Hedge

Hedge is a lightweight production web server written in Mach.

Hedge is the deployable product in the Mach web stack. It serves static files, Mach web applications, and upstream services over HTTP/1.1, HTTP/2, and HTTP/3 with native Mach TLS and QUIC.

Hedge serves HTTP/1.1 and HTTP/2 over TLS 1.3, with SNI, ALPN, session resumption and client certificates. It does not offer TLS 1.2, and refuses a TLS 1.2 client. A transport = "quic" listener serves HTTP/3, with ALPN inside QUIC selecting h3. The interoperability matrix in test/interop qualifies these against curl, OpenSSL and GnuTLS, and HTTP/3 against curl over ngtcp2, including request bodies, large responses and prompt shutdown. The matrix runs one client at a time. Static files, reverse proxying, bounded caches, virtual host dispatch, and ACME over authenticated TLS are implemented. A certificate that ACME issues or renews is installed into the running listener, and connections already open keep the certificate they started with. The live ACME suite reaches Let's Encrypt's staging directory over TLS verified against the system trust store on every pull request. Issuing a certificate from Let's Encrypt's production directory has not been run yet.

Hedge serves from one worker thread per CPU, but a QUIC listener is served by the first worker alone. That worker's QUIC receive path drops datagrams past about 10,000 a second, which 10,000 connections sending one keep-alive a second reach. A transport = "local" listener is served like a TCP one: the first worker accepts and hands each connection to the least loaded worker, and no load lane measures that handoff yet. The comparison against Caddy in doc/bench measured hedge 0.2.1, before the TLS handshake cost fell from about half a second of CPU to milliseconds and before serving moved to a worker per CPU. It has not been run since, so it does not describe hedge under load today.

Product goals

• direct public internet operation without a C runtime protocol dependency
• HTTP/1.1, HTTP/2, and HTTP/3
• TLS 1.2 and TLS 1.3 with SNI, ALPN, resumption, and certificate rotation
• IPv4, IPv6, TCP, Unix sockets where available, and QUIC
• static files, reverse proxying, load balancing, caching, and Mach handlers
• automatic ACME certificate management
• graceful configuration reload and connection draining
• strict resource bounds and hostile-input handling
• structured logs, metrics, traces, health, and readiness
• native Linux, Darwin, and Windows operation (Windows builds today, but its tests do not pass there yet, so it is not supported at runtime)
• small idle footprint and pay-for-what-is-enabled composition

Lightweight does not mean omitting production duties. It means that protocol engines, storage, observability, and optional services are independent components with explicit ownership and no mandatory framework runtime.

Repository family

• mach-std provides portable operating-system and runtime foundations.
• mach-crypto provides cryptographic algorithms over Mach constant-time primitives.
• mach-tls provides TLS and certificate machinery.
• mach-http provides HTTP semantics and connection engines.
• mach-quic provides QUIC transport and recovery.
• mach-acme provides certificate issuance and renewal.
• hedge assembles those libraries into an operated server.
• Laurel provides the production web application framework, hosted in hedge through graft.

See Project boundaries and Architecture for the dependency contracts.

Try it

• Demos are three configurations that run as they are: a static site, the same site over TLS with HTTP/2 and HTTP/3, and a reverse proxy. Each takes about a minute.
• Benchmarks measure hedge under load beside Caddy, with published results and a script that reproduces them.

Documentation

• Architecture
• Hosting applications
• Project boundaries
• Roadmap
• Production requirements
• Security model
• Configuration model
• Required mach-std work
• Validation strategy

Local development

Each dependency is selected by an exact released version, and the resolved release is committed as a gitlink under dep/.

mach dep pull
mach test . --all
mach build .

mach test . --all selects every artifact, so it also runs the tests artifact's test-only modules the executable never reaches.

CI runs mach test . --all on every pull request. The load, fuzz and live ACME suites run locally from test/.

Build output uses Mach's default out/ directory.