This documentation is still in progress. Some information may be incomplete or out of date. Please check back later.
httpjet · documentation · v0.0.5
httpjet
A from-scratch Rust web server that is a drop-in LiteSpeed replacement: it reads the same conf/httpd_config.xml tree, speaks native LSAPI to lsphp, evaluates the same .htaccess files, and adds native HTTP/2 and HTTP/3, reverse-proxy and FastCGI gateways, an opt-in LSCache-protocol page cache, optional ACME and OCSP, and a loopback admin API — all on one io_uring transport.
What httpjet is
httpjet is a complete origin server on a memory-safe Rust core, built so that an existing LiteSpeed Web Server (LSWS 6.3.5 compatibility target) or OpenLiteSpeed deployment becomes an httpjet deployment by pointing --root at the tree it already has. Compatibility is the feature; everything httpjet adds on top is an explicit opt-in that LiteSpeed simply ignores.
Compatible surface
- LiteSpeed XML: server, tuning, listeners, vhosts, contexts,
mime.properties - Native LSAPI wire protocol to any LSAPI-capable
lsphp - mod_rewrite, access control, Basic auth,
Header,ErrorDocument, LSCache directives - LSCache protocol (
X-LiteSpeed-Cache-Control/-Tag/-Vary/-Purge) - LiteSpeed
fileETag=28ETags,.html→PHP dispatch order
httpjet-native (opt-in)
- Per-client throttle, GeoIP/ASN rules, PROXY protocol, Unix-socket listeners
- Weighted upstream groups with active health checks;
h2:///h2s://upstreams; FastCGI - Per-context body/timeout/bandwidth overrides,
sub_filter, request decompression - ACME HTTP-01/DNS-01, OCSP stapling, kTLS/sendfile, OpenTelemetry
- Loopback status + transactional config API, WAF sidecar, compile-time extensions
httpjet serves WindowsForum.com in production on a single x86_64 node behind Cloudflare, over the pure io_uring transport with the page cache's file tier live. It is early-stage software (semantic version 0.0.5, Rust 1.99+, edition 2024, GPL-3.0-only) built around one production configuration — test on alternate ports before trusting it elsewhere. See Capabilities & limits for the honest matrix.
How the pieces fit
Every wire protocol lands in the same request pipeline. Click a node to jump to its page.
pipeline::handle() resolves the vhost and the client's identity, then dispatch() mirrors OpenLiteSpeed's ordering with the WAF, extension, page-cache lookup and store seams inserted at fixed points. Each terminal finishes through finalize_response before the transforms run.diagram source (mermaid)
flowchart TB
classDef on fill:#13203a,stroke:#818cf8,color:#fff
classDef term fill:#0e1424,stroke:#22d3ee,color:#e8ecf6
classDef gate fill:#1a1f33,stroke:#fbbf73,color:#e8ecf6
A["resolve<br/>SNI / Host → vhost"] --> B["trust & identity<br/>mTLS gate · client IP · ACL · geo · throttle"]
B --> W("WAF sidecar<br/>(opt-in)"):::gate
W --> X["extension pre-handlers<br/>(compile-time, optional)"]
X --> C[".htaccess chain<br/>SetEnvIf · pre-rewrite access"]
C --> D["rewrite<br/>inline rules, then .htaccess"]
D --> E["access enforcement<br/>Basic auth · PATH_INFO deny"]
E --> F("page-cache lookup<br/>(--page-cache)"):::on
F -- hit --> K
F -- miss / bypass --> G("dispatch")
G --> G1[WebSocket]:::term
G --> G2["proxy <context>"]:::term
G --> G3["LSAPI / FastCGI<br/>suffix routing"]:::term
G --> G4[static]:::term
G1 & G2 & G3 & G4 --> H["finalize<br/>Header ops · ErrorDocument"]
H --> I["cache store"]:::on
I --> K["response transforms<br/>promote small files · expires · sub_filter · compress · deny-CDN-cache · Alt-Svc"]
K --> L["access log · metrics · spans"]
click B "security.html"
click W "extensions.html#waf"
click X "extensions.html"
click C "rewrite.html"
click D "rewrite.html"
click E "rewrite.html#basic-auth"
click F "page-cache.html#lookup"
click I "page-cache.html#store"
click G2 "gateways.html"
click G3 "lsapi.html"
click K "compression.html"
click L "observability.html"By the numbers
Headline figures from the checked-in benchmark record — every number names its regime (see Performance for methodology and the raw CSVs).
Project status
| Aspect | State (2026-10-13) |
|---|---|
| Version | 0.0.5 — semantic versioning adopted 2026-09-17; MSRV Rust 1.99, edition 2024; dependencies current (0.0.5 sweep: aws-lc-rs 1.18, zstd 0.14, opentelemetry 0.33; the vendored monoio forks are off socket2 0.5/mio 0.8). |
| Configuration | LiteSpeed-compatible XML is the authority; httpjet-native directives are opt-in add-ons. check --strict is the deploy gate. |
| Transport | Pure io_uring (monoio) for H1/H2/H3 — the only transport; there is no epoll fallback and no Windows/macOS port. |
| PHP | Native LSAPI; the operator supplies lsphp. Production runs the persistent external pool with zero-downtime generation reloads. |
| Page cache | Off by default; LSCache-protocol opt-in, private tier, tmpfs file tier, per-vhost dictionaries, generation-scoped namespaces. Live in production. |
| Optional features | acme, ocsp, otel, ktls, profiling — build features that still need explicit runtime opt-in. |
| Security posture | Whole-codebase review rounds 2026-08-30, 09-06, 09-16 and 10-06 landed, plus a 0.0.5 remediation sweep of 15 findings (see audit posture); fail-closed defaults throughout. |
| Release | Source builds, generic systemd units, and a hardened OCI example. Signed public packages and a supported-platform matrix are still release work. |
Read next
The docs follow the request: how the server is structured, the protocols it speaks, how it runs PHP and proxies, who gets in, the page cache, and how it is configured, operated and measured.
check --strict, serve on loopback.hj-core seam, the io_uring bridge, generations.httpjet · documentation · synced to the source tree on 2026-10-13 (v0.0.5).
Source: github.com/faratech/httpjet · Home: httpjet.net · Found an error? Open an issue on the repository.