 route dispatch, in-memory hot reload, and long soak conformance remain roadmap work.

Setup

Build, verify, run, then point a domain at it.

git clone https://github.com/raya-ac/Layerline.git
cd Layerline
zig build -Doptimize=ReleaseFast
./scripts/verify-layerline.sh

./zig-out/bin/layerline \
  --config server.conf \
  --admin-ui true \
  --admin-ui-path /_layerline/admin

curl http://127.0.0.1:8080/health
curl http://127.0.0.1:8080/metrics
zig build run -- --dump-routes
zig build run -- --validate-config

GitHub repository Read the README Deployment docs

Roadmap honesty

Production quality is a checklist, not a slogan.

Ready nowStatic, PHP/FastCGI, proxy pools, domain files, TLS material loading, HTTP/2 routing, admin setup, metrics, logs.

In progressFull HTTP/3 route dispatch, in-memory hot reload, broader h2/h3 conformance, route-local stale/cache behavior, cert reload.

Next gateGeneral Caddy-class replacement after reload, live TLS material, route controls, soak tests, and rollback paths pass together.