Epic: HTTP/3 via QUIC

[shaneutt]

Summary

Add HTTP/3 support via Quiche, enabling QUIC transport for both client-facing listeners and upstream connections. Conformance targets: RFC 9114 (HTTP/3) and RFC 9000 (QUIC).

Unified Listener Model

• protocols field on Listener config (default [h2])
• Shared tls: block across TCP and QUIC transports
• Protocol registration binds both TCP + UDP when both h2 and h3 are enabled
• Validation: h3 requires tls; warn if h3 without h2 (no Alt-Svc fallback)

Core Implementation

• Add quiche workspace dep (behind h3 feature)
• Http3Proxy: accept QUIC connections, decode HTTP/3 frames, build Request/Response, run filter pipeline
• Convert layer bridging Quiche types to Praxis context (existing convert pattern)
• Body handling: QUIC DATA frames map to Bytes chunks; existing BodyMode semantics unchanged
• Wire into praxis binary
• 0-RTT disabled by default; opt-in config (replay risk)

Transport Negotiation

• Auto-inject Alt-Svc: h3=":PORT"; ma=86400 when h3 + h2 co-enabled on a listener
• Optional alt_svc listener config (custom max-age, port, or disable)
• ALPN h3 in QUIC TLS handshake
• Document DNS HTTPS/SVCB records for first-connection H3 (RFC 9460)

QPACK Considerations

Header filters must be compatible with QPACK dynamic table compression. Filters that modify headers need to account for QPACK encoding: modified headers are re-encoded by the QPACK encoder after filter processing. Header size limits and dynamic table size configuration should be exposed in listener config.

HTTP/3 Upstream

QUIC connections to upstream servers (not just client-facing listeners):

• Upstream cluster config with protocol: h3 option
• Connection pooling for QUIC upstream connections
• Fallback to h2/h1.1 if upstream does not support h3
• Health check probes over QUIC connections

Performance Benchmarking

Specific metrics to compare H2 vs H3:

• Connection establishment latency (TCP+TLS vs QUIC handshake)
• 0-RTT handshake latency savings
• Throughput under packet loss (QUIC head-of-line blocking avoidance)
• Per-stream latency under multiplexed load
• Memory footprint per connection (TCP vs QUIC)

Connection Migration

• IP-dependent filters (ip_acl, forwarded_headers, access_log) re-evaluate on address change
• Expose migration events in FilterContext
• Document migration behavior for filter authors

Graceful Shutdown

• Send GOAWAY frame on QUIC connections during graceful shutdown
• Drain period: allow in-flight streams to complete before closing the QUIC connection
• Coordinate with existing TCP graceful shutdown logic

Testing and Docs

• Integration: Alt-Svc upgrade, direct H3, filter pipeline on H3, mixed H2+H3 listener, body modes over QUIC
• Integration Tests: TCP + QUIC racing
• Document firewall/cloud requirements (UDP 443, MTU)