zig-waf is a high-performance, embeddable web application firewall and fleet
platform written in Zig. It targets the stable feature union of ModSecurity
3.0.16 and Coraza 3.7.0, with complete OWASP CRS 4.28.0 compatibility as a v1
release gate.
This repository is pre-alpha. Current builds establish API and compatibility foundations; they are not yet suitable as a production security boundary.
Zig 0.17-dev, PostgreSQL 18, and libpq are installed and locked through Pantry:
pantry install
zig build test
zig build check
zig build bench-scalars -Doptimize=ReleaseFast
zig build fuzz-parser -Dparser-fuzz-iterations=10000Production fleet mode requires PostgreSQL. SQLite will only support isolated tests and single-node demonstrations. Core request inspection never depends on database availability.
Local development uses sibling checkouts of zig-injection, zig-regex, and
zig-tls, plus ~/Code/Tools/stx. CI checks out the exact commits recorded in
dependencies.lock.json; no repository uses Git submodules.
- Immutable compiled
Wafand isolated per-requestTransaction zig-wafdHTTP/1.1 and HTTP/2 reverse proxy- C connector ABI and Nginx, Caddy, Envoy, and HAProxy integrations
- PostgreSQL-backed fleet controller and durable event ingestion
- STX operations console embedded as fingerprinted static assets
The complete implementation graph is tracked by the
WAF roadmap.
The bounded syntax and include contracts are documented in
docs/seclang-parser.md.
The typed byte semantics, compatibility profiles, ownership, and security
constraints for transformations are documented in
docs/transformations.md.
The fleet schema, repositories, and the durability and idempotency guarantees of
event ingestion are documented in
docs/fleet-storage.md.
Running that database — deployment profile, TLS, backups, point-in-time recovery,
failover, and the operator drills that verify each one — is documented in
docs/postgres-operations.md.
The control-plane API's resources, authorization, and versioning are defined in
src/api-v1.json (OpenAPI 3.1), held in step with the route table
in src/api.zig by a test.
What the engine reports about itself — metrics, the debug log and its levels, rule
timing, and W3C trace correlation — is documented in
docs/observability.md.
The C connector ABI's versioning, struct-size negotiation, capability discovery, and
ownership rules are documented in docs/c-abi.md.
The host extension contracts — what can be registered, what deliberately cannot,
and why an unavailable plugin is not the same as a clean request — are documented in
docs/plugins.md.
For help, discussion about best practices, or any other conversation that would benefit from being searchable:
For casual chit-chat with others using this package:
Join the zig-utils Discord Server
MIT. Imported compatibility fixtures retain their upstream licenses and notices.