https://github.com/religiya-serdtsa/cwist
Web Development Framework Suite in C
https://github.com/religiya-serdtsa/cwist
boringssl c http2 http3 http3-server io-uring lightweight low-level mux openssl quic server suckless systems-programming tls13 web-development web-engine web-framework
Last synced: 3 days ago
JSON representation
Web Development Framework Suite in C
- Host: GitHub
- URL: https://github.com/religiya-serdtsa/cwist
- Owner: Religiya-Serdtsa
- Created: 2026-01-07T12:06:07.000Z (5 months ago)
- Default Branch: main
- Last Pushed: 2026-05-27T04:30:32.000Z (4 days ago)
- Last Synced: 2026-05-27T06:21:38.575Z (4 days ago)
- Topics: boringssl, c, http2, http3, http3-server, io-uring, lightweight, low-level, mux, openssl, quic, server, suckless, systems-programming, tls13, web-development, web-engine, web-framework
- Language: C
- Homepage:
- Size: 55.4 MB
- Stars: 1
- Watchers: 0
- Forks: 1
- Open Issues: 2
-
Metadata Files:
- Readme: README
- Roadmap: ROADMAP.md
Awesome Lists containing this project
README
+------------------------------------------------------------------+
| ________ |
| ##### # # # # #### ##### == / \ |
| # # # # # # # == | ! \ |
| # # # # # ### # ==| \___ |
| # # # # # # # == | | | / |
| ##### ######## # #### # == \_________/ |
| |
| C Web development Is Still Trustworthy |
| |
+------------------------------------------------------------------+
A high-performance, C17 web framework that brings modern ergonomics
-- HTTP/3, WebTransport, Post-Quantum TLS, and zero-copy I/O --
to systems programming without sacrificing control.
Powered by BoringSSL, lsquic, OpenSSL without context contamination.
~~~HEAVY BENCHMARK ON CWIST APP~~~ ==> https://github.com/gg582/fly.board/blob/main/README.md
==================================================================
WHY CWIST?
==================================================================
Most C web frameworks stop at HTTP/1.1 and leave TLS, protocol
upgrades, and memory management as exercises for the user. CWIST
ships with the entire stack:
* HTTP/3 & WebTransport Server
Powered by lsquic. Server-side WebTransport sessions over QUIC
with bidirectional and unidirectional streams.
* Post-Quantum TLS
One API call: cwist_app_use_pqc_layer(app, true)
Forces hybrid X25519MLKEM768 and disables legacy TLS < 1.3.
No OpenSSL knowledge required.
* Server-side zero-copy I/O & C100K Reactor
Backed by io_uring / epoll / kqueue with lock-free job queues
and generational arena allocators from libttak.
* Nuke DB
A read-optimal, in-memory SQLite engine that syncs to disk on
every COMMIT.
* Auto-RDBMS Detection
Probe any TCP port and automatically mount PostgreSQL, MySQL,
or MariaDB runtimes by wire-protocol fingerprinting.
==================================================================
CORE FEATURES
==================================================================
Protocols HTTP/1.1, HTTP/2 (h2/h2c), HTTP/3 (QUIC),
WebSocket, WebTransport
TLS / Security BoringSSL, PQC hybrid groups, ECH, JWT,
DB Crypt, Monocypher
Database SQLite3 + ORM, Nuke DB (in-memory + WAL sync),
RDBMS auto-detection
Routing Express-style :param routes, Mux router,
chainable middleware
Performance Zero-copy I/O, generational arenas, EBR GC,
lock-free queues, Big Dumb Reply cache
Observability Structured access logs, metrics endpoint,
healthz, rate limiting
Rendering HTML builder, CSS composer, template engine,
JSON builder / heal
==================================================================
QUICK START
==================================================================
git clone https://github.com/religiya-serdtsa/cwist.git
cd cwist
make
--------------------------------------- code -----------------------------------
| #include |
| |
| static void hello(cwist_http_request *req, cwist_http_response *res) { |
| cwist_sstring_assign(res->body, "Hello from CWIST!"); |
| } |
| |
| int main(void) { |
| cwist_app *app = cwist_app_create(); |
| |
| /* SQLite + ORM-ready database */ |
| cwist_app_use_db(app, ":memory:"); |
| |
| /* Post-Quantum TLS (hybrid X25519MLKEM768) */ |
| cwist_app_use_pqc_layer(app, true); |
| |
| /* Observability endpoints */ |
| cwist_app_enable_metrics(app); |
| cwist_app_enable_healthz(app); |
| |
| /* Auto-detect RDBMS on localhost */ |
| cwist_app_auto_rdbms(app, 5432); |
| |
| /* Routes */ |
| cwist_app_get(app, "/", hello); |
| |
| cwist_app_listen(app, 8080); |
| cwist_app_destroy(app); |
| return 0; |
| } |
--------------------------------------------------------------------------------
gcc -o server main.c -lcwist -lssl -lcrypto -luriparser -lcjson -ldl -lpthread
./server
==================================================================
NUKE DB
==================================================================
Read-from-RAM, Write-to-Disk. Nuke DB loads an on-disk SQLite file
into memory via sqlite3_deserialize, runs PRAGMA integrity_check,
and then serves every query from RAM. Every COMMIT triggers a
background WAL sync. If bootstrap fails, it falls back to read-only
disk protection mode.
cwist_nuke_init("data.db", 5000); /* 5-second auto-sync */
cwist_db *db = cwist_nuke_get_db();
==================================================================
LIBTTAK PERFORMANCE CORE
==================================================================
CWIST links the in-tree libttak allocator/reactor toolkit:
Generational Arena Allocator
Static assets and BDR blobs are released in one shot, eliminating
RSS fragmentation.
Epoch-Based Reclamation (EBR)
ttak_epoch_enter/exit pin critical sections; stale buffers are
reclaimed automatically.
Detachable Memory
Signal-safe, cache-aligned arenas for TLS write buffers and
WebSocket frames.
Lock-Free Job Queue
Producers push with a single atomic swap; consumers reuse detached
nodes to prevent fragmentation.
==================================================================
PQC TLS LAYER
==================================================================
Enable post-quantum cryptography with one line:
cwist_app_use_pqc_layer(app, true);
This forces X25519MLKEM768:X25519:P-256, sets TLS 1.3 as the minimum
version, and strips all legacy TLSv1.0-1.2 ciphers. Application code
never touches OpenSSL directly.
==================================================================
WEBTRANSPORT
==================================================================
CWIST exposes server-side WebTransport over HTTP/3:
cwist_app_use_webtransport(app, my_wt_handler);
The framework handles the CONNECT negotiation, keeps the stream open
after 2xx, and provides cwist_webtransport_read/write/flush/close/
open_bidi/open_uni APIs.
==================================================================
RDBMS AUTO-MOUNT
==================================================================
Point CWIST at a local TCP port and it detects the provider by wire
protocol:
if (cwist_app_auto_rdbms(app, 5432)) {
/* PostgreSQL, MySQL, or MariaDB runtime mounted */
}
No port-number guessing -- CWIST sends a PostgreSQL StartupMessage
or reads a MySQL Handshake initiation packet to classify the server.
==================================================================
BENCHMARK SNAPSHOT
==================================================================
Recorded on an AMD EPYC 7763 container (4 vCPU, Linux 6.14):
Tool : ApacheBench 2.3
Command : ab -n 100 -c 85 -k http://localhost:31744/
Requests/sec : 2,958.40
Mean latency : 0.338 ms per concurrent request
Failed requests : 0
See BENCHMARK.txt for the full transcript and reproducible workflow.
==================================================================
DEPENDENCIES
==================================================================
* BoringSSL (in-tree)
* lsquic (in-tree, compiled with -DLSQUIC_WEBTRANSPORT=ON)
* libttak (in-tree)
* SQLite3 (in-tree)
* cJSON
* uriparser
* Monocypher
==================================================================
DOCUMENTATION
==================================================================
* API Reference : https://religiya-serdtsa.github.io/CWIST/
* docs/ -- tutorials and Doxygen sources
* example/ -- runnable demos including rps-showcase and othello-web