fix(edge): suppress dead HTTP/3 advert with Alt-Svc: clear #119

Merged

developer merged 1 commits from feature/edge-suppress-http3-altsvc into development 2026-06-22 19:41:16 +00:00

Conversation 1 Commits 1 Files Changed 3

+127 -1

developer commented 2026-06-22 19:20:59 +00:00

Owner

Copy Link

Copy Source

What

Suppress the edge's dead HTTP/3 advertisement: a site-level header Alt-Svc clear in
deploy/caddy/Caddyfile, plus docs/EDGE_HTTP3.md (diagnosis + verify + alternatives)
linked from ARCHITECTURE.md.

Why

Caddy enables HTTP/3 by default on any TLS listener and emits Alt-Svc: h3=":443"; ma=2592000,
but UDP/443 is never reachable: the prod compose maps only "443:443" (TCP) and ufw opens
443/tcp (test contour: the host caddy publishes only :443/tcp). A client that cached the
30-day advert tries QUIC first on later opens, gets no response, and waits for the QUIC attempt
to time out before falling back to h2 — which surfaced as the Telegram Mini App intermittently
hanging on load (a barely-noticeable pause up to a blank window that never finishes downloading
index.html). The h2/TCP serving path itself is healthy (~10 ms TTFB, no tail).

Alt-Svc: clear actively drops any cached alternative and pins clients to h2/h1.

Scope

• This caddy terminates TLS in prod → this is the prod fix.
• The test contour is already fixed at the host caddy (homelab config, outside this repo).
  A/B confirmed live: ~20 clean Mini App opens vs the prior intermittent stalls, prod left as the
  h3 control.
• In the test contour this caddy serves plain :80 and the host caddy re-stamps its own Alt-Svc,
  so the repo directive is a harmless no-op there.

Verification

• caddy validate → Valid configuration.
• Alt-Svc: clear stamped on every route (/telegram/, /app/, /, all 200) against the real
  upstreams on scrabble-internal.

Deploy

Prod is a manual rollout (workflow_dispatch from master, after a development → master
promotion) — owner-driven. No schema change; config-only and rollback-safe.

## What Suppress the edge's dead HTTP/3 advertisement: a site-level `header Alt-Svc clear` in `deploy/caddy/Caddyfile`, plus `docs/EDGE_HTTP3.md` (diagnosis + verify + alternatives) linked from `ARCHITECTURE.md`. ## Why Caddy enables HTTP/3 by default on any TLS listener and emits `Alt-Svc: h3=":443"; ma=2592000`, but **UDP/443 is never reachable**: the prod compose maps only `"443:443"` (TCP) and ufw opens `443/tcp` (test contour: the host caddy publishes only `:443/tcp`). A client that cached the 30-day advert tries QUIC first on later opens, gets no response, and waits for the QUIC attempt to time out before falling back to h2 — which surfaced as the **Telegram Mini App intermittently hanging on load** (a barely-noticeable pause up to a blank window that never finishes downloading `index.html`). The h2/TCP serving path itself is healthy (~10 ms TTFB, no tail). `Alt-Svc: clear` actively drops any cached alternative and pins clients to h2/h1. ## Scope - This caddy **terminates TLS in prod** → this is the prod fix. - The **test contour** is already fixed at the host caddy (homelab config, outside this repo). A/B confirmed live: ~20 clean Mini App opens vs the prior intermittent stalls, prod left as the h3 control. - In the test contour this caddy serves plain `:80` and the host caddy re-stamps its own Alt-Svc, so the repo directive is a harmless no-op there. ## Verification - `caddy validate` → **Valid configuration**. - `Alt-Svc: clear` stamped on every route (`/telegram/`, `/app/`, `/`, all `200`) against the real upstreams on `scrabble-internal`. ## Deploy Prod is a **manual** rollout (`workflow_dispatch` from `master`, after a `development → master` promotion) — owner-driven. No schema change; config-only and rollback-safe.

developer added 1 commit 2026-06-22 19:20:59 +00:00

fix(edge): suppress dead HTTP/3 advert with Alt-Svc: clear ... 9253b1bdca

Caddy enables HTTP/3 by default on any TLS listener and emits
Alt-Svc: h3=":443"; ma=2592000, but UDP/443 is never reachable: the prod
compose maps only "443:443" (TCP) and ufw opens 443/tcp (test contour: the
host caddy publishes only :443/tcp). A client that cached the 30-day advert
tries QUIC first on later opens, gets no response, and waits for the QUIC
attempt to time out before falling back to h2 -- which surfaced as the
Telegram Mini App intermittently hanging on load (a barely-noticeable pause
up to a blank window). The h2/TCP serving path itself is healthy (~10ms TTFB).

Emit Alt-Svc: clear site-wide at the contour caddy so clients actively drop
any cached alternative and stay on h2/h1. This caddy terminates TLS in prod
(the fix target); in the test contour it serves plain :80 and the host caddy
re-stamps its own Alt-Svc, so the live test fix lives in the host caddy. Add
docs/EDGE_HTTP3.md (symptom, diagnosis method, verify, and option B -- serving
h3 for real -- if it recurs) and link it from ARCHITECTURE.md.

owner approved these changes 2026-06-22 19:38:25 +00:00

developer merged commit 6cb88b28c4 into development 2026-06-22 19:41:16 +00:00

developer deleted branch feature/edge-suppress-http3-altsvc 2026-06-22 19:41:16 +00:00

developer referenced this pull request 2026-06-22 19:42:37 +00:00

release v1.2.2: edge HTTP/3 stall fix + db-size dashboard threshold #121

Sign in to join this conversation.

Reviewers

No Reviewers

owner

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

owner (Ilia) developer

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: developer/scrabble-game#119