httpjet

An experimental Linux web server written in Rust: it reads LiteSpeed-compatible XML, speaks LSAPI to lsphp, and serves HTTP/1.1, HTTP/2, and HTTP/3 with TLS, static files, proxying, rewrites, compression, and an opt-in page cache.

Production note. httpjet is early-stage software built around one production configuration. It powers WindowsForum.com in production. Test on alternate ports before using it elsewhere. Learn more — or at least enjoy the animation — at httpjet.net.

Contents

• Features at a glance
• Build and try it
• Configuration
• Capability limits
• Operations
• Development
• Security and contributing
• License

Features at a glance

Verified against the crate layout and the httpjet binary's argument definitions in crates/httpjet/src/main.rs:

Area	What is implemented
Protocols	HTTP/1.1, native HTTP/2, HTTP/3 (QUIC), TLS/mTLS
PHP	LSAPI to lsphp, with an optional standalone supervised pool (httpjet lsphp, httpjet lsphp-reload)
Content	Static files, reverse proxy with WebSocket and SSE forwarding
Rewrites	Apache mod_rewrite / .htaccess subset, including a limited mod_headers subset
Compression	Response zstd, Brotli, and gzip; gzip request decompression by default, Brotli/zstd opt-in via --request-decompression-extra
Caching	Opt-in LSCache-equivalent full-page cache (--page-cache, off by default); short-TTL origin (microcache) caching
Access control	LiteSpeed-compatible IP allow/deny, plus GeoIP/ASN sources loaded offline
Operations	Loopback Prometheus metrics (--metrics-addr, default 127.0.0.1:9090), optional loopback admin and WAF-sidecar endpoints, access/error logging

The httpjet binary is under crates/httpjet; reusable components are the hj-* crates (hj-config, hj-lsapi, hj-h2, hj-pagecache, hj-proxy, hj-rewrite, hj-tls, and others). Optional Cargo features are off by default: acme, ocsp, otel, profiling, allocount, and the staged ktls.

Build and try it

Requires Linux with io_uring and Rust 1.99.1 or newer (the workspace rust-version).

git clone https://github.com/faratech/httpjet.git
cd httpjet
cargo build --release -p httpjet
target/release/httpjet --root "$PWD/examples/litespeed" check --strict
target/release/httpjet --root "$PWD/examples/litespeed" serve \
  --http-addr 127.0.0.1:8080 --https-addr "" --workers 1 --no-php
curl -H 'Host: example.test' http://127.0.0.1:8080/

Use --root with an existing LiteSpeed configuration tree (default /usr/local/lsws). With no subcommand, httpjet runs check. Run httpjet serve --help for runtime options.

Configuration

httpjet reads a LiteSpeed configuration tree: conf/httpd_config.xml under the server root, plus one XML file per virtual host. Start from the bundled, synthetic quick-start fixture:

• examples/litespeed/conf/httpd_config.xml — server, tuning, listener, and vhost map
• examples/litespeed/conf/vhosts/example.test.xml — per-vhost document root and rewrite settings
• examples/litespeed/example/public/index.html — the page the quick start serves

Validate any tree before serving it:

target/release/httpjet --root /path/to/litespeed check --strict

Treat check --strict warnings as review items, not as proof of LiteSpeed parity (see Capability limits).

Capability limits

Compatibility covers only the implemented and tested directive and protocol surface:

• LiteSpeed XML is the configuration format; directives outside the implemented subset do not behave as they would under LiteSpeed.
• .htaccess response-header operations are intentionally a subset of Apache mod_headers; unsupported forms are ignored rather than emulated.
• Request decompression is bounded: gzip keeps its existing default behavior, while Brotli and zstd uploads are opt-in (--request-decompression-extra) under a transport-independent policy.
• Short-TTL origin caching works today; reusable route-policy controls for microcache are not yet exposed.
• The page cache is opt-in and additionally gated per vhost and per response; it is inert unless enabled.
• FastCGI primitives exist (hj-fastcgi) but are deliberately not wired into request routing yet.

Operations

• OCI / containers: a hardened, non-root OCI example documents the required writable mounts, separate TCP/UDP publication for HTTP/3, io_uring runtime requirements, and its non-privileged smoke gate. It is an adoption example, not the production deployment model.
• systemd: unit examples and install steps are in packaging/systemd/README.md.
• ACME (optional): certificate automation is available with --features acme and explicit runtime opt-in (HTTP-01 and DNS-01/wildcard). It is disabled by default and does not replace existing certbot configuration automatically.
• OCSP stapling (optional): available with --features ocsp and an explicit responder URL. It is for compatible certificate authorities, not current Let's Encrypt certificates (whose issuer retired OCSP).
• Fuzzing: targets and the continuous corpus checks are described in fuzz/README.md.

Development

cargo fmt --all --check
cargo check -p httpjet --bin httpjet
cargo test --workspace

Security and contributing

See CONTRIBUTING.md (focused changes, regression tests, signed commits), SECURITY.md (private vulnerability reporting and the production trust boundary), and THIRD_PARTY_NOTICES.md.

Donations support maintenance only; they do not buy features or influence. Funding links will appear in GitHub's Sponsor button when enabled.

License

httpjet is GPL-3.0-only, with no paid edition or license key. It is independent of and not endorsed by LiteSpeed Technologies.