[优化] 添加 HTTP/3 支持配置选项

openflare_server/common/constants.go

@@ -77,6 +77,7 @@ var OpenRestyProxyConnectTimeout = 3
 var OpenRestyProxySendTimeout = 60
 var OpenRestyProxyReadTimeout = 60
 var OpenRestyWebsocketEnabled = true
+var OpenRestyHTTP3Enabled = true
 var OpenRestyProxyRequestBufferingEnabled = false
 var OpenRestyProxyBufferingEnabled = true
 var OpenRestyProxyBuffers = "16 16k"

openflare_server/controller/option.go

@@ -159,6 +159,7 @@ func validateOpenRestyOption(key string, value string) error {
 		return nil
 	case "OpenRestyEventsMultiAcceptEnabled",
 		"OpenRestyWebsocketEnabled",
+		"OpenRestyHTTP3Enabled",
 		"OpenRestyProxyRequestBufferingEnabled",
 		"OpenRestyProxyBufferingEnabled",
 		"OpenRestyGzipEnabled",

openflare_server/model/option.go

@@ -70,6 +70,7 @@ func InitOptionMap() {
 	common.OptionMap["OpenRestyProxySendTimeout"] = strconv.Itoa(common.OpenRestyProxySendTimeout)
 	common.OptionMap["OpenRestyProxyReadTimeout"] = strconv.Itoa(common.OpenRestyProxyReadTimeout)
 	common.OptionMap["OpenRestyWebsocketEnabled"] = strconv.FormatBool(common.OpenRestyWebsocketEnabled)
+	common.OptionMap["OpenRestyHTTP3Enabled"] = strconv.FormatBool(common.OpenRestyHTTP3Enabled)
 	common.OptionMap["OpenRestyProxyRequestBufferingEnabled"] = strconv.FormatBool(common.OpenRestyProxyRequestBufferingEnabled)
 	common.OptionMap["OpenRestyProxyBufferingEnabled"] = strconv.FormatBool(common.OpenRestyProxyBufferingEnabled)
 	common.OptionMap["OpenRestyProxyBuffers"] = common.OpenRestyProxyBuffers
@@ -278,6 +279,8 @@ func updateOptionMap(key string, value string) {
 		}
 	case "OpenRestyWebsocketEnabled":
 		common.OpenRestyWebsocketEnabled = value == "true"
+	case "OpenRestyHTTP3Enabled":
+		common.OpenRestyHTTP3Enabled = value == "true"
 	case "OpenRestyProxyRequestBufferingEnabled":
 		common.OpenRestyProxyRequestBufferingEnabled = value == "true"
 	case "OpenRestyProxyBufferingEnabled":

openflare_server/service/config_version.go

@@ -152,6 +152,7 @@ type openRestyConfigSnapshot struct {
 	ProxySendTimeout          int    `json:"proxy_send_timeout"`
 	ProxyReadTimeout          int    `json:"proxy_read_timeout"`
 	WebsocketEnabled          bool   `json:"websocket_enabled"`
+	HTTP3Enabled              bool   `json:"http3_enabled"`
 	ProxyRequestBuffering     bool   `json:"proxy_request_buffering"`
 	ProxyBufferingEnabled     bool   `json:"proxy_buffering_enabled"`
 	ProxyBuffers              string `json:"proxy_buffers"`
@@ -952,6 +953,7 @@ func buildOpenRestyConfigSnapshot() openRestyConfigSnapshot {
 		ProxySendTimeout:          common.OpenRestyProxySendTimeout,
 		ProxyReadTimeout:          common.OpenRestyProxyReadTimeout,
 		WebsocketEnabled:          common.OpenRestyWebsocketEnabled,
+		HTTP3Enabled:              common.OpenRestyHTTP3Enabled,
 		ProxyRequestBuffering:     common.OpenRestyProxyRequestBufferingEnabled,
 		ProxyBufferingEnabled:     common.OpenRestyProxyBufferingEnabled,
 		ProxyBuffers:              common.OpenRestyProxyBuffers,
@@ -1071,6 +1073,7 @@ func diffOpenRestyOptionDetails(left openRestyConfigSnapshot, right openRestyCon
 	appendIfChanged("OpenRestyProxySendTimeout", fmt.Sprintf("%d", left.ProxySendTimeout), fmt.Sprintf("%d", right.ProxySendTimeout))
 	appendIfChanged("OpenRestyProxyReadTimeout", fmt.Sprintf("%d", left.ProxyReadTimeout), fmt.Sprintf("%d", right.ProxyReadTimeout))
 	appendIfChanged("OpenRestyWebsocketEnabled", fmt.Sprintf("%t", left.WebsocketEnabled), fmt.Sprintf("%t", right.WebsocketEnabled))
+	appendIfChanged("OpenRestyHTTP3Enabled", fmt.Sprintf("%t", left.HTTP3Enabled), fmt.Sprintf("%t", right.HTTP3Enabled))
 	appendIfChanged("OpenRestyProxyRequestBufferingEnabled", fmt.Sprintf("%t", left.ProxyRequestBuffering), fmt.Sprintf("%t", right.ProxyRequestBuffering))
 	appendIfChanged("OpenRestyProxyBufferingEnabled", fmt.Sprintf("%t", left.ProxyBufferingEnabled), fmt.Sprintf("%t", right.ProxyBufferingEnabled))
 	appendIfChanged("OpenRestyProxyBuffers", left.ProxyBuffers, right.ProxyBuffers)
@@ -1119,6 +1122,7 @@ func openRestyOptionKeys() []string {
 		"OpenRestyProxySendTimeout",
 		"OpenRestyProxyReadTimeout",
 		"OpenRestyWebsocketEnabled",
+		"OpenRestyHTTP3Enabled",
 		"OpenRestyProxyRequestBufferingEnabled",
 		"OpenRestyProxyBufferingEnabled",
 		"OpenRestyProxyBuffers",

openflare_server/service/https_phase1_test.go

@@ -489,6 +489,9 @@ func TestPublishConfigVersionRendersMultipleCertificatesForMultiDomainWebsite(t
 
 func TestPublishConfigVersionSkipsHTTPSForDomainsWithoutCertificate(t *testing.T) {
 	setupServiceTestDB(t)
+	if err := model.UpdateOption("OpenRestyHTTP3Enabled", "false"); err != nil {
+		t.Fatalf("UpdateOption failed: %v", err)
+	}
 
 	appCertPEM, appKeyPEM := generateCertificatePair(t, []string{"app.example.com"})
 	appCertificate, err := CreateTLSCertificate(TLSCertificateInput{
@@ -1338,6 +1341,80 @@ func TestOpenRestyProxyRequestBufferingDefaultsToOff(t *testing.T) {
 	}
 }
 
+func TestPreviewConfigVersionSupportsHTTP3(t *testing.T) {
+	setupServiceTestDB(t)
+
+	appCertPEM, appKeyPEM := generateCertificatePair(t, []string{"h3.example.com"})
+	appCertificate, err := CreateTLSCertificate(TLSCertificateInput{
+		Name:    "h3-cert",
+		CertPEM: appCertPEM,
+		KeyPEM:  appKeyPEM,
+	})
+	if err != nil {
+		t.Fatalf("CreateTLSCertificate failed: %v", err)
+	}
+
+	_, err = CreateProxyRoute(ProxyRouteInput{
+		SiteName:      "h3-site",
+		Domains:       []string{"h3.example.com"},
+		OriginURL:     "https://origin.internal",
+		Enabled:       true,
+		EnableHTTPS:   true,
+		CertID:        &appCertificate.ID,
+		DomainCertIDs: []uint{appCertificate.ID},
+	})
+	if err != nil {
+		t.Fatalf("CreateProxyRoute failed: %v", err)
+	}
+
+	if err := model.UpdateOption("OpenRestyHTTP3Enabled", "true"); err != nil {
+		t.Fatalf("UpdateOption OpenRestyHTTP3Enabled failed: %v", err)
+	}
+
+	preview, err := PreviewConfigVersion()
+	if err != nil {
+		t.Fatalf("PreviewConfigVersion failed: %v", err)
+	}
+
+	if !strings.Contains(preview.MainConfig, "listen 443 ssl default_server;\n        listen 443 quic reuseport default_server;") {
+		t.Fatalf("expected default server block to contain quic reuseport listener, main config: %s", preview.MainConfig)
+	}
+
+	if !strings.Contains(preview.RenderedConfig, "listen 443 quic;") {
+		t.Fatalf("expected routing server block to contain listen 443 quic, rendered config: %s", preview.RenderedConfig)
+	}
+	if !strings.Contains(preview.RenderedConfig, "add_header Alt-Svc 'h3=\":443\"; ma=86400';") {
+		t.Fatalf("expected routing server block to contain Alt-Svc header, rendered config: %s", preview.RenderedConfig)
+	}
+
+	if !strings.Contains(preview.RenderedConfig, "listen 443 ssl;") {
+		t.Fatal("expected standard listen 443 ssl to be preserved")
+	}
+	if !strings.Contains(preview.RenderedConfig, "http2 on;") {
+		t.Fatal("expected standard http2 on to be preserved")
+	}
+
+	if err := model.UpdateOption("OpenRestyHTTP3Enabled", "false"); err != nil {
+		t.Fatalf("UpdateOption OpenRestyHTTP3Enabled failed: %v", err)
+	}
+
+	previewOff, err := PreviewConfigVersion()
+	if err != nil {
+		t.Fatalf("PreviewConfigVersion failed: %v", err)
+	}
+
+	if strings.Contains(previewOff.MainConfig, "listen 443 quic reuseport default_server;") {
+		t.Fatal("expected default server block to omit quic listener when disabled")
+	}
+
+	if strings.Contains(previewOff.RenderedConfig, "listen 443 quic;") {
+		t.Fatal("expected routing server block to omit quic listener when disabled")
+	}
+	if strings.Contains(previewOff.RenderedConfig, "add_header Alt-Svc") {
+		t.Fatal("expected routing server block to omit Alt-Svc header when disabled")
+	}
+}
+
 func setupServiceTestDB(t *testing.T) {
 	t.Helper()
 	nodeAccessTokenCache.reset()

openflare_server/utils/render/openresty/render.go

@@ -305,7 +305,7 @@ func renderMainConfigTemplate(templateText string, cfg ConfigSnapshot) string {
 		"{{OpenRestyWorkerConnections}}", fmt.Sprintf("%d", cfg.WorkerConnections),
 		"{{OpenRestyWorkerRlimitNofile}}", fmt.Sprintf("%d", cfg.WorkerRlimitNofile),
 		"{{OpenRestyConnectionUpgradeMap}}", renderConnectionUpgradeMap(),
-		"{{OpenRestyDefaultServerBlock}}", renderDefaultServerBlock(cfg.DefaultServerReturnStatus),
+		"{{OpenRestyDefaultServerBlock}}", renderDefaultServerBlock(cfg.DefaultServerReturnStatus, cfg.HTTP3Enabled),
 		"{{OpenRestyAccessLogPath}}", AccessLogPlaceholder,
 		"{{OpenRestyErrorLogPath}}", ErrorLogPlaceholder,
 		"{{OpenRestyEventsUseDirective}}", renderTemplateDirective(cfg.EventsUse != "", fmt.Sprintf("use %s;", cfg.EventsUse)),
@@ -379,7 +379,13 @@ func renderHTTPRedirectServer(serverNames string) string {
 func renderHTTPSServer(serverNames string, siteName string, originURL string, originHost string, certificateID uint, customHeaders []CustomHeader, cacheConfig routeCacheConfig, limitConfig routeLimitConfig, upstreamConfig routeUpstreamConfig, powEnabled bool, basicAuthEnabled bool, basicAuthUsername string, basicAuthPassword string, cfg ConfigSnapshot) string {
 	certPath := fmt.Sprintf("%s/%d.crt", CertDirPlaceholder, certificateID)
 	keyPath := fmt.Sprintf("%s/%d.key", CertDirPlaceholder, certificateID)
-	return fmt.Sprintf("server {\n    listen 443 ssl;\n    http2 on;\n    server_name %s;\n    ssl_certificate %s;\n    ssl_certificate_key %s;\n%s%s    location / {\n%s%s%s%s%s    }\n%s}\n\n", serverNames, certPath, keyPath, renderAccessBlock(siteName, powEnabled), renderPowLocationBlocks(powEnabled), renderBasicAuthBlock(basicAuthEnabled, basicAuthUsername, basicAuthPassword), renderProxyHeaderBlock(originURL, originHost, customHeaders, upstreamConfig, cfg), renderRouteLimitBlock(limitConfig), renderRouteCacheBlock(cacheConfig, cfg), renderProxyPassBlock(originURL, upstreamConfig), renderPowStaticLocationBlock(powEnabled))
+	var h3Listen string
+	var h3Header string
+	if cfg.HTTP3Enabled {
+		h3Listen = "    listen 443 quic;\n"
+		h3Header = "    add_header Alt-Svc 'h3=\":443\"; ma=86400';\n"
+	}
+	return fmt.Sprintf("server {\n    listen 443 ssl;\n%s    http2 on;\n    server_name %s;\n    ssl_certificate %s;\n    ssl_certificate_key %s;\n%s%s%s    location / {\n%s%s%s%s%s    }\n%s}\n\n", h3Listen, serverNames, certPath, keyPath, h3Header, renderAccessBlock(siteName, powEnabled), renderPowLocationBlocks(powEnabled), renderBasicAuthBlock(basicAuthEnabled, basicAuthUsername, basicAuthPassword), renderProxyHeaderBlock(originURL, originHost, customHeaders, upstreamConfig, cfg), renderRouteLimitBlock(limitConfig), renderRouteCacheBlock(cacheConfig, cfg), renderProxyPassBlock(originURL, upstreamConfig), renderPowStaticLocationBlock(powEnabled))
 }
 
 func renderProxyHeaderBlock(originURL string, originHost string, customHeaders []CustomHeader, upstreamConfig routeUpstreamConfig, cfg ConfigSnapshot) string {
@@ -586,10 +592,14 @@ func renderConnectionUpgradeMap() string {
 	return "    map $http_upgrade $connection_upgrade {\n        default upgrade;\n        ''      \"\";\n    }\n\n"
 }
 
-func renderDefaultServerBlock(statusCode int) string {
+func renderDefaultServerBlock(statusCode int, http3Enabled bool) string {
 	if statusCode <= 0 {
 		statusCode = 421
 	}
+	var h3Default string
+	if http3Enabled {
+		h3Default = "\n        listen 443 quic reuseport default_server;"
+	}
 	return strings.Join([]string{
 		"    server {",
 		"        listen 80 default_server;",
@@ -599,7 +609,7 @@ func renderDefaultServerBlock(statusCode int) string {
 		"    }",
 		"",
 		"    server {",
-		"        listen 443 ssl default_server;",
+		fmt.Sprintf("        listen 443 ssl default_server;%s", h3Default),
 		"        server_name _;",
 		"",
 		"        ssl_reject_handshake on;",

openflare_server/utils/render/openresty/types.go

@@ -175,6 +175,7 @@ type ConfigSnapshot struct {
 	ProxySendTimeout          int    `json:"proxy_send_timeout"`
 	ProxyReadTimeout          int    `json:"proxy_read_timeout"`
 	WebsocketEnabled          bool   `json:"websocket_enabled"`
+	HTTP3Enabled              bool   `json:"http3_enabled"`
 	ProxyRequestBuffering     bool   `json:"proxy_request_buffering"`
 	ProxyBufferingEnabled     bool   `json:"proxy_buffering_enabled"`
 	ProxyBuffers              string `json:"proxy_buffers"`

openflare_server/web/features/performance/components/performance-page.tsx

@@ -48,6 +48,7 @@ const defaultPerformanceFields = {
   OpenRestyProxySendTimeout: '60',
   OpenRestyProxyReadTimeout: '60',
   OpenRestyWebsocketEnabled: true,
+  OpenRestyHTTP3Enabled: true,
   OpenRestyProxyRequestBufferingEnabled: false,
   OpenRestyProxyBufferingEnabled: true,
   OpenRestyProxyBuffers: '16 16k',
@@ -96,6 +97,7 @@ const performanceFieldTooltips: Record<string, string> = {
   proxy_read_timeout: '等待上游返回响应的超时时间，单位秒。',
   websocket:
     '控制是否为反向代理规则自动注入 WebSocket 升级所需的 HTTP/1.1、Upgrade 和 Connection 头。',
+  http3: '启用后，OpenResty 将在 443 端口启用 HTTP/3 (QUIC) 协议支持。',
   proxy_request_buffering:
     '控制请求体是否先在 Nginx 侧缓冲后再转发给上游，上传和流式场景经常会用到。',
   proxy_buffering:
@@ -233,6 +235,10 @@ export function PerformancePage() {
         optionMap.OpenRestyWebsocketEnabled,
         true,
       ),
+      OpenRestyHTTP3Enabled: toBoolean(
+        optionMap.OpenRestyHTTP3Enabled,
+        false,
+      ),
       OpenRestyProxyRequestBufferingEnabled: toBoolean(
         optionMap.OpenRestyProxyRequestBufferingEnabled,
         false,
@@ -450,6 +456,10 @@ export function PerformancePage() {
             'OpenRestyWebsocketEnabled',
             String(performanceFields.OpenRestyWebsocketEnabled),
           ],
+          [
+            'OpenRestyHTTP3Enabled',
+            String(performanceFields.OpenRestyHTTP3Enabled),
+          ],
           [
             'OpenRestyProxyRequestBufferingEnabled',
             String(performanceFields.OpenRestyProxyRequestBufferingEnabled),
@@ -1008,6 +1018,17 @@ export function PerformancePage() {
                     }))
                   }
                 />
+                <ToggleField
+                  label="http3"
+                  tooltip={performanceFieldTooltips.http3}
+                  checked={performanceFields.OpenRestyHTTP3Enabled}
+                  onChange={(checked) =>
+                    setPerformanceFields((previous) => ({
+                      ...previous,
+                      OpenRestyHTTP3Enabled: checked,
+                    }))
+                  }
+                />
                 <ToggleField
                   label="proxy_request_buffering"
                   tooltip={performanceFieldTooltips.proxy_request_buffering}