gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-10-12 23:52:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(http3): add opt-in QUIC transport (#7903)

Browse Source 
* build(http3): add optional s3s-http3 dependency

Signed-off-by: tommady <tommady@users.noreply.github.com>

* feat(server): add opt-in HTTP/3 transport

Signed-off-by: tommady <tommady@users.noreply.github.com>

* test(server): cover HTTP/3 TLS configuration

* feat(server): add opt-in HTTP/3 support

Serve S3 requests over QUIC with the existing middleware stack.

Signed-off-by: tommady <tommady@users.noreply.github.com>

* fix(http3): cancel pending body reads without panicking

* test(http3): keep transport independent of s3s

---------

Signed-off-by: tommady <tommady@users.noreply.github.com>
Co-authored-by: overtrue <anzhengchao@gmail.com>
This commit is contained in:
Lindroos Hsu
2026-10-07 18:59:21 +08:00
committed by GitHub
parent 14eb28dcd6
commit db2abcf0a6
13 changed files with 1449 additions and 156 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/operations/reverse-proxy.md
+6
View File
@@ -6,6 +6,12 @@
RustFS speaks plain S3 over HTTP/1.1 and HTTP/2. Most proxy problems are not RustFS storage bugs: if the same request works directly against `:9000`, the fault is in proxy/CDN request forwarding. Use the checklist below to find which forwarding behavior broke.
## Experimental HTTP/3
Build with `cargo build -p rustfs --features http3` and set `RUSTFS_HTTP3_ENABLE=true` together with `RUSTFS_TLS_PATH`. HTTP/3 listens on UDP at the S3 listener's TCP address and port. Allow UDP through your firewall or proxy; clients must explicitly support HTTP/3. The console and internode RPC remain on TCP. HTTP/3 uses TLS 1.3 with `h3` ALPN, disables early data and connection migration, and follows the existing certificate reload settings.
The external request stack is shared with TCP, including readiness, Keystone authentication, trusted proxy validation, rate limiting, CORS, and response compatibility. `RUSTFS_API_MAX_CONNECTIONS` bounds each transport listener separately; a value of `0` disables this cap. HTTP/3 refuses excess connections before their handshake. `RUSTFS_HTTP_REQUEST_BODY_READ_TIMEOUT` also bounds idle HTTP/3 body reads; unread or timed-out streams are canceled without draining them in a background task. Shutdown allows up to ten seconds for active HTTP/3 requests to finish.
## What RustFS requires from the proxy
S3 clients sign requests with AWS SigV4. RustFS (via `s3s`) re-derives the signature from the forwarded request and streams the request body to storage, so the proxy must forward the signed material and the body byte-for-byte: