feat(rustproxy-http): add HTTP/2 auto-detection via ALPN with TTL-backed protocol cache and h1-only/h2 ALPN client configs

rust/crates/rustproxy-passthrough/src/tcp_listener.rs

@@ -174,6 +174,7 @@ impl TcpListenerManager {
             std::time::Duration::from_millis(conn_config.connection_timeout_ms),
         );
         http_proxy_svc.set_backend_tls_config(tls_handler::shared_backend_tls_config());
+        http_proxy_svc.set_backend_tls_config_alpn(tls_handler::shared_backend_tls_config_alpn());
         http_proxy_svc.set_connection_timeouts(
             std::time::Duration::from_millis(conn_config.socket_timeout_ms),
             std::time::Duration::from_millis(conn_config.socket_timeout_ms),
@@ -209,6 +210,7 @@ impl TcpListenerManager {
             std::time::Duration::from_millis(conn_config.connection_timeout_ms),
         );
         http_proxy_svc.set_backend_tls_config(tls_handler::shared_backend_tls_config());
+        http_proxy_svc.set_backend_tls_config_alpn(tls_handler::shared_backend_tls_config_alpn());
         http_proxy_svc.set_connection_timeouts(
             std::time::Duration::from_millis(conn_config.socket_timeout_ms),
             std::time::Duration::from_millis(conn_config.socket_timeout_ms),
@@ -251,6 +253,7 @@ impl TcpListenerManager {
             std::time::Duration::from_millis(config.connection_timeout_ms),
         );
         http_proxy_svc.set_backend_tls_config(tls_handler::shared_backend_tls_config());
+        http_proxy_svc.set_backend_tls_config_alpn(tls_handler::shared_backend_tls_config_alpn());
         http_proxy_svc.set_connection_timeouts(
             std::time::Duration::from_millis(config.socket_timeout_ms),
             std::time::Duration::from_millis(config.socket_timeout_ms),

rust/crates/rustproxy-passthrough/src/tls_handler.rs

@@ -98,10 +98,24 @@ pub fn build_shared_tls_acceptor(resolver: CertResolver) -> Result<TlsAcceptor,
 }
 
 /// Build a TLS acceptor from PEM-encoded cert and key data.
+/// Advertises both h2 and http/1.1 via ALPN (for client-facing connections).
 pub fn build_tls_acceptor(cert_pem: &str, key_pem: &str) -> Result<TlsAcceptor, Box<dyn std::error::Error + Send + Sync>> {
     build_tls_acceptor_with_config(cert_pem, key_pem, None)
 }
 
+/// Build a TLS acceptor for backend servers that only speak HTTP/1.1.
+/// Does NOT advertise h2 in ALPN, preventing false h2 auto-detection.
+pub fn build_tls_acceptor_h1_only(cert_pem: &str, key_pem: &str) -> Result<TlsAcceptor, Box<dyn std::error::Error + Send + Sync>> {
+    ensure_crypto_provider();
+    let certs = load_certs(cert_pem)?;
+    let key = load_private_key(key_pem)?;
+    let mut config = ServerConfig::builder()
+        .with_no_client_auth()
+        .with_single_cert(certs, key)?;
+    config.alpn_protocols = vec![b"http/1.1".to_vec()];
+    Ok(TlsAcceptor::from(Arc::new(config)))
+}
+
 /// Build a TLS acceptor with optional RouteTls configuration for version/cipher tuning.
 pub fn build_tls_acceptor_with_config(
     cert_pem: &str,
@@ -204,6 +218,25 @@ pub fn shared_backend_tls_config() -> Arc<rustls::ClientConfig> {
     }).clone()
 }
 
+/// Get or create a shared backend TLS `ClientConfig` with ALPN `h2` + `http/1.1`.
+///
+/// Used for auto-detection mode: the backend server picks its preferred protocol
+/// via ALPN, and the proxy reads the negotiated result to decide h1 vs h2 forwarding.
+static SHARED_CLIENT_CONFIG_ALPN: OnceLock<Arc<rustls::ClientConfig>> = OnceLock::new();
+
+pub fn shared_backend_tls_config_alpn() -> Arc<rustls::ClientConfig> {
+    SHARED_CLIENT_CONFIG_ALPN.get_or_init(|| {
+        ensure_crypto_provider();
+        let mut config = rustls::ClientConfig::builder()
+            .dangerous()
+            .with_custom_certificate_verifier(Arc::new(InsecureVerifier))
+            .with_no_client_auth();
+        config.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];
+        info!("Built shared backend TLS client config with ALPN h2+http/1.1 for auto-detection");
+        Arc::new(config)
+    }).clone()
+}
+
 /// Connect to a backend with TLS (for terminate-and-reencrypt mode).
 /// Uses the shared backend TLS config for session resumption.
 pub async fn connect_tls(