Nishi Family › Compare › Sovereign edge -- TLS 1.3 termination + SNI routing vs the field (SOTA)

Nishi vs the Field

Sovereign edge -- TLS 1.3 termination + SNI routing vs the field — the full field, measured, sourced.

nishi sni_router + sites.elf (own TLS/HTTP stack, zero OpenSSL/nginx) vs the production edge stacks

How this is scored. This is a state-of-the-art comparison across the FULL competitor field: quantitative axes carry measured / published numbers (Nishi’s column is our own measurement, competitors are researcher-sourced), grade axes use Best / Yes / Part / No. Every axis carries a source note. No single vanity ‘coverage’ score — the honest picture is per-axis: Nishi leads only on sovereignty + determinism and trails on raw speed, scale, and breadth of features, by design (a research-grade sovereign engine, not a production GPU stack).
CapabilityNishinginxHAProxyCaddyTraefikEnvoyCloudflareAWS-ALBNotes / source
TLS + SNI
SNI-based routingYesYesYesYesYesYesBestYespeek ClientHello -> per-host backend (sni_extract)
TLS 1.3 terminationYesYesYesYesYesYesYesYesown nishi_tls13, not OpenSSL/BoringSSL
Per-SNI certificate selectYesYesYesYesYesYesYesYessites.elf nx_sni_cert_select, proven both domains
SNI passthrough (no re-encrypt)YesYesYesPartPartYesNoNosr_relay splices raw TCP; backend terminates
ACME / auto-certYesPartPartBestYesPartBestPartnx_acme_req Let's Encrypt live
0-RTT / session resumptionNoYesYesYesYesYesBestYesnot yet
HTTP/3 (QUIC)NoYesPartYesYesYesBestYesnot yet
mTLS to backendPartYesYesYesYesYesYesYespersonal-daemon path only
Routing + proxy
HTTP reverse proxyYesYesYesYesYesYesYesYessd2_proxy_to + data-driven proxy_routes.conf
Path + host routingYesYesYesYesYesYesBestYeslongest-prefix, boundary-safe (/site != /sitemap)
WebSocket passthroughYesYesYesYesYesYesYesYessd2_ws_pump TLS-terminating pump
Streaming (no full-buffer)YesYesYesYesYesYesYesYessd2_proxy_stream 256KB window, TCP backpressure
Full-body reassembly (large POST)YesYesYesYesYesYesYesYessd2_fill_body 2MiB, landed 2026-07-10
Hot config reload (no restart)YesPartPartYesYesPartBestBestadd-a-row registry, zero recompile
Health-checked backends / failoverPartPartBestYesYesBestBestBestguard-supervise liveness only, no active probe
Load balancing (multi-backend)PartYesBestYesYesBestBestBestsingle backend per host today
Sovereignty + safety
Zero third-party dependencyBestNoNoNoNoNoNoNoown TLS + HTTP + router; no OpenSSL/nginx/libc-TLS
Own source (no upstream CVE surface)BestNoNoNoNoNoNoNowhole edge stack ours bits-up
Never-brick self-heal (guard respawn)YesPartPartPartPartPartYesYescrash-loop-guarded supervise + .prev rollback
Deterministic / auditable pathBestNoNoNoNoNoNoNono opaque C runtime in the request path
Single authoritative edgePartYesYesYesYesYesBestBestDSM nginx LAN-shadow here (operator-gated fix)
Production scale (the field's turf)
Global anycast / CDN PoPsNoNoNoNoNoNoBestYessingle box on one WAN link
WAF / DDoS mitigationNoPartPartPartPartYesBestYesnone built
Autoscale / multi-nodeNoYesYesPartYesBestBestBestsingle box
Observability (metrics + traces)PartYesBestYesBestBestBestBeststructured logs only, no metrics export
Edge rate limitingYesYesYesYesYesYesBestBestper-client sliding window in mgmt edge
Performance (measured / sourced)
TLS handshake, same-box~40-140ms~1-3ms~1-3ms~2-5ms~2-5ms~1-3ms<1ms~1-3msnishi-hs MEASURED; certloop dominates -> optimize
SNI route decision<1ms<1ms<1ms<1ms<1ms<1ms<1ms<1msClientHello peek only
Max upload chunk (edge relay)1 MiBunboundedunboundedunboundedunboundedunbounded~100MB~100MBsd2_fill_body raised 8KB->1MiB 2026-07-10
Connection modelfork/conneventedeventedeventedeventedeventedmanagedmanagedsr fork-per-conn: simple + memory-isolated
7 competitors30 axes4 quantitativeNishi Best on 3
Honest verdict. On the CORE edge job -- SNI-routed TLS 1.3 termination with per-host certs, streaming + WebSocket passthrough, and hot-reloadable routes -- the sovereign edge is at parity with the field, built bits-up on our own TLS 1.3 + HTTP stack (zero OpenSSL, zero nginx), guard-supervised self-heal, deterministic/auditable. Those are structural wins no mainstream edge makes. It is NOT a production CDN: no HTTP/3, no 0-RTT, no WAF/DDoS, no global anycast, no autoscale, thin observability, one box; and TLS handshake is ~40-140ms vs ~1-3ms for the field (our cert-validation loop dominates -- the clear next optimization). One deployment gap remains, diagnosed 2026-07-10: the Synology DSM nginx still squats the LAN :443 as a shadow edge (external traffic already routes to our sovereign edge) -- the durable fix is an operator DSM-port change, not a scriptable one. Next rungs: cut handshake latency, HTTP/3, health-checked LB, metrics/traces.

Generated by nx_swcompare_sota from knowledge/compare/edge.sota — quantitative axes measured/sourced; researcher-fed (nx_swcompare_research). Zero JS, zero trackers.