Redirects

Sōzune exposes a few flavors of HTTP redirect, all handled natively by Sōzu (no extra hop, no middleware overhead).

HTTPS redirect

Force HTTP traffic to HTTPS for a given service. Sōzune answers 301 Moved Permanently on the HTTP listener and points the client to the matching HTTPS URL.

copy
labels:
  - "sozune.http.app.host=app.example.com"
  - "sozune.http.app.tls=true"
  - "sozune.http.app.httpsRedirect=true"

A request to http://app.example.com/foo?bar=1 returns 301 with Location: https://app.example.com/foo?bar=1. The path and query string are preserved.

Custom HTTPS port

When TLS is exposed on a non-standard port (e.g. behind another load balancer), force the redirect target to use that port:

copy
labels:
  - "sozune.http.app.httpsRedirect=true"
  - "sozune.http.app.httpsRedirectPort=8443"

A request to http://app.example.com/ returns Location: https://app.example.com:8443/.

redirect policy

The redirect label sets the per-frontend redirect policy. It accepts one of four values:

copy
labels:
  - "sozune.http.legacy.host=legacy.example.com"
  - "sozune.http.legacy.redirect=permanent"
  - "sozune.http.legacy.redirectScheme=use_https"

permanent, unauthorized and close answer without reaching a backend, so such a route needs no port. To close the connections a scanner opens on a path, give the path a route of its own, with a priority above the application's route on the same host:

copy
labels:
  - "sozune.http.wp.host=app.example.com"
  - "sozune.http.wp.path=/wp-login.php"
  - "sozune.http.wp.redirect=close"
  - "sozune.http.wp.priority=10"

redirectHost

Send clients to another host with a permanent redirect, keeping the path and the query: an old domain, an alias, www to the bare domain.

copy
labels:
  - "sozune.http.old.host=old.example.com,alias.example.com"
  - "sozune.http.old.tls=true"
  - "sozune.http.old.redirectHost=www.example.com"
  - "sozune.http.old.redirectScheme=use_https"

https://old.example.com/docs?page=2 answers 301 with Location: https://www.example.com/docs?page=2.

redirectHost implies redirect=permanent, and the route needs no port: it never reaches a backend. The value is a bare hostname, without scheme, port or path; anything else, or a redirect set to forward, unauthorized or close, emits W031 and the label is ignored. Without redirectScheme, the redirect keeps the request's scheme. With stripPrefix or addPrefix, the path in Location is rewritten the same way: path=/blog + stripPrefix=true sends old.example.com/blog/post to www.example.com/post.

redirectScheme

Controls the scheme written into the Location header on a permanent redirect.

httpsRedirect=true is shorthand for redirect=permanent + redirectScheme=use_https.

redirectTemplate

Override the Location header value with a custom template. Two placeholders are available:

• %REDIRECT_LOCATION — the URL Sōzu would have emitted by default
• %STATUS_CODE — the redirect status code

copy
labels:
  - "sozune.http.app.redirect=permanent"
  - "sozune.http.app.redirectTemplate=%REDIRECT_LOCATION?utm_source=redirect"

The default template (when redirectTemplate is unset) produces a standard Location header — you only need this for non-trivial cases like adding query parameters or pointing redirects to a different domain.

Behaviour

• Redirects are applied by Sōzu, not by a Sōzune middleware. There is no extra processing cost.
• For HTTPS redirects, the service still needs to be declared on the HTTP entry to receive the request that gets redirected. If you only declare the service on HTTPS, the HTTP listener has no rule for it and the request returns 404 instead.