CWIST

What CWIST is

CWIST is a C17 web framework and application server. It is not a binding over someone else's HTTP engine: the protocol stack, the reactor, the TLS configuration and the database layer are all part of the same static library, and the result is one binary with no runtime to install beside it.

The name is an argument as much as an acronym. Writing a web service in C is usually treated as a mistake by default; CWIST exists to make the ordinary version of that job (routing, TLS, a database, metrics, a health endpoint) as short to write as it is in any other ecosystem.

Two server modes, and why both exist

CWIST ships two request paths tuned for opposite things, selected with one environment variable.

The CWIST reactor is the default. It multiplexes many connections per event loop, so connection count is decoupled from thread count and a connection costs a reactor slot rather than a parked thread. It is the mode to pick when the number of open connections is the thing that grows.

The classic pool is thread-per-connection, enabled with CWIST_C1M_MODE=0. Every connection gets its own thread, so no request waits behind another in a batch. In our published runs it leads through the median and p99; the crossover against the async comparison happens at the extreme tail.

We publish the whole distribution rather than an average, because an average hides which requests were slow. The numbers come from one commit, one load profile and one CI environment, and the runner CPU model moves them more than most code changes do. Read them as a shape, not a guarantee.

Where it fits

CWIST is a reasonable choice when you already have C in the picture: an embedded system that grew an API, a numerical or media service whose core is C and whose HTTP layer should not double the deployment, or a service where the operators want to read every layer they are on call for. It is a poor choice if what you actually want is a large library ecosystem for business logic.

Installing

CWIST vendors its dependencies, so a clone and make is usually enough. There is also a Homebrew tap for macOS and Linuxbrew. The getting-started guide walks through both, then builds a first server.

main.c

#include <cwist/app.h>

static void hello(cwist_http_request *req,
                  cwist_http_response *res) {
    (void)req;
    cwist_sstring_assign(res->body, "Hello from CWIST!");
}

int main(void) {
    cwist_app *app = cwist_app_create();
    cwist_app_get(app, "/", hello);
    cwist_app_listen(app, 8080);
    cwist_app_destroy(app);
    return 0;
}

At a glance

C17 library and application server. Vendors BoringSSL, lsquic, libttak and SQLite3, so a plain build works on a fresh Linux, macOS or BSD machine. Installable from source or from the Homebrew tap.

Licence: MIT
Standard: C17

Vendored dependencies keep their own terms; see NOTICE.md in the repository before distributing a linked binary.

Open the repository →

Capabilities

What is in the box

H3

Modern protocols

HTTP/1.1, HTTP/2 and HTTP/3 over QUIC in one server, plus WebSocket and WebTransport, with no proxy in front to terminate them for you.

PQ

Post-quantum TLS

Hybrid X25519MLKEM768 key agreement, available behind a single call so that turning it on is a configuration decision rather than a project.

DB

Embedded SQLite ORM

A SQLite-backed ORM ships in the box, with auto-detection for a local PostgreSQL, MySQL or MariaDB when one is present.

RX

Two request paths

A multiplexing reactor for throughput and connection count, and an opt-in thread-per-connection pool for median and p99 latency.

WA

WASI 0.2 target

The same source compiles to wasm32-wasip2 and owns its accept loop through wasi:sockets, so a CWIST binary runs under wasmtime unchanged.

UI

Rendering without a frontend stack

An HTML element builder, a scoped CSS composer, a small template engine and content-hashed static assets, so a server can answer with a finished page instead of a JSON envelope.

Guides