foundation_proxy 0.1.2

Reverse proxy — SSL termination, zero-downtime deploys, health-check routing
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75

[package]
name = "foundation_proxy"
version = "0.1.2"
edition.workspace = true
rust-version.workspace = true
license.workspace = true
authors.workspace = true
repository.workspace = true
description = "Reverse proxy — SSL termination, zero-downtime deploys, health-check routing"

[dependencies]
foundation_errstacks = { path = "../foundation_errstacks", version = "0.0.3" }
foundation_core = { path = "../foundation_core", version = "0.0.6", features = ["multi"] }
foundation_http = { path = "../foundation_http", version = "0.0.3", features = ["multi", "ssl"] }
foundation_netio = { path = "../foundation_netio", version = "0.0.4", features = ["ssl", "multi"] }
foundation_iogate = { path = "../foundation_iogate", version = "0.0.3" }
foundation_nativeapis = { path = "../foundation_nativeapis", version = "0.0.3", features = ["fd"] }
foundation_db = { path = "../foundation_db", version = "0.0.4" }
foundation_macros = { path = "../foundation_macros", version = "0.0.6" }
foundation_deployment_cloudflare = { path = "../foundation_deployment_cloudflare", version = "0.1.3", optional = true }
# T3/T4: the proxy's H2 upstream leg reuses connectrpc's streaming H2 client
# (`H2Transport`) — the only H2 client in the tree with trailing-HEADERS support.
# `default-features = false` keeps it lean: we only need the transport seam.
foundation_connectrpc = { path = "../foundation_connectrpc", version = "0.0.3", default-features = false }

serde.workspace = true
serde_json.workspace = true
toml.workspace = true
sha2 = "0.10"
base64 = "0.22"
bytes = "1"
derive_more.workspace = true
tracing.workspace = true
chrono.workspace = true
# ACME (F15): ES256 JWS signing + account JWK (pure-Rust RustCrypto, already in
# the tree) and X.509 keypair/CSR generation. rcgen uses the `ring` backend
# (also already present via rustls/boringtun) so no new C crypto library.
p256 = { version = "0.13", features = ["ecdsa", "pem"] }
rand_core = { version = "0.6", features = ["getrandom"] }
rcgen = { version = "0.13", default-features = false, features = ["ring", "pem", "x509-parser"] }
# Drive the ACME provisioning future to completion at startup (its I/O is the
# shared client's blocking send, so it resolves in a single poll).
futures-lite = "2"
# Stream combinators (`StreamExt`) and `join` for the async H2 forward relays.
futures-util = "0.3"

[dev-dependencies]
foundation_deployment_platform = { path = "../foundation_deployment_platform" }
tokio = { version = "1", features = ["rt-multi-thread", "macros", "time", "net"] }
# The mock ACME CA in the F15 test parses the client CSR (DER) via rcgen, whose
# `from_der` takes a `CertificateSigningRequestDer` from rustls-pki-types.
rustls-pki-types = "1"
tracing-test = { version = "0.2", features = ["no-env-filter"] }
serial_test = "3"

[features]
default = []
cloudflare = ["foundation_deployment_cloudflare"]
docker-tests = []
# HTTP/3 (QUIC) proxy front end (F19): enables the H3 serving layer and handler.
quic = ["foundation_http/quic", "foundation_netio/quic"]

[[test]]
name = "proxy_integration_tests"
path = "tests/proxy_integration_tests.rs"
required-features = ["docker-tests"]

[lints]
workspace = true

# HTTP/3 proxy end-to-end test (F19) — real QUIC front end, quic-gated.
[[test]]
name = "h3_integration_tests"
path = "tests/h3_integration_tests.rs"
required-features = ["quic"]