http3-server

sparq HTTP/3 server bridge

Use sparq-http3 when a sparq HTTP server needs a second, encrypted UDP listener that dispatches into the same axum::Router as its existing HTTP/1.1 or HTTP/2 listener. The crate is internal and unstable (publish = false), and its server feature is off by default so Quinn and the pre-1.0 h3 stack do not enter ordinary workspace builds.

Add the opt-in dependency

[features]
default = []
http3 = ["dep:sparq-http3"]

[dependencies]
sparq-http3 = { path = "../sparq-http3", optional = true, features = ["server"] }

The downstream crate owns certificate/key loading and runtime configuration. Build a rustls::ServerConfig with the aws-lc-rs provider, TLS 1.3, and the exact h3 ALPN token:

use std::sync::Arc;

let provider = Arc::new(rustls::crypto::aws_lc_rs::default_provider());
let mut tls = rustls::ServerConfig::builder_with_provider(provider)
    .with_protocol_versions(&[&rustls::version::TLS13])?
    .with_no_client_auth()
    .with_single_cert(certificates, private_key)?;
tls.alpn_protocols = vec![b"h3".to_vec()];

let quic = sparq_http3::quic_server_config(tls)?;
let endpoint = quinn::Endpoint::server(quic, udp_addr)?;
# Ok::<(), Box<dyn std::error::Error>>(())

quic_server_config fails closed when h3 is missing from ALPN or the provider lacks QUIC's required initial cipher suite. It also replaces Quinn's effectively unbounded default connection receive window with an owned finite bound; a caller may still replace the returned config's transport settings before binding the endpoint.

Serve the shared router

sparq_http3::serve_h3(endpoint, router.clone(), async move {
    shutdown_signal.await;
})
.await?;
# Ok::<(), std::io::Error>(())

The compatibility entry point is safe by default: it limits total concurrent connections, connections from one public IP, and concurrent requests on each connection. Internal addresses are exempt from the per-IP cap to avoid treating a proxy, container bridge, or conformance runner as one client, but the global cap still applies. Existing callers need no changes. To tune the caps, use the additive variant: