@specific.dev/spectest 0.93.1 → 0.95.0

package/src/harness/http-proxy.test.ts

@@ -6,6 +6,7 @@ import {
   forwardableHeaders,
   isCorsPreflight,
   isHopByHop,
+  upstreamRequestHeaders,
 } from "./http-proxy";
 
 describe("hop-by-hop headers", () => {
@@ -13,7 +14,7 @@ describe("hop-by-hop headers", () => {
     expect(isHopByHop("Connection")).toBe(true);
     expect(isHopByHop("TRANSFER-ENCODING")).toBe(true);
     expect(isHopByHop("upgrade")).toBe(true);
-    expect(isHopByHop("host")).toBe(true);
+    expect(isHopByHop("host")).toBe(false);
   });
 
   test("ordinary headers are forwardable", () => {
@@ -23,8 +24,7 @@ describe("hop-by-hop headers", () => {
   });
 
   /** Forwarding transfer-encoding from a re-encoded body produces a
-   *  response the client cannot frame; forwarding host would hide which
-   *  service the upstream actually is. */
+   *  response the client cannot frame. Host identifies the requested origin. */
   test("forwardableHeaders drops them and keeps the rest", () => {
     const h = new Headers({
       host: "app.test",
@@ -34,7 +34,7 @@ describe("hop-by-hop headers", () => {
       "content-type": "application/json",
     });
     const out = forwardableHeaders(h);
-    expect(out.get("host")).toBeNull();
+    expect(out.get("host")).toBe("app.test");
     expect(out.get("connection")).toBeNull();
     expect(out.get("transfer-encoding")).toBeNull();
     expect(out.get("authorization")).toBe("Bearer x");
@@ -49,6 +49,68 @@ describe("hop-by-hop headers", () => {
   });
 });
 
+describe("upstream request headers", () => {
+  test("preserves authority and stamps forwarding headers from the incoming request", () => {
+    const headers = upstreamRequestHeaders(new Headers({
+      host: "bucket.storage.test:8443",
+      "x-forwarded-host": "unrelated.test",
+      "x-forwarded-proto": "http",
+      "x-forwarded-for": "10.0.0.1",
+      authorization: "signed-request",
+    }), { proto: "https", clientIp: "10.0.0.2" });
+    expect(headers.get("host")).toBe("bucket.storage.test:8443");
+    expect(headers.get("x-forwarded-host")).toBe("bucket.storage.test:8443");
+    expect(headers.get("x-forwarded-proto")).toBe("https");
+    expect(headers.get("x-forwarded-for")).toBe("10.0.0.1, 10.0.0.2");
+    expect(headers.get("authorization")).toBe("signed-request");
+  });
+
+  test.each(["http", "https"])("%s ingress forwards Host to a separately addressed upstream", async (proto) => {
+    const upstream = Bun.serve({
+      port: 0, hostname: "127.0.0.1",
+      async fetch(req) {
+        const url = new URL(req.url);
+        return Response.json({
+          host: req.headers.get("host"),
+          forwardedHost: req.headers.get("x-forwarded-host"),
+          forwardedProto: req.headers.get("x-forwarded-proto"),
+          authorization: req.headers.get("authorization"),
+          method: req.method, path: url.pathname + url.search, body: await req.text(),
+        });
+      },
+    });
+    // Both listeners in the daemon speak HTTP; HTTPS reaches one through the
+    // TLS terminator, with proto supplied explicitly to the forwarding path.
+    const proxy = Bun.serve({
+      port: 0, hostname: "127.0.0.1",
+      fetch(req) {
+        const url = new URL(req.url);
+        const headers = upstreamRequestHeaders(req.headers, { proto });
+        return fetch(new Request(new URL(url.pathname + url.search, upstream.url), {
+          method: req.method, headers, body: req.body, redirect: "manual",
+        }));
+      },
+    });
+    try {
+      for (const host of ["storage.test", "bucket.storage.test:8443"]) {
+        const res = await fetch(new URL("/uploads/file?generation=7", proxy.url), {
+          method: "PUT", body: "contents",
+          headers: { host, authorization: "signed-request" },
+        });
+        expect(res.status).toBe(200);
+        expect(await res.json()).toEqual({
+          host, forwardedHost: host, forwardedProto: proto,
+          authorization: "signed-request", method: "PUT",
+          path: "/uploads/file?generation=7", body: "contents",
+        });
+      }
+    } finally {
+      proxy.stop(true);
+      upstream.stop(true);
+    }
+  });
+});
+
 describe("preflight detection", () => {
   const req = (method: string, headers: Record<string, string>) =>
     new Request("http://app.test/", { method, headers });

package/src/harness/http-proxy.ts

@@ -13,8 +13,7 @@
  * Forwarding `transfer-encoding` or `content-length` from a re-encoded
  * body is the classic way to produce a response the client cannot frame;
  * forwarding `connection` leaks our keep-alive intent to the upstream.
- * `host` is here because the proxy sets its own — the upstream must see
- * the service it actually is, not the public name the client asked for.
+ * `host` identifies the requested origin and must survive the proxy hop.
  */
 export const HOP_BY_HOP_HEADERS: ReadonlySet<string> = new Set([
   "connection",
@@ -25,7 +24,6 @@ export const HOP_BY_HOP_HEADERS: ReadonlySet<string> = new Set([
   "trailers",
   "transfer-encoding",
   "upgrade",
-  "host",
 ]);
 
 export function isHopByHop(name: string): boolean {
@@ -41,6 +39,24 @@ export function forwardableHeaders(headers: Headers): Headers {
   return out;
 }
 
+/** Preserve the requested Host (including its port) while dialing the service's
+ * internal address. HTTP and WebSocket forwarding share this policy. */
+export function upstreamRequestHeaders(
+  headers: Headers,
+  opts: { proto: string; clientIp?: string },
+): Headers {
+  const out = forwardableHeaders(headers);
+  const priorXff = headers.get("x-forwarded-for");
+  const xff = opts.clientIp
+    ? priorXff ? `${priorXff}, ${opts.clientIp}` : opts.clientIp
+    : priorXff;
+  if (xff) out.set("x-forwarded-for", xff);
+  out.set("x-forwarded-proto", opts.proto);
+  const host = headers.get("host");
+  if (host) out.set("x-forwarded-host", host);
+  return out;
+}
+
 /**
  * A CORS preflight is an `OPTIONS` carrying both `Origin` and
  * `Access-Control-Request-Method`. An `OPTIONS` without them is a normal

package/src/harness/http2-proxy.test.ts

@@ -0,0 +1,91 @@
+import { afterEach, expect, test } from "bun:test";
+import http2 from "node:http2";
+import { once } from "node:events";
+import { startHttp2Proxy } from "./http2-proxy";
+
+const cleanup: (() => void)[] = [];
+afterEach(() => { for (const close of cleanup.splice(0).reverse()) close(); });
+async function backend(handler: (stream: http2.ServerHttp2Stream, headers: http2.IncomingHttpHeaders) => void) {
+  const server = http2.createServer();
+  const sessions = new Set<http2.ServerHttp2Session>();
+  server.on("session", session => { sessions.add(session); session.on("error", () => {}); });
+  server.on("stream", (stream, headers) => { stream.on("error", () => {}); handler(stream, headers); });
+  server.listen(0, "127.0.0.1");
+  await once(server, "listening");
+  cleanup.push(() => { for (const session of sessions) session.destroy(); server.close(); });
+  return `http://127.0.0.1:${(server.address() as { port: number }).port}`;
+}
+async function frontend(routes: Map<string, string>) {
+  const proxy = await startHttp2Proxy({ upstreamFor: async host => routes.get(host), clientIpFor: () => "10.0.0.2" });
+  cleanup.push(() => proxy.close());
+  const session = http2.connect(`http://127.0.0.1:${proxy.port}`);
+  session.on("error", () => {});
+  cleanup.push(() => session.destroy());
+  return session;
+}
+async function request(session: http2.ClientHttp2Session, authority: string) {
+  const stream = session.request({ ":authority": authority, ":path": "/rpc" });
+  let text = "";
+  stream.setEncoding("utf8"); stream.on("data", chunk => { text += chunk; });
+  const [headers] = await once(stream, "response");
+  await once(stream, "end");
+  return { text, headers };
+}
+
+test("routes each HTTP/2 authority, including routes added to an existing connection", async () => {
+  const a = await backend(s => { s.respond(); s.end("a"); });
+  const b = await backend(s => { s.respond(); s.end("b"); });
+  const routes = new Map([["a.test", a]]);
+  const client = await frontend(routes);
+  expect((await request(client, "a.test")).text).toBe("a");
+  routes.set("b.test", b);
+  expect((await request(client, "b.test:443")).text).toBe("b");
+  expect((await request(client, "missing.test")).headers[":status"]).toBe(421);
+});
+
+test("streams both directions before request end and forwards request/response trailers", async () => {
+  let upstreamHeaders: http2.IncomingHttpHeaders | undefined;
+  let requestTrailers: http2.IncomingHttpHeaders | undefined;
+  const url = await backend((s, h) => {
+    upstreamHeaders = h;
+    s.respond({ ":status": 200, "content-type": "application/grpc", "metadata-bin": "AQID" }, { waitForTrailers: true });
+    s.on("trailers", t => { requestTrailers = t; });
+    s.on("data", data => s.write(data));
+    s.on("end", () => s.end());
+    s.on("wantTrailers", () => s.sendTrailers({ "grpc-status": "7", "grpc-message": "Permission%20denied" }));
+  });
+  const client = await frontend(new Map([["grpc.test", url]]));
+  const stream = client.request({ ":authority": "grpc.test", ":path": "/package.Service/Call", ":method": "POST", "content-type": "application/grpc", te: "trailers" }, { waitForTrailers: true });
+  stream.on("wantTrailers", () => stream.sendTrailers({ "request-trailer": "preserved" }));
+  const response = once(stream, "response");
+  const first = once(stream, "data");
+  stream.write(Buffer.from([0, 0, 0, 0, 3, 0, 128, 255]));
+  expect((await first)[0]).toEqual(Buffer.from([0, 0, 0, 0, 3, 0, 128, 255]));
+  const trailers = once(stream, "trailers");
+  stream.end();
+  expect((await trailers)[0]["grpc-status"]).toBe("7");
+  expect((await response)[0]["metadata-bin"]).toBe("AQID");
+  expect(requestTrailers?.["request-trailer"]).toBe("preserved");
+  expect(upstreamHeaders?.[":authority"]).toBe("grpc.test");
+  expect(upstreamHeaders?.["x-forwarded-proto"]).toBe("https");
+  expect(upstreamHeaders?.["x-forwarded-for"]).toBe("10.0.0.2");
+});
+
+test("client cancellation reaches upstream without breaking another multiplexed RPC", async () => {
+  let cancelled!: Promise<unknown[]>;
+  const url = await backend((s, h) => {
+    if (h[":path"] === "/cancel") { cancelled = once(s, "aborted"); s.respond(); s.write("ready"); }
+    else { s.respond(); s.end("healthy"); }
+  });
+  const client = await frontend(new Map([["grpc.test", url]]));
+  const stream = client.request({ ":authority": "grpc.test", ":path": "/cancel" });
+  await once(stream, "data");
+  stream.close(http2.constants.NGHTTP2_CANCEL);
+  await cancelled;
+  expect((await request(client, "grpc.test")).text).toBe("healthy");
+});
+
+test("an unavailable upstream produces a bounded error response", async () => {
+  const client = await frontend(new Map([["grpc.test", "http://127.0.0.1:1"]]));
+  expect((await request(client, "grpc.test")).headers[":status"]).toBe(502);
+});

package/src/harness/http2-proxy.ts

@@ -0,0 +1,96 @@
+import http2, { type IncomingHttpHeaders, type OutgoingHttpHeaders, type ServerHttp2Stream } from "node:http2";
+import { isHopByHop } from "./http-proxy";
+import { hostWithoutPort } from "./hostmatch";
+
+export interface Http2ProxyOptions {
+  /** Resolve each stream independently; one connection can carry multiple authorities. */
+  upstreamFor(hostname: string): Promise<string | undefined>;
+  clientIpFor?(port: number | undefined): string | undefined;
+}
+
+function headersForHop(headers: IncomingHttpHeaders, pseudo: boolean): OutgoingHttpHeaders {
+  const result: OutgoingHttpHeaders = {};
+  for (const [name, value] of Object.entries(headers)) {
+    if ((!pseudo && name.startsWith(":")) || (isHopByHop(name) && !(name === "te" && value === "trailers"))) continue;
+    result[name] = value;
+  }
+  return result;
+}
+
+/** A stream proxy rather than fetch: gRPC depends on duplex bodies and trailers. */
+export async function startHttp2Proxy(options: Http2ProxyOptions) {
+  const server = http2.createServer();
+  const sessions = new Set<http2.Http2Session>();
+  const track = (session: http2.Http2Session) => {
+    sessions.add(session);
+    session.on("error", () => {});
+    session.once("close", () => sessions.delete(session));
+  };
+  server.on("session", track);
+  server.on("stream", (downstream: ServerHttp2Stream, headers) => {
+    downstream.on("error", () => {});
+    void forward(downstream, headers).catch(() => {
+      if (downstream.destroyed || downstream.closed) return;
+      if (downstream.headersSent) downstream.close(http2.constants.NGHTTP2_INTERNAL_ERROR);
+      else { downstream.respond({ ":status": 502 }); downstream.end("HTTP/2 upstream unavailable"); }
+    });
+  });
+
+  async function forward(downstream: ServerHttp2Stream, headers: IncomingHttpHeaders) {
+    const authority = String(headers[":authority"] ?? "");
+    const upstreamUrl = await options.upstreamFor(hostWithoutPort(authority.toLowerCase()));
+    if (downstream.destroyed || downstream.closed) return;
+    if (!upstreamUrl) {
+      // A coalesced connection must not silently route an authority to its SNI backend.
+      downstream.respond({ ":status": 421 });
+      downstream.end("No HTTP/2 route for this authority");
+      return;
+    }
+    const session = http2.connect(upstreamUrl);
+    track(session);
+    let requestTrailers: OutgoingHttpHeaders = {};
+    let responseTrailers: OutgoingHttpHeaders = {};
+    const requestHeaders = headersForHop(headers, true);
+    requestHeaders[":scheme"] = "http";
+    requestHeaders["x-forwarded-proto"] = "https";
+    requestHeaders["x-forwarded-host"] = authority;
+    const clientIp = options.clientIpFor?.(downstream.session?.socket.remotePort);
+    if (clientIp) requestHeaders["x-forwarded-for"] = [headers["x-forwarded-for"], clientIp].filter(Boolean).join(", ");
+    let upstream: http2.ClientHttp2Stream;
+    try { upstream = session.request(requestHeaders, { endStream: false, waitForTrailers: true }); }
+    catch (error) { session.destroy(); throw error; }
+    const fail = () => {
+      if (!downstream.closed && !downstream.destroyed) {
+        if (downstream.headersSent) downstream.close(http2.constants.NGHTTP2_INTERNAL_ERROR);
+        else { downstream.respond({ ":status": 502 }); downstream.end("HTTP/2 upstream unavailable"); }
+      }
+      session.destroy();
+    };
+    session.on("error", fail);
+    upstream.on("error", fail);
+    downstream.on("trailers", trailers => { requestTrailers = headersForHop(trailers, false); });
+    upstream.on("wantTrailers", () => { if (!upstream.destroyed && !upstream.closed) upstream.sendTrailers(requestTrailers); });
+    upstream.on("trailers", trailers => { responseTrailers = headersForHop(trailers, false); });
+    downstream.on("wantTrailers", () => {
+      if (!downstream.destroyed && !downstream.closed) downstream.sendTrailers(responseTrailers);
+    });
+    upstream.on("response", response => {
+      if (downstream.destroyed || downstream.closed) return;
+      downstream.respond(headersForHop(response, true), { waitForTrailers: true });
+      upstream.pipe(downstream);
+    });
+    downstream.on("aborted", () => upstream.close(downstream.rstCode || http2.constants.NGHTTP2_CANCEL));
+    upstream.on("aborted", () => { if (!downstream.closed) downstream.close(upstream.rstCode || http2.constants.NGHTTP2_CANCEL); });
+    downstream.once("close", () => session.destroy());
+    downstream.pipe(upstream);
+  }
+
+  await new Promise<void>((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => { server.removeListener("error", reject); resolve(); });
+  });
+  return {
+    port: (server.address() as { port: number }).port,
+    close() { for (const session of sessions) session.destroy(); server.close(); },
+  };
+}

package/src/harness/ingress-table.ts

@@ -53,7 +53,7 @@ import { certCovers, isWildcard, wildcardSuffix } from "./hostmatch";
  */
 export type Route<F = unknown> =
   | { kind: "fake"; fake: F }
-  | { kind: "proxy"; service: string; port: number };
+  | { kind: "proxy"; service: string; port: number; http2?: boolean };
 
 /** A PEM leaf + key, as handed to `Bun.serve`'s TLS config. */
 export interface Leaf {
@@ -70,7 +70,7 @@ export interface Leaf {
 export interface IngressTables<F = unknown> {
   /** Listen port → (hostname → route). Values are mutated in place. */
   routesByPort: Map<number, Map<string, Route<F>>>;
-  /** SNI server name → leaf. Adding to this is what forces a rebind. */
+  /** SNI server name → leaf. Read live by the TLS terminator without rebinding. */
   certByHost: Map<string, Leaf>;
 }
 

package/src/harness/tls-terminator.test.ts

@@ -18,6 +18,9 @@ import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test
 import { spawnSync } from "node:child_process";
 import { mkdtempSync, readFileSync, rmSync } from "node:fs";
 import net from "node:net";
+import http2 from "node:http2";
+import { once } from "node:events";
+import { startHttp2Proxy } from "./http2-proxy";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import tls from "node:tls";
@@ -238,3 +241,29 @@ describe("the pipe", () => {
     expect(term.connectionCount()).toBe(0);
   });
 });
+
+
+test("ALPN selects HTTP/2 only for opted-in routes and keeps HTTP/1.1 working", async () => {
+  const backend = http2.createServer();
+  const sessions = new Set<http2.Http2Session>();
+  backend.on("session", s => { sessions.add(s); s.on("error", () => {}); });
+  backend.on("stream", (s: http2.ServerHttp2Stream) => { s.respond({ ":status": 200 }); s.end("grpc backend"); });
+  backend.listen(0, "127.0.0.1");
+  await once(backend, "listening");
+  const h2 = await startHttp2Proxy({ upstreamFor: async () => `http://127.0.0.1:${(backend.address() as net.AddressInfo).port}` });
+  const optedIn = new Set(["app.test"]);
+  const terminator = await startTlsTerminator({ port: 0, hostname: "127.0.0.1", upstreamPort: plain.port,
+    http2Port: h2.port, supportsHttp2: name => optedIn.has(name), certFor: name => leaves.get(name ?? "app.test") });
+  const client = http2.connect(`https://127.0.0.1:${terminator.port}`, { servername: "app.test", ca: caPem });
+  try {
+    const stream = client.request({ ":authority": "app.test", ":path": "/" });
+    stream.setEncoding("utf8"); let body = ""; stream.on("data", chunk => { body += chunk; });
+    await once(stream, "end");
+    expect(client.alpnProtocol).toBe("h2"); expect(body).toBe("grpc backend");
+    const socket = tls.connect({ host: "127.0.0.1", port: terminator.port, servername: "late.test", ca: caPem, ALPNProtocols: ["h2", "http/1.1"] });
+    try { await once(socket, "secureConnect"); expect(socket.alpnProtocol).toBe("http/1.1"); } finally { socket.destroy(); }
+    optedIn.add("late.test");
+    const late = tls.connect({ host: "127.0.0.1", port: terminator.port, servername: "late.test", ca: caPem, ALPNProtocols: ["h2", "http/1.1"] });
+    try { await once(late, "secureConnect"); expect(late.alpnProtocol).toBe("h2"); } finally { late.destroy(); }
+  } finally { client.destroy(); terminator.close(); h2.close(); for (const s of sessions) s.destroy(); backend.close(); }
+});

package/src/harness/tls-terminator.ts

@@ -34,7 +34,8 @@
  *
  * The terminator does TLS and *nothing else*: it accepts on :443, picks a
  * leaf by SNI, and pipes the decrypted stream to a plaintext `Bun.serve`
- * bound on loopback. Everything downstream — routing, fakes,
+ * bound on loopback. Opted-in HTTP/2 routes select a separate stream router
+ * by ALPN; HTTP/1.1 and WebSockets retain the existing listener. Everything downstream — routing, fakes,
  * interceptors, reverse-proxying, and `server.upgrade()` WebSocket
  * bridging — is the same `Bun.serve` code that already serves :80, run
  * unchanged. Terminating HTTP here instead (`node:https`, `(req, res)`)
@@ -69,6 +70,9 @@ export interface TlsTerminatorOptions {
   hostname: string;
   /** Loopback port of the plaintext ingress server to pipe into. */
   upstreamPort: number;
+  /** Loopback HTTP/2 router, selected only for an opted-in SNI hostname. */
+  http2Port?: number;
+  supportsHttp2?(serverName: string): boolean;
   /**
    * The leaf to serve for an SNI server name, read live on every
    * handshake — this is what lets a certificate be added with no restart.
@@ -153,6 +157,9 @@ export function startTlsTerminator(opts: TlsTerminatorOptions): Promise<TlsTermi
   const server = tls.createServer(
     {
       ...(fallback ? { cert: fallback.cert, key: fallback.key } : {}),
+      ...(opts.http2Port ? { ALPNCallback: ({ servername, protocols }: { servername: string; protocols: string[] }) =>
+        protocols.includes("h2") && opts.supportsHttp2?.(servername) ? "h2"
+          : protocols.includes("http/1.1") ? "http/1.1" : undefined } : {}),
       SNICallback: (serverName, cb) => {
         const leaf = opts.certFor(serverName) ?? fallback;
         // No certificate at all is a handshake we cannot complete. Answer
@@ -175,7 +182,8 @@ export function startTlsTerminator(opts: TlsTerminatorOptions): Promise<TlsTermi
       // its bytes are buffered rather than dropped — which is the normal
       // case, since a client sends its first request the instant the
       // handshake completes.
-      const upstream = net.connect(opts.upstreamPort, "127.0.0.1");
+      const upstreamPort = client.alpnProtocol === "h2" ? opts.http2Port! : opts.upstreamPort;
+      const upstream = net.connect(upstreamPort, "127.0.0.1");
       upstream.setTimeout(0);
       upstream.setNoDelay(true);
       client.setNoDelay(true);
@@ -204,7 +212,7 @@ export function startTlsTerminator(opts: TlsTerminatorOptions): Promise<TlsTermi
         teardown();
       });
       upstream.on("error", (err) => {
-        warn(`ingress upstream :${opts.upstreamPort} failed`, err);
+        warn(`ingress upstream :${upstreamPort} failed`, err);
         teardown();
       });
       client.on("close", teardown);
@@ -224,7 +232,7 @@ export function startTlsTerminator(opts: TlsTerminatorOptions): Promise<TlsTermi
     server.listen(opts.port, opts.hostname, () => {
       server.removeListener("error", reject);
       resolve({
-        port: opts.port,
+        port: (server.address() as net.AddressInfo).port,
         clientIpFor: (upstreamPort) =>
           upstreamPort === undefined ? undefined : clientIpByUpstreamPort.get(upstreamPort),
         connectionCount: () => live.size,

package/src/harness/ws-bridge.test.ts

@@ -20,7 +20,7 @@ describe("parseSubprotocols", () => {
 describe("upstreamHandshakeHeaders", () => {
   test("forwards cookies and origin, drops the client's handshake fields, stamps provenance", () => {
     const req = new Headers({
-      host: "api.prod.specific.dev",
+      host: "api.prod.specific.dev:8443",
       connection: "Upgrade",
       upgrade: "websocket",
       "sec-websocket-key": "abc==",
@@ -32,16 +32,14 @@ describe("upstreamHandshakeHeaders", () => {
       authorization: "Bearer t",
     });
     const out = upstreamHandshakeHeaders(req, {
-      service: "api",
-      port: 4000,
       proto: "https",
       clientIp: "10.0.0.7",
     });
     expect(out["cookie"]).toBe("sid=1");
     expect(out["origin"]).toBe("https://app.test");
     expect(out["authorization"]).toBe("Bearer t");
-    expect(out["host"]).toBe("api:4000");
-    expect(out["x-forwarded-host"]).toBe("api.prod.specific.dev");
+    expect(out["host"]).toBe("api.prod.specific.dev:8443");
+    expect(out["x-forwarded-host"]).toBe("api.prod.specific.dev:8443");
     expect(out["x-forwarded-proto"]).toBe("https");
     expect(out["x-forwarded-for"]).toBe("10.0.0.7");
     for (const k of Object.keys(out)) {
@@ -52,8 +50,6 @@ describe("upstreamHandshakeHeaders", () => {
 
   test("appends the client to an existing x-forwarded-for", () => {
     const out = upstreamHandshakeHeaders(new Headers({ "x-forwarded-for": "1.2.3.4" }), {
-      service: "api",
-      port: 1,
       proto: "http",
       clientIp: "10.0.0.7",
     });
@@ -71,7 +67,7 @@ describe("the bridge on loopback", () => {
   let upstream: ReturnType<typeof Bun.serve>;
   let bridge: ReturnType<typeof Bun.serve>;
   /** What the upstream saw on its last handshake. */
-  let seen: { protocols: string[]; cookie: string | null; xfh: string | null } | null = null;
+  let seen: { protocols: string[]; cookie: string | null; host: string | null; xfh: string | null } | null = null;
 
   beforeAll(() => {
     upstream = Bun.serve({
@@ -81,6 +77,7 @@ describe("the bridge on loopback", () => {
         seen = {
           protocols,
           cookie: req.headers.get("cookie"),
+          host: req.headers.get("host"),
           xfh: req.headers.get("x-forwarded-host"),
         };
         if (protocols[1] !== "ticket-ok") return new Response("Unauthorized", { status: 401 });
@@ -110,8 +107,6 @@ describe("the bridge on loopback", () => {
       async fetch(req, server) {
         const protocols = parseSubprotocols(req.headers.get("sec-websocket-protocol"));
         const headers = upstreamHandshakeHeaders(req.headers, {
-          service: "api",
-          port: upstream.port!,
           proto: "https",
         });
         const url = new URL(req.url);
@@ -153,7 +148,7 @@ describe("the bridge on loopback", () => {
     ) => WebSocket;
     const ws = new Ctor(`ws://127.0.0.1:${bridge.port}/console?x=1`, {
       protocols,
-      headers: { cookie: "sid=abc", host: "api.prod.specific.dev" },
+      headers: { cookie: "sid=abc", host: "api.prod.specific.dev:8443" },
     });
     ws.binaryType = "arraybuffer";
     const events: Array<{ kind: "open" | "message" | "close" | "error"; value?: unknown }> = [];
@@ -180,7 +175,8 @@ describe("the bridge on loopback", () => {
     expect(seen).toEqual({
       protocols: ["console", "ticket-ok"],
       cookie: "sid=abc",
-      xfh: "api.prod.specific.dev",
+      host: "api.prod.specific.dev:8443",
+      xfh: "api.prod.specific.dev:8443",
     });
     await Bun.sleep(20);
     ws.send("hi");

package/src/harness/ws-bridge.ts

@@ -20,7 +20,7 @@
  * without a VM.
  */
 
-import { forwardableHeaders } from "./http-proxy.js";
+import { upstreamRequestHeaders } from "./http-proxy.js";
 
 /** Headers that belong to the client's own WebSocket handshake. Bun's
  *  WebSocket client mints its own key and version, and the protocol list
@@ -56,33 +56,20 @@ export function parseSubprotocols(header: string | null | undefined): string[] {
  * The headers the upstream handshake carries: everything forwardable from
  * the client's request (cookies, authorization, origin, user-agent …),
  * minus the client's own handshake fields, plus the proxy provenance
- * headers and a Host that names the service.
+ * headers and the original Host.
  */
 export function upstreamHandshakeHeaders(
   req: Headers,
   opts: {
-    service: string;
-    port: number;
     proto: string;
     clientIp?: string;
   },
 ): Record<string, string> {
   const out: Record<string, string> = {};
-  forwardableHeaders(req).forEach((value, key) => {
+  upstreamRequestHeaders(req, opts).forEach((value, key) => {
     if (HANDSHAKE_HEADERS.has(key)) return;
     out[key] = value;
   });
-  const priorXff = req.get("x-forwarded-for");
-  const xff = opts.clientIp
-    ? priorXff
-      ? `${priorXff}, ${opts.clientIp}`
-      : opts.clientIp
-    : priorXff;
-  if (xff) out["x-forwarded-for"] = xff;
-  out["x-forwarded-proto"] = opts.proto;
-  const publicHost = req.get("host");
-  if (publicHost) out["x-forwarded-host"] = publicHost;
-  out["host"] = `${opts.service}:${opts.port}`;
   return out;
 }
 

package/src/index.ts

@@ -1161,6 +1161,9 @@ export interface ServiceTls {
   /** HTTP port the service listens on inside its container. The
    * daemon forwards proxied requests here over `spectest-net`. */
   port: number;
+  /** Accept HTTP/2 over TLS and forward it as plaintext HTTP/2 (h2c).
+   * Required for gRPC. HTTP/1.1 continues to use the existing HTTP proxy. */
+  http2?: boolean;
 }
 
 /** @internal Normalized wire representation; legacy definitions remain accepted. */
@@ -1661,6 +1664,7 @@ function validateEnvironmentConfig<S extends ServicesMap>(
           `service "${name}" tls entry must be { hostname: string, port: number }; got ${JSON.stringify(entry)}`,
         );
       }
+      if (entry.http2 !== undefined && typeof entry.http2 !== "boolean") throw new Error(`service "${name}" tls http2 must be a boolean`);
       const h = entry.hostname.toLowerCase();
       if (!HOSTNAME_RE.test(hostPatternBody(h))) {
         throw new Error(

package/src/ingress.ts

@@ -40,7 +40,7 @@ export interface DnsDecl {
 export interface ProxyDecl {
   kind: "proxy";
   hostname: string;
-  upstream: { service: string; port: number };
+  upstream: { service: string; port: number; http2?: boolean };
 }
 
 export type IngressDecl = CertificateDecl | DnsDecl | ProxyDecl;
@@ -137,7 +137,7 @@ export function dnsName(hostname: string, target: DnsTarget): DnsDecl {
  */
 export function proxy(
   hostname: string,
-  upstream: { service: string; port: number },
+  upstream: { service: string; port: number; http2?: boolean },
 ): ProxyDecl {
   assertNameOrWildcard(hostname, "proxy()");
   if (!upstream || typeof upstream.service !== "string" || typeof upstream.port !== "number") {
@@ -145,6 +145,7 @@ export function proxy(
       `proxy(${JSON.stringify(hostname)}): upstream must be { service: string, port: number }`,
     );
   }
+  if (upstream.http2 !== undefined && typeof upstream.http2 !== "boolean") throw new Error("proxy(): http2 must be a boolean");
   return { kind: "proxy", hostname: hostname.toLowerCase(), upstream };
 }
 
@@ -197,7 +198,7 @@ export interface LoweredIngress {
   /** One leaf cert per group; SANs = the group's hostnames. */
   certificates: { hostnames: string[] }[];
   /** Reverse-proxy routes: hostname → upstream service:port. */
-  proxies: { hostname: string; service: string; port: number }[];
+  proxies: { hostname: string; service: string; port: number; http2?: boolean }[];
   /** Hostnames that resolve to the daemon ingress gateway (DNS registry
    *  + `--add-host` on every container). Covers fakes, TLS proxies, and
    *  any `dnsName(h, { ingress: true })`. */
@@ -226,7 +227,7 @@ function resolveSelf(service: string, selfKey: string): string {
  */
 export function lowerIngress(project: Project): LoweredIngress {
   const certificates: { hostnames: string[] }[] = [];
-  const proxies: { hostname: string; service: string; port: number }[] = [];
+  const proxies: { hostname: string; service: string; port: number; http2?: boolean }[] = [];
   const ingressSet = new Set<string>();
   const aliasesByService: Record<string, string[]> = {};
   const wildcards: { pattern: string; target: DnsTarget }[] = [];
@@ -241,7 +242,7 @@ export function lowerIngress(project: Project): LoweredIngress {
         break;
       case "proxy": {
         const service = resolveSelf(decl.upstream.service, selfKey);
-        proxies.push({ hostname: decl.hostname, service, port: decl.upstream.port });
+        proxies.push({ hostname: decl.hostname, service, port: decl.upstream.port, ...(decl.upstream.http2 ? { http2: true } : {}) });
         // A proxied hostname must route to the daemon. A wildcard one can
         // only be answered by the resolver (there is no `--add-host` for a
         // pattern), so it goes in the wildcard table pointed at the ingress.
@@ -278,7 +279,7 @@ export function lowerIngress(project: Project): LoweredIngress {
     // `tls: [{ hostname, port }]` → cert + TLS-terminated reverse proxy.
     for (const entry of (svc as ServiceConfig).tls ?? []) {
       applyDecl(certificate([entry.hostname]), name);
-      applyDecl(proxy(entry.hostname, { service: name, port: entry.port }), name);
+      applyDecl(proxy(entry.hostname, { service: name, port: entry.port, ...(entry.http2 ? { http2: true } : {}) }), name);
     }
     // `hostnames: [h]` → plain peer alias (no daemon hop).
     for (const h of (svc as ServiceConfig).hostnames ?? []) {