Crate orca_proxy 

Reverse proxy with HTTP routing for containers and Wasm trigger dispatch.

Routes HTTP traffic by Host header to container backends (round-robin), and by path pattern to Wasm component invocations via a callback. Supports automatic TLS via ACME/Let’s Encrypt (Caddy-style zero-config).

Modules

acme

ACME certificate management with automatic Let’s Encrypt provisioning.

rate_limit

Simple per-IP token bucket rate limiter.

sni

Peek at TLS ClientHello to extract SNI hostname without consuming bytes.

tls

TLS configuration for the reverse proxy.

Structs

FallbackConfig

Fallback proxy configuration. When orca’s route table has no match, requests are forwarded here. Lets orca coexist with another reverse proxy.

RouteTarget

A backend target for container routing.

SecurityHeadersConfig

Security response headers the proxy adds to every response it returns — add-if-absent, so a backend that sets its own Content-Security-Policy, X-Frame-Options, Strict-Transport-Security, etc. is never overridden (pass-through-plus-defaults, as Traefik/Caddy do). HSTS is applied only to HTTPS responses. The defaults are deliberately non-breaking; X-Frame-Options and CSP are off by default (they break iframe-embedded apps and most apps respectively) and are opt-in here or per app.

WasmTrigger

A Wasm HTTP trigger: maps a path pattern to a Wasm runtime instance.

Functions

init_security_headers

Install the proxy’s security-header policy (call once at startup). See [security_headers]. Install the proxy’s security-header policy from config. Call once at startup before serving. None installs the safe default set (on); a disabled config installs an empty (no-op) policy.

run_proxy

Run the reverse proxy on the given port.

run_proxy_with_acme

Run HTTP on port 80 (for ACME challenges + redirect) and HTTPS on port 443.

run_proxy_with_acme_and_fallback

Run HTTP+HTTPS with ACME and optional fallback to another reverse proxy.

run_proxy_with_fallback

Run the proxy with optional fallback support.

Type Aliases

SharedCertResolver

Shared dynamic cert resolver for hot-provisioning.

SharedWasmTriggers

Shared Wasm trigger table type.

WasmInvokeFuture

Future type returned by the Wasm invoker.

WasmInvoker

Callback invoked when a request matches a Wasm trigger. Receives (runtime_id, method, path, body) and returns the response body string.