Crate plecto_server 

plecto-server — the M2 fast path (ADR 000013, TLS 000014, HTTP/2 000015, HTTP/3 000016).

A tokio listener that turns Plecto from a library into an actual reverse proxy. It serves HTTP/1.1 and HTTP/2 over TCP (hyper, ALPN-negotiated — ADR 000015) and HTTP/3 over QUIC (quinn + the h3 crate, an independent UDP listener advertised via Alt-Svc — ADR 000016). All three transports feed the same transaction core (proxy_core); only the body adapters differ. Per request it: builds a header-only HttpRequest, asks the control plane which route matches (host + path prefix), runs that route’s filter chain, and either responds now (a filter short-circuited / failed closed) or forwards the request to the route’s upstream and runs the response side of the chain on the way back.

sync↔async bridge (the §6.3 prerequisite). Filter execution is synchronous and runs on a wasmtime Store that is !Send, so it cannot cross an .await. Each chain dispatch is moved to tokio’s blocking pool via spawn_blocking; the M1 trusted instance pool handles instance reuse and saturation there. Route matching is pure config lookup and stays on the async thread.

Request body: buffered ONLY when a filter reads it (ADR 000025 / 000038). A route whose filters all target the header-only filter world streams the request body straight to the upstream (zero-copy); a route with a filter that exports on-request-body (reads_body) has the body buffered (bounded) and run through the on-request-body chain. The response body always streams straight back — filters see response headers / status only (they may synthesise a short-circuit body of their own).

Modules

proxy_protocol

PROXY protocol v2 reception (ADR 000057): restore the real client address behind an L4 load balancer, at the only possible point — after accept, before the TLS handshake / HTTP parse.

Constants

DEFAULT_DRAIN_DEADLINE

Default drain window for graceful shutdown (ADR 000039), used when [listen.drain] window_ms is not declared (ADR 000059): generous enough for normal in-flight requests (the default per-try upstream timeout is 30 s too) and aligned with the common 30 s termination grace of process supervisors.

Functions

cap_malloc_arenas

Cap glibc’s per-thread malloc arenas at process start to bound RSS on many-core hosts.

serve

Serve the fast path on an already-bound listener until it errors unrecoverably. Each accepted connection is handled on its own task; the protocol is HTTP/1.1, or HTTP/2 when TLS-ALPN negotiates h2 (ADR 000015). A per-connection error is logged, not fatal. Bind with TcpListener::bind (the caller picks the addr, so a test can use an ephemeral 127.0.0.1:0 and read local_addr).

serve_with_shutdown

Serve like serve, but run the graceful-shutdown sequence when shutdown resolves (ADR 000039 / 000059): /readyz flips not-ready, accepts continue for the readiness grace ([listen.drain] readiness_grace_ms, default zero), then the drain starts and in-flight connections get the drain window ([listen.drain] window_ms, default 30 s) before the stragglers are cut.