Zoraxy, a reverse proxy whose language reads as HTML and whose config upgrades itself

The primary language is recorded as HTML for a project written in Go

The repository description ends with `Now written in Go!`, the build section requires Go 1.23 or higher, and the recorded primary language is HTML. Both are true at once, because the reverse proxy ships a browser interface and the templates and assets of that interface outnumber the Go source by volume. The Go module is not at the repository root either, which is why the build instructions change directory before doing anything:

git clone https://github.com/tobychui/zoraxy
cd ./zoraxy/src/
go mod tidy
go build

sudo ./zoraxy -port=:8000

So `src/` holds the module, `docker/` holds the container build, `docs/` and `img/` the documentation assets, and `tools/` sits alongside them. A search filter configured on the primary language will show you the web interface rather than the proxy, which is a small trap for anyone auditing this repository. Running the binary as root is the documented path on Linux as well as in the build recipe, and the same `-port=:8000` flag appears in the standalone section, so the interface is on port 8000 unless you change it.

Configuration auto-upgrade is on, and the flag list stops mid-sentence

The start parameters are printed as a usage block, and the first four entries set the tone. `-acmetestmode` runs ACME in test or staging mode. `-autorenew` is the certificate renewal check interval in seconds, defaulting to 86400, so once a day. `-cfgupgrade` enables automatic configuration upgrade if a breaking change is detected, and it is on by default. `-conf` sets the configuration folder, default `./conf`. Then the database flags: `-db` takes leveldb, boltdb or auto, defaulting to auto, with fsdb substituted on platforms it does not support, RISCV named as an example, and `-dbpath` defaulting to `./sys.db`. The list then cuts off partway through the description of `-default_inbound_enabled`, so any flag sorting after it has to be found by running the binary.

ACME auto-renew is a feature and an unmaintained section at once

The feature list advertises TLS and SSL setup with ACME features such as auto-renew, SNI support, SAN certificates, and a DNS challenge for Let's Encrypt backed by the lego provider list. The maintenance section, further down, lists `ACME integration (Looking for maintainer)` under its heading and repeats it under a dedicated Looking for Maintainer list alongside Zoraxy Auth and the logging module, the last of them described as covering analysis and attack prevention. So the same subsystem is simultaneously a headline feature with a working `-autorenew` flag and an area with nobody named as its owner. Two other ACME-adjacent entries do have names attached: the DNS challenge is credited to one contributor, and Forward Auth, OAuth2, the Docker container list, and the change log each name their maintainer, with the legacy Authelia and Authentik integrations marked as legacy. The page is unusually honest about this arrangement, telling readers to tag the relevant contributor directly when filing an issue about one of these sections.

The Raspberry Pi notes tell you to use a build the download links do not offer

Three binaries are linked directly from the page, each through the `releases/latest/download` path: a Windows amd64 executable, a Linux amd64 binary, and a Linux arm64 binary. Everything else is deferred to the releases page. Then the Raspberry Pi section says the install method is the same as Linux, that a Pi 4 or newer wants the arm64 release, and that older Pis want the arm build, armv6, instead. That armv6 binary is not among the three direct links, and it is not in the web SSH platform list either as a supported target, only as an experimental one. So the oldest Pi advice on the page points at an artifact you have to go and find, and the newest Pi is the only one with a link. The Windows route is different again: there is no service or installer, the instruction is to download the executable and double click it, so a Windows install has no documented upgrade path beyond fetching the newest `releases/latest/download` file by hand.

Web SSH refuses loopback, and one flag undoes that

The web SSH terminal gives you a shell in the browser, and it is Linux only. The supported platforms are listed as linux/amd64 and linux/arm64, with linux/armv6 and linux/386 marked experimental. Loopback connections are off by default: if you try to connect to 127.0.0.1 or localhost, the connection is rejected, and the page gives the reason as security. To turn it back on for testing or development there is a single flag:

./zoraxy -sshlb=true

The combination is worth sitting with. A browser shell into the proxy host is available on two architectures and experimental on two more, and the one guard against using it to reach services bound to loopback is a command line flag with no warning attached to it, unlike the no-auth mode below.

noauth disables the login page, and the warning ends in a stray asterisk

Standalone mode is the default and comes with a basic authentication system protecting a single account, which is what makes it usable on a home router. The alternative is External Permission Management Mode, for when another proxy in front already handles who you are. It is one flag:

./zoraxy -noauth=true

and it is followed by a WARNING callout saying that for security reasons you should only enable no-auth in a trusted environment or with another authentication management proxy in front. That sentence finishes with a lone asterisk after the period, the residue of an emphasis marker that was never closed, which is a small sign of how quickly the block was written.

Security advisories are now routed through Discord and a username

This section explains a policy change in plain language: because of recent automated and AI generated advisories, the project will no longer accept security advisories opened directly on GitHub. Instead, if you find an issue you are asked to contact them via Discord, provide your GitHub username, and the maintainers assign an advisory number. The paragraph that explains this contains two typos, `secuity` for security and `a security advisories`. Nothing here is a criticism of the decision, since automated advisory spam is a real problem, but the practical effect is that a vulnerability report now depends on a chat platform and on a person reading it.

The Global Area Network controller moved out to a plugin in another organisation

One feature is no longer in core. The Global Area Network Controller has been moved to the official plugin repository, specifically the ztnc plugin, which lives in the aroz-online organisation rather than under tobychui. Two more things point outside this repository. The nginx to Zoraxy config converter, launched from the project homepage, is labelled new and experimental, which is a reasonable caveat for something that rewrites proxy configuration. And the project homepage itself is at zoraxy.aroz.org. The tree reflects the split: `example/plugins/` holds example plugins, `CODEOWNERS` marks who owns which path, and `CAPTCHA_FEATURE.md` sits at the root as a standalone document for the reCAPTCHA support listed as a community contribution.

Editorial conclusion

Zoraxy fits a homelab or a small set of servers where one operator wants a reverse proxy with a UI instead of hand-written proxy rules, and the standalone single-admin mode is built for exactly that. Check five things before you point real traffic at it. Configuration auto-upgrade is on by default, so read what it changes on a breaking version. The download links cover three architectures while the Raspberry Pi notes tell you to use armv6, which is not one of them. Web SSH is Linux only and refuses loopback by default, with a flag to undo that. ACME auto-renew is listed as a feature and as an unmaintained section at the same time. And if you find a vulnerability, the public advisory route is closed and Discord plus your GitHub username is the way in.

Frequently asked questions

Official sources

1. Official documentation
2. Official README
3. Project repository
4. Release notes